Raspberry Pi and 1-Wire Temperature/Environmental Sensors

I've discussed 1-wire before. In this case, I needed a cheap temperature sensor to alert on environmental conditions in an server room.

I set up a Raspberry Pi with stock Raspian and install digitemp like so:

apt install digitemp

I used an iButtonlink usb master (here: http://www.ibuttonlink.com/products/linkusb and a t-sense sensor here:
http://www.ibuttonlink.com/products/t-sense )

The USB device shows up as /dev/ttyUSB0 as an FTDI serial port.

I can walk the 1-wire tree like so:

sudo digitemp_DS9097U -s /dev/ttyUSB0 -w
DigiTemp v3.6.0 Copyright 1996-2007 by Brian C. Lane
GNU General Public License v2.0 - http://www.digitemp.com
Turning off all DS2409 Couplers
..
Devices on the Main LAN
2149B214090000D1 : DS18B20 Temperature Sensor
01C3235419000000 : DS2401/DS1990A Serial Number iButton

That being said, you'll want to create a dot file to use this like so:

 sudo digitemp_DS9097U -s /dev/ttyUSB0 -i
DigiTemp v3.6.0 Copyright 1996-2007 by Brian C. Lane
GNU General Public License v2.0 - http://www.digitemp.com
Turning off all DS2409 Couplers
..
Searching the 1-Wire LAN
2149B214090000D1 : DS18B20 Temperature Sensor
ROM #0 : 2149B214090000D1
Wrote .digitemprc

I have one temperature sensor at the moment. After creating the .digitemprc, I can query it:

 sudo digitemp_DS9097U -s /dev/ttyUSB0 -t 0
DigiTemp v3.6.0 Copyright 1996-2007 by Brian C. Lane
GNU General Public License v2.0 - http://www.digitemp.com
Oct 30 20:16:45 Sensor 0 C: 21.00 F: 69.80

Cisco ASA tftp Copies and Issues with atftpd

while attempting to copy a new anyconnect pkg file from a CentOS based server running atftpd, I received the following error on a Cisco ASA 5505:

%Error reading tftp://mytftpserver/anyconnect-win-3.1.14018-k9.pkg (Undefined error code)

On the tftp server in /var/log/messages, I saw:

Mar  6 14:49:19 mytftpserver  atftpd[15147]: Serving anyconnect-win-3.1.14018-k9.pkg to 192.168.47.5:32947

Mar  6 14:49:19 mytftpserver atftpd[15147]: Requested file to big, increase BLKSIZE

I had installed tftp a while ago... specifically atftp-server. After looking at the man page for in.tftpd, I concluded there was no good way to set BLKSIZE on this package. The fix was:

sudo yum erase atftp-server

sudo yum install tftp-server

I then edited the xinet.d/tftp file to enable it and change the target directory and restarted xinetd. After this, I was able to copy the pkg file over successfully.

RedHat Enterprise 7/CenOS 7 Firewall oneliners

Assuming you're using the default zone of "public" (you may need to temporarily disable selinux (setenforce 0)):


1. To allow everyone to access port 8080/tcp:

   firewall-cmd --zone=public --add-port=8080/tcp --permanent


2. Allow a server from the IPv4 address 10.20.30.40 to access this server on port 1234 over UDP:

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.20.30.40/32" port port="1234" protocol="udp" accept' --permanent

CentOS 7 error: Connection 'wired connection 1' is not available on the device ens32 at this time.

This error is presented when attempting to bring up a network connection using nmcli. The connection name can be anything, of course.

There is a RedHat bug on this titled "RHEL 7 syslog shows failure related to network.service" bug #1079353.

There is no fix listed in the bug. I've seen this on a virtual machine, and the easiest work around was to delete the virtual machine's NIC, reboot, add a new NIC - reboot. After doing that, I deleted the new network connection using nmcli and applied the new device to the original connection profile I was attempting to use.

