CS's IT Weblog

Convert OpenSSH RSA or DSA key to PEM format

2011-01-14T12:05:00.000+05:45

RSA to PEM

First create an RSA key using OpenSSH tools:

$ ssh-keygen -t rsa

Then converted it to PEM format:

$ openssl rsa -in ~/.ssh/id_rsa -outform pem > id_rsa.pem

DSA to PEM

First create an DSA key using OpenSSH tools:

$ ssh-keygen -t dsa

Then converted it to PEM format:

$ openssl dsa -in ~/.ssh/id_dsa -outform pem > id_dsa.pem

Update Gentoo Profile

2009-12-21T17:54:00.000+05:45

There are 2 ways to upgrading Gentoo’s profile, which is whether by using the program eselect, or by manual linking.

Firstly the portage tree need to be updated to get the latest profile list by running he following command;

# emerge --sync
The following example is to update using eselect;

# eselect profile list
# eselect profile set <number>
where number is the number of favored profile from the list.

To manually update the profile, simply delete the softlink and create a new link to the intended profile as the following (be sure not to add / at the end of /etc/make.profile)

# rm /etc/make.profile
# ln -s /usr/portage/profiles/<profile of choice> /etc/make.profile
Optionally, in the end you might want to upgrade the system using the new profile;

# emerge --sync
# emerge --update --newuse --deep world

Jabber - an open source instant messaging

2009-11-12T17:01:00.000+05:45

Jabber is an open instant messaging technology that anyone can use.

Jabber Server Setup on CentOS 5

Configuring and Installing jabber server

Install rpmforge repo

rpm -Uhv http://apt.sw.be/redhat/el5/en/i386/rpmforge/RPMS/rpmforge-release-0.3.6-1.el5.rf.i386.rpm

Install necessary packages

yum -y install gcc-c++ vim-enhanced mysql-server mysql gcc mysql-devel libidn-devel make automake libtool tcpdump rsync crontabs vixie-cron php-mysql cyrus-sasl-devel expat-devel udns-devel

Install gsasl

cd /usr/src/
wget ftp://alpha.gnu.org/pub/gnu/gsasl/libgsasl-0.2.29.tar.gz
tar xvfz libgsasl-0.2.26.tar.gz
./configure
make
sudo make install

Add gsasl library ‘/usr/local/lib’ to ld.so.conf

echo "/usr/local/lib" >> /etc/ld.so.conf.d/usr-local-lib.conf
ldconfig

Create Jabber User and Group

su
useradd jabber
passwd jabber

Getting Jabber Server

wget http://ftp.xiaoka.com/jabberd2/releases/jabberd-2.2.0.tar.bz2

Uncompress sources

tar xvfj jabberd-2.2.0.tar.bz2

Configure

cd jabberd-2.2.0
./configure --prefix=/opt/jabber --enable-mysql --enable-ssl --enable-ldap --with-sasl=gsasl --enable-debug
make
sudo make install

mysql -u root -p < tools/db-setup.mysql
mysql -u root -p
GRANT select,insert,delete,update ON jabberd2.* to jabberd2 at localhost IDENTIFIED by 'jtest';

Add Jabberd2 library to ld.so.conf

echo "/opt/jabber/lib/jabberd" >> /etc/ld.so.conf.d/jabberd2.conf
ldconfig

Customizing the jabberd server install

To customize the server, we first need to change to the jabberd directory by running the following command: cd /opt/jabber/etc/. Then we want to edit the sm.xml file so we follow the following steps as root:

• Open sm.xml in your favorite text editor
• Change the ID on the network from localhost to jabber.chatur.test (Make sure that jabber.chatur.test resolves)
• Change the MYSQL database passwaed from<pass>secret</pass> to <pass>jtest</pass>
• Scroll down to the User Options and uncomment the <auto-create/> tag. This allows users that are not registered on the server to register themselves.
• If you want to have a predefined userlist to populate all new users, scroll to the the end of the file and uncomment <roster>/opt/jabber/etc/templates/roster.xml</roster>. We will cover the contents of the roster.xml in a few minutes.

