HITORI

Raspberry Pi - Pi-Hole and NxF combination. Home DNS and Ads blocking

2020-07-21T18:48:00.002+05:00

For this tutorial I'm using Raspberry Pi 4B. I do not explicitly explain how to image the Pi or configure network interfaces her. I'm also not focusing on extra-security configuration for the setup, which is surely possible.

What we're trying to achieve

Pi-Hole is known as a good and easy to use DNS filter for a home network with many ads blocking lists publicly available. Although it helps to get rid of some of the annoying ads and known malware, it lacks advanced functionality and control. Even in a home network you may be tempted to have more control and custom policies.

NXFilter is much more than an ads filter, in fact it's designed to be used in an enterprise environment with many amazing features that allow granular control. It is free, and the Jahaslist for blocking that comes with it is free for home usage (under 25 users configured in the system).
Some of the features include:
- Creating users based on IP or LDAP and assigning different DNS access policies to them, including time quota
- Manage categories and classifiers, easily create your own
- Block by categories
- Malware and botnet detection

We want to daisy chain Pi-Hole and NXfilter to take advantage of both of them in our home network and run all of that on our Raspberry Pi. Also, I'm not a fan of installing everything on a bare metal - it's often more complicated, leads to port conflicts and too much configuration, harder to keep up to date. For this scenario we want to use docker containers and leverage their default security and isolation.

Topology explained

- Configure your Raspberry Pi with a static IP.
- Set Raspberry Pi as the primary and only DNS IP for you LAN network (can be done in DHCP settings on your router/modem or manually on each device).
- Run Pi-Hole on the raspberry Pi and expose DNS port 53 to the client devices.
- Run NxFilter on the raspberry Pi. Configure Pi-Hole to use NxFIlter's container IP as the only upstream DNS
- Configure NxFilter for DOH (DNS over HTTPS). It will use actual internet DNS servers and complete the name resolution.

1. Install docker on Pi:

# Install dependancies

sudo apt-get install vim apt-transport-https ca-certificates software-properties-common -y

# Get the docker easy install script

curl -fsSL get.docker.com -o get-docker.sh && sh get-docker.sh

# Allow pi user to run docker commands without sudo

sudo usermod -aG docker pi

# Add docker to the package update repositories. This will allow to update docker.

# Import the key

sudo curl https://download.docker.com/linux/raspbian/gpg

# Add the repository url to the apt list

# EDIT FILE: /etc/apt/sources.list

deb https://download.docker.com/linux/raspbian/ stretch stable

# Verify that repository is working and upgrade packages, if needed

sudo apt-get update

sudo apt-get upgrade

# Verify that docker is running or start it if it's not:

systemctl status docker.service

systemctl start docker.service

systemctl enable docker.service

# Configure a size limit for docker logs
# EDIT FILE: /etc/docker/daemon.json
{
    "log-driver": "json-file",
    "log-opts": {
        "max-size": "10m"
    }
}


2. Run Pi-Hole in a docker container and verify that it works.
Ports for this container must be published to the recommended standard values to work properly, as this is what LAN clients will face first: 80, 443, 53.
Update the environment variable TZ to your timezone.

Docker image used: https://hub.docker.com/r/pihole/pihole/
Folders for Pi-Hole configuration persistence: /home/pi/Documents/DOCKER/. . .

# Create a docker network where we will keep both containers
docker network create dns
# Check which subnet was assigned to the network (e.g. 172.18.0.0). We will use it to set static IPs to the containers.
docker network inspect dns
. . .
"Subnet": "172.18.0.0/16",
. . .

# Create a folder where we will keep our containers' persistence data
mkdir ~/Documents/DOCKER

# Start Pi-Hole. Use a static IP in the 'dns' network subnet (here 172.18.0.2). Note that I'm not publishing DHCP port 67, since I don't use Pi-Hole dhcp.

