Midnight Commander

Got around to try using mc(1) (Midnight Commander)
for ftp and ssh file operations. Didn’t have any problem
with ssh, but I couldn’t get anything going with ftp except
errors, especially:

ftpfs: invalid value for ai_flags

Read the man page and the Makefile, searched some of
the OpenBSD mailing lists, and came up with:

Midnight Commander error on 4.7:

Here’s a snippet from that link:

I’m not a good C coder, so I just did some basic
research and replaced line 703 in ftpfs.c:
old: “hints.ai_flags = AI_ADDRCONFIG;”.
new: “hints.ai_flags = 1;”

Now it works as expected.

I didn’t have any idea how to do the above, but figured
it was time I learned, so first I used pkg_delete(1) to
uninstall mc(1). I knew when you build a port it will
download the port file and extract all its files in
subdirectories under /usr/ports. I found the file I
needed, ftpfs.c, under:

/data2/mktemp/obj/mc-4.7.0.6p0/mc-4.7.0.6/lib/vfs/mc-vfs

That’s because of limited space on my main drive and
fixing that problem by creating /etc/mk.conf and adding:

WRKOBJDIR=/data2/mktemp/obj
DISTDIR=/data2/mktemp/distfiles
PACKAGE_REPOSITORY=/data2/mktemp/packages

I edited ftpfs.c as described above, deleted the installed
package, changed directory into /usr/ports/misc/mc,
and did:

sudo make -D –with-vfs -D –with-samba \
-D –with-screen=slang -D –with-subshell \
-D –enable-charset

I don’t know if there is a way to tie all those together
without all the extra -D’s, and comments are welcome,
but I was tired at that point of all the searching to fix the
problem, so I did it the long way and it worked. Then I
did make install, then opened mc and this time ftp worked.
Mission accomplished! :-)

2011 OpenBSD Puffy Desktop Calendar

Made an OpenBSD Puffy desktop calendar wallpaper for myself.
It’s 406×700 pixels. You can put it on a black background or
copy and paste it into a plain black image of your own making
the size of your desktop. Took Puffy from a snapshot of the
OpenBSD ftp login screen and pasted it into the calendar image.
The characters and Puffy are kind of subdued terminal green color.

GoogleCL on OpenBSD

Installed googlecl on OpenBSD 4.8 tonight. Looked at the port's
Makefile and didn't see anything special, so I just installed the
package. First time you run googlecl it creates its config file in
~/.googlecl. When you run it there will be a long outputted
string and it'll tell you before you hit enter you will need to
okay access. You do that through the browser while in your
Google account in:

My Account
Change authorized websites

The catch is, I had to open my browser to do that, and it made no
difference to googlecl. Each time after okaying it in my account
settings in my browser googlecl still errored out. I added the
following to the config file to fix it:

auth_browser = /usr/local/bin/seamonkey

This time when I hit enter it opened a new tab in my browser and
everything worked. After it was working I tried doing a listing of
my docs and it worked. Next I ran some commands that accessed
contacts, blogger, and calendar, and got all of them okayed in my
account settings. Still a lot to learn, but it's working okay now.
Just a matter of reading up more on it online and playing around
with it. Incidentally, I uploaded this post with googlecl. Didn't
format quite like I wanted and I had to do some editing from my
browser, but not bad first time out.

Free OpenBSD Shell Account Provider, Unix Shells

Found out about this site the other day. Nice folks, great site.
Here's a snippet from their manifesto:

Devio.us came about one afternoon while brainstorming
new possible projects. While other shell providers do
exist, most of them lack a clear goal, or are ran by an
inexperienced group of people. The servers are either
unstable, insecure or the hardware is just plain bad.
Realizing this sad state of of affairs, we set out to
create devio.us. While Kayla set out to design the site,
the rest of the team started working on writing all the
user administration utilities, automating tasks and
setting up the environment. Shortly thereafter, the
project was launched.

Lots of FAQ's and help on the site. Check out the forums at

Free Unix Shell Accounts - Devio.us Forums

or join in on the chat at irc.freenode.net #devious

bsdtalk180- OpenBSD Enthusiast Girish Venkatachalam

Interview with my programmer OpenBSD bud Girish Venkatachalam.