Once we are done editing, save sm.xml and exit the editor. Now we need to customize c2s.xml, so follow these steps as root:

• Open c2s.xml in your favorite text editor
• Scroll to the 'Local network configuration' section and change the <id> from localhost to jabber.chatur.test
• In order to able to login though Mac OS X iChat client, change the authentication mechanism under ‘sasl’ first comment out ‘digest-md5’ from <digest-md5 /> to <-- <digest-md5 /> --> and add ‘cram-md5’ instead <cram-md5 />
• Change the MYSQL database passwaed from<pass>secret</pass> to <pass>jtest</pass>
• Save and exit

This completes the configuration of the jabberd server. This gives us a basic jabber server that allows users to register themselves and chat with each other. However, if we want to have the ability to create chat rooms, we need to install some additional software called mu-conference. We will cover the installation of mu-conference momentarily.

Creating a default buddy list for new users

jabberd gives us the ability to create a template buddy list so that each new user has a default buddy list. This is very useful in environments where the administrator wants to make sure each user has all the important people in their buddy list without spending a lot of time adding each user manually.

The template file is located in the templates subdirectory and is called roster.xml. The file has the following format:

<query xmlns=’jabber:iq:roster’>

</query>

To add new users we need to uncomment the <item name> tag and add a new line for each user. For example if you wanted to add me to the default roster and my JID (Jabber ID) was chatur@jabber.chatur.test the entry for my name would look like this:

<item name='chatur' jid='chatur@jabber.chatur.test' subscription='both'>
<group>Support</group>
</item>

The group field tells the client the group under which the entry is supposed to be stored. In this case chatur is being stored under the Support group. All entries need to be enclosed within the <query> </query> tag, so the complete file with one user would look something like:

<query xmlns=’jabber:iq:roster’>
<item name=’chatur’ jid=’chatur@jabber.chatur.test’ subscription=’both’>
<group>Support</group>
</item>
</query>

Generating a Self-Signed SSL Certificate

Important: Key Is Self-Signed The key generated by the instructions below is self-signed. Such a key is not part of a trust hierarchy. When used to secure communications with Jabber clients, a self-signed key will usually cause warnings to appear because its authenticity cannot be verified against a trusted key.

Generate Key Pair

From a working directory, enter the command below to begin an interactive key generation process:

openssl req -new -x509 -newkey rsa:1024 -days 3650 -keyout privkey.pem -out server.pem

You will be prompted for a passphrase for the private key. After entering and confirming your passphrase, you will be prompted for public information about your key.

Note: Common Name Note that you should enter your domain name as the Common Name for your certificate.

Note: Key Lifetime Note that the command above creates a key with a 3650 day (10 year lifetime). To change the key lifetime, use a different number of days for the -days parameter.

Remove Passphrase

Enter this command to remove the passphrase from your private key:

openssl rsa -in privkey.pem -out privkey.pem

Combine the Private and Public Key

Enter this command to combine the private and public keys into a single file:

cat privkey.pem >> server.pem

Delete Private Key

You should now delete your private key:

rm privkey.pem

Move Key and Set Permissions

You can now move your key to its permanent location. For example, to move the key to the default Jabberd pemfile location, you would enter this command (as superuser):

mv server.pem /opt/jabber/etc/server.pem

Then, you should set permissions on this file so that it is owned by superuser and is readonly (as superuser):

chown root:jabber /opt/jabber/etc/server.pem
chmod 640 /opt/jabber/etc/server.pem

Your certificate is now ready for use by Jabberd. You should make a backup (such as to a floppy) of your certificate.

Ethernet Bridge on FreeBSD

2009-10-05T00:01:00.000+05:45

The basic operation of a bridge is to join two or more network segments together. There are many reasons to use a host based bridge over plain networking equipment such as cabling constraints, firewalling or connecting pseudo networks such as a Virtual Machine interface. A bridge can also connect a wireless interface to a wired network and act as an access point.

Requirements:
Two Physical (Real) Network Card (NIC) (minimum)

Enabling the Bridge:
The bridge is created using interface cloning.

To create a bridge use ifconfig

# ifconfig bridge create
bridge0

# ifconfig bridge0
bridge0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 96:3d:4b:f1:79:7a
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
        root id 00:00:00:00:00:00 priority 0 ifcost 0 port 0

Add the member network interfaces to the bridge.

# ifconfig bridge0 addm re0 addm re1 up
# ifconfig re0 up
# ifconfig re1 up

To remove a BRIDGE interface, enter:
# ifconfig bridge0 destroy

To make configuration persistence, open /etc/rc.conf, Append / modify as follows:
# vi /etc/rc.conf
cloned_interfaces="bridge0"
ifconfig_bridge0="addm re0 addm re1 up"
ifconfig_re0="up"
ifconfig_re1="up"

bridge interface can be configured to take part in network.
# ifconfig bridge0 inet 192.168.200.1/24

Linux Ethernet Bridge

2009-10-04T23:43:00.000+05:45

The Linux ethernet bridge can be used for connecting multiple ethernet devices together. The connection is fully transparent: hosts connected to one ethernet device see hosts connected to the other ethernet devices directly.

