Zoneminder on Eeepc i386 kali-2023.1

Eeepc hotel room monitoring works with these settings still:

https://digitalsatori2015.blogspot.com/2016/07/zoneminder-on-1001x-eepc.html

5fps is a bit much for the eepc so set it to 2.  model name      : Intel(R) Atom(TM) CPU N455   @ 1.66GHz

Doesn't work with selinux enabled.  Disabled auditd for speed.

Works with  same GUI settings from before in earlier blog post.

HOWEVER sometimes image is very dim now.  Setting to capture more than 1 frame at a time seems to help but problem keeps coming back.  Goes away for awhile after changing frame settings.

└─# lsb_release -a   

No LSB modules are available.

Distributor ID: Kali

Description:    Kali GNU/Linux Rolling

Release:        2023.1

Codename:       kali-rolling

└─# uname -a

Linux node17 6.1.0-kali7-686-pae #1 SMP PREEMPT_DYNAMIC Debian 6.1.20-2kali1 (2023-04-18) i686 GNU/Linux

└─# /etc/init.d/zoneminder status

● zoneminder.service - ZoneMinder CCTV recording and surveillance system

     Loaded: loaded (/lib/systemd/system/zoneminder.service; enabled; preset: disabled)

     Active: active (running) since Fri 2023-05-05 13:51:01 PDT; 3h 24min ago

       Docs: http://zoneminder.readthedocs.org/en/latest/

   Main PID: 2819 (zmdc.pl)

      Tasks: 11 (limit: 4650)

     Memory: 866.9M

        CPU: 17min 53.616s

     CGroup: /system.slice/zoneminder.service

             ├─2819 /usr/bin/perl -wT /usr/bin/zmdc.pl startup

             ├─2852 /usr/bin/perl -wT /usr/bin/zmfilter.pl --filter_id=1 --daemon

             ├─2856 /usr/bin/perl -wT /usr/bin/zmfilter.pl --filter_id=2 --daemon

             ├─2859 /usr/bin/perl -wT /usr/bin/zmwatch.pl

             ├─2865 /usr/bin/perl -wT /usr/bin/zmtelemetry.pl

             ├─2869 /usr/bin/perl -wT /usr/bin/zmstats.pl

             └─3427 /usr/bin/zmc -d /dev/video0

May 05 13:50:55 node17 zmc_dvideo0[2846]: ERR [zmc_dvideo0] [Failed to set video standard 45056: 25 Inappropriate ioctl for device]

May 05 13:51:01 node17 systemd[1]: Started zoneminder.service - ZoneMinder CCTV recording and surveillance system.

May 05 13:51:09 node17 zmtelemetry[2865]: WAR [Telemetry server returned HTTP POST error code: 301]

May 05 14:34:41 node17 zmc_dvideo0[2846]: ERR [zmc_dvideo0] [Failed to stop capture stream: Bad file descriptor]

May 05 14:34:41 node17 zmc_dvideo0[2846]: ERR [zmc_dvideo0] [Failed to stop capture stream: Bad file descriptor]

May 05 14:34:41 node17 zmwatch[2859]: ERR [Memory map file '/dev/shm/zm.mmap.1' does not exist in zmMemAttach.  zmc might…running.]

May 05 14:34:47 node17 zmc_dvideo0[3383]: ERR [zmc_dvideo0] [Failed to set video standard 45056: 25 Inappropriate ioctl for device]

May 05 14:35:45 node17 zmc_dvideo0[3383]: ERR [zmc_dvideo0] [Failed to stop capture stream: Bad file descriptor]

May 05 14:35:45 node17 zmc_dvideo0[3383]: ERR [zmc_dvideo0] [Failed to stop capture stream: Bad file descriptor]

May 05 14:35:47 node17 zmc_dvideo0[3427]: ERR [zmc_dvideo0] [Failed to set video standard 45056: 25 Inappropriate ioctl for device]

Hint: Some lines were ellipsized, use -l to show in full.

# zmu -d /dev/video0 -q -v

05/05/23 17:21:28.785100 zmu[5103].ERR-zm_local_camera.cpp/1551 [Failed to set video input 0: Device or resource busy]

Video Device: /dev/video0

General Capabilities

  Driver: uvcvideo

  Card: USB 2.0 Camera: USB Camera

  Bus: usb-0000:00:1d.7-6

  Version: 6.1.20

  Type: 0x84a00001

    Supports video capture (X)

    Does not support video output

    Does not support frame buffer overlay

    Does not support VBI capture

    Does not support VBI output

    Does not support sliced VBI capture

    Does not support sliced VBI output

    Does not support video output overlay

    Does not have tuner

    Does not have audio in and/or out

    Does not have radio

    Does not support read/write i/o (X)

    Does not support async i/o

    Supports streaming i/o (X)

    Standards:

  Formats:

  YUYV 4:2:2 (0x56595559)

Crop Capabilities

  Cropping is not supported

Inputs: 1

Error, failed to switch to input 0: Device or resource busy

 v4l2-ctl --all 

Driver Info:

Driver name      : uvcvideo

Card type        : USB 2.0 Camera: USB Camera

Bus info         : usb-0000:00:1d.7-6

Driver version   : 6.1.20

Capabilities     : 0x84a00001

Video Capture

Metadata Capture

Streaming

Extended Pix Format

Device Capabilities

Device Caps      : 0x04200001

Video Capture

Streaming

Extended Pix Format

Media Driver Info:

Driver name      : uvcvideo

Model            : USB 2.0 Camera: USB Camera

Serial           : SN0001

Bus info         : usb-0000:00:1d.7-6

Media version    : 6.1.20

Hardware revision: 0x00000528 (1320)

Driver version   : 6.1.20

Interface Info:

ID               : 0x03000002

Type             : V4L Video

Entity Info:

ID               : 0x00000001 (1)

Name             : USB 2.0 Camera: USB Camera

Function         : V4L2 I/O

Flags            : default

Pad 0x01000007   : 0: Sink

  Link 0x02000013: from remote pad 0x100000a of entity 'Extension 5' (Video Pixel Formatter): Data, Enabled, Immutable

Priority: 2

Video input : 0 (Input 1: ok)

Format Video Capture:

Width/Height      : 640/480

Pixel Format      : 'YUYV' (YUYV 4:2:2)

Field             : None

Bytes per Line    : 1280

Size Image        : 614400

Colorspace        : sRGB

Transfer Function : Rec. 709

YCbCr/HSV Encoding: ITU-R 601

Quantization      : Default (maps to Limited Range)

Flags             : 

Crop Capability Video Capture:

Bounds      : Left 0, Top 0, Width 640, Height 480

Default     : Left 0, Top 0, Width 640, Height 480

Pixel Aspect: 1/1

Selection Video Capture: crop_default, Left 0, Top 0, Width 640, Height 480, Flags: 

Selection Video Capture: crop_bounds, Left 0, Top 0, Width 640, Height 480, Flags: 

Streaming Parameters Video Capture:

Capabilities     : timeperframe

Frames per second: 30.000 (30/1)

Read buffers     : 0

User Controls

                     brightness 0x00980900 (int)    : min=-64 max=64 step=1 default=10 value=40

                       contrast 0x00980901 (int)    : min=0 max=95 step=1 default=30 value=20

                     saturation 0x00980902 (int)    : min=0 max=128 step=1 default=75 value=75

                            hue 0x00980903 (int)    : min=-40 max=40 step=1 default=0 value=0

        white_balance_automatic 0x0098090c (bool)   : default=1 value=1

                          gamma 0x00980910 (int)    : min=72 max=500 step=1 default=100 value=100

                           gain 0x00980913 (int)    : min=0 max=100 step=1 default=0 value=0

           power_line_frequency 0x00980918 (menu)   : min=0 max=2 default=2 value=2 (60 Hz)

0: Disabled

1: 50 Hz

2: 60 Hz

      white_balance_temperature 0x0098091a (int)    : min=2800 max=6500 step=1 default=6500 value=6500 flags=inactive

                      sharpness 0x0098091b (int)    : min=0 max=6 step=1 default=3 value=3

         backlight_compensation 0x0098091c (int)    : min=0 max=2 step=1 default=1 value=1

Openscap on Fedora 36 segfaults

Fun With OpenScap!

# cat /etc/redhat-release 

Fedora release 36 (Thirty Six)

# lshw

    description: Desktop Computer

    product: Raspberry Pi 3 Model B

# uname -a

Linux hostname 5.17.5-300.fc36.armv7hl #1 SMP Thu Apr 28 16:43:41 UTC 2022 armv7l armv7l armv7l GNU/Linux

Look at the XML!