Main Site for bsdtalk
Interview mp3 link
Interview ogg link

Absolute Minimal OpenBSD USB Image

My friend Girish Venkatachalam has added another
OpenBSD USB bootable image, a very minimal 1GB
version without X and without a single package,
just the base install.

Absolute Minimal Version

Enjoy!

Cksum

Create Fingerprints Using Cksum

cksum(1) is a very important utility since it
can figure out the fingerprint/message digests
using several key algorithms employed in
cryptography.

     1. cksum
     2. md4
     3. md5
     4. rmd160
     5. sha1
     6. sha256
     7. sha384
     8. sha512
     9. sum
    10. sysvsum

sha512 is the best algorithm to use since
it gives the longest output and there is
very little chance of collision.

I think this article is not going to make
much sense without explaining the rationale
and the math behind the idea of cryptographic
hashes of message digests.

The basic goal is quite easy to state and
understand. The idea of a message digest is
to create a fixed length "fingerprint" from
any input data of any length, be it 2 bytes
or 2 Terabytes. This is done in a such a way
that the output varies significantly for
slight changes in input data.

All that is fine and dandy but the most
important aspect of the checksum algorithm
is its ability to avoid collisions.
Collisions are input values for which the
checksum algorithm produces the same output.
This can be quite dangerous and defeats the
very purpose of having a checksum in the
first place.

But mathematically speaking, nature enforces
a limit to the probability or possibilty of
collisions. But in practice this works quite
well as long as your output sample space is
quite big. Which is the case with sha512
digests. MD4 is broken. Don't use it. MD5 is
weak too.

The importance of cryptographic hashing comes
from many angles. First thing is that it is key
to generating digital signatures. A signature
is a private key encrypted message digest of
the input message. Simple and straight.

Then you have something called HMAC or hashed
message authentication code where a secret key
is used for generating message digests.
Normally message digests do not employ any
secret information. It is completely open.
Anyone can generate cryptographic hashes since
the algorithm is well known, there are no keys
and given the input, the output is fixed.

This is alright when we want to detect accidental
changes or integrity of file transfers. But this
does not protect us from malicious tampering. For
that we normally encrypt the hash with a secret key.
Or append it with the message and encrypt it. That
way we can detect tampering.

However HMAC is different. In this method,
the cryptographic hash is protected with a
secret key and only if you possess the secret
key you can generate the hash.

HMAC is widely used in TLS or SSL web security.
We have already seen many applications for
message digests or cryptographic hashes.

There is one important detail however. All
the public key cryptosystems in particular
the most widely used RSA algorithm relies
on cryptographic hashes in a interesting way.

RSA is a little complicated to explain in
this article but my idea is to illustrate
that cryptographic hashes have a much bigger
role to play than simple integrity checking.

Cryptographic hash functions are also known
as one way hash functions. Which is to say
that the function is not reversible. There
is no inverse of the function. You can only
get an output from input, never the other
way round.

RSA is nothing but a one way hash function
of the input data with a key. RSA relies on
the prime number factorization problem. So
the idea here is that you can multiply two
prime numbers trivially but you cannot divide
them. You can of course but not without a
significant computational overhead.

Now that we have seen enough theory, let us
get to the practical side and figure out how
it can help us in real life. After all math
has a great real life significance.

$ cksum /etc/passwd
3171604895 3646 /etc/passwd

$ cksum -a sha512 /etc/passwd
SHA512 (/etc/passwd) =
b4d6a742cada5305686832f1037b60f79b56fe6dfdf99
04e6070295e74c2341535db26b731e27e04a73f0cb70b
b589d31b8e9e18e207a8aae5aa81d06ea29f5a
(above cksum output line wrapped)

$ cksum -a sha256 /etc/passwd
SHA256 (/etc/passwd) =
fd2626c043a288c0a25bdc9772af4b19e001c890e9317
0a4de40043a9516e94a
(above cksum output line wrapped)

$ cksum -a rmd160 /etc/passwd
RMD160 (/etc/passwd) =
70455b60aad955b556aa4052af017ecf61bfe5a1

