Random Technological Ramblings

Checking a Website and Restarting a Windows Service with PowerShell

2012-10-26T19:30:00.000-05:00

One of the Windows 2008 servers that I administer hosts a website on Tomcat that loses it's connection to its database randomly and needs to be restarted every once in a while. It's a legacy web application that is no longer supported by the company that produced it. So, fixing the underlying issue is not really an option.

My next best choice was to create a PowerShell script to run locally on the web server that will retrieve a page from the site that gets content from the database, parse the content of the page to determine whether it is serving an error page or not, and then restart the Tomcat service on the Windows server if necessary.

Obviously, this script can be modified to perform any activity after the content verification is complete but my use case required that I restart a service. So, I have left this as is in this example.

If you are curious as to how I determine what the actual service name is (it can be different from what is displayed in the "Services" panel), this can be found in the properties of the service. Go to Start -> Run -> Services.msc -> Right click the service you want to restart -> click Properties -> General tab. Once you are in the general tab for the service properties, you will find the name in the "Service name:" field. In my case, this is Tomcat7.0.26. You will notice in the screenshot that the main panel shows the name of this service as being Apache Tomcat 7.0.26. This is not what we want.

Service name location.

The 'net stop/start' command in the script is not a PowerShell cmdlet -- it is a Windows command-line (CMD) tool. PowerShell will run Windows command-line commands natively and, since I was already familiar with net stop/start, I didn't bother to look up a PowerShell cmdlet for it.

NOTE: The server that I wrote this for has PowerShell 2.0 installed. If I'd had PowerShell 3.0, I could have used a different cmdlet called Invoke-WebRequest that would have worked a little better as this will return an object containing multiple useful items rather than saving the content to a file which has to be read back into a variable. However, System.Net.WebClient() can be used to download files. So, if you need a script that will download files from a site and you are running PwerShell 3.0, System.Net.WebClient() will do it!

If anyone else has a better way of doing this in PowerShell 2.0, please comment (or contact me on Twitter -- @awestin_1). I would be interested in hearing a different way. I don't like the fact that the cmdlet that I am using saves the retrieved content to a file first. This is the first cmdlet that I found. So, I just went with it.

Edit: For documentation of the WebClient class and its contructors, properties, methods, and events, look here.

Edit: You may also want to note that, if you are using HTTPS and pointing this script to a site that is using an invalid SSL certificate, the WebClient() function will throw an error. You will need to figure out a way to handle this exception.

Disable Weak SSL Cipher Suites in Tomcat/JBoss

2012-08-29T14:15:00.001-05:00

In order to disable weak SSL cipher suites in JBoss or Tomcat, you must make the changes below in the server.xml file and then restart the Tomcat/JBoss server.

Tomcat: <Tomcat dir>\conf\server.xml
JBOSS: <JBoss dir>\server\all\deploy\jbossweb.sar\server.xml

Add the following directive to the SSL connector:

ciphers="SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"

Example:

<Connector protocol="HTTP/1.1" SSLEnabled="true"
port="443" address="${jboss.bind.address}"
scheme="https" secure="true" clientAuth="false"
keystoreFile="${jboss.server.home.dir}/conf/test.keystore"
keystorePass="PaSsWoRd"
sslProtocol = "TLS" ciphers="SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"/>

Once I add this directive to the SSL connector and restart the Tomcat/JBoss server, I no longer get Medium or High vulnerability results from Nessus about weak SSL cipher suites being used.

Using Google Authenticator to Enable Two-Factor Authentication for SSH

2012-04-19T11:39:00.000-05:00

There's something about two-factor authentication that gives me this warm feeling inside. I enable it on every service that I can (i.e. LastPass, Google Accounts, eBay, PayPal, Amazon Web Services, etc.). It helps me to feel just a little safer in this cruel dark world that we call the World Wide Web.

This past weekend, I was dwelling on these feelings in order to help me feel better about having to remote into work for a couple of hours. While signing into my work account via SSH, I thought to myself, "wouldn't it be awesome if I started using MFA (multi-factor authentication) to authenticate my SSH sessions?" After a few minutes of research, I learned that Google had written a PAM (pluggable authentication module) implementation of their two-step verification solution, Google Authenticator. Google Authenticator generates one-time passcodes that can be used in tandem with your regular password. This means that, if an attacker manages to obtain your password and watches you type in your one-time passcode, they still cannot log into your account because the one-time passcode can only be used (you guessed it) one time before another passcode is generated. This was great news as I have an Android phone with the Google Authenticator app already installed.