docker run -d \

--name pihole \

--network dns \

--ip 172.18.0.2 \

-p 53:53/tcp -p 53:53/udp \

-p 80:80 \

-p 443:443 \

-e TZ="America/Chicago" \

-v "/home/pi/Documents/DOCKER/etc-pihole/:/etc/pihole/" \

-v "/home/pi/Documents/DOCKER/etc-dnsmasq.d/:/etc/dnsmasq.d/" \

--dns=127.0.0.1 --dns=1.1.1.1 \

--restart=unless-stopped \

--hostname pi.hole \

-e VIRTUAL_HOST="pi.hole" \

-e PROXY_LOCATION="pi.hole" \

pihole/pihole:latest

# Verify container status (Up, healthy):

docker ps -a

IMAGE CREATED STATUS PORTS
pihole/pihole:latest 25 hours ago Up 24 hours (healthy) 0.0.0.0:53->53/udp, 0.0.0.0:53->53/tcp, 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp

# See container logs for troubleshooting, if required. You will also find the random Web Interface password here.

docker logs pihole

# Login to the Pi-Hole web interface and verify that it's working. You should be able to login with the web interface password found in docker logs. Alternatively change the password: docker exec -it pihole_container_name pihole -a -p

http://<RaspPI IP ADDRESS>/admin/

# Test DNS from one of your client machines against PiHole

nslookup google.com <RaspPI IP ADDRESS>

3. NXFilter (NxF)
Now that the Pi-Hole is working, we're ready to start the NxF. We will put NxF container in the same docker network as Pi-Hole. This way pi-hole can access NXFilter's dns port without them being published on the host. At the same time both will be isolated from the Docker default network. NXFilter Web interface ports shall be published to something that do not overlap with Pi-Hole's web interface (e.g. change 80 to 8080, change 443 to 8081)

At the moment of writing I could not find a well-documented and working docker image for ARM, so I made my own Dockerfile to build the image: https://github.com/maksokami/docker-nxfilter

# Build the docker image
git clone https://github.com/maksokami/docker-nxfilter.git
docker image built -t maksokami/nxfilter .

# Start NXFilter. Use a static IP in the 'dns' network subnet (here 172.18.0.3).

docker run -dt \

--name nxfilter \

--network dns \

--ip 172.18.0.3 \

-p 8080:80 \

-p 8081:443 \

-v "/home/pi/Documents/DOCKER/nxfilter-conf":/nxfilter/conf \

-v "/home/pi/Documents/DOCKER/nxfilter-db":/nxfilter/db \

-v "/home/pi/Documents/DOCKER/nxfilter-log":/nxfilter/log \

-e TZ="America/Chicago" \

--restart=unless-stopped \

maksokami/nxfilter

# Verify container status (Up, healthy):

docker ps -a

IMAGE CREATED STATUS PORTS
maksokami/nxfilter 2 days ago Up 25 hours 0.0.0.0:8080->80/tcp, 0.0.0.0:8081->443/tcp

# See container logs for troubleshooting, if required.
docker logs nxfilter

# Go to the NxF web interface and verify that it's working. Default credentials: admin/admin
https://<RaspPI IP>:8081/admin

# For additional troubleshooting you can publish DNS ports as well and test them separately from Pi-Hole:

# Add extra parameters to the docker run:

docker run . . . -p 8053:53/tcp -p 8053:53/udp . . .

# Test NxF DNS functionality (without Pi-Hole) from a client machine with linux or even from the PI.

dig @<RaspPI IP> -p 8053 google.com A

4. Enable the chain
Now all you need to enable the daisy-chaining is to configure Pi-Hole to use NxF's container IP ( 172.18.0.3) as the only upstream DNS.
Go to Pi-Hole Settings -> DNS. Configure "Upstream DNS server" to be 172.18.0.3. Disable any other DNS, including DOH (DNS over HTTPS). You should configure DOH in NxF instead.

You will be able to observe some blocking happening at Pi-Hole container, and additional blocking and your custom policies applied at NxF container.

Pi-Hole:

NxF:

Python PyPi mirror in virtualenv (bandersnatch)

2017-06-22T17:42:00.001+05:00

First of all PEP381 is no longer supported and won't work. Use bandersnatch instead.
For customized mirrors with whitelists, etc use devpi.

