Krzysztof Burghardt’s blog » Software

ESE Key Daemon 1.2.7 released

Krzysztof Burghardt — Mon, 05 Jul 2010 07:35:52 +0000

New version of ESE Key Daemon was released today.

New features include the ability to handle multiple key combinations and distinguish between key presses and releases. A problem with the handling of the last line in a configuration file when there is no newline on the last line is gone. Numeric keys are now also allowed in the configuration file.

Download: esekeyd-1.2.7.tar.gz (.asc)

MD5: 5937ad6d7815dbc6ab6983411a9f37d4
SHA1: 07671be42b61973a3270aaf1b41c3467568ae7ac

Integration of AA Google 404 with Atahualpa

Krzysztof Burghardt — Fri, 13 Nov 2009 01:41:55 +0000

AskApache Google 404 default 404.php does not work properly with Atahualpa theme. To fix those problems create another 404.php file in /themes/atahualpa with this content:

ob_start();

include(TEMPLATEPATH . '/functions/bfa_get_options.php');
get_header();

if (function_exists('aa_google_404'))
aa_google_404();
else
{
?>

_e('Not Found','atahualpa'); ?>

_e("Sorry, but you are looking for something that isn't here.","atahualpa"); ?>

}

bfa_center_content($bfa_ata['center_content_bottom']);

get_footer();

exit();

?>

When it is done, choose wp-content/themes/atahualpa/404.php as 404 File Handling and enable AA Google 404.

Virtual destinations are faster than Camel routing

Krzysztof Burghardt — Sat, 31 Oct 2009 20:26:08 +0000

Routing messages from one input queue to two output queues in ActiveMQ can be done in two different ways. Apache Camel, a powerful rule-based routing engine often used with ActiveMQ, is a typical choice. Virtual composite queue is another solution. Which to choose? The faster.

Apache Camel

Camel configuration I use:

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://camel.apache.org/schema/spring http://camel.apache.org/schema/spring/camel-spring.xsd">

id="camel" xmlns="http://camel.apache.org/schema/spring">
>
uri="activemq:INPUT-QUEUE"/>
uri="activemq:OUTPUT-1-QUEUE"/>
uri="activemq:OUTPUT-2-QUEUE"/>
>
>

id="activemq" class="org.apache.activemq.camel.component.ActiveMQComponent" >
name="connectionFactory">
class="org.apache.activemq.ActiveMQConnectionFactory">
name="brokerURL" value="vm://localhost?create=false&waitForStart=10000" />
name="userName" value="${activemq.username}"/>
name="password" value="${activemq.password}"/>
>
>
>
>

Benchmark took 3 minutes 31 seconds to send 10 thousand messages through Camel:

$ time ./amqinject INPUT-QUEUE 10000
0.651u 0.490s 3:31.43 0.5%      0+0k 0+0io 0pf+0w

Unfortunately “Number Of Pending Messages” was always about 1024 and amqinject gets blocked in send() call:

INFO | Usage Manager memory limit reached on queue://INPUT-QUEUE. Producers will be throttled to the rate at which messages are removed from this destination to prevent flooding it. See http://activemq.apache.org/producer-flow-control.html for more info

Virtual Composite Queue

Virtual destinations are configured in tag. Here is my configuration:

>
physicalName="INPUT-QUEUE" />
physicalName="OUTPUT-1-QUEUE" />
physicalName="OUTPUT-2-QUEUE" />
>

>
>
>
name="INPUT-QUEUE">
>
physicalName="OUTPUT-1-QUEUE" />
physicalName="OUTPUT-2-QUEUE" />
>
>
>
>
>

Amqinject never blocked and it took only 2 minutes 29 seconds to complete:

% time ./amqinject INPUT-QUEUE 10000
0.718u 0.539s 2:29.33 0.8%      0+0k 0+0io 0pf+0w

Migrating from ActiveMQ-CPP/CMS version 2.2 to 3.0

Krzysztof Burghardt — Sun, 23 Aug 2009 00:02:55 +0000

Migrating from ActiveMQ-CPP/CMS version 2.2.6 to 3.0.1 is very easy. There are only two minor problems to deal with.

