Password Rants and Raves...

Sometimes it is necessary to update a password or sometimes you can't use the default one you use for everything. For things you use regularly I recommend at minimum changing your password every three months, especially for anything that has sensitive information. Not that passwords are all guessable, I love my base one, but I did see 2014 top dumb passwords list and was surprised at how easy some are, including numbers 1 and 2 respectively 123456 and password (http://www.cnet.com/news/worst-passwords-of-2014-are-just-as-awful-as-you-can-imagine/).

If you don't want the hassle of changing all of your passwords, most online services have two factor (basically a number that changes every 30 seconds). So long as you have an accurate time it works nicely. I have seen private ones get blocked by firewalls because the ntp service could not reach the server.

So here are a couple of suggestions for varying strength in passwords.

Simple:
Go to a dictionary (physical book or online) and find a random word (thumb the page for a few seconds and stop after about 3-7 then find a word on the page or choose a random word from your favorite dictionary site). Convert that word into leet (1337) there are various methods of doing this, including online converters that you choose the conversion. Generally I only use a few @ for a $ for s and 3 for e to keep it simple.
Find a poem you like and choose the first letters of each word, or line.
Write a poem and do the same.
Add a ... or ,,, or ??? etc at the end of your current password - (this actually increases it's complexity significantly)

http://creativitygames.net/random-word-generator is a site that I often use as it lets you pick a number of random words.
http://watchout4snakes.com/ is another good one that gives you options to make a phrase etc.

More Complex:
Convert a phrase to leet from your favorite quotes, books, etc.
Grab multiple words in the dictionary (3 to 4 is generally a good amount of security) and throw in random numbers and symbols.

http://www.robertecker.com/hp/research/leet-converter.php

This is my favorite leet converting site. Mostly because it lets you pick a few things thus making it more random or pre-generated if you are lazy ^.^

Most complex:
Use a random alpha numeric and symbol generator (the utility here is from a personal developer I know http://www.maxoutput.com/)

It is actually a networking utility (I use that aspect of it the most) but the fact that it creates random passwords has been a bonus. It even does more than one at once.

From my experience I believe generally 10 to 12 characters minimum is sufficient, but beefier the better.

If you are anything like me you have many variations on your password and cannot always keep straight which one is which. Well I have 3 solutions:

Classic little black book - no one looks for these any more, you can get one for about a dollar at the store for notes and such and just choose a page for passwords.

KeePass - If you don't like carrying notebooks around but always have a flash drive you can use Key Pass. the nice thing about it is it lets you organize everything as well. It does however take a password to open so in reality you only need to remember 1 password so you can access everything else. You can also make notes about each item. It includes a random password creator which is (I think) intended for use as you are making accounts.

Passpack - So I recently started using this because of work. It is nice in that you can share your password with people if you want as well as has 2 layers of passwords before you get to actually see the passwords. The other nice thing is it is online. A simple account is free to use with limited sharing etc but I found I didn't need more than that. You create an account, Then you create what they call a packing key (they recommend using a sentence). Then you can view things, search the database they have and even "hide" things from people peeking over your shoulder. They even include a generator as well I found out the other day.
https://www.passpack.com/online/

I mostly use KeePass as I have used that one the longest and am most comfortable with it.

This one was a bit long but hopefully people will be encouraged to beef up their security a bit.

Wireshark and tcpdump

First off let me say I started using Wireshark having NO IDEA what the crap was going on other than I see things on the network. This made it a very non useful tool to me. I could find out things I wanted to know without so much jumble in the middle other ways. That said I never had to look at packets as I was generally trying to figure out other things.

Now I have taken the time to look at a few things with it, as I needed a way to capture the packets so the development department at work could figure out if we were truncating responses in our software or if a client was.

Some things to note:
1) Working with Wireshark is much easier once you understand it a bit. It is not something I think someone should just jump into as it gets frustrating.

2) Know what you want to do before you go to Wireshark. In this example I am looking for requests and responses to one other machine.

3) Understand filtering of what you want to do.

So I want to filter two machines (hopefully based on IP) and I want to follow their tracing.

Now I can only capture based on what is sent to one computer so I would need Wireshark on both computers (this being said I only have access to one so I was only responsible for getting results to one).

So objective: Compare two packets and see if loss occurs.

tcpdump is another tool that lets us do basically the same thing but command line only. Write it to a file and then import it to another machine and load it in Wireshark if you prefer the gui.

tcpdump -w <filename>.pcap -i eth0
tcpdump -nvX src net 192.168.0.0/16 and dst net 10.0.0.0/8 or 172.16.0.0/16

(I forgot my username at first, then I forgot to do it with sudo ^.^ sorry but at least it has the commands in there)
Ctrl+c to stop the dump. I believe you can also run it as a daemon but I don't remember.