RedHat Enterprise/CentOS Kickstart with Bonding

In order to set up the bonded interfaces (in 802.3ad mode) when first booting, you'll need to supply the following arguments to kickstart:


ks=http://name_of_apache_server/myconfig.cfg ip=your.ip.address netmask=yournetmask gateway=yourgateway dns=nameserver1,nameserver2 hostname=yourfqdn bond=bond0:eth0,eth1:mode=802.3ad:miimon:100

Blocking Outbound File Attachments In MailScanner

MailScanner is a popular anti-virus/anti-spam open source package that supports several operating systems, including Linux and FreeBSD. It can be helpful for minor compliance work.

For exmaple, Company X wants to block outbound Microsoft Word Docs (both .doc and .docx) but allow people from outside to send them in. To set this up, you'll need to create a couple of files and modify the main config, Mailsca

In order to block only, say, word docs in Mailscanner, you need to do a few things.

Steps

1. add a rule to split the filename processing. On CentOS, we'll call this /etc/MailScanner/rules/filenameconf.rules

The contents are:

From:   *@mydomain.com /etc/MailScanner/filename.mydomain.rules.conf
From:       default /etc/MailScanner/filename.rules.conf

2. copy /etc/MailScanner/filename.rules.conf to /etc/MailScanner/filename.mydomain.rules.conf

3. edit /etc/MailScanner/filename.mydomain.rules.conf and set the rules you want. To block doc/docs:

deny   \.docx?$        Windows Word Doc                                                               Word  documents may contain sensitive information or viruses

(note, the fields are tab delimited, not space delimited!)

4. modify the main config file, /etc/MailScanner/MailScanner.conf and comment out this line:

Filename Rules = %etc-dir%/filename.rules.conf

and replace it with this:

Filename Rules = %rules-dir%/filenameconf.rules

5. restart mailscanner (sudo service MailScanner restart)

OSSEC Agent Installation on RedHat Enterprise and/or CentOS

I consider a HIDS to be one of the very most important security systems in a network. It's very important to know if someone is attempting to brute force his way into one of your servers, but if the attacker breaks in, it's even more important to know what changed. While log monitors and tools like Splunk can detect the former, they're not designed to note changes in binaries. That's where a HIDS (Host-based Intrusion Detection System) comes into play. One of the most popular is OSSEC. It's open sourced and free to deploy. It notes troublesome issues in the logs (like login failures) and can even take proactive measures, such as blocking an attacking host by manipulating the firewall.

OSSEC works on Windows, various flavors of unix and linux, as well as network devices such as switches, routers, and firewalls. It can run stand alone or report to a master server.

Agent installation on RHEL/CentOS

1. Install the Atomic Yum repo:

sudo "wget -q -O - http://www.atomicorp.com/installers/atomic | sh"

2. Install the EPEL repo (We're using 64bit Linux here)

 If RHEL 5/CentOS 5, 

sudo rpm -ivh http://download.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm

If RHEL 6/CentOS 6,

sudo rpm -ivh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm

CentOS 6

 3. Install the RPMs from yum (should be about 4 RPMs or so):

sudo yum -y install ossec-hids-client

3a. (optional) Disable the Yum repos for Atomic and EPEL:

sed -i /etc/yum.repos.d/atomic.repo -e 's/enabled = 1/enabled = 0/g'
sed -i /etc/yum.repos.d/epel.repo -e 's/enabled = 1/enabled = 0/g'

4. You'll need to set your server (if you even have a central OSSEC server) in the config file like so:

5. (optional) make an exception for the central server (again, if you even have one):

sudo iptables -A INPUT -p udp --dport 1514 -j ACCEPT

 That's basically it. It's most definitely worth reading up on the documentation and you should definitely test OSSEC out before using the active rules.

 

Setting Up an RPM Installed Java as the Primary Java in Rhel

1. install the new Java

2. Tell alternatives about it:

sudo alternatives --install /usr/bin/java java /usr/java/latest/bin/java 1

sudo alternatives config java


and set the /usr/java/latest/bin/java as the default java.


sudo alternatives --display java | head 3

should show the correct info.