First problem: exceptions

No idea what “N3cms12CMSExceptionE” is? Use getCause() on cms::CMSException
objects to get std::exception*. Do not call what() directly. Do not try to call what() from any base classes.

catch (cms::CMSException& e) {
cout << e.getCause()->what() << endl;
}

And now “N3cms12CMSExceptionE” is “No Matching Factory Registered for format := tcp”.

Second problem: library initialization

“No Matching Factory Registered for format := tcp” suggests that library was not initialized properly or some protocol-related modules was not loaded. Version 3.0 (and above) requires explicit initialization of ActiveMQ library.

To fix this problem include activemq/library/ActiveMQCPP.h and call ActiveMQCPP::initializeLibrary().

#include
// ...
activemq::library::ActiveMQCPP::initializeLibrary();

Optimizing GNOME for Netbooks

Krzysztof Burghardt — Mon, 04 May 2009 20:17:49 +0000

GNOME can be easily optimized for Netbooks using configuration editor. Disabling animations, thumbnails and splash screen speeds up GNOME while scaling down icons saves space on desktop.

Metacity will give the user less feedback by using wireframes, avoiding animations, or other means if /apps/metacity/general/reduced_resources is set to true. This can be set with gconf-editor or from shell with gconftool:

gconftool-2 -s /apps/metacity/general/reduced_resources -t bool true

When Metacity run on reduced resources it’s time to disable animations in panels and desktop:

gconftool-2 -s /apps/panel/global/enable_animations -t bool false
gconftool-2 -s /apps/panel/toplevels/bottom_panel_screen0/enable_animations -t bool false
gconftool-2 -s /apps/panel/toplevels/panel_0/enable_animations -t bool false
gconftool-2 -s /desktop/gnome/interface/enable_animations -t bool false

Disabling splash screen:

gconftool-2 -s /apps/gnome-session/options/show_splash_screen -t bool false

Disabling logout effect and shading and shading the background colors:

gconftool-2 -s /desktop/gnome/background/color_shading_type -t str "solid"
gconftool-2 -s /apps/gnome-session/options/logout_effect -t str "black"

Finally Nautilus shouldn’t generate any images or documents thumbnails:

gconftool-2 -s /apps/nautilus/preferences/show_icon_text -t str "never"
gconftool-2 -s /apps/nautilus/preferences/show_image_thumbnails -t str "never"

Disable sounds on user events and playing sound from files under mouse:

gconftool-2 -s /apps/nautilus/preferences/preview_sound -t str "never"
gconftool-2 -s /desktop/gnome/sound/event_sounds -t bool false

When everything is disabled time to scale down icons in GNOME menu. This can be done in configuration file named ~/.gtkrc-2.0. To scale down icons create file with this content:

gtk-menu-images = 1
gtk-button-images = 1
gtk-icon-sizes = "panel-menu=16,16:panel=16,16:gtk-button=16,16:gtk-large-toolbar=16,16"

Sptrace 1.4.2 released

Krzysztof Burghardt — Sat, 14 Mar 2009 09:00:06 +0000

New version of sptrace was released today. Sptrace is a secure ptrace() Linux Kernel Module (LKM). It limits users’ access to the ptrace() call. Module was updated to reflect changes in new kernel releases and tested with 2.6.26.

