computer

Apr 15 2014

Creating Self Signed Certificates

Have you ever created a self-signed certificate and then seen the following errors in the apache error log?

1
[warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)

Well this is likely because you are using a certificate that is used to sign other certificates as your SSL cert rather than using a cert that is just for SSL. The remainder of this document will walk you through the correct steps to generating a self-signed certificate. This guidance is based on the instructions provided by Heroku.

The openssl library is required to generate your own certificate. Run the following command in your local environment to see if you already have openssl installed installed.

1
2
$ which openssl
/usr/bin/openssl

 

If you have openssl installed, the first step is to generate a private key and certificate signing request.

1
2
3
4
5
6
7
8
9
10
// Generation of RSA Private Key
$ sudo openssl genrsa -des3 -passout pass:x -out server.pass.key 2048
// Removes password from RSA private key
$ sudo openssl rsa -passin pass:x -in server.pass.key -out server.key
// Remove the original private key
$ sudo rm server.pass.key
// Certificate Signing Request
$ sudo openssl req -subj /C=US/ST=Virginia/L=Alexandria/O=IT/CN=www.openfisma.org -new -key server.key -out server.csr
// Self-signed certificate generated from server.key private key and server.csr
$ sudo openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

By • , , 0

Virtualbox_logo

Aug 6 2012

Free Windows Vista & Windows 7 for Testing on Mac/Linux

If you want to test exploits against windows machines or if you’re a web developer and need to test code in IE 7, 8, and 9 you will want to have multiple windows virtual machines handy. This tutorial will show you how to legally get copies of windows installed on virtualbox using the free editions provided by Microsoft. These additions are not fully registered and you will need to restore the images after every 30 days so they aren’t useful for desktop machines but they are perfect for testing purposes.

This will produce the following virtual machines:

  • Windows Vista with IE 7
  • Windows 7 with IE 8
  • Windows 7 with IE 9

    • We will be using a script to automate the build process courtesy of Greg Thornton and it is available via github at https://raw.github.com/xdissent/ievms/master/ievms.sh. The admin password for all of the IE VMs is “Password1″ without the quotes. This has been tested and confirmed to work with Mac OS X 10.7 Lion and Mac OS X 10.6 Snow Leopard.

    Instructions

    Step 1: Download and install VirtualBox
    Step 2: Launch the Terminal (located in /Applications/Utilities/)
    Step 3: Run the installation script, this will take some time to download and install

    1
    curl -s https://raw.github.com/xdissent/ievms/master/ievms.sh | IEVMS_VERSIONS="7 8 9" bash

    Step 4: Launch VirtualBox and boot one of the virtual machine

    Recovering from a failed installation

    Each version is installed into a subdirectory of “~/.ievms/vhd/“. If the installation fails for any reason (corrupted download, for instance), delete the version-specific subdirectory and rerun the install. If nothing else, you can delete “~/.ievms“ and rerun the install.

    By • , 0

    backtrack-logo-trace

    Aug 5 2012

    Installing VirtualBox Guest Additions in Backtrack

    If you want to run BackTrack in virtual box, I highly recommend installing the guest additions to take advantage of the screen resizing, shared windows, shared clip board, etc. Backtrack does not come with the virtualbox guest additions installed by default. Earlier versions of BT required several rounds of downloading kernel headers, patching, and copying files around, as of version BT5 R2 this is no longer the case and it couldn’t be simpler to install guest additions.

    These instructions were tested on Mac OSX 10.7.4 running VirtualBox 4.1.18 with the extension pack and BackTrack 5 R2 64bit Gnome edition.

    Download and Install
    Download BackTrack
    Download The Oracle VM Extension Pack, required if you want support for USB 2.0 devices.
    If you want support for USB 2.0 devices you must download and install the Oracle VM Extension Pack

    We are assuming you already have a copy of BT installed and that you have also installed the extension pack. In the virtual box menu go to Devices >> Install Guest Additions. This will automount the cd and you will be presented with a screen that asks if you wish to run the program, click yes and follow the instructions and everything will compile successfully.


    If you run into problems you can download and install the kernel headers on your own with the instructions below, but for BT 5 R2 you shouldn’t have to.

    1
    2
    3
    root@bt # prepare-kernel-sources
    root@bt # cd /usr/src/linux
    root@bt # cp -rf include/generated/* include/linux/

    By • , , 0 • Tags: ,

    wordpress

    Aug 2 2012

    Resetting WordPress Security Keys

    Several people have recently come to me asking for help identifying and remediating hacks against their wordpress blogs. Many of the online tutorials fail to address attackers who try to maintain persistence by changing user passwords and remaining logged in to wordpress. Even if you reset the password the attacker can still make changes because their cookies are still valid. By default, WordPress allows users to remain logged in for 48 hours or 14 days if you check the “Remember Me” box.

    Since version 2.6 of WordPress they have added security keys to ensure better encryption of information stored in cookies. If you change these keys then the previously existing cookies will no longer be valid and the attacker who is logged in will no longer have access. WordPress offers an key genereator which will randomly generate new keys for you or you could just make random changes to the existing keys. Please note that this will invalidate all existing cookies and all users will have to login again.