$ cksum -a md5 /etc/passwd
MD5 (/etc/passwd) =
e7818836fe36fa1fde1ab6198ee2da77

$ cksum -a sha1 /etc/passwd
SHA1 (/etc/passwd) =
9c80fdd62b69909a705c64fe79b6294d778ffef6

You can avoid the above mentioned issue of
collisions with the cksum(1) utility since
you have access to several state of the art
checksum algorithms from one command/utility.
So if you are paranoid kindly compare the sha1
and sha256 sums of the same file at both sides
after transfer. That way you can avoid issues
with collision.

openssl(1) also comes built in with access to
several checksum algorithms and so can sha1 and
md5 commands help under OpenBSD. But cksum has
an advantage of supporting many algorithms. Moreover
all these utilities come with base OpenBSD. There
is never a need to install any specific package.
In other words you are guaranteed to find them,
on any OpenBSD box!

Note on Authorship:
This article was contributed by Girish Venkatachalam
who is also a co-author on Denny's OpenBSD Newbies Blog.

Small Conky Calendar

I”m not a perl programmer and I’m sure my chances of having
come up with this on my own would be right up there with the
classic example about the monkeys with typewriters creating
the encyclopedia! :-) I got it off this mailing list:

freebsd-questions@freebsd.org

cal | perl -pe ’s/^/ /;s/$/ /;s/ ‘”$(date “+%e”)”‘ /\['"$(date "+%e")"']/’

I plugged it into the bottom of my .conkyrc file like so:

${color green}${execi 360 cal | perl -pe ’s/^/ /;s/$/ /;s/ ‘”$(date “+%e”)”‘ /\[ '"$(date "+%e")"']/’} ${color}

BTW, the above perl lines are wrapped, both the first which
is from the command line, and the second, which is the entire
line in .conkyrc. It shows the current day enclosed in brackets
in order to highlight it. Nice touch.

Cheers!

Taking Desktop Screenshots

I was Googling around the other night looking for graphics
help and ran across this site where I learned about some
X stuff I didn’t even know was there on my box:

Useful Things You Can Do with FVWM

Example of dumping the root screen using xwd, part
of the X Window System included with OpenBSD:
xwd -root -out file

Example of displaying the dumped image with xwud,
again part of the X Window System:
xwud -in file

Example of dumping the root screen & outputting it to
jpg format using xwdtopnm and pnmtopng, both
included in the netpbm port/package:

xwd -root |xwdtopnm |pnmtopng > file.jpg

Example of converting an existing screenshot taken with
xwd, using xwdtopnm and pnmtopng:

xwdtopnm < file | pnmtopng > file.png
xwdtopnm < file | pnmtojpeg > file.jpg

Example converting a screenshot taken with xwd with
convert, part of the ImageMagick port/package:

convert file file.png
convert file file.jpg

Cheers!

Conky Update

Added some information at the end of Conky System Statistics
on a new way to stop one version of Conky from a script that runs
from a cronjob and start a new version, again from a script run
from a cronjob. Hope if anyone used the old way they didn't have
the same problem I did. If so, sorry. The current way has been
working without issue for several days now.

Cheers!

ClamAv Update on OpenBSD Box

Updated my ClamAv today from version 0.95.2 to 0.95.3
and luckily read the warning about needing to patch it
on the download page at:

Clam AntiVirus

There’s a link there to download the diff. I downloaded
everything, then ran gpg against the file and signature
file to verify:

gpg –verify clamav-0.95.3.tar.gz.sig clamav-0.95.3.tar.gz

gpg: Signature made Wed Oct 28 10:59:38 2009 CDT using DSA key ID 985A444B
gpg: Good signature from “Tomasz Kojm ”
gpg: aka “Tomasz Kojm ”
gpg: aka “Tomasz Kojm ”
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 0DCA 5A08 407D 5288 279D B434 5482 2DC8 985A 444B

After that, cd /usr/ports/mystuff/ and do:

sudo tar xzvf /path/to/clamav-0.95.3.tar.gz

Next, I needed to uninstall the old version, but first I
had to stop the daemon running:
ps auxw grep clamd
sudo kill PID#