Requirements:

Two Physical (Real) Network Card (NIC) (minimum)
bridge-utils - This package contains utilities for configuring the Linux ethernet bridge.

Steps:
1. Zero IP the interfaces.
        # ifconfig eth0 0.0.0.0
        # ifconfig eth1 0.0.0.0

                OR

        # ifconfig eth0 up promisc
        # ifconfig eth1 up promisc

2. Create the bridge interface.
        # brctl addbr br0

3. Add interfaces to the bridge.
        # brctl addif br0 eth0
        # brctl addif br0 eth1

        OR

        # brctl addif br0 eth0 eth1

4. Put up the bridge.
        # ifconfig mybridge up

5. The virtual interface br0 can also be configured to take part in network. It behaves like real interface (like a normal network card).
        # ifconfig br0 192.168.200.100 netmask 255.255.255.0

kill process based on username and logout users

2009-10-03T19:55:00.000+05:45

To kill all process of logged in user and logout

pkill -KILL -u username

Ethernet Loopback connector

2009-10-03T18:15:00.000+05:45

Occasionally I need for a network card to operate as a live network connection, without it actually being connected to a network. Typically for testing purposes, I need a quick and easy way to make a loopback connector. Small enough to keep in my Pocket. The following is a quick "how to" for making an Ethernet loopback connector.

To create a loopback plug, cross pin 1 (TX+) and pin 3 (RX+) together, and cross pin 2 (TX-) and pin 6 (RX-) together. You need the following equipment to create the loopback:

A 6-inch long CAT5 cable
An RJ-45 connector
A crimping tool

When you create and then test a physical loopback, you are testing the RJ-45 interface of the NIC.

Know Number of Logged in User in FreeRadius from Shell

2009-10-03T17:52:00.000+05:45

This is a very useful perl script that i created to know how many user are logged in on FreeRadius from the UNIX/Linux shell or command line.

It’s for FreeRadius with MySQL and I think it is usefull for other radiuses as well.
Below is the full code.

#!/usr/bin/perl -w

use DBI;
 my $db = 'radius';
my $db_host = 'localhost';
my $db_username = 'username';
my $db_password = 'password';
my $dbh = DBI->connect("dbi:mysql:database=$db;host=$db_host:port number;user=$db_username;password=$db_password") or die "Couldn't connect to database: $DBI::errstr\n";

my $sql = qq{SELECT DISTINCT UserName,AcctStartTime,FramedIPAddress,CallingStationId FROM radacct WHERE AcctStopTime = '0000-00-00 00:00:00' AND NASIPAddress = '192.168.254.2' GROUP BY UserName};

$sth = $dbh->prepare($sql) or die "Couldn't prepare query '$sql': $DBI::errstr\n";

$sth->execute() or die "Couldn't execute query '$sql': $DBI::errstr\n";

print $sth->rows();

$sth->finish();

$dbh->disconnect();

exit;

Note:
change the username and password to actual username and password of a MySQL database, and NASIPAddress.

MacJournal to WordPress

2009-10-03T17:17:00.000+05:45

You can publish your MacJournal to WordPress.
(For custom configuration.)

Here’s the step-by-step guide:

1. Select your desired journal entry.

2. From the menu Entry, click Send to Blog.

3. Click Manual Setup

4. Type in Name : (your blog name)

5. In pull down menu,Type: select Movable Type

6. Type in URL: http://yourname.wordpress.com/

7. Type in Post URL: http://yourname.wordpress.com/xmlrpc.php

8. Type in Username : (your account name)

9. Type in Blog ID : 1

10. Press button Ok.

FreeBSD VLANs Configuration using ifconfig command

2009-04-20T19:15:00.000+05:45

To create a new VLAN interface, enter:
# ifconfig {vlan-name} create

To associate the VLAN interface with a physical interface and assign a VLAN ID, IP address, and netmask:
# ifconfig {vlan-name} {ip-address} netmask {subnet-mask} vlan {vlan-id} vlandev {physical-interface}

The following examples, all packets will be marked on egress with 802.1Q VLAN tags, specifying a VLAN ID of 500:
# ifconfig vlan500 10.0.0.1 netmask 255.255.255.0 vlan500 vlandev em0