When someone not allowed to trace processes uses program that call ptrace() (like strace, ltrace or gdb) current and parent processes names, pids, uids and euids are logged, e.g.:

Mar 13 08:51:11 ghost kernel: [ 8086.730499] sptrace: ptrace() DENIED for (gdb:6810) UID(1000) EUID(1000), parent (gdb:6785) UID(1000) EUID(1000)
Mar 13 08:51:11 ghost kernel: [ 8086.984694] sptrace: ptrace() DENIED for (gdb:6785) UID(1000) EUID(1000), parent (tcsh:32216) UID(1000) EUID(1000)
Mar 13 08:51:44 ghost kernel: [ 8119.928920] sptrace: ptrace() DENIED for (gdb:6923) UID(1000) EUID(1000), parent (tcsh:32216) UID(1000) EUID(1000)

Program that call ptrace() will get EPERM error:

$ strace ls
strace: ptrace(PTRACE_TRACEME, ...): Operation not permitted
$ ltrace ls
PTRACE_TRACEME: Operation not permitted
PTRACE_SETOPTIONS: Operation not permitted
$ gdb -p 32215
GNU gdb 6.8-debian
[...]
This GDB was configured as "i486-linux-gnu".
Attaching to process 32215
ptrace: Operation not permitted.

Module log both allowed and denied ptrace() calls. Allowed traces as logged as:

Mar 11 19:14:48 ghost kernel: [ 6445.524669] sptrace: ptrace() by (ltrace:27558) UID(1000) EUID(1000), parent (ltrace:27557) UID(1000) EUID(1000)
Mar 11 19:14:48 ghost kernel: [ 6445.525460] sptrace: ptrace() by (ltrace:27557) UID(1000) EUID(1000), parent (tcsh:26606) UID(1000) EUID(1000)

By default sptrace deny access to ptrace() to all non root users (GID != 0). Root group (or wheel) is allowed to use this call. To disable tracing for all users, including those in root group pass parameter ptrace_group=-1, e.g.:

$ insmod ./sptrace.ko ptrace_group=-1

Download: sptrace-1.4.2.tar.gz (.asc)

md5sum: 9a23198cbdcd256b11e2b0dc2c03b331
sha1sum: 458f9b15e9a5b02cd18759b6b09a4b41d062d7cd

Keep Doxyfile in sync with Autoconf

Krzysztof Burghardt — Wed, 04 Mar 2009 19:37:16 +0000

Generating Doxygen configuration file – Doxyfile from Autoconf is simple and helps to avoid duplication of version numbers, input and output directories and packages names. Doxyfile can be generated like Makefiles from Doxyfile.in by configure script.

First generate Doxyfile skeleton like usual:

$ doxygen -g Doxyfile.in

Then open Doxyfile.in in $EDITOR and set following variables:

PROJECT_NAME = @PACKAGE_NAME@
PROJECT_NUMBER = @VERSION@

INPUT = @top_srcdir@
OUTPUT_DIRECTORY = @top_builddir@/doc

RECURSIVE = YES

Finally add Doxyfile to configure.ac (or .in if you prefer .in convention):

AC_CONFIG_FILES([Makefile
...
Doxyfile
])
AC_OUTPUT

Recreate configure script and run it (just run “make” and it will do all the magic for you).

Next time you change version, package name or anything else in Autoconf Doxyfile will be recreated with updated values.

ClamFS 1.0.0 has been released

Krzysztof Burghardt — Sun, 08 Feb 2009 14:18:45 +0000

ClamFS 1.0.0 has been released yesterday. It contains some new features that might be quite interesting for its users.

Completed clamd results caching

This was a long waiting feature. Version 0.9.1 cache only information about clean files. Infected files was scanned on every access. Starting from version 1.0.0 information about both clean and infected files are kept in cache while files that cannot be scanned (mostly because of permission problems) are discarded from cache.