Then:

cd clamav-0.95.2
sudo ./configure
sudo make uninstall

There’s a warning in the docs about old librairies
and file versions on your system:

Caveats:

1) Make sure that you haven’t got old libraries (libclamav.so)
lying around your filesystem. You can verify it using:

$ ldd `which freshclam`
/usr/local/bin/freshclam:
Start          End            Type  Open  Ref  GrpRef  Name
1c000000  3c011000  exe     1           0       0              /usr/local/bin/freshclam
0470f000  24744000   rlib     0           1       0              /usr/local/lib/libclamav.so.6.5
022d7000  222db000  rlib    0           2       0              /usr/local/lib/libbz2.so.10.4
07d8b000  27d93000  rlib    0           2       0              /usr/lib/libz.so.4.1
0cd94000  2cd9d000  rlib    0           1       0              /usr/lib/libpthread.so.11.0
0c104000  2c13a000   rlib     0           1       0              /usr/lib/libc.so.48.0
05e7e000  05e7e000   rtld    0           1       0              /usr/libexec/ld.so

With my previous version of Clamav I had the file
/usr/local/lib/libclamav.so.6.4 but the uninstall
removed it okay.

More warnings:

2) Also make sure there is only one version of ClamAv
     on your system.

3) whereis freshclam

4) whereis clamscan

In case anything went wrong I saved my old configuration
files in /usr/local/etc renaming them. Then:

cd /usr/ports/mystuff/clamav-0.95.3/
cp /path/to/patch-0.95.3-bug1737.diff .
sudo patch -p1

After everything built and installed successfully, all that
was left to do was go back into /usr/local/etc and configure
clamd.conf and freshclam.conf, then restart the daemon:

sudo /usr/local/sbin/clamd

I want to stress like always that it pays to read
documentation. Where you want your TemporaryDirectory,
where you want your LocalSocket and DatabaseDirectory
and so on. Same goes for your freshclam settings.
READ THE DOCS!

If you’re going to go through all the above to have
Clamav on your system, then you’re probably going
to want to start it when your system boots. I’ve got
the following in /etc/rc.local:

if [ -x /bin/mkdir ]; then
/bin/mkdir /tmp/clamd && chown clamav:clamav /tmp/clamd
fi

if [ -x /usr/local/sbin/clamd ]; then
/usr/local/sbin/clamd
fi

I do the above mkdir along with the ownership thing
since my sytem cleans out /tmp on reboot. It’s set in
/etc/rc.conf.local:

clear_tmp_enable=”YES”     # clear /tmp on reboot

Cheers!

Tracking Network Usage With a Shell Script

Every morning the daily output is waiting there for
me in my email. Part of the normal output under Ipkts
and Opkts shows what went through the interface:

Ipkts            Opkts
2999812      2509494

I don’t reboot very often but when I do, it seems the system
zeros this out and it starts all over again. I put together
a script that runs periodically from a cronjob:

#!/bin/sh
# Filename: netusage.sh

cd $HOME/bin
if grep ‘daily output’ $HOME/Mail/root/new/*; then
cat `grep -l ‘daily output’ ~/Mail/root/new/*` | \
grep xl0 |tail -1 |awk ‘{print $5}’ > ibytes.out
cat `grep -l ‘daily output’ ~/Mail/root/new/*` | \
grep xl0 |tail -1 |awk ‘{print $7}’ > obytes.out

else
echo “No daily output yet” > /dev/null 2>&1
fi
cd

At the end of the month I run another script to total
the network usage:

#!/bin/sh
# Filename: netusemonthly.sh
cd $HOME/bin
date > `date +”%Y%m%d”`_endofmonthnetuse.log
echo “” >> `date +”%Y%m%d”`_endofmonthnetuse.log
echo “Monthly Ibytes” >> `date +”%Y%m%d”`_endofmonthnetuse.log
cat *ibytes.out |awk ‘{ SUM += $1 } END { print SUM }’ >> \
`date +”%Y%m%d”`_endofmonthnetuse.log
echo “” >> `date +”%Y%m%d”`_endofmonthnetuse.log
echo “Monthly Obytes” >> \
`date +”%Y%m%d”`_endofmonthnetuse.log
cat *obytes.out |awk ‘{ SUM += $1 } END { print SUM }’ >> \
`date +”%Y%m%d”`_endofmonthnetuse.log
mv -f *ibytes.out *obytes.out rebytes/
mv -f *endofmonthnetuse.log rebytes/
cd