    Here is an example of the section in wp-config.php that you will need to edit.


    Okay, so to sum things up.

  • Step 1: Go to the key genereator and copy all keys
  • Step 2: Edit the wp-config.php file and paste the keys to keys section
  • Step 3: Save the file and changes will become effective immediately
  • Step 4: Harden your wordpress site

    • Happy WordPress blogging!

    By • 0 • Tags:

    Virtualbox_logo

    Jul 31 2012

    Install VirtualBox Guest Additions in Ubuntu

    1. Update your software

    1
    sudo apt-get update

    2. Install the latest security updates

    1
    sudo apt-get upgrade

    3. Install required packages

    1
    sudo apt-get install dkms build-essential linux-headers-generic linux-headers-$(uname -r) module-assistant

    4. Install guest additions
    Click on Install Guest Additions… from the Devices menu, then choose to browse the content of the CD when requested.
    Run sudo sh /media/cdrom/VBoxLinuxAdditions.run, and follow the instructions on screen.

    By • 0 • Tags: ,

    apple-logo-png-black-i1

    Jul 31 2012

    Installing MacPorts on your Mac

    What is MacPorts?

    MacPorts provides an infrastructure for building, installing, and packaging open source software. It is designed to match the functionality of the FreeBSD Ports system and to be extensible for future enhancements.

    Installing MacPorts

    Download the macports package for your version here or you can click on the version of the MacOS you have here: Mountain Lion, Lion, Snow Leopard orLeopard. Double click on the package to run the Installer and follow the on-screen instructions until completion.

    Basic Usage

    The main user interface to MacPorts is the port command and the various facilities it provides for installing ports. The first thing you should do after you install MacPorts is to make sure it is fully up to date by pulling the latest revisions to the Portfiles and any updated MacPorts base code from our rsync server, all accomplished simply by running the port selfupdate command as the Unix superuser:

    1
    sudo port selfupdate

    Running this command on a regular basis is recommended — it ensures your MacPorts installation is always up to date. Afterwards, you may search for ports to install:

    1
    port search <portname>

    where is the name of the port you are searching for, or a partial name. To install a port you’ve chosen, you need to run the port install command as the Unix superuser:

    1
    sudo port install <portname>

    where now maps to an exact port name in the ports tree, such as those returned by the port search command. Please consult the port(1) man page for complete documentation for this command and the software installation process.

    By • , 0 • Tags:

    computer

    Jul 29 2012

    Automating WordPress Backups on Godaddy

    If you have ever tried to backup a wordpress site on godaddy you are in for a treat, I decided to write this article in case I ever needed to go through this again and in the hopes that it may help someone else. If you’re like me, you have one or more wordpress sites that you would like to ensure are backed up before a disaster occurs and rather than use wordpress plugins which may break due to software upgrades I’d rather roll my own that leverages cron, tar, and scp.

    Turn on SSH

    If you want to test out your backup script before you add it to cron you will need to activate SSH. Godaddy doesnt have ssh on by default so you have to enable it. To do this go to the “Hosting Control Center” and select “SSH” under the “Settings” menu.

    From here you can click the “Enable” button to turn on ssh access. SSH will use the same FTP username and password you have configured for the godaddy account. You should be able to connect using any ssh client, for you windows users I recommend putty. Once you have logged in you should be at a bask prompt. I should note that if you have an ultimate hosting account and are hosting more than one website you should be ssh’ing to the primary domain which is under “Settings” and “Hosted Domains”.

    There are a million different ways to skin this cat, for me I like Godaddy’s built in file restore and database backup but always want to make sure I have a full off-site backup just in case. To accomplish this I will run a weekly cron job to back up all wordpress sites and the associated databases so that in case of an emergency they can be restored to Godaddy or even another hosting provider. The script below is an example of the script I run, you will need to customize this based on your environment.

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    #!/bin/bash

    DATE=`date +%m%d%y`

    /usr/bin/mysqldump -h databasehostaddress.db.hostedresource.com -u databaseusername -pdatabaseuserpassword databasename > $HOME/html/_db_backups/daily/databasename.$DATE.sql

    cp -r $HOME/html/wordpressfolder $HOME/html/_db_backups/daily

    # Zipping directory structure...
    tar -cvzf $HOME/html/_db_backups/$DATE.tar.gz $HOME/html/_db_backups/daily/*

    # Cleansing backup folder
    rm -r $HOME/html/_db_backups/daily/*

    To run this script you will need to create the _db_backups directory as well as the daily subdirectory otherwise the primitive script will fail. Using the FTP file manager from godaddy you should be able to create the backup.sh script file under the _db_backups folder. You will also need to mark it as executable so it may run. In FTP File Manager just click the check box of the shell script file and “permissions” at the top and make sure executable is checked you will see a additional graphic next to the file once you apply the change.

    Now you are ready to create a Cron Job for your shell script to execute. To diagnose any errors you may get make sure when creating the Cron Job you include an email address for the errors to be delivered. Enable the Cron Job and change the Frequency to “Weekly” and Minute to whatever is closest for the script to execute.

    By • 0 • Tags: , ,