IDA on Debian amd64 with python

Are you the lucky owner of an IDA Pro linux license? Since I had errors last time I set it up, here is a quick brain dump on setting up IDA Pro 6.5 on Debian sid with IDA python 2.7. It may even work for Ubuntu.

TOR relay and transparent routing

I assume you already know about TOR, The Onion Router for anonymity to protect your privacy.

TOR is a network so it can only work if there are nodes (relays). If you have a server, you can run one so consider it. Afraid of legal issues? You do not need to run an exit node, a relay is just fine: everything is encrypted.

This post will show you how easy it is to set up a TOR relay on Debian, how to nicely monitor it and how to use it as a transparent router.

PPTP VPN and policy routing on user

The first part of this post describes how to use PPTP VPN on Linux, in command-line and not GUI. The second part, actually independent of VPN, describes how to set up policy routing for a user, in order to have all traffic from that user to go through a specific interface (e.g. the VPN interface).

Hack in the Box Amsterdam 2011 CTF

May 19th-20th was Hack in the Box Amsterdam 2011 security conference in the Netherlands, also holding a CTF. To participate, you had to qualify to one of the two qualification rounds that involved web security and reverse engineering.

We passed qualifications with team CoP so I went there with teammate sh4ka to play, and we were lucky enough to end in the first place. Congrats to all teams, it was intense! In addition to a nice HITBSecNews jacket, staff generously awarded us two training and conference tickets to HITB Kuala-Lumpur (Malaysia) 2011. So, see you there :)

final scoreboard

Login notifications, pam_exec scripting

If you like monitoring, you might want to receive notifications at every (or only root) login, in addition to logs.

/etc/profile, bashrc, etc.

One can first think of a script in /etc/profile - I saw that solution on many websites - but it is wrong because the user can connect with ssh /bin/sh and it will not run any login script. Also, this kind of login does not appear in last/wtmp but only in auth.log by sshd (because it's not considered as an "interactive login").

Exec race condition exploitations

I recently learned a cool technique for exploiting exec race conditions. It was mentioned in a comment by Julien Tinnes about the 2009 pulseaudio vulnerability in Linux, and more recently by Tavis Ormandy (@taviso) about the GNU C library dynamic linker expanding $ORIGIN in setuid library search path vulnerability. I am sure that many people know this for ages, but still it was new to me and I thought it was worth a small post on it.

Nanosecond time measurement with clock_gettime, CPU idling

Recently, I had to do latency testing of message passing between kernel-land and user-land, so I first looked after time structures and functions available in both the kernel and the libc, and then I looked after possible tuning of the kernel.

Obviously gettimeofday is not precise enough because it returns a timeval structure (defined in time.h), which only has a microsecond resolution:

struct timeval {
  time_t      tv_sec;       /* seconds */
  suseconds_t tv_usec; /* microseconds */
};

Logging smartd (or any daemon) messages with rsyslog

Rsyslog is the enhanced syslogd for Linux and Unix, extending the good syslog-ng.

If you use smartmontools to monitor your disks with smartd, you can see that your logs are filled with too many information related to your disks. The first solution is to tell smartd to send messages into a local facility (1-7 are available) and then in syslog-ng write all messages sent to that facility into file smartd.log. It's a good solution, as long as this facility is not used for something else.

Logging iptables messages with rsyslog

Rsyslog is the enhanced syslogd for Linux and Unix, extending the good syslog-ng.

If you use netfilter's iptables, you may know that a target could be LOG (with a prefix that can be configured) sending detailed information in the kernel log (since netfilter runs in the kernel). Rsyslog and syslog-ng regularily read the kernel log and save it to kern.log (among others).

IPv6 NDP Proxy

A few days ago, I wrote an article about IPv6 NDP Proxy for a blog that I love to read. The problem discussed is that some routers who provide you an IPv6 prefix want to see the IPv6 addresses on the same L2 segment, so you can't use routing directly.

This problem can be encountered at OVH - an European dedicated server provider - if you want to set up virtual machines with IPv6 routing; or, if you have a Freebox - the set-top box provided by Free.fr provider - and want to use your own router behind.

In the article, I explain a solution based on the use of the NDP Proxy included in the linux kernel, with the example of a dedicated server at OVH.

Read the article (French)

Reducing the number of devices in a RAID-5

(This blog entry has already been published in French on Nibbles' microblog)

Since 2006, linux RAID allows to grow a RAID-5 volume by adding new devices, and thus allowing to grow the filesystem underneath in order to have more free space. The opposite operation was missing, that is shrinking a RAID-5 volume by removing devices, assuming the underneath filesystem has already been reduced (otherwise data would be lost).
This summer, Neil Brown developed this feature among others, as he announced on his blog.

SATA2 and linux software RAID performance

A server I have to manage has 9 SATAII disks of 1TB each. Six of them are plugged directly to an ASRock motherboard, and three of them on a Promise PCI card providing 4 SATA II ports. These disks are partitioned on the same design: 2 partitions, a small one (1GB) for a RAID-1 and a the remaining for a RAID-5. I am therefore not using dedicated hardware but the great software RAID implemented in linux kernel.