Install Google Authenticator Mobile App
As of the date of this post, Google has published the Google Authenticator app for the following mobile operating systems:

Install instructions for each mobile OS can be found here.

Install Google Authenticator PAM

Obviously, having the Google Authenticator app on your phone is not enough. You will need to install the Google Authenticator PAM on the Linux machine hosting your SSH server. Pre-requisites for installing the Google Authenticator PAM on your Linux server are as follows:

GIT
Make
GCC

You can install each of these by issuing the following commands from a terminal session on your server using the yum package manager:

yum install git
yum install make
yum install gcc

If you are not using the yum package manager on your machine, you may want to install it or find the proper commands for the package manager that you are using.

Once these packages have been installed, issue the following commands to download, compile, (that's right, I use the Oxford comma and I'm not ashamed) and install the PAM:

git clone https://code.google.com/p/google-authenticator/
cd google-authenticator/libpam/
make
make install

Configure the SSH Server
Now that the Google Authenticator PAM has been installed, the SSH server will need to be configured to use it. Open /etc/pam.d/sshd with your favorite text editor.

nano /etc/pam.d/sshd

Make sure that the following lines are in the file:

auth required pam_sepermit.so auth required pam_google_authenticator.so auth include password-auth

This is what my /etc/pam.d/sshd file looks like:

#%PAM-1.0 auth required pam_sepermit.so #this line already existed auth required pam_google_authenticator.so #added this line auth include password-auth #this line already existedaccount required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session optional pam_keyinit.so force revoke session include password-auth

Edit: NOTE - If you would like some users to be able to authenticate with two-factor authentication and others to connect WITHOUT two-factor authentication, change the " auth required pam_google_authenticator.so " line to "auth optional pam_google_authenticator.so".

Configure the User Account and Mobile App
Now that the SSH server has been configured, there's one step left -- the user accounts that will be using two-factor authentication must be configured. To do this, log in as the user and run the following command:

google-authenticator

This will run an interactive setup guide and will generate a file in the user's home directory named .google_authenticator. This file contains all of the Google Authenticator configuration information for the user. Check it out. Here is a copy of mine (with the key and scratch codes changed of course):

ABCDEFGHIJKLMNOP12
" RATE_LIMIT 3 30
" DISALLOW_REUSE
" TOTP_AUTH
12345678
09876543
19827364
01928374
75849302

Edit: WARNING - If you choose to configure this with TOTP (time-based verification) rather than HOTP (counter-based verification), be sure that your server's clock is in sync. If the server's clock is off by a few minutes, time-based verification will not work.

The google-authenticator interactive setup will provide you with a key. Open the Google Authenticator app on your mobile device and add an account through the settings menu. You will be asked for the key. Once you configure the account, you're all set. The mobile app will start generating passcodes that you can use to log into the SSH server with the user that was configured.

Happy multi-factor authenticating.

Edit: This may not be compatible with certificate authentication. I haven't tested this yet.

Automating a Cursor with Python

2011-09-03T14:48:00.000-05:00

I haven't been posting here as often as I would like to be. Unfortunately, I have been too busy. However, I got lucky the other day and ran into a problem with a really simple solution. For this post, time will not be an issue.

This can, obviously, be applied to any other situation where cursor input is required. My particular use case just happens to be keeping my RDP sessions from timing out.

I use RDP to remote into a lot of servers where the policies are set up to log users out of their session if the RDP connection idles for 15 minutes. This can be especially frustrating when you need to copy a large file across the network overnight and you don't have the administrative privileges to adjust these policies (or the time to babysit the session). So, I took 3 minutes to write up a quick script in Python that will move the cursor to specific pixels on my screen (over the RDP window) and execute clicks. Thus, keeping the RDP session alive and my process running.