Example:
Python 2.7
Virtualenv path: /data/pypi_mirror/
Mirror path: /data/pypi_mirror/data/
Url: local-pypi.local.com

Create and activate virtualenv

cd /data/

mkdir /pypi_mirror

mkdir /pypi_mirror/data

virtualenv pypi_mirror

source ./pypi_mirror/bin/activate

Install packages

sudo pip install bandersnatch

sudo pip install configparser

sudo pip install --upgrade future

sudo pip install --upgrade websocket

sudo pip install --upgrade urllib3

Allow Apache to access files:

cd /pypi_mirror

sudo chown -R apache:apache data

Configure Bandersnatch:

sudo vi /etc/bandersnatch.conf

[mirror]

directory = /data/pypi_mirror/data/

master = https://pypi.python.org
timeout = 10
workers = 3
stop-on-error = false

delete-packages = true

Enable Virtual Host in Apache:

Create virtual host:

cd /etc/httpd/sites-available/

vi webapps_pypi.conf :

NameVirtualHost <SERVER IP>:80

SSLEngine on

SSLCertificateFile *****

SSLCertificateKeyFile *****

SSLProtocol all -SSLv3

ServerName local-pypi.local.com

ServerAlias local-pypi

DocumentRoot /data/pypi_mirror/data/web/

SetEnv /data/pypi_mirror/data/

ErrorLog /data/pypi_mirror/pypi.error.log

CustomLog /data/pypi_mirror/pypi.custom.log combined

</VirtualHost>

ServerName local-pypi.local.com

DocumentRoot /data/pypi_mirror/data/web/

Redirect permanent / https://local-pypi.local.com/

</VirtualHost>

Enable the Virtual Host and restart Apache:

cd /etc/httpd/sites-enabled/

sudo ln -s ../sites-available/webapps_pypi.conf webapps_pypi.conf

sudo /usr/sbin/apachectl restart

Run mirror synchronization

sudo bandersnatch mirror

Execution Errors:

Cannot find parse module in urllib.parse

sudo vi /lib/python2.7/site-packages/bandersnatch/package.py

Replace line:

from urllib.parse import urlparse, unquote

With:

try:

from urllib.parse import urlparse, unquote

except ImportError:

from urlparse import urlparse, unquote

Errors encoding parameter not supported:

sudo vi /lib/python2.7/site-packages/bandersnatch/mirror.py

Search for:

with open(

Remove parameter:

*, encoding="..." )

Cisco 3750 mixed stack

2016-06-25T23:27:00.000+05:00

Today I was able to do some testing on a mixed stack of C3750, C3750G and C3750X.
It is not a secret that C3750X with lan-base license can only stack with other lan-base 3750X. In make case it was ip-base, but I needed to upgrade all stack to ip-services, which it was using before 3750X was added. So have a note, that below works fine (as long as stack master will be another older switch with ip-services):
C3750 - ipservices
C3750G - ipservices *master
C3750X - universal

Also played with SDM profile. Even though desktop-routing allows up to 11K prefixes, in reality with about 8K CPU gets up to 40% with almost no usage and easily reaches 100% when more traffic appears.

ManG - Bulk ping tool (python)

2016-06-03T12:30:00.003+05:00

ManG - tiny program that resolves and pings a list or IP addresses or ranges.
You need to run this program as administrator (uses native python ping with sockets).

Python 2.7
PyQt
Tested on: Ubuntu, Windows 7
Windows binary
Source
Also on GitHub: ManG

Windows dependencies:
MSVCP90.dll library is not included. You may need to download and install "Microsoft Visual C++ 2008 Redistributable Package"

This program is distributed under GNU CPL

Seoul lds temple - easy pop-up card

2016-05-29T23:34:00.000+05:00

All measurements are in centimeters. Images may not be scaled and are not for printing.

Result:

Design layout (cm):

Easy pop-up cards

2016-05-29T22:50:00.001+05:00

I think, nowadays everything handmade is slowly getting more popular. Compared to how it was a century ago, we can buy a lot of gifts, but hand made things are more rear and therefore more valuable and convey more emotions now.

There is nothing easier than making your own card, even a pop-up card! In fact it will only take you 20-30 minutes, depends on how fast you draw and what image do you want to pop-up. You will only need to make a 'step' in the middle of the cardboard list and glue your image to it:

The 'step' itself looks like this (cm):

Ubuntu - python paramiko issue (SSH)

2016-05-12T18:18:00.000+05:00

Today I've encountered an issue with paramiko on Ubuntu server 12.04.
Tried to run a simple python script with SSH connection and got an error below:

$ python
>>> from Exscript.protocols import SSH2
>>> conn = SSH2()
>>> conn.connect("192.68.164.1")

Traceback (most recent call last):