Results:
Effectively what I ended up doing was using just what I said using tcpdump and inporting it to Wireshark. I dumped everything as I didn't have my notes with but but luckily Wireshark lets you filter very nicely which made it easy. The hard part is I don't have the .pcap file from the other people to compare with they only sent over the csv of ALL the communication between the two computers but none of the packets, which I want to compare.

I merged the two files together so it would be easier to try and use native Wireshark tools to try and analyze it. Here is what I used to filter out the two. The times are different on our end and theirs which made it hard to search through and note I am only looking for https requests hence port 443 being looked at only.

(ip.src == internal.ip.addr.server && ip.addr == external.ip.addr.client)  || (ip.src == external.ip.addr.server && ip.addr == internal.ip.addr.client) && tcp.port == 443
I don't have a server and client scan that I can use (the one I was using has sensitive data on it so I don't want to take a chance).

Here is a smaller filter of a packet capture I did that uses part of this larger filter:

The || is or so if you have both files combined it works nicely. There are lots of tips for filtering Wireshark. Just give Google a go.

Wiresharks native compare tool almost lined the times up exactly from what I could tell which made it much easier to tell where the packet loss happened as well as the fact they issued a connection reset. All in all it was most useful yet we didn't find what was causing the "bug" in our (or their) software, but now I know a lot more about packets and networking.

The compare tool told me basically the time difference and I was able to find it on both sides using that but also because I was at the location on one side and at the beginning of the trace on the other and it just happened to be at the beginning of the other trace. We calculated the difference by hand (basically found some packets that matched and subtracted the time difference) and the compare tool was right on. If you are using two different traces, you have to combine them together first then compare, otherwise it won't tell you much.

Other things to note the sending side will always have more than the receiving as parts are getting stripped in the routing.

Linux Audit Logs

So I had to dig through the Linux audit logs the other day and it was a bit painful to look at.

sealrert - this lets you read alerts that are in your audit log file.
I think you have to install it with yum install setroubleshoot-server
It isn't the best but it if you want the basics

yum install setroubleshoot-server
After the install is completed, you can then analyze the audit log by issuing the following command:

sealert -a /var/log/audit/audit.log > /var/log/audit/audit_human_readable.log

rcauditd is an audit service that makes it much easier to understand things.

I found the summary to be quite useful as it is literally a quick view of everything.
aureport --summary

This let me see basically everything I wanted to and specify time frame as well as other useful things like who logged in etc.

A good link is:
https://www.suse.com/documentation/sles11/singlehtml/audit_quickstart/audit_quickstart.html

Linux/Windows/Mac and Opinion

I will try to not be exclusive in the future with the how to's etc. If someone really needs me to convert something I have written to a different OS ask. I have comments open for a reason and will do my best, or feel free to email me. The rest of this post is kinda rant like so feel free to skip it.

So I am a windows user and have been for an extremely long time, but mostly by culture not by choice. Essentially Windows was chosen for me many times and I've just gone with it. I have looked at Apple and played with it a bit but in all honesty I am starting to fall in love with Linux distros.

1) They are FREE 99
2) They come with the things you need when working as an admin.
3) Updates are much easier to handle and control I feel.

Reasons why I will ALWAYS own a windows machine (or VM):
1) Gaming - people don't develop games as much for linux
2) Excel - It is the most robust tool for any financial things and although I am not an expert with it (nor an accountant) I get files that are in Excel format and can't always change/convert.

So From what I have found it comes down to why are you using the machine. I have something like 5 or 6 (or maybe closer to 10) computers in my house and I use each for different reasons. In working as an Administrator I have found you pretty much have to use Linux at some point and so I am learning what I can replace on Windows with Linux alternatives and for somethings it is just easier for me to do in Windows because I have done it that way for so long.
So I guess I am going to re-install some of my computers with Linux.

I decided to comment on Mac as well. I own a really really old (over 10 years) MacBook but I'm a poor guy so I am not able to speculate on Mac. Nor will I include any mac stuff in my how to's as I can't test it.

Task oriented

I am a very task oriented person.
Pen and paper works best for me. something about hand writing it helps me.

other options:
Evernote:
I was not a big fan of, mostly because writing it down kept me more focused. It does allow you to do many more things though so if you are a good note taker and have lots of notes this is a nice application.

I stole the image from Google (I think it actually came from the evernote blog).

Google tasks:
https://mail.google.com/tasks/canvas
Lets you have multiple lists. I use this one for goals for myself rather than actual tasks.
Your phone task list - I never got this one down but for some people it is a quick task list they need.

Another one that I have used is Asana.
This is a nice way for a manager to assign tasks as well as it makes it easy to break things down to different levels and make projects. This was very nice for me when my tasks changed daily on what I needed to work on as my manager could see what I was doing and assign things different priorities. The best part about it is the hidden unicorn feature.

Same thing for this image as the Evernote one.

Microsoft Security Essentials Logs

So there may come a time when you need to know what has happened with your virus scans for reporting or anything really (for me it was reporting). Well when that happens here is how you can find your logs in Microsoft Security Essentials.