Building Snort RPMs On CentOS 6.x x86_64

This was done on

You'll want epel, most likely - to pick up the libdnet dependencies for snort. (sudo rpm -ivh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm)


1. install the prerequisites:


 sudo yum install -y pcre pcre-devel gcc flex byacc bison l libxml2-devel kernel-devel  libdnet libdnet-devel  autoconf automake libpcap-devel rpm-build

2. install the src rpms (do not do this as root)

3. This will create an rpmbuild dir in your home, go ahead and build daq:

rpmbuild -bb ~/rpmbuild/SPECS/daq.spec

4. Install the daq libraries you just built:

  sudo rpm -ivh RPMS/x86_64/daq-*.rpm

5. Now, build snort

rpmbuild -bb ~/rpmbuild/SPECS/snort.spec

6. Remove the daq libraries you installed in step 4:

 sudo rpm -e daq

You should have two libraries in RPMS/x86_64. You'll need to install both for Snort to function.

Moving MySQL's Data Directory on a New Install on Linux

It seems pretty simple on a new install. You can copy the files from /var/lib/mysql to the new location. If you want to initialize it from scratch:

1. set up the datadir variable in /etc/my.cnf under [mysqld] like so:

[mysqld]
datadir           = /my/path/to/data/directory



2. You'll need to run the mysql_install_db perl script as the mysql user like so:

su - mysql -c "mysql_install_db --datadir=/my/path/to/data/directory"

or, if you have sudo configured:

sudo -u mysql mysql_install_db --datadir=/my/path/to/data/directory


2b. If you're using selinux, copy the security contexts from /var/lib/mysql recursively like so:

chcon -R --reference=/var/lib/mysql /my/path/to/data/directory



3. Now, you should be able to start MySQL from init or using the service command (on Redhat based distributions)

sudo /etc/init.d/mysql start

or 

sudo /sbin/service mysql start

Autofs direct maps for NFS mounts

I had a situation where I needed to automount an NFS share on the root level, i.e.,

mynfsserver:/data/nfsshar1 on /myNFSshare on a local NFS client.

In order to do this, I had to set up a direct map. In /etc/auto.master, I added:


/-      /etc/auto.direct

and then I created the file /etc/auto.direct with the following entry:

/myNFSshare         mynfsserver:/data/nfsshar1

I reloaded autofs and was then able to do a directory listing on the share. This works for Rhel 5 & 6 and CentOS 5&6.

Java keytool quick tips

Creating a keystore from an SSL key and cert

To store an SSL key for Jetty or other Java based webserver, you usually use keytool. You'll first need to convert the key to pkcs12 (we're calling the output file jetty.pkcs12) format like so (we're assuming your key is generated with openssl or something similar - also, we're in the same directory as the keys):

Convert mykey,key and mykey.crt to a pkcs12  format using openssl

( I highly recommend using a passphrase on the key)


openssl pkcs12 -inkey ./mykey.key -in ./mykey.crt -export -out ./jetty.pkcs12

Let's take that pkcs12 key and convert it into a Java keystore (we're calling the keystore mykeystore)

 

keytool -importkeystore -srckeystore jetty.pkcs12 -srcstoretype pkcs12 -destkeystore mykeystore

Let's list the contents of this keystore:

keytool -list -storename mykeystore

Add an CA certificate to the default java CA cert keystore

 

Java keeps its own CA cert repo - which can be frustrating if you don't update java on your server frequently. To add a new CA cert (let's assume you just bought an SSL cert online and your cert CA's certificates were created recently)

1. Find cacerts for your installation - note that many commercial java programs like to install their own java. If you're looking at the default java location, try:

find /usr -name cacerts

1b. If you're trying to find the cacerts for an application you installed, figure out where java is being called from:

ps wwaux | grep java

(you'll likely see a path for java - i.e., /opt/java/bin/java  or something similar)

Now, find the cacerts,   

 find /opt -name cacerts

2. Add the CA cert to your cacerts file:

keytool -import -trustcacerts -alias MyCAsName -file /path/to/ca-certificatec -keystore /path/to/keystore