  File "<stdin>", line 1, in <module>

  File "/usr/local/lib/python2.7/dist-packages/Exscript/protocols/Protocol.py", line 588, in connect

    return self._connect_hook(self.host, port)

  File "/usr/local/lib/python2.7/dist-packages/Exscript/protocols/SSH2.py", line 261, in _connect_hook

    self.client = self._paramiko_connect()

  File "/usr/local/lib/python2.7/dist-packages/Exscript/protocols/SSH2.py", line 153, in _paramiko_connect  
    t.start_client()

  File "/usr/local/lib/python2.7/dist-packages/paramiko/transport.py", line 493, in start_client

    raise e

AttributeError: 'EntryPoint' object has no attribute 'resolve'

At this point the easiest solution is to upgrade pip and paramiko as below:

# Upgrade pip

sudo pip install --upgrade pip

#  Refresh cli cache

hash -r

# Use new pip to upgrade paramiko package

sudo pip install --upgrade paramiko

Also you may need to upgrade setuptools.

F4F fragmented video stream recording

2016-05-05T23:14:00.003+05:00

1. Install php and required extensions

apt-get install php5
apt-get install php5-curl

1.5 It is possible, that curl will work with your webserver scripts, but not with the CLI ones. To fix that you need to update php.ini for CLI

Find curl binary location

find / -name 'curl.so'

Find out php.ini for CLI path (usually /etc/php5/cli/php.ini)

php -i | grep 'php.ini'

Open file and search for curl section

vi /etc/php5/cli/php.ini
/curl

Add path to your curl binary

[curl]
; A default value for the CURLOPT_CAINFO option. This is required to be an absolute path.
;curl.cainfo =
extension=/usr/lib/php5/20131226/curl.so

2. Get AdobeHDS.php script, which will assemble video fragments.

3. Get manifest url
Use Firefox Developer tools -> Web console. Filter on "manifest" or "f4m" and refresh the page with video.

Alternatively you can try "HDS Link Detector" extension.

Example: http://www.byutv.org/watch/livetv
Manifest: http://byuhd2-lh.akamaihd.net/z/byutvglobalhd2_live@103134/manifest.f4m?hdcore=2.10.3&g=TVZYNXO*****

4. Now you're ready to start the capture

Capture Start Script

php AdobeHDS.php --manifest "your_manifest_url" --delete

Capture Stop Script

#!/bin/sh 
pkill php

Links: F4F capturing converting

Recording online radio - examples

2016-05-03T20:50:00.001+05:00

1. Capturing ASF radio with mimms (e.g. FM Ushiku)

Filename includes current date, duration of the program is 30min, and it is converted to mp3. After that mp3 file is copied to SMB share.

Capture script

#!/bin/sh

now=$(date +"%m_%d_%Y")

url="mmsh://211.1.40.21:80/fmuu?MSWMExt=.asf"

output_filename=Bridge_For_Joy_${now}
output_filename2=Bridge_For_Joy_${now}.mp3

output_dir=/home/onosan/BridgeForJoy/

mimms -t 35 $url $output_dir$output_filename
avconv -i $output_dir$output_filename $output_dir$output_filename2
cd $output_dir
smbclient //<SMB SHARE> <PASSWORD> -U <USERNAME> << SMBCLIENTCOMMANDS
cd <FOLDER>
put $output_filename2
exit
SMBCLIENTCOMMANDS

2. Capturing MP3 streaming radio with wget

Start capture script

#!/bin/sh

now=$(date +"%m_%d_%Y")

url="http://219.117.222.167:8020/giglive"

output_filename=DJ_J_${now}.mp3

output_dir=/home/username/DJJ/

wget -O "$output_dir$output_filename" $url

Stop capture script

#!/bin/sh
pkill wget

3. Crontab entries example

0 8 * * 4 /home/username/DJJStart
0 9 * * 4 /home/username/DJJStop
13 13 * * 3 /home/username/mimms_capture

Русификация HTC Explorer из Ubuntu

2016-05-03T20:28:00.001+05:00

1. Для начала нужно установить android-tools-fastboot и android-tools-adb.

apt-get install android-tools-fastboot
apt-get install android-tools-adb

** Чтобы не запускать fastboot из под root, можно создать файл

/etc/udev/rules.d/51-android.rules и разрешить доступ usb для вашего типа устройства:

"usb", ATTR{idVendor}=="<VENDOR>", MODE="0666", GROUP="plugdev"