Starting without clamd available

A new “check” option was added to allow you to mount a ClamFS file system when clamd is not available, such as during an early stage of the boot process. To disable ClamAV Daemon (clamd) check on ClamFS startup set option check to no:

socket="/var/run/clamav/clamd.ctl" check="no" />

Mounting file systems from /etc/fstab

With “check=no” mounting ClamFS file systems form /etc/fstab is possible using fuse mount helper (/sbin/mount.fuse). ClamFS will be started on boot with configuration file defined here provided as its argument. Simple definition of ClamFS mount point in /etc/fstab looks like:

clamfs#/etc/clamfs/share.xml /clamfs/share fuse defaults 0 0

Read-only mounts

The “readonly” option was added to the filesystem options allowing you to create a read-only protected file system. Just extend filesystem definition in config file with readonly option set to yes:

root="/share" mountpoint="/clamfs/share" readonly="yes" />

File system and cache statistics

ClamFS has file system statistics that allow you to monitor and tune its performance. Statistics module keep track of file system usage and cache hits. Stats module is configured with “stats” tag. It can dump statistics periodically and on ClamFS dismount:

atexit="yes" every="3600" />

Statistics are dumped to configured logging target. Here is an example of such statistics dumped to syslog:

Feb  8 14:52:51 ghost clamfs: --- begin of statistics ---
Feb  8 14:52:51 ghost clamfs: Early cache hit: 1038
Feb  8 14:52:51 ghost clamfs: Early cache miss: 1030
Feb  8 14:52:51 ghost clamfs: Late cache hit: 1038
Feb  8 14:52:51 ghost clamfs: Late cache miss: 0
Feb  8 14:52:51 ghost clamfs: Whitelist hit: 10
Feb  8 14:52:51 ghost clamfs: Blacklist hit: 108
Feb  8 14:52:51 ghost clamfs: Files bigger than maximal-size: 3
Feb  8 14:52:51 ghost clamfs: open() function called 2081 times (allowed: 1803, denied: 278)
Feb  8 14:52:51 ghost clamfs: Scan failed 278 times
Feb  8 14:52:51 ghost clamfs: --- end of statistics ---

Better default extension blacklist

Default blacklist in configuration file was extended. I advise all users to incorporate blacklist from version 1.0.0 into their configuration files.

ESE Key Daemon 1.2.4 released

Krzysztof Burghardt — Tue, 23 Sep 2008 19:10:58 +0000

New version of ESE Key Daemon was released today.

Release notes:

Fixed cross-compilation bug reported by hartleys.
Removed debian directory (will try to include esekeyd in Debian).
Removed old directory (Linux 2.4 users can use 1.2.3, but 2.4 support is no longer maintained).
Removed lib directory (any modern (g)libc has getopt).

Download: esekeyd-1.2.4.tar.gz (.asc)

MD5: 5eb8d1b02cdd99d0681e946768e529db
SHA1: 12395b670dbf9ae93573e9cd5f57c51c3572a8aa

Web browser anonymity threats

Krzysztof Burghardt — Tue, 13 May 2008 22:05:35 +0000

Anonymity in important for many people. Few years ago, it was problematic issue only for hackers, human rights workers and anonymity freaks. They want to keep they identity in secret for obvious reasons. They were traced only by law enforcement agencies and government. Today everything is much more difficult. Hundreds of advertising agencies trying to reveal identity of people to target their commercials better.

Web browser can give them so many information. For example in which languages you speak (browser shares your language preferences with sites you visit)., in which city you live (this can be obtained from IP), how big is your computer display (web page can get your display resolution), what video player or office suite you have installed (they can query installed browser plugins) and much more...

Server side

Various information are available from PHP and Apache.

This include IP address, hostname (reverse DNS lookup), source port and sometimes user name:

Your IP: 38.107.191.93Your hostname: 38.107.191.93Your source port: 17958Your username:

Those basic information are available from _SERVER associative array members named REMOTE_ADDR, REMOTE_PORT and REMOTE_USER.