 # oscap info /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

Document type: Source Data Stream

Imported: 2022-08-02T00:37:49

Stream: scap_org.open-scap_datastream_from_xccdf_ssg-fedora-xccdf-1.2.xml

Generated: (null)

Version: 1.3

Checklists:

Ref-Id: scap_org.open-scap_cref_ssg-fedora-xccdf-1.2.xml

Status: draft

Generated: 2022-08-02

Resolved: trueode57 

Profiles:

Title: OSPP - Protection Profile for General Purpose Operating Systems

Id: xccdf_org.ssgproject.content_profile_ospp

Title: PCI-DSS v3.2.1 Control Baseline for Fedora

Id: xccdf_org.ssgproject.content_profile_pci-dss

Title: Standard System Security Profile for Fedora

Id: xccdf_org.ssgproject.content_profile_standard

Referenced check files:

ssg-fedora-oval.xml

system: http://oval.mitre.org/XMLSchema/oval-definitions-5

ssg-fedora-ocil.xml

system: http://scap.nist.gov/schema/ocil/2

Checks:

Ref-Id: scap_org.open-scap_cref_ssg-fedora-oval.xml

Ref-Id: scap_org.open-scap_cref_ssg-fedora-ocil.xml

Ref-Id: scap_org.open-scap_cref_ssg-fedora-cpe-oval.xml

Dictionaries:

Ref-Id: scap_org.open-scap_cref_ssg-fedora-cpe-dictionary.xml

Run the Scan!

#  oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard --report report.html /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

Segmentation fault (core dumped)

try again

#  oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard --report report.html /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml

OpenSCAP Error: Failed to create new OVAL agent session for: 'ssg-fedora-oval.xml'. [/builddir/build/BUILD/openscap-1.3.6/src/XCCDF/xccdf_session.c:1177]

look at the logs during the scan

debug logs

oscap[2479]: Evaluation started. Content: /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml, Profile: xccdf_org.ssgproject.content_profile_standard. 

systemd-coredump[2486]: Resource limits disable core dumping for process 2484 (oscap)

systemd-coredump[2486]: Process 2484 (oscap) of user 0 dumped core

# sestatus 

SELinux status:                 enabled

SELinuxfs mount:                /sys/fs/selinux

SELinux root directory:         /etc/selinux

Loaded policy name:             targeted

Current mode:                   enforcing

Mode from config file:          enforcing

Policy MLS status:              enabled

Policy deny_unknown status:     allowed

Memory protection checking:     actual (secure)

Max kernel policy version:      33

:)

Security Onion Syslog-NG Console Logging

Goal1

By default so only logs into elkstack, not to a file!  We want a file too so we can tail -f file|ccze on a console and look cool like in the movies!

Goal is minimal editing of /etc/syslog-ng.conf which gets blown away after so updates, so

 make sure security onion /etc/syslog-ng.conf has

@include "/etc/syslog-ng/conf.d/*.conf"

add a /etc/syslog-ng/conf.d/cool.conf file:

destination d_remotesyslog { file("/var/log/remotesyslog"); };

log {

source(s_network);

destination(d_remotesyslog);

};

then tail -f /var/log/remotesyslog|ccze shows remote systems logs on console

sources:

https://serverfault.com/questions/825556/avoid-logging-in-var-log-syslog-only-using-etc-syslog-ng-conf-d

rc.local on kali2020

I love old school /etc/rc.local files to run scripts at boot.
This fixes some bugs from the last one I posted.  Still learning systemd...


$ cat rc.local.sh

cat <<'EOF' > /etc/systemd/system/rc-local.service
 [Unit] 
  Description=/etc/rc.local Compatibility 
  ConditionPathExists=/etc/rc.local 
 [Service] 
  Type=forking 
  ExecStart=/etc/rc.local start 
  TimeoutSec=0 
  StandardOutput=tty 
  RemainAfterExit=yes 
  SysVStartPriority=99 
 [Install] 
  WantedBy=multi-user.target 
EOF

printf '%s\n' '#!/bin/bash' 'exit 0' | tee -a /etc/rc.local 
chmod +x /etc/rc.local
systemctl enable rc-local 
systemctl start rc-local.service 
systemctl status rc-local.service

Fight Coronavirus with BOINC Rosetta@Home

Rosetta@Home is fighting Corona Virus with protein folding research.

Here is how to help:

1 download client for your computer:

https://boinc.berkeley.edu/download.php

If running windows just follow the gui for the screen saver, if linux manual follow step 2b, for auto 2a.

2a
#install it
apt-get install boinc-manager boinc-client
#start it at boot
update-rc.d boinc-client enable
#start it as a service
service boinc-client start
#start gui manager
boincmgr
click to bar -> tools -> add project, add your account username/password registered via the boincmgr or on the projects website

I add rosetta@home and gpugrid


2b

Sign up for account at https://boinc.bakerlab.org/rosetta/

3

Get your account key
https://boinc.bakerlab.org/rosetta/weak_auth.php

Its the string inside  <authenticator>YOURKEYHERE</authenticator>


4
Run boinc client with the account key attached to rosetta, to do it from command line run this:

boinc -attach_project  https://boinc.bakerlab.org/rosetta/ YOURKEYHERE

There are modes of BOINC for windows where it can run as a screensaver.
https://boinc.berkeley.edu/wiki/BOINC_screensaver

5
Check your progress here, it can take hours to update once it starts running
https://boinc.bakerlab.org/rosetta/home.php

If you arn't sure its running, check your CPU usage, when running right it should use 100% CPU on all cores so make sure your fan works well.

TP-LINK TL-WR802N OpenWrt

I started using these instructions:
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=e6f047fa368ca9c90691b93aa5e03068fe1f4178
However for the V4 I have they are wrong, the ip is actually 192.168.0.66 for the tftpd.
Also the filename tested that works is wr802nv1_tp_recovery.bin not tp_recovery.bin

Thanks to this person for the mentioning ip and filename changes:
http://wr802n.blogspot.com/2018/04/dd-wrt-install-on-tp-link-tl-wr802n.html

Tested with Ubuntu18.04 atftp server.

apt-get install atftpd
cp wr802nv1_tp_recovery.bin to /srv/tftpd
chown -R nobody /srv/tftpd
sudo atftpd -v --user nobody /srv/tftp --daemon --listen-local
tftp to 192.168.0.66 and issue a get wr802nv1_tp_recovery.bin to confirm tftp is operational
reset router with ethernet jack plugged into tftpd server, wait for it to download the firmware

wait for device to reboot, get dhcp from newly running openwrt
ssh root@192.168.1.1
Gets you OpenWrt 4.14.149 2019

opkg update doesn't work because I am connected over the thernet port and the wifi port isn't configured with internet

try to config wifi client to get inet
https://openwrt.org/docs/guide-user/network/wifi/connect_client_wifi
uci set wireless.@wifi-device[0].disabled="0"
uci commit wireless
wifi

confirm iw dev wlan0 scan returns list of aps and wifi is enabled

uci get network.wwan returns blank so set it

uci set network.wwan=wlan0
lets try this
http://h-wrt.com/en/mini-how-to/wifi_openwrt

editing the /etc/config/wireless and /etc/init.d/network got us wlan0 internet access!
now opkg update worked

opkg install luci works now!

rc.local on kali19.3

Based on https://www.linuxbabe.com/linux-server/how-to-enable-etcrc-local-with-systemd A ton of apps don't have systemd scripts.
cat makerc-local.sh

 #!/bin/bash  
 #create a service that runs /etc/rc.local at boot based on  
 #https://www.linuxbabe.com/linux-server/how-to-enable-etcrc-local-with-systemd  
 cat > /etc/systemd/system/rc-local.service <<EOL  
 [Unit]  
  Description=/etc/rc.local Compatibility  
  ConditionPathExists=/etc/rc.local  
 [Service]  
  Type=forking  
  ExecStart=/etc/rc.local start  
  TimeoutSec=0  
  StandardOutput=tty  
  RemainAfterExit=yes  
  SysVStartPriority=99  
 [Install]  
  WantedBy=multi-user.target  
 EOL  
 printf '%s\n' '#!/bin/bash' 'exit 0' | tee -a /etc/rc.local  
 systemctl enable rc-local  
 systemctl start rc-local.service  
 systemctl status rc-local.service  

OpenSCAP on Centos7

yum install openscap openscap-scanner scap-security-guide

$ rpm -qa | grep openscap
openscap-scanner-1.2.16-8.el7_5.x86_64
openscap-1.2.16-8.el7_5.x86_64

$rpm -qa | grep scap-security-guide

scap-security-guide-0.1.36-10.el7.centos.noarch

$ pwd

/usr/share/xml/scap

Things you can scan for free:

$ find . | grep xml

./ssg/content/ssg-centos6-ds.xml

./ssg/content/ssg-centos7-ds.xml

./ssg/content/ssg-centos7-xccdf.xml

./ssg/content/ssg-firefox-ds.xml

./ssg/content/ssg-jre-ds.xml

./ssg/content/ssg-rhel7-cpe-dictionary.xml

./ssg/content/ssg-rhel7-cpe-oval.xml

./ssg/content/ssg-rhel7-oval.xml

./ssg/content/ssg-centos6-xccdf.xml

./ssg/content/ssg-firefox-cpe-dictionary.xml

./ssg/content/ssg-firefox-cpe-oval.xml

./ssg/content/ssg-firefox-ocil.xml

./ssg/content/ssg-firefox-oval.xml

./ssg/content/ssg-firefox-xccdf.xml

./ssg/content/ssg-jre-cpe-dictionary.xml

./ssg/content/ssg-jre-cpe-oval.xml

./ssg/content/ssg-jre-ocil.xml

./ssg/content/ssg-jre-oval.xml

./ssg/content/ssg-jre-xccdf.xml

./ssg/content/ssg-rhel6-cpe-dictionary.xml

./ssg/content/ssg-rhel6-cpe-oval.xml

./ssg/content/ssg-rhel6-ds.xml

./ssg/content/ssg-rhel6-ocil.xml

./ssg/content/ssg-rhel6-oval.xml

./ssg/content/ssg-rhel6-xccdf.xml

./ssg/content/ssg-rhel7-ds.xml

./ssg/content/ssg-rhel7-ocil.xml

./ssg/content/ssg-rhel7-xccdf.xml

Here is how to get a report of your compliance.
#  oscap info "/usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml"
Document type: Source Data Stream
Imported: 2017-10-19T18:41:07

Stream: scap_org.open-scap_datastream_from_xccdf_ssg-rhel7-xccdf-1.2.xml
Generated: (null)
Version: 1.2
Checklists:
        Ref-Id: scap_org.open-scap_cref_ssg-rhel7-xccdf-1.2.xml
                Status: draft
                Generated: 2017-10-19
                Resolved: true
                Profiles:
                        xccdf_org.ssgproject.content_profile_standard
                        xccdf_org.ssgproject.content_profile_pci-dss
                        xccdf_org.ssgproject.content_profile_C2S
                        xccdf_org.ssgproject.content_profile_rht-ccp
                        xccdf_org.ssgproject.content_profile_common
                        xccdf_org.ssgproject.content_profile_stig-rhel7-disa
                        xccdf_org.ssgproject.content_profile_stig-rhevh-upstream
                        xccdf_org.ssgproject.content_profile_ospp-rhel7
                        xccdf_org.ssgproject.content_profile_cjis-rhel7-server
                        xccdf_org.ssgproject.content_profile_docker-host
                        xccdf_org.ssgproject.content_profile_nist-800-171-cui
                Referenced check files:
                        ssg-rhel7-oval.xml
                                system: http://oval.mitre.org/XMLSchema/oval-definitions-5
                        ssg-rhel7-ocil.xml
                                system: http://scap.nist.gov/schema/ocil/2
                        https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2
                                system: http://oval.mitre.org/XMLSchema/oval-definitions-5
        Ref-Id: scap_org.open-scap_cref_ssg-rhel7-pcidss-xccdf-1.2.xml
                Status: draft
                Generated: 2017-10-19
                Resolved: true
                Profiles:
                        xccdf_org.ssgproject.content_profile_pci-dss_centric
                Referenced check files:
                        ssg-rhel7-oval.xml
                                system: http://oval.mitre.org/XMLSchema/oval-definitions-5
                        ssg-rhel7-ocil.xml
                                system: http://scap.nist.gov/schema/ocil/2
                        https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2
                                system: http://oval.mitre.org/XMLSchema/oval-definitions-5
Checks:
        Ref-Id: scap_org.open-scap_cref_ssg-rhel7-oval.xml
        Ref-Id: scap_org.open-scap_cref_ssg-rhel7-ocil.xml
        Ref-Id: scap_org.open-scap_cref_ssg-rhel7-cpe-oval.xml
        Ref-Id: scap_org.open-scap_cref_ssg-rhel7-oval.xml000
        Ref-Id: scap_org.open-scap_cref_ssg-rhel7-ocil.xml000
Dictionaries:
        Ref-Id: scap_org.open-scap_cref_ssg-rhel7-cpe-dictionary.xml

# oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard --report report.html /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml
WARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them.
WARNING: Skipping https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content
Title   Ensure Red Hat GPG Key Installed
Rule    xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed
Result  pass

Title   Ensure gpgcheck Enabled In Main Yum Configuration
Rule    xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated
Result  pass

Title   Ensure Software Patches Installed
Rule    xccdf_org.ssgproject.content_rule_security_patches_up_to_date
Result  notchecked

Title   Verify and Correct File Permissions with RPM
Rule    xccdf_org.ssgproject.content_rule_rpm_verify_permissions
Result  fail

Title   Verify File Hashes with RPM
Rule    xccdf_org.ssgproject.content_rule_rpm_verify_hashes

Result  pass

Title   Add nodev Option to /dev/shm

Rule    xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev

Result  pass

Title   Add nosuid Option to /dev/shm

Rule    xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid

Result  pass

Title   Verify that All World-Writable Directories Have Sticky Bits Set

Rule    xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits

Result  fail

Title   Ensure No World-Writable Files Exist

Rule    xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable

Result  pass

Title   Ensure All SGID Executables Are Authorized

Rule    xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_sgid

Result  pass

Title   Ensure All SUID Executables Are Authorized

Rule    xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_suid

Result  pass

Title   Prevent Log In to Accounts With Empty Password

Rule    xccdf_org.ssgproject.content_rule_no_empty_passwords

Result  fail

Title   Ensure that Root's Path Does Not Include World or Group-Writable Directories

Rule    xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write

Result  pass

Male configuration report using settings database
$ oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard --report report.html /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml

$oscap oval eval --results $(hostname)-oval-results-$(date +%Y%m%d).xml --report $(hostname)-oval-report-$(date +%Y%m%d).html /usr/share/xml/scap/ssg/content/ssg-rhel7-oval.xml

$oscap xccdf eval --oval-results --profile server --cpe /usr/share/xml/scap/ssg/content/ssg-rhel7-cpe-dictionary.xml /usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml

download centos oval
wget https://oval.mitre.org/rep-data/5.10/org.mitre.oval/p/platform/centos.linux.7.xml

make vuln report based on cves

oscap oval eval --results $(hostname)-oval-results-$(date +%Y%m%d).xml --report $(hostname)-oval-report-$(date +%Y%m%d).html centos.linux.7.xml

that report is pretty out of date though!  mitre hasn't updated since 2015.

try to download and run per https://www.open-scap.org/resources/documentation/perform-vulnerability-scan-of-rhel-6-machine/

these commands dont seem to make anything past 2014 either...
wget https://www.redhat.com/security/data/oval/Red_Hat_Enterprise_Linux_7.xml
oscap oval eval --results rhsa-results-oval.xml  --report oval-report.html  Red_Hat_Enterprise_Linux_7.xml


this one doesnt return anything at all
wget https://oval.cisecurity.org/repository/download/5.11.2/vulnerability/centos_linux_7.xml
 oscap oval eval --results centos-results-oval.xml --report oval-report-centos.html centos_linux_7.xml

try the patch one

https://oval.cisecurity.org/repository/download/5.11.2/patch/centos_linux_7.xml

 sudo  oscap oval eval --results centos-results-oval.xml --report oval-report-centos.html centos_linux_7.xml

doesn't seem to show any missing patches from a box I know is missing a few...

references:

https://sharknet.us/2014/03/06/run-a-scap-security-audit-on-centos-6/

https://sharknet.us/2017/01/07/running-oscap-on-centos-7/

https://community.alfresco.com/community/platform/blog/2016/12/21/hardening-assessment-and-automation-with-openscap-in-5-minutes
https://oval.mitre.org/rep-data/5.10/org.mitre.oval/p/index.html


https://serverfault.com/questions/923295/openscap-and-centos-7-oval-definitions
"wget https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2

bunzip2 com.redhat.rhsa-RHEL7.xml.bz2

oscap oval eval --results rhsa-results-oval.xml --report ${HTMLPATH}/myreport.html com.redhat.rhsa-RHEL7.xml"

Competitors to openscap audits vs CIS on CENT7
https://github.com/haxorof/centos-bench-security
https://github.com/massyn/centos-cis-benchmark
https://github.com/CISecurity/OVALRepo

OpenVAS OSX Sierra Mac Ports install fails

Here is my failed attempt at getting ports to install openvas on OSX.

port Version 2.4.2

xcodebuild version 9.2 Build version 9C40b

sudo port install openvas*

fails, missing lbzip2

sudo port install lbzip2

sort port install openvas* fails due to missing ac_nonexistent.h

google says that .h file comes from coccinelle

sudo port install coccinelle fails with "info:build is not a compiled interface for this version of OCaml

port list |grep -i ocaml finds a ton of different ocaml ports, which is it?

since we don't know, sudo port install ocaml*

that fails at ocaml-kernel, cannot find external tool ocamlbuild

sudo port install ocaml-ocamlbuild

then sudo port install ocaml* failed again on ocaml-core-kernel

giving up on ocaml, it looksl ike the coccinelle was built with an older version of ocaml, how to lock that older version into the port install?

Zoneminder USB Cam

Well it turns out you don't need your own scripts, zoneminder can natively use a USB camera at 15FPS!