> Коды <VENDOR> для подстановки

2. Разблокировка загрузчика. Необходимо зарегистрироваться на сайте и зайти на страницу Unlock Bootloader. Для HTC Explorer нет модели в списке устройств, поэтому нужно выбрать "All other supported models", и следовать инструкции, где объясняется, как перейти в fastboot режим.

www.htcdev.com/bootloader

далее нужно будет получить идентификационный токен телефона с помощью утилиты fastboot, которую мы установили на первом шаге

:~$ fastboot oem get_identifier_token
...
(bootloader)   
(bootloader) < Please cut following message >
(bootloader) <<<< Identifier Token Start >>>>
(bootloader) 344B76469E7E98B62D57ED58891CF1D7
(bootloader) 7B25BC2FE749E0F273730ACBBA5E53C0
(bootloader) EB3AF73861E4743C960C44B86117B8D1
. . .
. . .
. . .
(bootloader) <<<<< Identifier Token End >>>>>
OKAY [  0.063s]
finished. total time: 0.063s

Скопируйте номер начиная с "<<<< Identifier Token Start >>>>" и до "<<<< Identifier Token End >>>>", без "(boatloader) " в начале строк, вставьте его в форму на вебсайте и получите разблокировочный файл по почте.

** Если на этапе запроса токена появляется ошибка "< waiting for device >", почитайте следующий пост: http://androidp1.ru/android-waiting-for-device/

3. Установка разблокировочного файла

fastboot flash Unlock_code.bin

Теперь можно заменить загрузчик.

4. Замена загрузчика и recovery
Скачайте и распакуйте "HTC Pico_Recovery,Boot with ext 2 3 4 support"
Альтернативная ссылка

Откройте recovery.bat файл, и выполните нужные команды в консоли.

adb reboot bootloader  - загрузится в fastboot, если нужно
fastboot devices - список устройств
fastboot flash boot boot.img 
fastboot flash recovery recovery.img
fastboot reboot
adb wait-for-device
adb reboot recovery

6. Скачайте русскую прошивку HTC Explorer и скопируйте ее на sd карту телефона

5. Теперь из recovery можно сделать бэкап конфигурации (backup and restore), удалить текущую конфигурацию (wipe cache, wipe data) и установить новую прошивку (install zip from sd card)

Другие полезные ссылки:
Получение root на HTC Explorer (ENG)
Получение root из Ubuntu

2016-04-13T10:18:00.003+05:00

Wireless

Dead spots and slow zones (MetaGeek)

ASR shell
http://ccie-in-3-months.blogspot.ru/2010/02/get-your-hands-dirty-with-linux-on.html

Cisco code implant
https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html

1142 AP can't join the WLC - hardware failure

2016-04-13T10:15:00.000+05:00

For those who may encounter something similar to save troubleshooting time.

What you may observer:
APs went offline and couldn't join the WLC anymore. It also couldn't join another WLC running on a higher code version.

AP model: AIR-LAP1142N-E-K9

Errors you will see on the WLC (Monitor->AP join)
8.0.121.0 Ignoring config status as mac address is not present in database
8.1.131.0 Invalid License in configuration request

View from AP CLI:

APe05f.bXXX.XXXX#
*Mar 29 11:47:12.944: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.88.99:5246
*Mar 29 11:47:23.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.88.99 peer_port: 5246
*Mar 29 11:47:23.743: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 192.168.88.99 peer_port: 5246
*Mar 29 11:47:23.744: %CAPWAP-5-SENDJOIN: sending Join Request to 192.168.88.99

Radio interfaces cannot be detected even after AP re-image:

APe05f.b915.d0c2#sh int desc
Interface                      Status         Protocol Description
BV1                            up             up
Gi0                            up             up

Resolution: hardware failure.

2016-04-13T10:05:00.000+05:00

Why MAC Address Randomization is not Enough

Windows Server 2012 File Server and SMB 3.0

Routing over Nexus 7000 vPC peer-link? Yes and No

Saas, Paas, Iaas difference

2016-03-17T11:04:00.001+05:00

I think it's a really good and easy to understand video to explain the difference between cloud computing SaaS, PaaS, and IaaS approaches.

Firefox - Secure connection failed

2015-09-14T12:14:00.000+05:00

If you see the error below for some webpages in firefox you can try to disable old ciphers to resolve it.

