Thursday, November 10, 2016

Upgrade Mageia5 to Mageia6


Back in the early days of Linux, the changes to the operating system were so dramatic that even when updating withing the same distro, in-place point release updates were problematic enough and it was always recommended that a major version release be done from scratch. There were just too many major changes to the underlying subsystems and package naming conventions. Doing an in-place update was just asking for trouble.

Modern distros have matured quite a bit even though there are occasionally some major subsystem changes being made. Yet it's never been easier to do an in-place major version upgrade.

I just did the upgrade on several Mageia5 systems and the results were consistent and satisfactory, not to mention simple.

Step 0.

Always backup critical information. Have a Mageia5 recovery disc on hand.

Read the Release Notes, the Documentation and the Errata for Mageia 6. Other than updated applications, the biggest changes are support for UEFI and GRUB2.

You can always download an ISO image to do the upgrade rather than do an in-place installation if your Internet connection is slow. DO NOT attempt an upgrade from the Live ISO image as it will overwrite your existing system.


Upgrade From GUI

Step 1.

Open a terminal window.

$ sudo mgaapplet-upgrade-helper --new_distro_version=6

And you're done. This essentially does all the following individual commands.


Upgrade From CLI

Step 1.

Fully update the packages you now have installed.

$ sudo urpmi --auto-update --auto -v


Step 2.

Remove all the existing Mageia5 repositories.

$ sudo urpmi.removemedia -av

Step 3.

Add the Mageia 6 repositories. (All on one line.)

$ sudo urpmi.addmedia --distrib --mirrorlist 'http://mirrors.mageia.org/api/mageia.6.i586.list'

Note: for 64-bit systems, substitute x86_64 for i586.

Step 4.

Update the packages

$ sudo urpmi --replacefiles --auto-update --auto -v

Step 5.

Reboot. You'll be using a new kernel, new glibc and so on.

$ sudo shutdown -r now

Step 6.

Run the package update command from Step 4 again. It should return with no packages needing updating.

Done.  But . . . .

Do Some Checking.

$ cat /etc/redhat-release
$ cat /etc/issue

Those commands should return the information that you are running Mageia 6.

I did have an issue on one machine and

$ sudo urpmi mageia-release-common 

fixed it. You can also manually edit those version files in /etc to change the version number.

Saturday, August 13, 2016

Here's the Linux Fix to disable WPAD ATTACKS

Use the internet? This Linux flaw could open you up to attack

Study Highlights Serious Security Threat to Many Internet Users

"RIVERSIDE, Calif. (www.ucr.edu) — Researchers at the University of California, Riverside have identified a weakness in the Transmission Control Protocol (TCP) of all Linux operating systems since late 2012 that enables attackers to hijack users’ internet communications completely remotely."

tl;dr The FIX

Edit /etc/sysctl.conf to include this line:

net.ipv4.tcp_challenge_ack_limit = 999999999

Then execute this command as root to apply the fix.

# sysctl -p

If you need the Windows Fix:

How to Turn Off (Disable) Web Proxy Auto Discovery (WPAD) in Windows Server 2008 R2

Tuesday, June 07, 2016

Bootable USB device for Mageia 5

If you Google "create a bootable USB drive in Linux> most of the returns you get will tell you to use Rufus for Windows or netbootin for Linux.

The problem is that Mageia no longer provides unetbootin and instead provides their own tool, IsoDumper. Still in development, IsoDumper can only save as a disk image of the existing files, write an image file to the USB device, or format the USB device with a FAT, NTFS or EXT filesystem. It would be nice if Mageia provided a bootable DOS image for you so that you could easily do BIOS and firmware updates since Linux has yet to produce a usable tool for that.

It's always good to know how to do that from the command line if the GUI tools are not available, so that's what we will do.


You can get a USB image containing FreeDOS from this site. There are three different images depending on the size of your USB stick. Mine is 2GB, so I could choose either of the first two. I chose the second image.

Once downloaded, you need to uncompress the file like this:

$ bunzip2 FreeDOS-1.1-memstick-2-256M.img.bz2

Now it's simply a matter of using dd to copy the image file to the USB device. On my system, the USB device was detected as /dev/sdj and /dev/sdj1 was auto-mounted at /run/media//. That's OK to let it do that, no need to unmount it, just note what the device is named by your system. Note that we use dd to write to the device, not the filesystem that may be on it.