Taken from:
https://major.io/2015/02/07/using-zoneminder-logitech-c270-webcam/

These settings worked for me with a normal usb camera on i386 Ubuntu 17.04:

• Device Path: /dev/video0
• Capture Method: Video For Linux version2
• Device Format: PAL
• Capture Palette: YUYV
• Capture Width: 800
• Capture Height: 600

I do see if I browse to zoneminder though, apache2 stays at 100% afterwards.

Dumpster Fire Wireless Capture the Flag @ Bsidesmsp.org 2017

Compete in the Dumpster Fire Wireless Capture the Flag Contest @ Bsidesmsp.org 2017!
June 24-25, 2017 (Saturday & Sunday) at the Minneapolis Convention Center

The Dumpster Fire Wireless CTF will be in the hardware village @ #bsidesmsp2017

Rules:

Contestants can submit results in the hardware village with the contestant name, contact information, and list of flags found and captured.


Don't attack the event infrastructure, flags will be clearly designated

Teams allowed.

Flags can use any radio frequency or protocol legal to use in the US.

Contestants with points will get 1 raffle ticket per point and be entered in a contest Sunday evening to win fabulous dumpster-related prizes.

Clues:

https://cyphercon.com/cyphercon-20/presentations/wireless-hacking-capture-flag/

https://twitter.com/CypherCon_wCTF

Clue sheet available for canned food donation to the Minneapolis Healthy Food Shelf Network.

YOLO!

zoneminder on 1001x eepc

Use built in camera: /usr/bin/mplayer tv:// -tv driver=v4l2:device=/dev/video0 -vo png -frames 10

Run this script in an area zoneminder can access the png files, the first few will be blank while the camera loads.  I take the 4th or 5th frame as a file type source in zoneminder, and have zone minder read that file into its db as a camera monitor, which creates events. 

#!/bin/bash
cd /var/www/html
while [ 1 ]
do
/usr/bin/mplayer tv:// -tv driver=v4l2:device=/dev/video0 -vo png -frames 10 > /dev/null 2>&1
sleep 10
done

I tried using zoneminder to detect the camera natively with some zmu commands but gave up and just wrote the above mplayer script to create png images.

Another method which worked with a usbcam which didn't seem to like mplayer was:

avconv -f video4linux2 -s 640x480 -i /dev/video0 -ss 0:0:2 -frames 1 out.jpg


References and other notes:

http://defectio.blogspot.com/2012/09/connecting-webcam-to-zoneminder.html

failed capture commands with the eepc:

# zmu -d /dev/video0 -q -v
Error, failed to enumerate standard 0: Connection timed out

another failed attempt at mplayer:

# mplayer tv:// -vo aa -monitorpixelaspect 0.5 -quiet

MPlayer2 2.0-728-g2c378c7-4 (C) 2000-2012 MPlayer Team

Cannot open file '/root/.mplayer/input.conf': No such file or directory

Failed to open /root/.mplayer/input.conf.

Cannot open file '/etc/mplayer/input.conf': No such file or directory

Failed to open /etc/mplayer/input.conf.

Playing tv://.

Detected file format: TV

Selected driver: v4l2

 name: Video 4 Linux 2 input

 author: Martin Olschewski <olschewski@zpr.uni-koeln.de>

 comment: first try, more to come ;-)

v4l2: your device driver does not support VIDIOC_G_STD ioctl, VIDIOC_G_PARM was used instead.

Selected device: USB 2.0 Camera

 Capabilities:  video capture  streaming

 supported norms:

 inputs: 0 = Camera 1;

 Current input: 0

 Current format: YUYV

tv.c: norm_from_string(pal): Bogus norm parameter, setting default.

v4l2: ioctl enum norm failed: Inappropriate ioctl for device

Error: Cannot set norm!

Selected input hasn't got a tuner!

v4l2: ioctl set mute failed: Invalid argument

Error opening/initializing the selected video_out (-vo) device.

v4l2: select timeout

v4l2: ioctl set mute failed: Invalid argument

v4l2: 0 frames successfully processed, 1 frames dropped.

Exiting... (End of file)

#  v4l2-ctl --list-devices

USB 2.0 Camera (usb-0000:00:1d.7-6):

        /dev/video0

https://wiki.zoneminder.com/Hardware_Compatibility_List#USB_Cameras

http://ubuntuforums.org/showthread.php?t=1939703


Another method of capturing I like is using a cheap pci capture card and normal CCTV cameras, 4 channels, and these zone minder settings.

source /dev/video0
video for linux version 2 capture method
device channel 0
device format ntsc
capture palette YUYV
768x480, 10 frames/second

All of this was done using Ubuntu 16.04 x86_64

hddtemp + gkrellm

Here is how I got gkrellm to show my hard drive temperatures on kali2.

apt-get -y install hddtemp gkrellm*

edit /etc/default/hddtemp set RUN_DAEMON="true"
update-rc.d hddtemp enable
/etc/init.d/hddtemp start still didnt start in daemon mode,

http://ubuntuforums.org/showthread.php?t=1359129 shows you have to run
sudo dpkg-reconfigure hddtemp
I set it in suid mode and to run in daemon mode, then ran /etc/init.d/hddtemp start and it kept running:

# ps aux | grep hdd
root     25386  0.0  0.0   6308  1968 ?        S    18:07   0:00 /usr/sbin/hddtemp -d -l 127.0.0.1 -p 7634 -s | -S 600 /dev/sda /dev/sdb /dev/sdc

testing it: # telnet localhost 7634

next I try gkrellm-hddtemp: http://www.guzu.net/linux/hddtemp.php

$ make

Type 'make gkrellm1' and then 'make install1'
  or 'make gkrellm2' and then 'make install2'

$ dpkg -l gkrellm
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version      Architecture Description
+++-==============-============-============-=================================
ii  gkrellm        2.3.6~rc1-1  amd64        GNU Krell Monitors

so I want make install2

$ make gkrellm2
gcc -Wall -fPIC -O2 -DGKRELLM2 `pkg-config --cflags gtk+-2.0` -I. -c gkrellm-hddtemp.c
gkrellm-hddtemp.c: In function ‘string_extents’:
gkrellm-hddtemp.c:93:22: warning: passing argument 1 of ‘gdk_string_extents’ from incompatible pointer type
   gdk_string_extents(ext->ts.font, string, &ext->lbearing, &ext->rbearing,
                      ^
In file included from /usr/include/gtk-2.0/gdk/gdk.h:42:0,
                 from /usr/include/gtk-2.0/gtk/gtk.h:32,
                 from /usr/include/gkrellm2/gkrellm.h:47,
                 from gkrellm-hddtemp.c:40:
/usr/include/gtk-2.0/gdk/gdkfont.h:122:10: note: expected ‘struct GdkFont *’ but argument is of type ‘struct PangoFontDescription *’
 void     gdk_string_extents (GdkFont     *font,
          ^
gcc -shared -Wl -o gkrellm-hddtemp.so gkrellm-hddtemp.o
gcc: error: unrecognized command line option ‘-Wl’
Makefile:19: recipe for target 'gkrellm2' failed
make: *** [gkrellm2] Error 1

googling "gcc: error: unrecognized command line option ‘-Wl’"  I find:
http://stackoverflow.com/questions/33114509/gcc-error-unrecognized-command-line-option-wl-in-makfile

so I try to compile it with Wall instead of Wl and it works:

$~/dev/gkrellm-hddtemp-0.2-beta$ gcc -shared -Wall -o gkrellm-hddtemp.so gkrellm-hddtemp.o

$ sudo make install2
install -d /root/.gkrellm2/plugins/
install gkrellm-hddtemp.so /root/.gkrellm2/plugins/

then I run it again as my normal user since it seems to be using ~/.gkrellm2 instead of some dir in /etc, and restart gkrellm:

I see hddtemp in the plugins list and enabling it shows 3 boxes with temperatures.  Success!

Now how to make gkrellm show smartd status?

DD-WRT WRT310Nv2 vs E3200

Using a WRT310Nv2 running Firmware: DD-WRT v24-sp2 (08/12/10) mini

Release 2.0 Broadcom 4716 @ 300 MHz 32 MB RAM 4 MB Flash 2.4 GHz Radio

My favorite setting for gaming reduces the transfer queue length to decrease latency:
Administration-> Commands and enter:

ifconfig eth0 txqueuelen 2
ifconfig eth1 txqueuelen 2

No more buffer bloat!  Using the txqueuelen tuning reducing the ping rate to a Neverwinter Nights server noticeably.

Buffer Bloat is bad! :
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=694799

Next project is to compare the WRT310Nv2 with a http://www.dd-wrt.com/wiki/index.php/Linksys_E3200

I would like to try using the E3200 as a USB file server while also keeping the txqueuelen tweaks...

The E3200 has 500MHz processor, a USB2.0 port, and 2.4ghz AND 5Ghz radios.

So why is the E3200 better than the WRT310Nv2?  The 5Ghz radio and faster cpu and usb port is why.