Go to "about:config" in firefox
Search for "dhe"
Switch ciphers to "false" with a double-click:

security.ssl3.dhe_rsa_aes_128_sha
security.ssl3.dhe_rsa_aes_256_sha

Process explorer - show malware rating of each process

2015-09-04T22:40:00.001+05:00

This might be interesting for some users - if you use Process Explorer you can easily see if process is trusted or what malware rating does it have.
This is how it is done:

Result:

Linux SSH - Connection closed issue

2015-09-04T21:59:00.001+05:00

Today I ran an ssh/expect script on a number of Cisco devices and noticed that connection to about 10% of them failed. What an unpleasant surprise it was... The issue was on both of my computers with CentOS and Xubuntu. Looking at ssh debug I noticed that ssh failed at "expecting SSH2_MSG_KEX_DH_GEX_GROUP". There is a bug in Cisco IOS and in Open SSH that causes it. Related info can be found here:
https://supportforums.cisco.com/discussion/12051361/cisco-ios-does-not-support-openssh-64
https://bugzilla.redhat.com/show_bug.cgi?id=1026430
I saw numerous ways to resolve similar problem on internet including changing MTU! but that must be related to some other bug and didn't help in my case.

For some people it was enough to uncomment "Cipher" and "MACs" lines in the /etc/ssh/ssh_config, but for me only specifying algorythms below solved issue for all connections. Other options would cause failures on some of the hosts.

Resolution:

ssh -o StrictHostKeyChecking=no -o HostKeyAlgorithms=ssh-rsa,ssh-dss -o KexAlgorithms=diffie-hellman-group1-sha1 -o Ciphers=aes128-cbc,3des-cbc -o MACs=hmac-md5,hmac-sha1 <user@IP>

Symptoms:

[username@trinity dhcp_rm]$ ssh -o StrictHostKeyChecking=no username@*.*.225.225
Connection closed by *.*.225.225
[username@trinity dhcp_rm]$ ssh -vvv username@*.*.225.225
OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to *.*.225.225 [*.*.225.225] port 22.
debug1: Connection established.
debug1: identity file /home/username/.ssh/id_rsa type -1
debug1: identity file /home/username/.ssh/id_rsa-cert type -1
debug1: identity file /home/username/.ssh/id_dsa type -1
debug1: identity file /home/username/.ssh/id_dsa-cert type -1
debug1: identity file /home/username/.ssh/id_ecdsa type -1
debug1: identity file /home/username/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/username/.ssh/id_ed25519 type -1
debug1: identity file /home/username/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.6.1
debug1: Remote protocol version 2.0, remote software version Cisco-1.25
debug1: no match: Cisco-1.25
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
debug2: kex_parse_kexinit: hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96
debug2: kex_parse_kexinit: hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: setup hmac-md5
debug1: kex: server->client aes128-cbc hmac-md5 none
debug2: mac_setup: setup hmac-md5
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: kex: diffie-hellman-group-exchange-sha1 need=16 dh_need=16
debug1: kex: diffie-hellman-group-exchange-sha1 need=16 dh_need=16
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<3072<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
Connection closed by *.*.225.225

Ubuntu: Wireshark doesn't list interfaces

2015-03-18T10:55:00.003+05:00

sudo addgroup -system wireshark
sudo chown root:wireshark /usr/bin/dumpcap
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
sudo usermod -a -G wireshark YOUR_USER_NAME

Run TinyWeb as a service in Win7

2014-06-11T14:17:00.001+06:00

1. Create a service record using srvany.exe from Resource Kit:

C:\>instsrv.exe TinyWS "C:\Program Files (x86)\Windows Resource Kits\Tools\Srvany.exe"

Where TinyWS is a required service name.

2. Go to the service key in Windows registry:

3. Create a nested key "Parameters" and add two string values - "Application" and "AppParamteres". The last value specifies parameters string for TinyWeb, so in this case it will run on port 8080 for a folder "ConfigGenerator"

Few more birthday t-shirts

2014-05-02T14:51:00.000+06:00

First t-shirt has a USSR map with republics where the future owner lived. Back shows his an old calendar (198* year) and reflect that he is an M.D.

The second t-shirt has a russian helicopter at the front and a portrait of owner's wife at the back.

