David Hrbáč » Uncategorized

Firefox and Thunderbird repositories for Ubuntu 10.10

David Hrbáč — Tue, 17 Jan 2012 21:43:41 +0000

sudo add-apt-repository ppa:mozillateam/firefox-stable sudo add-apt-repository ppa:mozillateam/thunderbird-stable

Text_CAPTCHA_Numeral bugs

David Hrbáč — Thu, 06 Jan 2011 13:38:59 +0000

There are two bugs in Text_CAPTCHA_Numeral Pear Module. Here is the patch.

diff -Nuar Text_CAPTCHA_Numeral-1.3.0.ok/php-pear-Text-CAPTCHA-Numeral.xml Text_CAPTCHA_Numeral-1.3.0/php-pear-Text-CAPTCHA-Numeral.xml
--- Text_CAPTCHA_Numeral-1.3.0.ok/php-pear-Text-CAPTCHA-Numeral.xml	2010-10-24 04:16:40.000000000 +0200
+++ Text_CAPTCHA_Numeral-1.3.0/php-pear-Text-CAPTCHA-Numeral.xml	2010-11-18 23:15:05.000000000 +0100
@@ -43,7 +43,7 @@
    <file baseinstalldir="Text" md5sum="1b16ce634831d571c8ba2e5819aaf6f9" name="tests/captchanumeral.answerisok.phpt" role="test" />
    <file baseinstalldir="Text" md5sum="33de4b4f24e52c2e2ff35645cf1b4e51" name="tests/captchanumeral.firstandsecond.phpt" role="test" />
    <file baseinstalldir="Text" md5sum="2f4a58be0ef33a4a112b265c0eb0b5dd" name="tests/captchanumeral.operator.phpt" role="test" />
-   <file baseinstalldir="/" md5sum="554c5a360fb6efe189bdb8e73b2e2e70" name="Text/CAPTCHA/Numeral.php" role="php" />
+   <file baseinstalldir="/" md5sum="e12804274c4e51bed45b706a49f0efa4" name="Text/CAPTCHA/Numeral.php" role="php" />
    <file baseinstalldir="/" md5sum="72851c7bf12ba07412098a83592aee0b" name="Text/CAPTCHA/Numeral/NumeralInterface.php" role="php" />
   dir>
  contents>
diff -Nuar Text_CAPTCHA_Numeral-1.3.0.ok/Text/CAPTCHA/Numeral.php Text_CAPTCHA_Numeral-1.3.0/Text/CAPTCHA/Numeral.php
--- Text_CAPTCHA_Numeral-1.3.0.ok/Text/CAPTCHA/Numeral.php	2010-10-24 04:16:39.000000000 +0200
+++ Text_CAPTCHA_Numeral-1.3.0/Text/CAPTCHA/Numeral.php	2010-11-18 23:13:58.000000000 +0100
@@ -355,7 +355,7 @@
      */
     private function setOperation($type = null)
     {
-        if (!stristr($type, 'F')) {
+        if (stristr($type, 'F')) {
             $this->operation = $this->getFirstNumber() . ' ' . $this->operator;
         } else {
             $this->operation = $this->getFirstNumber() . ' ' .
@@ -514,6 +514,15 @@
                 ->setSecondNumber($first)
                 ->setOperation();
         }
+        /**
+        * Get rid of problematic zero result
+        */
+        elseif ($first == $second) {
+            $this->setFirstNumber($first)
+                 ->setSecondNumber($second-1)
+                 ->setOperation();
+        }
+
 
         $answer = $this->getFirstNumber() - $this->getSecondNumber();
         $this->setAnswer($answer);

Nagios and dpt-i2o-raidutils, raidutil check

David Hrbáč — Fri, 05 Feb 2010 08:24:49 +0000

We do check our production boxes with hardware raid cards on raid status. We are using our script to call raidutil, which is running fine, but not under nagios user. Permissions for the files are as follows:

-rwxr-xr-x 1 root root 254708 Aug 20  2008 raideng
-rwxr-xr-x 1 root root 255880 Aug 20  2008 raidutil

Solution is to add proper rights to utils with:

chmod u+s raid*

It should look like this:

-rwsr-xr-x 1 root root 254708 Aug 20  2008 raideng
-rwsr-xr-x 1 root root 255880 Aug 20  2008 raidutil

pure-ftpd with geoip

David Hrbáč — Fri, 16 Oct 2009 15:31:48 +0000

During the last few weeks we are experiencing compromised FTP accounts within our production. These accounts seem to be stolen from infected Windows client machines, infected by malware or trojans. As far as I know the issues, everyone of them is using Total Commander… TC seems to save the credentials in plain text form, unencrypted. Fine.

I have been going through pure-ftpd log to gather ips that had been used to upload files. I’ve found that most of them were outside our country, China, Romania, Russia, etc. So I decided to limit users set and allow only ips from Czech Republic. I wanted to go with iptables geoip module, which is working very fine. But I have found geoip patch for pure-ftpd. I have corrected it a little bit and finally created RPM packages for Centos4/5. You can find the packages within my repository. Feel free to use…

Packages

http://fs12.vsb.cz/hrb33/el5/hrb/stable/i386/repoview/pure-ftpd.html
http://fs12.vsb.cz/hrb33/el5/hrb/stable/x86_64/repoview/pure-ftpd.html

http://fs12.vsb.cz/hrb33/el4/hrb/stable/i386/repoview/pure-ftpd.html
http://fs12.vsb.cz/hrb33/el4/hrb/stable/x86_64/repoview/pure-ftpd.html