Confirmed after adding dd-wrt v24-sp 12/11/14 mini that 5ghz wifi and usb2.0 disk does NOT work

http://www.dd-wrt.com/wiki/index.php/What_is_DD-WRT%3F#File_Versions

Upgraded to mega...
That got me many more options, yay :)
One was a USB and NAS tab, with proftpd and samba.
Enabling core usb support and usb storage support...
enable ssh support, ssh in to see if it sees drive
looks like 5ghz does not work even with mega



After replacing the WRT310Nv2 with the E3200 I ran some tests.
USB File sharing worked with FAT32 formated usb disks at about 8M/s.
My raspberry pi can only go about 2-3M/s.

Then I have the same tunings above for latency plus some iptables rules to create a SPAN port which I monitor with OSSIM USM 5.2.0 community edition running on a VMware virtual machine, OSSIM is swapping with only 6G of ram I need to upgrade :)

So my onboot commands to customize ddwrt and send a copy of all traffic to 192.168.1.2 look like:

ifconfig eth0 txqueuelen 2
ifconfig eth1 txqueuelen 2
iptables -t mangle -A POSTROUTING -d 0.0.0.0/0 -j ROUTE --tee --gw 192.168.1.2
iptables -t mangle -A PREROUTING -s 0.0.0.0/0 -j ROUTE --tee --gw 192.168.1.2

How Mutant Exploits Defeat IDS 2006

How Mutant Exploits Defeat IDS

A report on the ACM paper:
“Testing Network-based Intrusion Detection Signatures Using Mutant Exploits”
Downloaded from:
http://portal.acm.org/browse_dl.cfm?linked=1&part=series&idx=SERIES320&coll=portal&dl=ACM via a search for “mutant”.

A well known network security concept, Intrusion detection systems function by listening on the network for suspicious activity. This paper explores some of their weaknesses and shows that they are not very effective when exploit mutations are applied.

According to the authors the tested IDS's are “network-based misuse detection systems”. An example of network misuse could be running an exploit against a server, scanning the entire network for hosts, or sending traffic which results in a Denial of Service attack.

The authors preform rigorous tests of 2 IDS systems, ISS RealSecure and Snort. These were chosen because they “represent the leading products in the open-source and commercial worlds” and “possess excellent attack detection capabilities and correctly manage many different types of evasion”. Both of these IDS systems are reliant on “signatures” of known attacks. At first glance this seems a very effective way of detecting network-misuses, however this paper shows that in reality, doing this is much more difficult.

It is difficult because “attacks that exploit a certain vulnerability may do so in completely different ways”. While it is easy to write IDS signatures for publicly known exploits, realistically not all exploits are going to be released, nor will all versions of a specific exploit be released. One would think “well how am I supposed to detect misuses that I don't even know exist?”. A valid question, however the problem gets even worse.

IDS systems typically have signatures for thousands of exploits. These signatures are very static, effectively searching for a specific packet or set of packets sent across the network. Problems arise however, when an exploit is modified or “mutated” in ways that allow it to still function in compromising a host, yet in a way which obfuscates the network traffic. The paper breaks down such “Mutation Mechanisms” into a number of groups. 

Network Layer Mutations include using Ipv6 to evade Ipv4 only IDSs, and IP Packet Splitting to evade IDS systems that are not smart enough to reassemble packets before checking them against attack signatures.
Application Layer Mutations include Protocol Rounds, FTP Evasion Techniques, HTTP Evasion Techniques, and SSL NULL Record Evasion Techniques. All of these mutations change the data sent to the application by the exploit, in a way which the application can still understand the attackers message however the message does not match the IDS signature for the attempted exploit. Also, “examples of HTTP protocol evasion techniques include neglecting the use of carriage returns, random insertion of whitespace characters, and inserting junk characters into parsed numerical fields”. While RFCs strictly specify protocols, often times real products are more lax in regards to them, allowing for the strange behavior which makes such mutations possible.

Exploit Layer Mutations are the newest of the group. They include polymorphic shellcode, and Alternate Encodings. ADMmutate “generates self-decrypting exploit payloads that will defeat most popular NIDS shellcode detectors, including "XOR-encoded payloads, randomized NOP generation, and support for banned characters".

The shellcode part of the exploit is easily added to IDS signatures. Since many exploits use predefined shellcode. IDS check for shellcode because regardless of the exploit some shellcode usually has to be pushed onto the compromised host in order to run some command for the attacker. Encoding the shellcode in a different format works as does the “insertion of non-destructive junk instructions and the reordering/substitution of code”. In this way you have a functional shellcode which does not match any IDS signatures.

Alternate Encodings work by encoding the exploit into some format the server can decode and execute, but the IDS does not. Examples include TAR, ZIP, or url encoding via hex.

The paper tested 10 exploits mutated in various ways. The exploits were run against the server. Detection results were collected from the IDS systems. Success results were collected from an “oracle” application which they used to check whether the exploit was successful.

The exploits were chosen to represent the range of target operating systems, protocols, and categories of attacks. Linux, Windows, OpenBSD, FTP, HTTP, IMAP, RPC, and SSL were tested, along with buffer overflow and directory traversal attacks.

The following specific exploits were tested:
IIS Escaped Characters Double Decoding
WU-ftpd Remote Format String Stack Overwrite
Microsoft DCOM-RPC aka blaster
IIS Extended Unicode Directory Traversal
NSIISlog.DLL Remote Buffer Overflow
IIS 5.0 .printer ISAPI Extension Buffer Overflow
WS-FTP Server STAT Buffer Overflow Denial-Of-Service
Apache HTTP Chunked Encoding Overflow
OpenSSL SSLv2 Client Master Key Overflow

Each exploit was run through the authors' “mutation engine” to generate mutant exploit combinations. Once a particular exploit was found which evaded the IDS systems yet still functioned, the authors moved on to the next exploit. One point made by the authors is that for some exploits the number of functional mutations could be quite large, leading to “an unmanageable number of mutant exploits”. The mutation engine tried using a variety of the previously mentioned methods.

The results of all these tests were quite sobering. Snort only detected 4 out of 10 of the mutant exploits, and IIS RealSecure only detected one. So what does this tell us? That a determined attacker could probably easily evade most commercial signature based IDS systems. I would say that signature based IDS are good for detecting "canned" exploits run at the "script kiddie" level. However, for someone who understands how they work, they seem to be rather trivial to defeat with automated tools such as ADMmutate.

Security means defense in depth, and signature-based IDS systems are only one layer. Another type of IDS system is based on Cisco's netflow technology. While I am not aware of any commercial products which do this, it is possible to correlate the data from Cisco router's netflows, in order to detect suspicious patterns such as port scans. Professor Skwarek touched on this briefly in his network security class.

Another layer of IDS that should not be over looked is host based IDS systems. Often exploits create anomalies in the log files which can be watched for and reported, possibly even before the attacker explores enough of the compromised system to discover the alarm message has been sent. Attackers can modify logs, change configuration files, or replace system binaries with trojaned "rootkits". 

Such changes can be detected with programs like tripwire, chkrootkit and rkhunter. Tripwire keeps a database of the hashes of the system files it protects. Chkrootkit and rkhunter act similar to network based IDS systems except they scan the system files for suspicious names, rootkit strings and configuration changes. However, these also are reliant on signatures and thus vulnerable to mutations of the known rootkits.

Smartd settings for USB and RAID cards

USB Attached Hard Drive:
via raspbian  smartctl 5.41 2011-06-09 r3365 [armv6l-linux-3.12.22+] (local build)

 smartctl -a -d sat /dev/sdb
/etc/smartd.conf contains:
/dev/sda  -a -d sat


Super Micro X7DB8 3ware Inc 9650SE SATA-II RAID PCIe (rev 01)

via Scientific Linux 6.3 smartmontools release 6.3 dated 2014-07-26 at 09:49:11 UTC 

smartctl -a -d 3ware,0 /dev/twa0

/etc/smartd.conf contains:
/dev/twa0 -d 3ware,0 -S on -o on -a -I 194 -s (S/../.././19|L/../../3/17|C/../.././11)
/dev/twa0 -d 3ware,1 -S on -o on -a -I 194 -s (S/../.././20|L/../../2/16|C/../.././10)
/dev/twa0 -d 3ware,2 -S on -o on -a -I 194 -s (S/../.././21|L/../../1/15|C/../.././9)
/dev/twa0 -d 3ware,3 -S on -o on -a -I 194 -s (S/../.././22|L/../../4/14|C/../.././8)
/dev/twa0 -d 3ware,4 -S on -o on -a -I 194 -s (S/../.././23|L/../../5/13|C/../.././7)
/dev/twa0 -d 3ware,5 -S on -o on -a -I 194 -s (S/../.././18|L/../../6/12|C/../.././6)
/dev/twa0 -d 3ware,6 -S on -o on -a -I 194 -s (S/../.././16|L/../../7/11|C/../.././5)
/dev/twa0 -d 3ware,7 -S on -o on -a -I 194 -s (S/../.././14|L/../../7/10|C/../.././4)

Cisco C220M3 LSI Logic / Symbios Logic MegaRAID SAS 2008 [Falcon] (rev 03)

smartctl -a -d sat+megaraid,2 /dev/sda

/etc/smartd.conf contains:

/dev/sda -a -d sat+megaraid,3
/dev/sda -a -d sat+megaraid,2

I notice on Cisco machines of the same vintage, some are numbered different.