To remove a VLAN interface, enter:
# ifconfig {vlan-name} destroy

To make configuration persistence, open /etc/rc.conf:
# vi /etc/rc.conf

Append / modify as follows:
cloned_interfaces=“vlan500 vlan600”
ifconfig_vlan500="inet x.x.x.x netmask y.y.y.y vlan 500 vlandev em0"
ifconfig_vlan600="inet x.x.x.x netmask y.y.y.y vlan 600 vlandev em0"

Static ARP entry

2009-01-03T12:35:00.000+05:45

arp -s ip_address ethernert_address

example:

arp -s 192.168.69.126 00:1f:f3:52:20:ed

arp -S ip_address ethernert_address
- Is just like -s except any existing ARP entry for this host will be deleted first.

example:

arp -S 192.168.69.126 00:1f:f3:52:20:ed

Reset Forgotten MySQL Root Password

2008-03-09T18:10:00.000+05:45

Have you ever forgotten the root password on one of your MySQL servers? No? Well maybe I’m not as perfect as you. This is a quick how to reset your MySQL root password. It does require root access on your server.

First things Log in as root and stop the mysql daemon. Now lets start up the mysql daemon and skip the grant tables which store the passwords.

mysqld_safe --skip-grant-tables

You should see mysqld start up successfully. If not, well you have bigger issues. Now you should be able to connect to mysql without a password.

mysql --user=root mysql
update user set Password=PASSWORD('new-password'); flush privileges; exit;

Now kill your running mysqld, then restart it normally. You should be good to go. Try not to forget your password again.

Install Firefox 3 beta in CentOS 5 / RHEL 5

2008-02-21T18:10:00.000+05:45

This short howto is about is CentOS 5 which is based on RedHat Enterprise Linux 5, so this should also work on RHEL 5.

I use CentOS 5 as a Desktop OS on office PC, it’s a very stable and working distro even if it doesn’t always have the latest software. This is why I had to manually install the latest Beta Firefox 3.

First off all we need to install compat-libstdc++-33. Otherwise Firefox won’t run.
# yum install compat-libstdc++-33

Then download the latest beta version of Firefox 3 from www.mozilla.com/firefox/all-beta.html and unpack it to /usr/lib

# tar jxvf firefox-3.0b3.tar.bz2
# mv firefox /usr/lib/firefox-3.0b3

Set the link for the binary
 # cd /usr/bin
# cp firefox firefox-1.5
# gedit firefox

then replace all ‘firefox-1.5.0.12’ with ‘firefox-3.0b3’
and finally for a desktop menu create a firefox-3.desktop on /usr/share/applications

# gedit /usr/share/applications/firefox-3.desktop

[Desktop Entry]
Version=1.0
Encoding=UTF-8
Name=Firefox 3 beta 3
GenericName=Web browser
Comment=Send and Receive Email
Exec=firefox
Icon=firefox.png
Terminal=false
MimeType=text/html;text/xml;application/xhtml+xml
Type=Application
Categories=Network;Application;X-Fedora;
Comment=Firefox Web Browser

thats all, Firefox 3 beta is ready to run with required plugins.
Same steps can be followed for laatest stable Firefox version 2.

Promote Additional Domain Controller to Primary Domain Controller

2008-02-19T18:11:00.000+05:45

In an Active Directory forest, where you have several domain controllers, but one primary domain controller (PDC) - you may think that you must RESTORE or recover this PDC to salvage the domain. In other words, if the PDC fails - is all lost? Nope, not at all. Unless you do not have backup domain controllers.

When you promote additional servers on your domain, and make them member DC's in the same forest, then your domain details are available to you - and you simply need to transfer the Operation Master role to another DC - but before doing that - there are the FSMO's - yea, something hardly anyone knows about: FSMO = Flexible Single Master Operation - something your PDC or master of operations - manages. If a PDC - and Global Catalog for that matter - goes offline, a backup DC will generally pickup and juggle traffic for the PDC. But what happens if the PDC crashes altogether, and you need to basically assign a member backup DC the PDC role?

FSMO must be transferred to a backup DC before that DC can assume the Master of Operations role. This is done at the command-line level, and you must be careful before you make this call - ONLY do this if you are sure you cannot recover the original PDC because once you do this - you cannot laterr recover the PDC and bring it online. It cannot be added back into the forest at all.
So, the FSMO roles and how we transfer these. In a word, you cannot simply transfer the FSMO roles because the PDC is off line and not available to authorize the transfer. However, you 'can' SEIZE the FSMO roles from the original PDC - even with the machine offl line.