Cisco WLC interface and cli are extremely slow

2014-04-04T12:26:00.000+06:00

Today I encountered a case when one of 5500 Cisco wireless controllers stopped operating properly. Both GUI and ssh were extremely slow and users complained too.
In the logs I could see multiple unsaccessfull authentications. Below is how it looked like.
Appeared that local IT guy connected WLC console to a local cisco router. Looped router console output was treated as an authentication attempt.

242 Fri Apr 4 06:39:28 2014 User Usage is monitored; unauthorized from CONSOLE has made too many unsuccessful login attempts.
244 Fri Apr 4 06:39:06 2014 User User Access Verification from CONSOLE has made too many unsuccessful login attempts.

Norton vs Windows Defender

2013-08-25T00:37:00.002+06:00

Today I've got to work with a brand new HP Pavilion laptop (Windows 8) with Norton AntiVirus pre-installed . Windows would hang every 10 minutes or so because of it. Norton was correctly uninstalled but Windows Defender refused to work after that. Now just a quick note for those who still ask how to install Windows Defender (security essentials) on Win8 - it is already there, pre-installed and default.
So service could not be started so as the Control Panel button returned an error.
I tried Norton Removal Tool which was recommended on many websites but it didn't change a thing.
So at the end I manually changed two registry keys that allowed OS to activate its internal antivirus.

I've seen many people having issues with this and not that many clear explanation on how to fix it, so below would be a small guide for those in need. Some screenshots are made in a foreign-languaged OS but you can get the idea of where to find the settings.

Open Windows Registry editor.

We are interested in 2 keys in \HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender/
that need to be set to "0", as on the picture below.

I didn't have permissions to change them (even though regedit is started under administrator account). In this case you can change the owner (select "Permissions").

E.g. set Administrator as an Owner (select "Advanced", change the Owner).

And give this user permissions to edit the keys (Check "Full access" for Administrator).

After that you can change key values and restart the system. Now Control Panel should allow you to open a Windows Defender GUI. If the interface is all red then the Defender service still hasn't been started.
To start the service go to Control Panel and search for "Services"

Find Windows Defender, start it and make sure it is set to Auto-start in properties.

Don't forget to check proactive protection.

PS: If you still have issues with changing the keys than you may try to login under Administrator by enabling the account as below and try it there.
Don't forget to disable this account later or set a strong password.

Start->Run->cmd

Norton против Защитника WIndows

2013-08-24T23:53:00.001+06:00

Сегодня в руки попал новый HP Pavilion (Windows 8) с предустановленным Norton AntiVirus. Надо сказать, что с ним система вешалась каждые 10 минут. После его удаления обычным деинсталятором встроенный антивирус от Microsoft (который по умолчанию есть в Windows 8, и ставить его не надо), отказался запускаться. Служба сразу останавливалась, а "Защитник Windows" в панели инстрментов тоже выдавал ошибку.
Попробовала Norton Removal Tool, которая в идеале должна была справится с последствиями от установки Norton, однако софтина не помогла.
В итоге пришлось вручную исправить 2 ключа в реестре, из-за который ОС не хотела активировать свой антивирус.
Видела много топиков на форумах с описанием данной проблемы, и все посылают в сторону Removal Tool. Так что ниже руководство в скриншотах для бедолаг - пользователей.

Запустите редактор реестра:

Нас интересуют два ключа в \HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender/
Их нужно выставить в "0", как на рисунке.

Если выдается ошибка нехватки прав (даже если regedit запущен из под Администратора), то можно поменять владельца ветки.

Например, можно поставить Администратора владельцем.

И после этого дать ему полномочия для редактирования.

После этого можно поменять значения ключей и перезагрузится. Теперь "Панель управления->Защитник WIndows" должен открыть его интерфейс. Скорее всего служба все еще не будет запущена, и Защитник работать не будет, поэтому запускаем службу.
Заходим в управление службами: Панель управления -> поиск "службы" -> Просмотр локальных служб.

Находим защитник Windows, запускаем и убеждаемся, что в свойства стоит Тип Запуска - Авто

Не забудьте убедиться, что включена защита в реальном времени.

White dragon pop-up card

2013-08-18T21:11:00.002+06:00

Rexburg Idaho temple v1

2013-08-18T21:10:00.002+06:00

Pop-up card - Rexburg Idaho temple v1