Some have 2,3 for disk #s, some have 8,9, try different numbers.

It seems inconsistent which makes writing a static smartd.conf file hard for these machines.

Supermicro X8ST3 LSI Logic / Symbios Logic MegaRAID SAS 2108 [Liberator] (rev 05)

smartd[26209]: Monitoring 26 ATA and 0 SCSI devices

/etc/smartd.conf
DEVICESCAN -H -S on -o on -a -I 194 -s (S/../.././5|L/../../6/4|C/../.././6)

smartd.conf:

DEVICESCAN -H -S on -o on -a -I 194 -s (S/../.././5|L/../../6/4|C/../.././6)

Dell with 4 disks in a PERC6i

/dev/sda -a -d megaraid,0
/dev/sda -a -d megaraid,1
/dev/sda -a -d megaraid,2
/dev/sda -a -d megaraid,3 

Standard Sata Disks with no RAID card:

smartd.conf:

DEVICESCAN -H -S on -o on -a -I 194 -s (S/../.././5|L/../../6/4|C/../.././6)

http://www.gazj.co.uk/2011/01/25/smart-through-usb-controllers/

Full Stack Linux Tuning

Here is a list of things I tune on RHEL6 linux servers with 10g ethernet and dell PERC raid cards running a RAID6.

/usr/local/sbin/10gtxqueuelen.p1p1.sh
/usr/local/sbin/set_irq_affinity.p1p1.sh
echo noop > /sys/block/sdb/queue/scheduler
/usr/local/sbin/10gtxqueuelen.p1p2.sh
/usr/local/sbin/set_irq_affinity.p1p2.sh
/usr/local/sbin/10gtxqueuelen.bond0.sh

$ cat /usr/local/sbin/10gtxqueuelen.p1p1.sh
ifconfig p1p1 txqueuelen 10000

$ cat /usr/local/sbin/set_irq_affinity.p1p2.sh
#!/bin/bash
/usr/local/sbin/set_irq_affinity.sh p1p2


set_irq_affinity.sh

https://gist.github.com/syuu1228/4352382


Megaraid tuning for dell perc6 servers:
 http://mycusthelp.info/LSI/_cs/AnswerPreview.aspx?sSessionID=6624973237SOJMBBDMCFLZRNJDJQAXSSBVDAYBNA&inc=8273

$ uname -r
2.6.32-431.11.2.el6.x86_64

So our kernel is new enough, however by default our kernel does not use 6.12 or newer:

$ modinfo megaraid_sas
filename:       /lib/modules/2.6.32-431.11.2.el6.x86_64/kernel/drivers/scsi/megaraid/megaraid_sas.ko
description:    LSI MegaRAID SAS Driver
author:         megaraidlinux@lsi.com
version:        06.700.06.00-rh1
license:        GPL
srcversion:     9426C5CDA69586AABE13C02
alias:          pci:v00001000d0000005Fsv*sd*bc*sc*i*
alias:          pci:v00001000d0000005Dsv*sd*bc*sc*i*
alias:          pci:v00001000d0000005Bsv*sd*bc*sc*i*
alias:          pci:v00001028d00000015sv*sd*bc*sc*i*
alias:          pci:v00001000d00000413sv*sd*bc*sc*i*
alias:          pci:v00001000d00000071sv*sd*bc*sc*i*
alias:          pci:v00001000d00000073sv*sd*bc*sc*i*
alias:          pci:v00001000d00000079sv*sd*bc*sc*i*
alias:          pci:v00001000d00000078sv*sd*bc*sc*i*
alias:          pci:v00001000d0000007Csv*sd*bc*sc*i*
alias:          pci:v00001000d00000060sv*sd*bc*sc*i*
alias:          pci:v00001000d00000411sv*sd*bc*sc*i*
depends:
vermagic:       2.6.32-431.11.2.el6.x86_64 SMP mod_unload modversions
parm:           max_sectors:Maximum number of sectors per IO command (int)
parm:           msix_disable:Disable MSI-X interrupt handling. Default: 0 (int)
parm:           msix_vectors:MSI-X max vector count. Default: Set by FW (int)
parm:           throttlequeuedepth:Adapter queue depth when throttled due to I/O timeout. Default: 16 (int)
parm:           resetwaittime:Wait time in seconds after I/O timeout before resetting adapter. Default: 180 (int)


So some how you have to download the newer driver in order to spread the interrupts from your raid card across all CPUS...

CAVE HTCondor Sysview

CHTC Visualization via CAVE

"UW–Madison runs a high-throughput cluster system using the HTCondor scheduling system which is operated and maintained by the Center for High Throughput Computing (CHTC). This project focuses on visualizing performance and load distribution of the cluster by displaying collected log files. The log files are timestamped and gathered over long time periods; the visualization plays them back one frame at a time and with the ability to pause or reverse. Load of the cluster and of individual nodes can be therefore not only seen, but also traced in time. Questions, such as, “Which part of the cluster is running idle at 2 a.m.?” or “Where is the highest load concentrated?” can be answered quickly and intuitively, with the time-varying datasets showing trends and patterns in the cluster usage. The project is a collaboration between the LEL and the CHTC with Markus Broecker from the LEL, and Becky Gietzel and Nate Yehle from the CHTC."

References:

 http://wid.wisc.edu/research/lel/projects/

 https://github.com/bgietzel/htcondor-sysview

Building a Linux Cluster out of Windows Desktops

Using htcondor, windows7, vmware, and linux you can build a linux cluster on top of windows desktops.

Step 1
Install Htcondor, VMWare Player,  VIX, and VMWare Perl scripting API on Windows 7 machines.

use this as installer.bat to preload the msi installer with your pool data.  This requires you have a file at windows.php which loads a default config or overrides if it hostname.local is in the same dir.

REM CHTC URL Config HTCondor Windows7 Installer for CSL 
@echo on
cd /d "%~dp0"
set ARGS=
set ARGS=%ARGS% NEWPOOL=N
set ARGS=%ARGS% POOLNAME="CS"
REM RUNJOBS=c to use keyboard daemon to stop jobs when there is activity
set ARGS=%ARGS% RUNJOBS=C
set ARGS=%ARGS% VACATEJOBS=Y
REM SUBMITJOBS=N windows nodes no the cs pool are not submitters
set ARGS=%ARGS% SUBMITJOBS=N
set ARGS=%ARGS% CONDOREMAIL=""
REM defaults incase http get of real config fails
set ARGS=%ARGS% HOSTALLOWREAD="*.wisc.edu  execute-side@matchsession"
set ARGS=%ARGS% HOSTALLOWWRITE="*.cs.wisc.edu *.chtc.wisc.edu"
set ARGS=%ARGS% HOSTALLOWADMINISTATOR="condor.cs.wisc.edu"
set ARGS=%ARGS% INSTALLDIR="C:\Condor"
set ARGS=%ARGS% POOLHOSTNAME="condor.cs.wisc.edu"
set ARGS=%ARGS% ACCOUNTINGDOMAIN="none"
set ARGS=%ARGS% JVMLOCATION="java.exe"
set ARGS=%ARGS% SMTPSERVER=""
set ARGS=%ARGS% USEVMUNIVERSE=Y
set ARGS=%ARGS% VMNETWORKING=C
set ARGS=%ARGS% VMMAXNUMBER=1
set ARGS=%ARGS% VMMEMORY="$(DETECTED_MEMORY)/2"
set ARGS=%ARGS% PERLLOCATION="C:\sperl-5.18.2.1\perl.exe"
set ARGS=%ARGS% ACCOUNTINGDOMAIN=cs.wisc.edu
set ARGS=%ARGS% LOCAL_CONFIG_FILE = condor_urlfetch -TOOL 
http://url/windows.php?host=$(HOSTNAME) 
 /etc/condor/condor_configt.url_cache |
del c:\condor\condor_config
start /wait msiexec /q /l* "C:\Program Files\CSL\logs\condor-8.2.5.txt" /i condor-8.2.5-284806-Windows-x86.msi %ARGS% REBOOT=Suppress
net start condor 

# cat windows.php
<?php

$base_config = "WINDOWS7";
$base_config_lines = file($base_config);