$ dd -if=FreeDOS-1.1-memstick-2-256M.img of=dev/sdj bs=512

For good measure, invoke the sync command and unmount the device.

$ sync && sudo umount /dev/sdj

Reinsert the USB device, allow the system to auto-mount it, and transfer whatever BIOS/firmware and installation program you need. Use the USB device to boot your computer which will leave you at a command prompt to invoke whatever installation program you have.


REFERENCES

Rufus Download

unetbootin homepage

IsoDumper Homepage

dd manpage

FreeDOS for USB/PXE Homepage



Monday, May 30, 2016

Kill the Upgrade to Windows 10

There are many people who, for whatever reason, don't want to upgrade  to Windows 10. Microsoft admits this and outlines the way to do this on their support page.

This is what you need to do:

Create a blank .reg file and put this in it:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Gwx]
"DisableGwx"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"DisableOSUpgrade"=dword:00000001



Then run it bu double-clicking on it.  Alternatively, you may manually add those keys to the registry yourself using regedit.

Or you can download this file which is the file you were told to create above. Please examine the downloaded file in a text editor to see that it matches the instructions above.

Wednesday, May 18, 2016

Adding a Spellchecker to Leafpad


Leafpad is the text editor for the LXDE desktop environment. It does well for editing basic text files, but it lacks a spellchecker.

This is a hack to use the default-installed Hunspell to spell-check your text file.

To accomplish this, you need to save the text file, open it in Hunspell, close Hunspell and re-open the document in Leafpad.

This is accomplished by a script added to your .bashrc. I found this script in a recent Knoppix thread.

Add this to .bashrc:

lpad() { # uses leafpad to edit $1; on closing leafpad, # # # hunspell checks spelling; 
#on closing hunspell, leafpad shows corrected copy.
leafpad $1; aspell $1; leafpad $1 &
}

NOTE: You can also use this with ispell, but you'll need to invoke "ispell  -c".

NOTE: I found the command line at the bottom of Hunspell to be misleading. For example, it says that pressing "I" is "Insert". It actually means "Accept  the  word,  capitalized as it is in the file, and update private dictionary."  As well, "U" is "Uncap". It actually means "Accept the word, and add an uncapitalized (actually,  all lower-case) version to the private dictionary." "X" causes you to exit the file with no changes and "Q" causes you to exit, discarding any changes you have already made.

NOTE: Hunspell keeps its dictionaries in /usr/share/hunspell and by default two additional dictionaries are installed. I have found that these other dictionaries, en_CA and en_GB, often confuse Firefox and that is solved easily by deleting all but the en_US files.


RESOURCES






Sunday, May 15, 2016

Using a Blocklist File With Iptables

I read an interesting piece about securing servers written by Greg Bledsoe in LinuxJournal. I thought I would try it out and it turns out that it needed a few massages to make it run on my Mageia5 system.

There are two parts to his approach, a short script that runs as rc.local, which file does not exist in Mageia, but will be properly run if you create it in /etc/rc.d/rc.local.

#!/bin/sh
#/etc/rc.d/rc.local
# REF: http://www.linuxjournal.com/content/server-hardening?page=0,2
#create iptables blocklist rule and ipset hash
/usr/sbin/ipset create blocklist hash:net
/usr/sbin/iptables -I INPUT 1 -m set --match-set blocklist 
↪src -j DROP

This file owner should be root with 700 permissions.

Once you create it, you should execute it manually because that needs to be done before you run the script to collect the blocklists.

I put the blocklist collection script in /usr/local/bin. You will need to create the directory /usr/local/bin/tmp because the script wants to keep its temporary files there.