Microsoft Security Essentials (MSE) actually logs all of its scans and findings, although you can't find them in the program itself. It logs them to the event viewer.

There are a couple of options:

1) Find and create a filter for the specific logging you want.

2) There is a built in dump of all of the logs to one file called MpCmdRun

To run the built in option simply open an administrator command prompt and go to the directory where it is located. 

cd %programfiles%\Microsoft Security Essential

[add pic]

Then run "MpCmdRun.exe -getfiles"

It takes a bit to run sometimes depending on how often and how many logs there are.

It makes a file called MPSupportFiles.cab which will be saved automatically to "%ProgramData%\Microsoft\Microsoft Antimalware\Support\" folder

[add pic]

The other option lets you export an XML so you can then import that into MySQL or anything really. I will get a query once I test it out again.

You can also use the Event Viewer (Start > Run > eventvwr.msc) under [System] right click View > filter (by Event Source: Microsoft Antimalware) 

I usually make the filter for a week so I don't get too much data.

I filter out the update events but other than that here is the xml:

<ViewerConfig><QueryConfig><QueryParams><Simple><BySource>True</BySource><Channel>System</Channel><Source>Microsoft Antimalware</Source><RelativeTimeInfo>4</RelativeTimeInfo><EventId>-2000</EventId></Simple></QueryParams><QueryNode><Name>MSE Events</Name><QueryList><Query Id="0" Path="System"><Select Path="System">*[System[Provider[@Name='Microsoft Antimalware'] and TimeCreated[timediff(@SystemTime) &lt;= 604800000]]]</Select><Suppress Path="System">*[System[(EventID=2000)]]</Suppress></Query></QueryList></QueryNode></QueryConfig></ViewerConfig>

It is all in one line. To export it to a database it is easier to use powershell but that was a project in and of itself so I am not going to go over that in this post.

How to reduce the root partition in LVM

So at work I ended up being told two different things. First I was told use all of the disk space so that we can get an LVM with as much size on it as possible. Then I was told oh we need 20 percent or so so that we can use it for backing up. With that I set out on a mission to find out how to resize LVM space. We come to find out we put the root partition in the LVM. This means we have a few more steps to do.

A few sites mention how to do this but I found one step by step guide with pictures the rest were not as informative as this site and we were using the same distro so I chose to use this for my base documentation. Other changes include a few grammer tweaks.

Best practice would be to make sure you don't have to shrink your LVM as it can become corrupt, and it is much easier to enlarge it.

Modified from:

https://rbgeek.wordpress.com/2013/02/11/how-to-reduce-the-root-partition-in-lvm/

My additions are in blue comments and have brackets
In this tutorial, I am using the CentOS 6 (I believe that its also applicable on other Linux distro but haven't tried yet) that has ext4 partition lv_root mounted as / and lv_swap as swap from the volume group vg_centos6 (which is default), that has two hard drives (66GB & 25GB). Due to some reasons, I want to remove the 25GB hard drive from my computer and want to add new 50 GB hard drive. Before, removing the hard drive from the computer, we need to resize the lv_root, then remove it from volume group and at the end from the physical volume.

WARNING: It’s really dangerous, so backup your data before attempting this. Please don’t blame me, if you destroy your system. You are responsible for your own actions!

Check the size of lv_root before starting this process:

df -h



Boot from CentOS 6 DVD (or any other Linux distro that you are using) and select “rescue” option:



[The next thing I chose to do was I selected to enable the em0 (the ethernet device adapter) incase I needed it for any reason. This was not a step mentioned in the tutorial I took this from.]

Select the Skip, so that it will not mount the filesystem:



Run these commands:

pvscan
vgscan
vgchange -a y
lvscan



Display the lv_root:

lvdisplay /dev/vg_centos6/lv_root



[This section would not run] fsck on the large root filesystem (lv_root):

fsck.ext4 /dev/vg_centos6/lv_root

]

Run e2fsck with -f (force) option:

e2fsck -f /dev/vg_centos6/lv_root



Issue the resize2fs command to reduce the filesystem (Important: The size here is the actual/total size of thelv_root after reduce, not the size that we want to decrease):

resize2fs -p /dev/vg_centos6/lv_root 65G [I chose to use 2750G as we have 4 terabytes and that is what I calculated to be 20 % ish]



Now, issue the lvreduce command to reduce the logical volume size:

lvreduce -L 65G /dev/vg_centos6/lv_root [Once again I chose to use 2750G]



Run lvdisplay command to confirm the change:

lvdisplay /dev/vg_centos6/lv_root



Reboot the system and login. Remove the disk (in my case it is, /dev/sdb1) from volume group and then from physical volume:

[These next two commands would also not run]

sudo vgreduce vg_centos6 /dev/sdb1

sudo pvremove /dev/sdb1

]

Check the size of lv_root after all these changes:

df -h



Success!