$host = $_GET["host"] . ".local";
if (file_exists($host)) {
  $config_lines = file($host);
  $config = array_merge($base_config_lines, $config_lines);
}
else {
  $config = $base_config_lines;
}

foreach ($config as $line_num => $line ) {
  echo $line;
}

?>

# cat WINDOWS7
COLLECTOR_HOST = $(CONDOR_HOST)
CCB_ADDRESS = $(CONDOR_HOST)
PRIVATE_NETWORK_NAME = cs.wisc.edu
STARTER_ALLOW_RUNAS_OWNER = False
DYNAMIC_RUN_ACCOUNT_LOCAL_GROUP = Condor Reuse Users
ALLOW_WRITE = $(IP_ADDRESS)


#VM Policy
VM_GAHP_LOG = C:\Condor\log\VMGAHPLog
VMWARE_PERL=C:\sperl-5.18.2.1\perl\bin\perl.exe
VM_TYPE = vmware
VM_NETWORKING = TRUE
VM_NETWORKING_TYPE = NAT
VM_MEMORY= $(DETECTED_MEMORY) - 512
VM_MAX_NUMBER = $(DETECTED_CORES)

#preemption policy
use policy : desktop
#start jobs if the non condor load is under .3 and the keyboard has been idle for at least 60 min
START = (( LoadAvg - CondorLoadAvg) <= 0.3 ) && (KeyboardIdle > 60 * 60)
PREEMPT = ((Activity == "Suspended") && ((time() - EnteredCurrentActivity) > 10 * 60)) || (SUSPEND && (WANT_SUSPEND ==False))
KILL = $(SUSPEND)
#KILL = ((KeyboardIdle < 60) || ( (CpuBusyTime > 120) && ifThenElse(JobStart =!= UNDEFINED, (time() - JobStart),0 > 90)))
SLOTS_CONNECTED_TO_CONSOLE = $(NUM_CPUS)
SLOTS_CONNECTED_TO_KEYBOARD = $(SLOTS_CONNECTED_TO_CONSOLE)

#slot policy
NUM_SLOTS=1
NUM_SLOTS_TYPE_1=1
SLOT_TYPE_1_PARTITIONABLE=true
SLOT_TYPE_1 = cpus=100%,disk=100%,swap=100%,gpus=100%
ASSIGN_CPU_AFFINITY=true
use FEATURE : GPUs

#ADMIN Policy
CONDOR_ADMIN = admin@domain.com
HOSTALLOW_ADMINISTRATOR = $(CONDOR_HOST)


Step 2
Create VMWare VM which starts htcondor on boot and randomizes its name, I take a random entry from cracklib-dicts.

Step 3
Submit vm directory to your windows machines, and watch as the linux vms start up and take jobs that otherwise would not run on windows.

Using vmsl65 as the directory of your vmware image this submit file will send it out to windows hosts to create your linux vms:

#cat vmsl65.sub
universe = vm
executable = linux.iso
vm_type = vmware
vm_networking = true
vm_networking_type=nat
vmware_dir = vmsl65
vmware_should_transfer_files = YES
vmware_snapshot_disk = false
vm_memory = 2000
request_memory = 2004
request_disk = 20000000
log = ~/vmsl65_$(Cluster)_$(Process).log
notification = NEVER
requirements = Target.OpSys == "WINDOWS"
queue 5000

#condor_submit vmsl65.sub

References:
Thanks TJ!

https://twiki.grid.iu.edu/bin/view/CampusGrids/LinuxCondorPoolOnWindowsLabMachines

SELinux: An Introduction

SELinux:  An Introduction
6/11/2005
 

SELinux is an implementation of a Mandatory Access Control architecture called 
Flask, using the Linux Kernel.  Up until its release such systems were not very 
widespread.  Currently however, Fedora Core 3 comes with SELinux installed, 
and many other distributions such as Debian and Slackware are adopting it.

According to the NSA, a MAC is needed when "protection decisions must not be 
decided by the object owner, and the system must enforce the protection 
descisions over the wishes or intentions of the object owner". 

Flask evolved from a long line of NSA research on such MAC systems.  
Mandatory Access Controls were originally built to enforce security clearances 
given to users for objects in the system.  SELinux takes the concept one step 
farther, applying such restrictions to almost every definable object a system could 
have.

Non SELinux systems use a Discretionary Access control system which is 
"vulnerable to tampering and bypass, and malicious or flawed applications can 
easily cause failures in system security."  This is due to the fact that actions are 
limited only by user identity and ownership, not by role.  

For example, an attacker gaining control of a program in a DAC system is 
allowed to do anything with that control, and can access anything the user the 
process runs as can access.  This is often not a good thing, as it allows the 
corrupted process to do malicious things regardless of what role the program 
originally was meant for.

SELinux policy helps solve this problem by allowing for very fine grained access 
control.  Some policies are separation policies to enforce legal and classification 
restrictions on data, containment policies to restrict process access to data and 
files, integrity policies to protect against modifications to data, and invocation 
policies to control how processes run on the system.

In order for SELinux to function on Fedora Core 3, install libselinux, selinux-
policy-strict, setools, checkpolicy, and policycoreutils rpms.  
The system-config-securitylevel and setools-gui rpms are also helpful to see 
some good examples of policies assignable to a user.  In order to compile some 
of the later examples, you will need a also need the libselinux-devel and selinux-
policy-strict-sources rpms.

SELinux accomplishes Mandatory Access Control with Flask and a "combination 
of a Type Enforcement (TE) model and a Role-Based Access Control (RBAC) 
model.”  The TE model is implemented by “binding a security attribute called a 
type to each object". 


Classes of objects are defined in the 
/etc/selinux/strict/src/policy/flask/security_classes file.
A class is a kind of object such as a filesystem, file, directory, or socket.  Classes 
each have an access vector defining what functions they preform.  Access 
vectors are defined here: 
/etc/selinux/strict/src/policy/flask/access_vectors
The file class can read, write, create, and append for example, while the socket 
class can also read and write along with the bind, listen and connect.  Types 
given to processes are also known as domains.
The second part of flask, Role-Based Access Control, assigns roles to users.  
The roles are then allowed some access vectors to various types.  The 
combination of user, role and type is a security “context”.
The SELinux policy determines which security contexts are allowed.
If SELinux is enabled on a Linux kernel, security contexts will be available for 
viewing.  
View the context of a file:
 [root@xoci ~]# ls --context /etc/passwd
-rw-r--r-- root root system_u:object_r:etc_t /etc/passwd
View the context of a sshd process:
[root@xoci ~]# ps ax --context | grep sshd
 2886 system_u:system_r:kernel_t      /usr/sbin/sshd

You can also view information on the current policy with the seinfo program.  This 
also seems to be hard coded to the strict policy.  Try it with a few settings:
seinfo -t show types, seinfo -u show users, seinfo -r show roles
SELinux is configured in the /etc/selinux/config file.  For testing purposes use the 
following settings:
SELINUX=permissive #(logs but does not enforce)
SELINUXTYPE=strict
Permissive mode will print warnings but not deny access, and is very useful 
when writing your policy or debugging a program.  On fedora research only 
seemed to have success compiling policies of the strict type, as it seems setools 
on fedora has a path hard coded to the strict policy.
Once SELinux is configured, try to compile and install a policy from source.  This 
is done from the /etc/selinux/strict/etc/policy directory.
The following make commands work:
make policy will make the policy but not install it
make load will make and load the policy
make relabel will relabel the type of any files to match the policy.
make load takes the files in the policy source directory, and attempts to process 
them with the m4 macro processor into a policy.conf file. This file is then passed 
to the SELinux policy compiler checkpolicy, which creates the the binary policy 
/etc/selinux/strict/policy/policy.18 for loading into the kernel.
After running a make load try rebooting the machine and login as root.
Create a new user account, setest.  Login with this account.
setest@pc-00071 ~]$ id -Z
user_u:user_r:user_t
The SILinux policy assigns the above context by default to undefined users.
Add the user_r and staff_r roles to setest by editing 
/etc/selinux/strict/src/policy/users.
user setest roles { user_r staff_r };
Save the file and run make load again.  Then login setest and check the context.
[setest@pc-00071 home]$ id -Z
setest:user_r:user_t
Try changing roles to staff_r
[setest@pc-00071 ~]$ newrole -r staff_r
Authenticating setest.
Password:
setest@pc-00071 ~]$ id -Z
setest:staff_r:staff_t  

SELinux allows for the creation of new types as well.  Create a new file here:
/etc/selinux/strict/src/policy/types/custom.te
Add a new type declaration to this file:
type setestfile_t, file_type, sysadminfile;
This adds a new type to the policy, setestfile_t with the attributes of file_type and 
sysadminfile.
The different attributes for types are listed in /etc/selinux/strict/src/policy/attrib.te.
Adding a new role requires modifying 
/etc/selinux/strict/src/policy/domains/user.te.
To add the setest_r role, add these to the user.te file:
full_user_role(setest) 
priv_user(setest)
Then modify /etc/selinux/strict/src/policy/macros/user_macros.te by adding:
role setest_r types $1;
Run make load again, and then do a seinfo -t | grep setest_t
You should see a list of types starting with setest_t, including setest_home_dir_t 
and  setest_home_t for examples.  What happened was the macro processor 
created all the default types to go along with the role.  
Next add setest_r:setest_t to /etc/selinux/strict/src/policy/appconfig/default_type.  
This ensures that SELinux knows what domain to place a user in when first 
logging in.

