Lenovo Thinkpad Laptops Failing to Connect to Wifi

I ran into a recent problem where a Windows 7 Thinkpad would not connect to wifi access points properly. It would connect to the Thinkvantage wifi profile, but networking was unavailable. Wired access worked fine, as did everything else. The problem ended up being the Thinkvantage tools.The advanced wifi settings of the network profile showed a power savings setting of maximum savings. Switching that to medium savings enabled networking. I suspect the laptop would have worked if the WAP was only a few feet away, but this user was over 30 feet away.

Moving from Ntop to Ntopng

I used to start ntop this way:
screen -d -m ntopng -u ntop  -m my.subnets,myothersubnets -i eth2,eth3 -W 4443 -w 40000 -M &


But this failed as the redis cache was not running (but was installed as part of the dependencies):

18/Mar/2014 16:50:33 [Redis.cpp:43] ERROR: ntopng requires redis server to be up and running
18/Mar/2014 16:50:33 [Redis.cpp:44] ERROR: Please start it and try again or use -r
18/Mar/2014 16:50:33 [Redis.cpp:45] ERROR: to specify a redis server other than the default

I now need redis to be running. I modified  /etc/redis.conf to point to /opt/redisdb for its "dir" variable and changed the owner of the dir to redis as well as chmoding the directory to 700.
So, in redis.conf,

#dir /var/lib/redis/
dir /opt/redisdb/

You'll probably want to copy the selinux context info, if you're using selinux:

As you can see:

ls -laZ /var/run/redis/

drwxr-xr-x. redis root  system_u:object_r:var_run_t:s0   .

drwxr-xr-x. root  root  system_u:object_r:var_run_t:s0   ..

-rw-r--r--. redis redis unconfined_u:object_r:initrc_var_run_t:s0 redis.pid

chcon --reference /var/run/redis /opt/redisdb

 I started redis, which was listening to 6379 on localhost only (sudo service redis start)

Ntopng also likes to have a data directory, so I created /opt/ntopng:

sudo mkdir /opt/ntopng
sudo chown ntop /opt/ntopng
sudo chmod 700 /opt/ntopng

sudo screen -d -m ntopng -u ntop  -r localhost:6379 -m my.subnets,myothersubnets -i eth2,eth3 -W 4443 -w 40000 -M &

But now, it was listening on eth0 as it didn't like the ordering of arguments. I saw this error:

18/Mar/2014 16:45:58 [NetworkInterface.cpp:79] WARNING: No capture interface specified
18/Mar/2014 16:45:58 [NetworkInterface.cpp:1438] Available interfaces (-i ):

18/Mar/2014 16:45:58 [NetworkInterface.cpp:1459] 1. eth0 (eth0)

18/Mar/2014 16:45:58 [NetworkInterface.cpp:1459] 2. eth1 (eth1)
18/Mar/2014 16:45:58 [NetworkInterface.cpp:1459] 3. usbmon1 (USB bus number 1)
18/Mar/2014 16:45:58 [NetworkInterface.cpp:1459] 4. eth2 (eth2)
18/Mar/2014 16:45:58 [NetworkInterface.cpp:1459] 5. usbmon2 (USB bus number 2)
18/Mar/2014 16:45:58 [NetworkInterface.cpp:1459] 6. usbmon3 (USB bus number 3)
18/Mar/2014 16:45:58 [NetworkInterface.cpp:1459] 7. usbmon4 (USB bus number 4)
18/Mar/2014 16:45:58 [NetworkInterface.cpp:1459] 8. any (Pseudo-device that captures on all interfaces)
18/Mar/2014 16:45:58 [NetworkInterface.cpp:1459] 9. lo (lo)

18/Mar/2014 16:49:52 [PcapInterface.cpp:68] Reading packets from interface eth0...

18/Mar/2014 16:49:52 [Ntop.cpp:573] Registered interface eth0 [id: 0]

Not desirable, so that becomes (I removed -M (I'm not sure what replaces "don't merge interfaces") as well as changed -u to -U and added -n 1 to resolve only ip addresses listed in -m (local))

sudo screen -d -m ntopng -i eth1 -i eth2 -d /opt/ntopng -n 0 -W 4443 -w 40000 -m mysubnets -r localhost:6379 -U ntop &

One last thing, you now need to set the password for admin, either via a file, by the gui (after logging in as admin/admin) or by the redis-cli client. I chose the latter.

redis-cli SET user.admin.password `echo -n "mylousypassword" | md5sum | cut -f 1 -d " "`

You can see the users in the gui or here:

redis-cli KEYS user* 

You can a new user either through the gui like so:

 redis-cli SET user.mynewuser.password `echo -n "mylousypassword" | md5sum | cut -f 1 -d " "`

Splunk: Importing Oneshot Files with a Source Rename

I had to import some old gzipped log files - so I simply did a:

splunk add oneshot /var/log/mylogfile.1.gz

The problem was that the source type was /var/log/mylogfile.1.gz and not /var/log/mylogfile - breaking some of the field extractions I use. I found that I could not use wildcards in the source to capture the field extraction, and I couldn't use sourcetype as there were multiples.

1. I figured out the ranges of the data and deleted it using a search

2. I readded the data using a oneshot with a rename-source

splunk add oneshot /var/log/mylogfile.1.gz -rename-source /var/log/mylogfile

(repeat multiple times for each compressed logfile of the same name)

Problem solved - though this will go against your quota as the data is being re-indexed.

Uninstalling Symantec Antivirus Client 10.2 from Windows 7 64bit Without the Uninstall Password

If you attempt to install Symantec Antivirus Win64 from Win 7 without the uninstall password, you'll probably find that people suggest that you change a registry key value:

HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AdministratorOnly\Security\UseVPUninstallPassword from 1 to 0.