The file names I used probably look ludicrous and they are all
completely arbitrary. If you try this out you can use whatever
file names and paths suit your needs. The whole thing was done
just to learn more about scripting, awk, and so forth. Also, to keep
the numbers right after a reboot, I added the following to
/etc/rc.shutdown:

netstat -ivn |head -8 |tail -1 |awk ‘{print $5}’ > \
/home/useracct/bin/`date +”%Y%m%d%H:%M:%S”`_reboot_ibytes.out
netstat -ivn |head -8 |tail -1 |awk ‘{print $7}’ > \
/home/useracct/bin/`date +”%Y%m%d%H:%M:%S”`_reboot_obytes.out
chown useracct:useracct /home/useracct/bin/*reboot_*bytes*

Like I said, this was all done just for learning purposes.
Maybe you can find a way to use some variation of the idea
on your own system.

Cheers!

Saving Tips From Mailing Lists

Besides my constant experimentation towards always
learning more about OpenBSD, one of my other means
of accumulating tips is from the mailing lists I
subscribe to. I put together a script to save messages
from the misc@openbsd mailing list. It finds all the
messages in thread in my mutt subdirectory under Mail
and concatenates all of them to a text file. It’s
interactive and it asks you for a search pattern,
where to search, and where to save the output to.
Here’s what it looks like:

#!/bin/sh
# Filename: obsd2tips.sh – save mailing list problem
# questions and resolutions to my BSD tips folder

echo “Enter your search pattern: ”
read r

echo “Enter your search path: ”
read R

echo “Enter file to save to: ”
read i

cat `grep -l “$r” $HOME/$R/*` | \
sed ‘/Return-Path/,/X-Virus-Checker-Version/d’ >> \
$HOME/bsd/$i.txt

The stuff like Return-Path and X-Virus-Checker-Version
are stuff in my header I don’t want in the saved tip.
If it was just a single message I could strip the entire
header with a sed command, but it doesn’t work when there
is more than one message in the thread. It gets even more
complicated on the script I use to do the same thing with
my freebsd-questions mailing list threads. Here’s that
script and you will see the difference:

#!/bin/sh
# Filename: fbsd2tips.sh – save mailing list problem
# questions and resolutions to my BSD tips folder

echo “Enter your search pattern: ”
read r

echo “Enter your search path: ”
read R

echo “Enter file to save to: ”
read i

cat `grep -l “$r” $HOME/$R/*` | \
sed ‘/Return-Path/,/X-Virus-Checker-Version/d’ | \
sed ‘/freebsd-questions/d’ |sed ‘/unsubscribe/d’ >> \
$HOME/bsd/$i.txt

Depending on your MUA you will have to adjust your
filtering. I’ve been using mutt for years and do not
have any intention of switching to anything else. So,
if you’re using mutt, it will be easy to implement
for you. If you’re using some other MUA YMMV. ;)

Cheers!

Sat Oct 31 14:35:33 CDT 2009
Addendum:

Made the script a bit more interactive and helpful.
Thanks go to my friend Girish for helping me on it,
too. Here’s the new script for searching through my
misc@openbsd mail threads:

#!/bin/sh
# Filename: obsd2tips.sh – save mailing list problem
# resolutions to my BSD tips folder
found=”N”
while [ "$found" = "N" ]; do
echo “Enter your search pattern: ”
read r

echo “Enter your search path: ”
read R

echo “Enter file to save to: ”
read i

if grep $r $HOME/$R/* > /dev/null 2>&1 ;
then
cat `grep -l “$r” $HOME/$R/*` | \
sed ‘/Return-Path/,/X-Virus-Checker-Version/d’ >> \
$HOME/bsd/$i.txt
# XXX finish the program!
found=”foo”
else
echo “Can’t find it! Check your search pattern and path.”
# Rerun the search with new pattern and/or path
found=”N”
fi
done

I’d also like to add something at the end of the script where,
even after it finds what I’m looking for and writes it out to my
tips file, it will still come up and ask me if I’d like to enter
a new search. Anyone have a suggestion, please leave a comment.