Now allow some access to the new setestfile_t, edit custom.te again and add:
allow user_t setestfile_t:file { read };
allow setest_t setestfile_t:file { read write execute };
Then add setest_r to the list of roles granted to the user setest in the users file.
Now that a new user, type and role have been created, run some tests to see if 
the kernel is actualy using them.  Logged in as setest:
[setest@pc-00071 ~]$ touch afile
[setest@pc-00071 ~]$ ls --context afile
-rw-rw-r--  setest   setest   setest:object_r:user_home_t      afile
Try to chang the context of afile: chcon -t setestfile_t.
This works because we are in permissive mode, but it leaves the following log:
Jun 11 06:01:12 pc-00071 kernel: audit(1118487672.558:0): avc:  denied  { 
relabelto } for  pid=22595 exe=/usr/bin/chcon name=afile dev=dm-0 ino=2142232 
scontext=setest:user_r:user_t tcontext=setest:object_r:setestfile_t tclass=file

What this means is the kernel noted that the context  setest:user_r:user_t 
executed a relabelto on a  user_home_t object.  Since this was not explicitly 
allowed in the policy an error message is generated.
The user_r can only read this file, so cat afile is allowed but echo "test" >> afile 
creates an error message for the "append" attribute.
SELinux also has C libraries which can be used in programs.  The following code 
shows how to manipulate security contexts and print out SELinux information.
#include <stdio.h>
#include <stdlib.h>
#include <selinux/selinux.h>
#include <selinux/context.h>
//this code prints selinux related information
int main (int argc, char **argv)
{
  printf("Checking if selinux is enabled...\n");
  if(is_selinux_enabled())
    {printf("this program is running on a SELinux kernel\n");} 
  else
    {printf("this program is not running on a SELinux kernel\n");}
  int permissive = 0;
  int enforcing = 1;
  if(security_getenforce() == permissive)
    {printf("SELinux is running in permissive mode\n");}
  if(security_getenforce() == enforcing)
    {printf("SELinux is running in enforcing mode\n");}
  int rcc;
  typedef char* security_context_t; 
  security_context_t scon;
  printf("getting this program's current context...\n");
  rcc = getcon(&scon);
     if (rcc < 0) 
     {
        perror("getcon");
        return -1;
     }
     printf("this program's security_context_t is: = %s\n",scon);
     context_t newcon;
     //creat a new context_t from the contents of scon
     newcon = context_new(scon);

     //free the memory used by scon
     freecon(scon);
     //display context attributes
     char* newcontexttype;
     newcontexttype = context_type_get(newcon);
     printf("this program's context_t type is: %s\n",newcontexttype);
     char* newcontextrole;
     newcontextrole = context_role_get(newcon);
     printf("this program's context_t role is: %s\n",newcontextrole);
     char* newcontextuser;
     newcontextuser = context_user_get(newcon);
     printf("this program's context_t user is: %s\n",newcontextuser);
     rcc = context_type_set(newcon, "faketype_t");
     rcc = context_role_set(newcon, "fakerole_r");
     rcc = context_user_set(newcon, "fakeuser_u");
     printf("context after setting fake type, role and user: 
%s\n",context_str(newcon));
     //check if context selinux is enabled and the context is valid 
     printf("Verifing security context...\n");
     if(security_check_context(newcon) < 0)
       {printf("invalid context: %s\n",context_str(newcon));}
     else
       {printf("valid context: %s \n",context_str(newcon));}
    return 0;
}

Compile this code with the following options:
gcc -lselinux -o print_selinux_status print_selinux_status.c
The code should output the following:

[user@pc-00071 final]$ ./print_selinux_status 
Checking if selinux is enabled...
this program is running on a SELinux kernel
SELinux is running in permissive mode
getting this program's current context...
this program's security_context_t is: = setest:user_r:user_t
this program's context_t type is: user_t
this program's context_t role is: user_r
this program's context_t user is: user
context after setting fake type, role and user: fakeuser_u:fakerole_r:faketype_t
invalid context: fakeuser_u:fakerole_r:faketype_t

The kernel also prints a check_context error:
 Jun 11 06:38:50 pc-00071 kernel: audit(1118489930.704:0): avc:  denied  { 
check_context } for  pid=22934 
exe=/home/user/final/print_selinux_statusscontext=setest:user_r:user_t 
tcontext=system_u:object_r:security_t tclass=security

This is because the user_r role does not have access to run functions using the 
check_context attribute.  Specifically, the security_check_context() function 
requires the calling process context be allowed to check_context on the 
system_u:object_r:security_t context.
Programs can change the context of their next exec by using the execve funtion.  
Here is a simple example which runs less, allowing you to see what context the 
process was run as.
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <selinux/selinux.h>
#include <selinux/context.h>

//http://www.frech.ch/man/man3p/execve.3p.html

int main (int argc, char **argv)
{
typedef char* security_context_t; 
  security_context_t scon;
  int rcc;
 printf("getting this program's current context...\n");
  rcc = getcon(&scon);
     if (rcc < 0) 
     {
        perror("getcon");
        return -1;
     }
     printf("this program's security_context_t before setexeccon is: = %s\n",scon);
int ret;
char *cmd[] = { "less", "/etc/passwd", (char *)0 };
char *env[] = { "HOME=/usr/home", "LOGNAME=home", "TERM=vt220",(char *)0 
};
setexeccon("setest:setest_r:setest_t");
ret = execve ("/usr/bin/less", cmd, env);
}

Running this code with the setest:user_r:user_t  context of the command shell 
prints a kernel error.  This is due to the transition not being explicitly allowed in 
the SELinux policy.  When set to enforcing mode the power of selinux can be 
harnessed to defeat attacks which use a corrupted process to launch other 
processes.  SELinux could prevent or log any such attempts to operate outside 
the normal conditions needed for the service. Here is an example log of a context 
transition being denied.



Jun 11 06:58:15 pc-00071 kernel: audit(1118491095.820:0): avc:  denied  { 
transition } for  pid=23006 exe=/home/setest/execve_example path=/usr/bin/less 
dev=dm-0 ino=1348733 scontext=setest:user_r:user_t 
tcontext=setest:setest_r:setest_t tclass=process

In order to allow transitions between types, add this to the custom.te file:
allow user_t setest_t:process transition;

Once the transition is allowed, run the program again:
setest@pc-00071 ~]$ ./execve_example
then check the running processes with ps ax --context

After the setexeccon gives a new context, execve executes its arguments with 
that context.  
Running in memory: 23118 setest:setest_r:setest_t        less /etc/passwd
but the user who called execve_example only had setest:user_r:user_t context.

SELinux seems to be the future of security with Linux.  Using SELinux allows for 
greater control over every aspect of the operating system, to a degree never 
before seen in a publicly available operating system which can operate on 
commodity hardware.  These two facts combined should make a powerful 
combination which will continue to attract developers and administrators to 
SELinux.  SELinux being included in Fedora Core 3 shows that the ideas 
proposed are mature enough for mainstream adoption.  

References:

Stephen Smalley, "Configuring the SELinux Policy", January 2003
http://www.nsa.gov/selinux/papers/policy2.pdf (11 June 2005)

Peter Loscocco and Stephen Smalley, "Integrating Flexible Support for Security
Policies into the Linux Operating System", June 2001
http://www.nsa.gov/selinux/papers/freenix01/freenix01.html (11 June 2005)

Redhat, "Bugzilla Bug 125737  setools Makefile has incorrect policy install 
location defined" June 2004,
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=125737 (11 June 2005)

Mayank Sharma, "SELinux: Playing with fire" (January 2005)
http://security.linux.com/security/05/01/25/1423211.shtml?tid=124&tid=123&tid=113&t
id=35 (11 June 2005)

Faye Coker, "Getting Started with SE Linux HOWTO" (March 2004)
http://www.lurking-grue.org/GettingStartedWithNewSELinuxHOWTO.pdf (11 June 
2005)

Faye Coker, "Writing SE Linux Policy HOWTO" (March 2004)
http://www.lurking-grue.org/WritingSELinuxPolicyHOWTO.pdf (11 June 2005)

Kerry Thompson, "SELinux" (March 2003)
http://www.samag.com/documents/s=7835/sam0303a/0303a.htm (11 June 2005)

Ram Varma, "SELinux Programming" (April 2005)
http://www.ensl.cs.gwu.edu/resources/SELinux_20Programming (5 June 2005)

Susan Douglas and Korry Douglas, 2004, "Linux Timesaving Techniques for 
Dummies" , John Wiley & Sons.

Russel Coker, "SE Linux API Documentation" (January 2004)
Also, irc conversations with him in #selinux of irc.freenode.net (June 2005)

John Barkley, "Security in Open Systems" (July 1994)
http://csrc.nist.gov/publications/nistpubs/800-7/main.html (June 11 2005)