Here is an example how to get hostname quering DNS using gethostbyaddr():

echo gethostbyaddr($_SERVER["REMOTE_ADDR"]); ?>

In the same way we can obtain name and version of browser (HTTP_USER_AGENT). You are using:

CCBot/1.0 (+http://www.commoncrawl.org/bot.html)

HTTP_REFERER reveals site you come form. Currently:

We are able to check what browser accepts as a response (HTTP_ACCEPT, HTTP_ACCEPT_ENCODING, HTTP_ACCEPT_CHARSET):

HTTP_ACCEPT: text/html,application/xhtml+xml,text/xml;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5HTTP_ACCEPT_ENCODING: gzipHTTP_ACCEPT_LANGUAGE: en-us,en;q=0.5HTTP_ACCEPT_CHARSET: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Those settings may leak your language and, if you leave default settings, your browser identity.

Proxy

Proxy servers often adds new headers to those sent by browser. We can access them using HTTP_X_FORWARDED_FOR and HTTP_FORWARDED . Some proxy servers sets also headers like HTTP_CLIENT_IP, HTTP_VIA, HTTP_PROXY_CONNECTION, HTTP_XROXY_CONNECTION.

Currently they are set to:

X-Forwarded-For: Forwarded: Client-IP: Via: PROXY: XROXY:

If none of above is set user is probably using direct connection. However some proxy servers (often called "high anonymous proxy" or "elite proxy") forward requests without adding any headers or even removing some headers that leaks browser identity.

Client side

Web browser may leak user identity to anyone who is able to run JavaScript. By default browsers run any script embedded into web page.

Browser identity is hold in navigator object. Its name is in navigator.appName Currently:

Browser code name (navigator.appCodeName):

Browser version (navigator.appVersion):

Finally, platform it is running on (navigator.platform):

History length (or how many pages were visited - history.length):

Screen size and dept is hold in screen object. Example code to obtain screen properties:

document.write(screen.width," x ",screen.height, " x ", screen.colorDepth, " bpp (available for browser: ", window.screen.availWidth, " x ", window.screen.availHeight, ")");

Result of the above:

Referrer can be read from document.referrer:

Using simple loop one can iterate trough installed plugins:

if (navigator.plugins.length) {
for (i = 0; i < navigator.plugins.length; i++) {
plugin = navigator.plugins[i];
document.write(plugin.name, " (", plugin.filename, ")\n");
}
}

Result of above code:

Java

If Java is enabled JavaScript can use Java VM to obtain more information from OS. navigator.javaEnabled() returns true or false if Java is enabled.

JavaScript with small help of Java can obtain client IP address with:

if (navigator.javaEnabled()) {
addr=java.net.InetAddress.getLocalHost();
host=addr.getHostName();
ip=addr.getHostAddress();
document.write(ip, " (hostname: ", host, ")");
}

Results:

Or with alternative version:

if (navigator.javaEnabled()) {
host= window.location.host;
port=window.location.port || 80;
sock=new java.net.Socket();
sock.bind(new java.net.InetSocketAddress('0.0.0.0', 0));
sock.connect(new java.net.InetSocketAddress(host, (!port)?80:port));
addr=sock.getLocalAddress();
host=addr.getHostName();
ip=addr.getHostAddress();
document.write(ip, " (hostname: ", host, ")");
} else {
document.write("Java disabled");
}

Results:

Java applets

Another possibility to obtain IP address of client is using Java applets. Here is sample applet that tries to connect back to web server and reveal client address:

//

import java.applet.*;
import java.awt.*;
import java.net.*;

public class ShowIP extends Applet {
String m_ip;
public void init() {
try {
m_ip = (new Socket(getDocumentBase().getHost(), getDocumentBase().getPort())).getLocalAddress().getHostAddress();
} catch (Exception e) {
m_ip = "unknown";
e.printStackTrace();
}
}
public void stop() { }
public void paint(Graphics g) {
g.drawString(m_ip, 10, 10);
}
}

Applet in action:

ActiveX and other threats

ActiveX object can reveal client identity, too. Fortunately AvtiveX works only in Internet Explorer on Windows. Maybe also Flash's Action Script can be used to achieve this. If you known any other possibilities let me known.