Cheers!

Find and Kill Process

I had used the following to find an instance of conky and
kill it in order to start a different conky configuration:

ps -U useracct |grep justweather |head -1 | \
cut -c 1-5 |sed -e ’s/[\ ]//g;/^$/d’ > jwpid.out
kill -9 `cat jwpid.out`

That’s unnecessarily complicated compared to this simpler way:

ps -U useracct |grep justweather.conkyrc | awk ‘{print $1}’ | \
xargs kill -15

Keeping Up With Security Patching

Put together a script that uses lynx(1) and sed(1) to download
and parse to a nice output the latest OpenBSD security and
reliability notifications.

#!/bin/sh
# Filename: undead.sh

cd $HOME/bin/
echo "" > errata.out
echo - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \
>> errata.out
echo "" >> errata.out

echo "Undeadly.org" >> errata.out
echo "" >> errata.out

lynx -dump http://undeadly.org/ ¦sed -n '/OpenBSD Errata/,$p, ¦ \
sed '/OpenBSD Resources/q' ¦ sed -n -e :a -e '1,3!{P;N;D;};N;ba' ¦ \
sed 's/^[ \t]*//' >> errata.out

echo "" >> errata.out
echo - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \
>> errata.out
echo "" >> errata.out

echo "OpenBSD Errata" >> errata.out
echo "" >> errata.out

lynx -dump http://www.openbsd.org/errata44.html ¦ \
sed -n '/OpenBSD\ FAQ/,$p' ¦ \
sed '1d ' ¦sed '/References/,$d' ¦sed '$d' >> errata.out

echo "" >> errata.out
echo - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \
>> errata.out
echo "" >> errata.out

cat errata.out ¦mail -s "OpenBSD Daily Errata" dennyboy

cd

You can always subscribe to security-announce@openbsd.org
but, sometimes, despite good intentions, things fall through the
cracks. In the end, at least IMHO, security is the responsibility of
the system admin, whether he's overseeing a server room full of
blade servers or if he's just a home user running one box.

Cheers!

Passive Aggressive Spam Filtering

Passive Aggressive Spam Filtering: "

Using OpenBSD and spamd for spam filtering and grey-listing is very old news but there are a few situations where it becomes politically and technically challenging to run in production. Here was a simple yet (and in no way the best method) of using PF and some friends on the internet to help 'slow the flow' of offal from the Internet into your mail server.

Read more..."

OpenBSD 4.6 Pre-Orders Online!

OpenBSD 4.6 Pre-Orders Online!: "

Pre-orders are now being accepted for OpenBSD 4.6, scheduled for release on October 1st, 2009.

The developers bring us an amazing amount of cool new stuff (PF now enabled by default, a new privilege-separated SMTP daemon, routing domain support and lots more).

Of course, t-shirts and posters are available too. Order your set NOW!

"

BSD load demystified

BSD load demystified: "

Ariane van der Steldt (ariane@) posted a reply to the OpenBSD misc mailing list last month that offered some valuable insight into how load is calculated in the BSD kernel. This is a topic that comes up routinely but remains largely misunderstood by the average user.

Read on for Ariane's explanation and comparison to Linux load...

Read more..."

SecPuffy:): OpenBSD tips and tricks - adding swap on the fly

SecPuffy:): OpenBSD tips and tricks - adding swap on the fly

Spam control with OpenBSD greylisting

New link for my friend in Tamil Nadu. He's renamed
his antispam product to SpamCheetah. He has been a
good friend over the years, helped me numerous times
with OpenBSD and other projects, and definitely knows
what he's doing. So if you're in need of an antispam
solution, he's definitely the guy to see! The link is
in the title but here it is again just to be safe:

SpamCheetah - Main Site
SpamCheetah - On SourceForge

Youtube videos about the product:
OpenBSD Tarpit
SpamCheetah's Web Interface

There is both a commercial version with full tech-support and
the free downloadable open source version.