That doesn't really work for the 64 bit variant as the key locations are different. I looked around a bit and found that the key was here, instead:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Intel\LANDesk\VirusProtect6\CurrentVersion\AdministratorOnly\Security\UseVPUninstallPassword

After changing that 1 to 0, you should be able to uninstall without a password.

Blocking Outbound File Attachments In MailScanner

MailScanner is a popular anti-virus/anti-spam open source package that supports several operating systems, including Linux and FreeBSD. It can be helpful for minor compliance work.

For exmaple, Company X wants to block outbound Microsoft Word Docs (both .doc and .docx) but allow people from outside to send them in. To set this up, you'll need to create a couple of files and modify the main config, Mailsca

In order to block only, say, word docs in Mailscanner, you need to do a few things.

Steps

1. add a rule to split the filename processing. On CentOS, we'll call this /etc/MailScanner/rules/filenameconf.rules

The contents are:

From:   *@mydomain.com /etc/MailScanner/filename.mydomain.rules.conf
From:       default /etc/MailScanner/filename.rules.conf

2. copy /etc/MailScanner/filename.rules.conf to /etc/MailScanner/filename.mydomain.rules.conf

3. edit /etc/MailScanner/filename.mydomain.rules.conf and set the rules you want. To block doc/docs:

deny   \.docx?$        Windows Word Doc                                                               Word  documents may contain sensitive information or viruses

(note, the fields are tab delimited, not space delimited!)

4. modify the main config file, /etc/MailScanner/MailScanner.conf and comment out this line:

Filename Rules = %etc-dir%/filename.rules.conf

and replace it with this:

Filename Rules = %rules-dir%/filenameconf.rules

5. restart mailscanner (sudo service MailScanner restart)

Apache mod_jk to Tomcat/Jboss Connection Errors Related to Palo Alto Firewalls

I recently ran across a problem when sending mod_jk/AJP connections back to a Jboss app server running behind a Palo Alto firewall (PA500.) The error was a little mysterious as Jboss didn't really report anything interesting. I could see that traffic was passing (via tcpdump) but Apache generated 500 errors.
The only clue was the following error message in the mod_jk log:


[Wed Jan 29 17:23:44 2014][9283:16992576] [info] ajp_handle_cping_cpong::jk_ajp_common.c (876): awaited reply cpong, not received 
[Wed Jan 29 17:23:44 2014][9283:16992576] [error] ajp_connect_to_endpoint::jk_ajp_common.c (957): (WSERVICES) cping/cpong after connecting to the backend server failed (errno=104) 
[Wed Jan 29 17:23:44 2014][9283:16992576] [error] ajp_send_request::jk_ajp_common.c (1507): (WSERVICES) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno=104) 
[Wed Jan 29 17:23:44 2014][9283:16992576] [info] ajp_service::jk_ajp_common.c (2447): (WSERVICES) sending request to tomcat failed (recoverable), because of error during request sending (attempt=1)

The cping/cpong message is talking about a failed keep alive.

I figured it was something related to the way the PA firewall manipulates the data via a proxy. I then created a rule defining 8009 as a service (as opposed to an application), turned off AV inspection of the traffic, and the problem went away.

Saving Acme Packet Configs using Rancid

No one has yet written a Rancid module for Acme Packet's (now Oracle) Session Border Controller/SBCs/SIP routers. I played around with it because I wanted a quick and easy way to diff Acme config revisions. This method works for me with SBCs using 6.2 of the Acme software. It produces several errors at the top of the config, since the Cisco module tries to run a lot of commands.

1. I created an SSH key as the rancid user, with no password:

/bin/su - rancid -c "ssh-keygen -b 2048 -t rsa"

2. I created an SSH key based user on the SBCs (I have a HA pair, so I did this on the primary) - and I used the public key I created in step one (i.e., ~rancid/.ssh/id_rsa.pub    - just remember that the format is very strict. You should match, more or less, the example below. The comment goes at the beginning, and not at the end like openssh)

ssh-pub-key import authorized-key rancid

IMPORTANT:

       Please paste SSH public key in the format defined in RFC 4716.
       Terminate the key with ";" to exit.......

---- BEGIN SSH2 PUBLIC KEY ----


Comment: My rancid user's public key

AAAAB3NzaC1yc2EAAAasdasdawdawdhZj07+93RKwx0RXcwaaadawdawdaefZuc6ePw+3G9jiZUcyxFb8Td9sc700HtZLN0CtezZKHsC+bJPp0oocb9ykAIzO9xs3vOs55aadwdad21d12fq==


---- END SSH2 PUBLIC KEY ----;

I usually create host file entries for rancid, as not all of the hosts are in dns, and some have multiple addresses. But, it's entirely up to you. The key format above is strict. Make sure there are no empty spaces at the end of lines. 

3. modify .cloginrc and add the following (assuming your SBC is called mysbc1.myfqdn.local

add password mysbc1.myfqdn.local noRealPasswordNecessaryJustFillThisInWithGarbage

add autoenable mysbc1.myfqdn.local 1

add user mysbc1.myfqdn.local rancid

add method mysbc1.myfqdn.local ssh


4. log into the SBC with the actual rancid user, just so the rancid user will add the host to its ssh_known_hosts file


5. add the SBC to the router.db for your particular environment:


mysbc1.myfqdn.local:cisco:up


 6. Now, you should be all set. Run Rancid as you would, normally. For instance, I have a COLO called pac1:


/bin/su - rancid -c "/usr/local/rancid/bin/rancid-run pac1