import ctypes
import time
while True: # infinite loop
time.sleep(20) #wait 20 seconds
ctypes.windll.user32.SetCursorPos(1200, 850) # move cursor to 1200,850 (x,y)
ctypes.windll.user32.mouse_event(2, 0, 0, 0,0) # left mouse button down
ctypes.windll.user32.mouse_event(4, 0, 0, 0,0) # left mouse button up
time.sleep(20) #wait 20 seconds
ctypes.windll.user32.SetCursorPos(1220, 850) # move cursor to 1220, 850 (x,y)
ctypes.windll.user32.mouse_event(2, 0, 0, 0,0) # left mouse button down
ctypes.windll.user32.mouse_event(4, 0, 0, 0,0) # left mouse button up

There are a few things to note here:

You may have noticed by the function names (ctypes.windll) that this is a windows only solution. If you need to do this on a different OS, Google will show you the way.
Be sure to run this script from the machine running the RDP client. If you run this script on the target machine rather than from the machine that you are connecting from, the cursor activity will not be captured by the RDP client and the RDP session will go idle anyway.
If the machine from which you are executing this script has multiple screens, you can simply add extra pixels in the SetCursorPos function to escape from the main screen. If your main screen is above or to the right of another screen, you will need to use negative numbers to access that other screen.

Enom Dynamic DNS Updater

2011-06-12T18:53:00.009-05:00

Update: The script outlined below is obsolete. WhatIsMyIP.com has updated their usage rules and will not allow connections from clients that do not have a particular user agent set. See the usage rules. I have not had a chance to update the script.

If you have a domain whose DNS records are managed with Enom and you're hosting a server with a dynamic IP, the following Python script may prove to be useful to you.

I am in this situation myself and I decided that, rather than hunting around for a dynamic dns client that supports Enom, I would write something myself.

This script retrieves your external IP address from WhatIsMyIp.com's .asp page which was created with developers in mind and the understanding that they have been needing to scrape their external IP's from such sites.

Please be mindful of WhatIsMyIP.com's automation usage rules. They ask that you refrain from retrieving your IP more than once every 5 minutes. They have a few more rules as well. You can find their automation rules at the address below.

http://www.whatismyip.com/ip-faq/automation-rules/

Please note that, when run, the script will perform a single update. If you want this to happen constantly, you can schedule the script to run every so many minutes. Use task scheduler for Windows or cron for Linux.

http://pastebin.com/a0N1seRy

####################################################################
#
# Author: Awestin1
#
# Date: 2011.06.09
#
# File Name: enom_update.py
#
# Purpose: The purpose of this Python script is to serve as
# a dynamic DNS updater for domains registered
# with Enom.
#
# Requirements:
#
# -The user MUST have their domain registered through ENOM.
#
###################################################################
import urllib2
#set variables
#URL for the WhatIsMyIP page that returns your external IP
ip_lookup_url = 'http://automation.whatismyip.com/n09230945.asp'
#set your domain or subdomain
domain = 'subdomain.domain.com'
#set your Enom account password
password = 'PaSsWoRd'
#retrieve IP from URL defined in ip_lookup_url and store it in current_ip_addr
current_ip_addr = urllib2.urlopen(ip_lookup_url).read()
#build enom dynamic dns update url and store it in domain_ip_update_url
domain_ip_update_url = 'https://dynamic.nameservices.com/interface.asp?command=setdnshost&zone='+domain+'&domainpassword=' +password+ '&address=' + current_ip_addr
#updates domain DNS records by getting the url built in domain_ip_update_url and returns Enom's response and stores it in the response variable
response = urllib2.urlopen(domain_ip_update_url).read()
#prints the response from Enom
print response

BackTrack 5 - X Server Crash

2011-06-09T21:18:00.006-05:00

On May 10, 2011, like many excited BackTrack fans, I downloaded and installed the new BackTrack 5 release (x64 KDE version). Much to my frustration, I found that, every time I ran startx, the x server would crash and I would be returned to the command line. While I spend most of my time in the shell, a GUI is nice sometimes and I wanted to at least check it out.

The solution:

$ fix-splash

$ rm ~/.kde/cache-root/icon-cache.kcache

$ rm ~/.kde/cache-root/plasma_theme_Volatile.kcache

$ rm ~/.kde/cache-bt/icon-cache.kcache

$ rm ~/.kde/cache-bt/plasma_theme_Volatile.kcache

Where ~ is the home directory of the user you are running "startx" as.

Edit: Apparently this is a well known bug in BackTrack 5 KDE x64.

http://www.backtrack-linux.org/forums/backtrack-5-fixes/40286-bt5-kde-64bit-startx-problem.html