#!/bin/bash
#/usr/local/bin/getblocklist
# REF: http://www.linuxjournal.com/content/server-hardening?page=0,2

PATH=$PATH:/sbin
WD=`pwd`
TMP_DIR=$WD/tmp
IP_TMP=$TMP_DIR/ip.temp
IP_BLOCKLIST=$WD/ip-blocklist.conf
IP_BLOCKLIST_TMP=$TMP_DIR/ip-blocklist.temp
list="chinese nigerian russian lacnic exploited-servers"
BLOCKLISTS=(
"http://www.projecthoneypot.org/list_of_ips.php?t=d&rss=1" # Project 
 ↪Honey Pot Directory of Dictionary Attacker IPs
"http://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.1.1.1"  
 ↪# TOR Exit Nodes
"http://www.maxmind.com/en/anonymous_proxies" # MaxMind GeoIP 
 ↪Anonymous Proxies
"http://danger.rulez.sk/projects/bruteforceblocker/blist.php" 
 ↪# BruteForceBlocker IP List
"http://rules.emergingthreats.net/blockrules/rbn-ips.txt" 
 ↪# Emerging Threats - Russian Business Networks List
"http://www.spamhaus.org/drop/drop.lasso" # Spamhaus Dont Route 
 ↪Or Peer List (DROP)
"http://cinsscore.com/list/ci-badguys.txt" # C.I. Army Malicious 
 ↪IP List
"http://www.openbl.org/lists/base.txt"  # OpenBLOCK.org 30 day List
"http://www.autoshun.org/files/shunlist.csv" # Autoshun Shun List
"http://lists.blocklist.de/lists/all.txt" # blocklist.de attackers
)

cd  $TMP_DIR
# This gets the various lists
for i in "${BLOCKLISTS[@]}"
do
    curl "$i" > $IP_TMP
    grep -Po '(?:\d{1,3}\.){3}\d{1,3}(?:/\d{1,2})?' $IP_TMP >> $IP_BLOCKLIST_TMP
done
for i in `echo $list`; do
    # This section gets wizcrafts lists
    wget --quiet http://www.wizcrafts.net/$i-iptables-blocklist.html
    # Grep out all but ip blocks
    cat $i-iptables-blocklist.html | grep -v \< | grep -v \: | grep -v \; | grep -v \# | grep [0-9] > $i.txt
    # Consolidate blocks into master list
    cat $i.txt >> $IP_BLOCKLIST_TMP
done

sort $IP_BLOCKLIST_TMP -n | uniq > $IP_BLOCKLIST
rm $IP_BLOCKLIST_TMP
wc -l $IP_BLOCKLIST

ipset flush blocklist
egrep -v "^#|^$" $IP_BLOCKLIST | while IFS= read -r ip
do
        ipset add blocklist $ip
done

#cleanup
rm -fR $TMP_DIR/*

exit 0

This file owner should be root with 700 permissions.

Check your script and remove the " ↪" symbols, re-connecting the comments to the line above them.

Now manually execute the script. It should run and exit, creating the blockhost.conf file that the first script above will execute.

The final step is to add the second script in your crontab to run once a day.

All Done. Remember to read the entire article.

Friday, May 06, 2016

ImageMagick Interim Fix

A vulnerability resides in ImageMagick, a widely used image-processing library that's supported by PHP, Ruby, NodeJS, Python, and about a dozen other languages. Many social media and blogging sites, as well as a large number of content management systems, directly or indirectly rely on ImageMagick-based processing so they can resize images uploaded by end users. According to developer and security researcher Ryan Huber, ImageMagick suffers from a vulnerability that allows malformed images to force a Web server to execute code of an attacker's choosing. Websites that use ImageMagick and allow users to upload images are at risk of attacks that could completely compromise their security.

Update your /etc/ImageMagick/policy.xml file so that it contains the code taken from http://imagetragick.com  and restart corresponding daemons.

You're safe now. The full fix is still being worked out.

And if you have the old version of ImageMagick (because you are on CentOS 5, for example) which doesn't support policy.xml, you can edit delegates.xml, by removing all delegates just to be safe. The file will be somewhere around: /usr/lib64/ImageMagick-6.2.8/config/

RESOURCES
https://en.wikipedia.org/wiki/ImageMagick

https://it.slashdot.org/story/16/05/06/1516254/huge-number-of-sites-imperiled-by-critical-image-processing-vulnerability

http://fmwconcepts.com/imagemagick/

In a terminal type
$ display
and the ImageMagick native GUI appears.
If you want to create an application luncher with the logo then the icon is in the folder
/usr/share/doc/imagemagick/www/Magick++/ImageMagick.png