Caution: Using the Ntdsutil utility incorrectly may result in partial or complete loss of Active Directory functionality.

Open a CMD prompt on the backup DC you want to perform this on. At the command-line prompt, type Ntdsutil and press <Enter>.

C:\WINDOWS>ntdsutil ntdsutil:
At this prompt, type roles and press <Enter>:
ntdsutil: roles
fsmo maintenance:
Now type connections and press <Enter>:
fsmo maintenance: connections
server connections:
Now type connect to servername <serverName> where <serverName> is the name of the backup DC you are working on, and press <Enter>:
server connections: connect to servername hamddc02
Connected to hamdc02 using credentials of locally logged on user.
server connections:
At the server connections prompt type q and press <Enter>:
server connections: q
fsmo maintenance:

Now we are going to SEIZE the FSMO roles we want. NOTE: Out of the 5 FSMO roles, we are NOT
going to seize the Infrastructure Master. We do not want to put the Infrastructure Master (IM) role on the same domain controller as the Global Catalog server. If the Infrastructure Master runs on a GC server it will stop updating object information because it does not contain any references to objects that it does not hold. This is because a GC server holds a partial replica of every object in the forest. For now, we'll seize the following:

Seize domain naming master
Seize PDC
Seize RID master
Seize schema master

We do this by typig the line shown above. For example, to seize the domain naming master, type seize domain naming master and press <Enter>

You will receive a Windows dialog prompting to confirm this move - click <Yes> and then you'll see the attempt to safely transfer the FSMO role, a failure message, and then it will seize the role, assigning it to the backup DC you specified when you connected to the server above.
Once you have completed this for the 4 roles, type Quit to exit the utility, then Exit to return to Windows.

From the Start menu, select Run and enter dsa.msc and press <Enter>.
On the domain that is displayed, right click and select Operations Masters. You should now see that this backup domain controller (HAMDC02 in this case) is not the Operations master.
From here you simply re-create the failed domain controller, and promote it - joining it to this existing forest.

NOTE:
some great tips found on net

The seize command is a rather heavy handed route to undertake and only should happen as a last resort if the usual transfer is not possible. Don't be alarmed though if you need to go down this road. If the DC is limping till it gives up the ghost, try and transfer the roles without delay. In other words, if there is a chance to transfer then, do it otherwise fall back on seizing them.

The issue of never returning the same DC back into the AD had concerened me the most especially as it's written everywhere yet with no good explanation as to why. The main reason for it is that the AD will be competing with the downed server for the handling of the RID pool in particular. If this was to occur, any newly created items within AD will not get unique identifiers and start to cause unknown complications when calling on these ID's leading up to an unstable and very confused AD.

However, the above rule would only happen if the downed DC was not freshly rebuilt before returning to the domain. If the server _is_ the same one that left, then you can never bring it back into AD and promote it. However, if it's the same server physically yet was formatted and repartitioned with a fresh OS then its not technically the same server as the GUID of the new machine will be different. That's what is referred to when instructed never to bring it back - the GUID. So, when rebuilding you can even use the same netbios/dns name as the original since AD will hand it a new GUID on entry to the directory.

This then means that when removing the server (or rebuilding it from a crash) there will still be remnants of it within AD. You will then need to do a metadata cleanup via ntdsutil. To ensure that all records of the original server have been removed from AD, use the DcDiag /v command.

If you need to determine which servers are handling each of the 5 FSMO roles, use the "Netdom query FSMO /domain" command available from either the windows 2000 support tools or within the standard 2003 server.

How to add Google meta verification to Joomla

2008-02-12T17:13:00.000+05:45

Easy. Simply sign up for Google Webmaster Tools, and choose the meta tag verification option. Google will then generate a custom meta tag that you need to embed in the template of your Joomla site.

If you use multiple templates, you should add this code to all templates and upload.

We prefer to make these changes using Dreamweaver (or notepad) and FTP. But, if for some reason you do NOT have FTP access, you can still make the changes yourself through the Joomla control panel.

Just log in and go to site > template manager. Click the radio box of the template you want to manage and click the EDIT HTML icon in the upper right.

A window will open and you can edit the HTML code directly.

We recommend you ad the code just above the <head> tag.

It should look something like this:

<meta name="verify-v1" content="UniqueGoogleID" />
<head>