The patch

diff -ur pure-ftpd-1.0.22/src/ftpd.c pure-ftpd-1.0.22-geoip/src/ftpd.c
--- pure-ftpd-1.0.22/src/ftpd.c 2009-09-17 09:38:04.000000000 +0200
+++ pure-ftpd-1.0.22-geoip/src/ftpd.c   2009-09-17 09:34:03.000000000 +0200
@@ -34,6 +34,8 @@
 # include "osx-extensions.h"
 #endif
 
+#include "GeoIP.h"
+
 #ifdef WITH_GSSAPI
 # include "auth_gssapi.h"
 #endif
@@ -4818,7 +4820,7 @@
 die(421, LOG_ERR, MSG_GETPEERNAME ": %s" , strerror(errno));
 }
 fourinsix(&amp;peer);
-    if (checkvalidaddr(&amp;peer) == 0) {
+    if (checkvalidaddr(&amp;peer) == 0 || STORAGE_FAMILY(ctrlconn) != AF_INET) {
 die(425, LOG_ERR, MSG_INVALID_IP);
 }
 #ifndef DONT_LOG_IP
@@ -4854,6 +4856,37 @@
 *host = '?';
 host[1] = 0;
 #endif
+    do {
+        char line[LINE_MAX];
+        GeoIP *gi;
+        const char *country;
+        char *sep;
+        int found = 0;
+        FILE *fp;
+
+        gi = GeoIP_new(GEOIP_STANDARD);
+        country = GeoIP_country_code_by_name(gi, host);
+        if (country == NULL || *country == 0 ||
+            !(fp = fopen(CONFDIR "/pureftpd-restricted-countries.txt", "r"))) {
+            break;
+        }
+        while (fgets(line, sizeof line, fp) != NULL) {
+            if (*line == '#') {
+                continue;
+            }
+            if ((sep = strchr(line, '\n')) != NULL) {
+                *sep = 0;
+            }
+            if (strcasecmp(line, country) == 0) {
+                found++;
+                break;
+            }
+        }
+        fclose(fp);
+        if (found == 0) {
+            die(425, LOG_ERR, MSG_INVALID_IP);
+        }
+    } while(0);
 iptropize(&amp;peer);
 logfile(LOG_INFO, MSG_NEW_CONNECTION, host);
 
diff -ur pure-ftpd-1.0.22/src/Makefile.am pure-ftpd-1.0.22-geoip/src/Makefile.am
--- pure-ftpd-1.0.22/src/Makefile.am    2006-04-25 10:15:54.000000000 +0200
+++ pure-ftpd-1.0.22-geoip/src/Makefile.am      2009-09-17 09:37:14.000000000 +0200
@@ -16,7 +16,7 @@
 
 pure_ftpd_LDADD = \
        ../puredb/src/libpuredb_read.a \
-       @LDAP_SSL_LIBS@ @GETLOADAVG_LIBS@ @BONJOUR_LDADD@
+       @LDAP_SSL_LIBS@ @GETLOADAVG_LIBS@ @BONJOUR_LDADD@ -lGeoIP
 
 pure_ftpd_CFLAGS = -DINCLUDE_IO_WRAPPERS=1
 
diff -ur pure-ftpd-1.0.22/src/Makefile.in pure-ftpd-1.0.22-geoip/src/Makefile.in
--- pure-ftpd-1.0.22/src/Makefile.in    2006-04-25 10:45:12.000000000 +0200
+++ pure-ftpd-1.0.22-geoip/src/Makefile.in      2009-09-17 09:35:43.000000000 +0200
@@ -221,7 +221,7 @@
 target_alias = @target_alias@
 pure_ftpd_LDADD = \
        ../puredb/src/libpuredb_read.a \
-       @LDAP_SSL_LIBS@ @GETLOADAVG_LIBS@ @BONJOUR_LDADD@
+       @LDAP_SSL_LIBS@ @GETLOADAVG_LIBS@ @BONJOUR_LDADD@ -lGeoIP
 
 pure_ftpd_CFLAGS = -DINCLUDE_IO_WRAPPERS=1
 pure_ftpd_SOURCES = \

nmap to get web server info

David Hrbáč — Thu, 12 Feb 2009 20:10:41 +0000

I realized that nmap can be used to get info about web server. Informations about servers are easy to read via header. Admins tend to mask actual product or version the web is running on. So, then nmap comes to play with.

[root@kremilek ~]# nmap -sV -P0 -p80 www.idnes.cz
Starting Nmap 4.20 ( http://insecure.org ) at 2009-02-12 21:03 CET
Interesting ports on c1.idnes.cz (194.79.52.192):
PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS webserver 6.0
Service Info: OS: Windows
Service detection performed. Please report any incorrect results at http://insecure.org/nmap/submit/ .
Nmap finished: 1 IP address (1 host up) scanned in 6.096 seconds
Header way:
[root@kremilek ~]# HEAD www.idnes.cz
200 OK
Cache-Control: no-cache
Connection: close
Date: Thu, 12 Feb 2009 20:03:46 GMT
Accept-Ranges: bytes
ETag: W/"c6b3f4ff4c8dc91:23a"
Server: Microsoft-IIS/6.0
Content-Length: 77562
Content-Location: http://www.idnes.cz/sph.htm
Content-Type: text/html
Last-Modified: Thu, 12 Feb 2009 20:03:40 GMT
Client-Date: Thu, 12 Feb 2009 20:03:46 GMT
Client-Peer: 194.79.52.192:80
Client-Response-Num: 1
X-Powered-By: ASP.NET