The DK Projects

hiatus

dk — Thu, 24 Mar 2011 21:56:12 +0000

This year I endeavored to become more professional, more expert, and waged a ceaseless “hire me” campaign against what I believe is the security firm that produces the most knowledgeable and capable security teams in the country. The short version is my tenacity has paid off and I’ll be devoting all my time to this new era of my career.

Router Firmeware Upgrade

dk — Wed, 19 Jan 2011 04:55:16 +0000

For arguably too long my apartment has been dominated by the presence of a Belkin wireless router, tireless in it’s pursuit of 802.11G stability. So I picked up a Cisco WRT610N which would allow me to use the significantly faster 802.11N technology for those devices which are capable while also supporting my “legacy” wireless devices. This is so much fun I’m feeling palpitations just thinking about it – maybe next I should fill out some warranty cards. Anyway, the refurb device I bought was a v1 device with OEM firmware – that just will not do – we’re going to put DD-WRT on there and let a Linux kernel do the heavy lifting.

Preface: I take no responsibility for what you’re about to do with your router. I don’t want to say it’s highly likely you’ll screw something up I just want to mention that it is possible that something goes wrong and your router is bricked. If that happens you need to meet my friend Google. Google is going to be your best friend but I won’t. I might even laugh because of some social maladjustment.

Step 1 was to perform ye olde 30/30/30 reset. This operation, which initially daunts the installer, involves holding the reset button for 3o seconds with the device powered up, continue to hold for 30 more seconds after unplugging, and once more for 30 seconds after plugging the device in. Basically hold that reset button for at least 90 seconds. After the device comes back online open IE and make your way to http://192.168.1.1 and login using admin/admin. Navigate to Administration and select firmware upgrade. I grabbed the binary file from here and was able to paste the following into the firmware upgrade textbox:

ftp://dd-wrt.com/others/eko/BrainSlayer-V24-preSP2/03-24-10-r14144/broadcom/dd-wrt.v24_mega_wrt610n.bin

After receiving the completion message wait for at least 5 minutes. This short time period feels very long. In retrospect I might have planned to get a sandwich or something – instead I spent 5 very long minutes watching the clock before removing power for 10 seconds. Attach a PC to the router and wait to receive a DHCP address before repeating the 30/30/30 reset. After this you can connect to the router and configure it – you’ll know you were successful when you see the DD-WRT logo as you connect. If I’ve had one problem it was adapting syslog to use rsyslog to push privilege escalation attempts to a remote log repository.

Linux P2V conversion to VMWare ESXi

dk — Wed, 03 Nov 2010 03:39:22 +0000

It’s been a wild couple months.

Lately I’ve performed a number of physical to virtual conversions (P2V) from legacy hardware to VMWare ESXi 4.0. This isn’t exactly a simple process as anyone who has accomplished or undertaken something like this can affirm but it is interesting. The issues I ran into were the product of good intentions combined with sloth and a small amount of stubbornness. The solution was time intensive but now that I understand the limitations I think I’m comfortable sharing how I got things back in action.

My physical machine is a 12 year old beige box running Debian 3.0 (Sarge) with a 2.2.17 Kernel. The general hardware specs were a Celeron Mendocino CPU running at 366 MHz, 64MB of SDRAM, and a 10 GB IDE harddrive. The virtual host has 2 Xeon quad-core CPUs at 3 GHz and 32 GB of DDR-2 with a 1 Terabyte SAS RAID5 array and gigabit ethernet. Fiat to Ferrari is the comparison I’m thinking of but it might be more apt to say we’re going from bicycle to motorcycle.

The physical machine, for what it’s worth, was engineered cleverly but it is readily apparent to me that this is one of the many problems I will have to resolve – I’ll elaborate:

Early Linux kernels came in a couple general varieties but it was very common, especially when drive space was limited, to trim down the Kernel as much as possible. This has a couple outcomes, and Kernel slimness is still relevant today, like freeing up valued hard drive space and ensuring that your Kernel loads very quickly. In this case the Kernel was built using a config file and installed as a compressed Kernel image along with the tools required to decompress it. Fantastically small, really, but we’ll encounter an issue shortly that resulted in no small amount of cursing.

Step one involved running VMWare Converter Standalone from a Windows XP workstation and connection to a remote Linux machine using SSH credentials. You will know if connecting is a success if you are capable of retrieving machine settings. Step two involves selecting the destination which I chose as an Infrastructure machine and submitted it’s IP address and relevant user credentials. Step three, most ambiguous of steps, was the reconfiguration of the VM I was creating. I chose to keep the exact settings of my physical machine with one exception: I assigned a BusLogic disk controller instead of leaving it IDE. This is because my ESXi host has no IDE controller and will fail to emulate IDE devices. To be honest I learned this during a trial run and was well aware that I’d have to make this change just to get started. I could convert it and reconfigure after the fact but it is actually just as easy to make this change now. The process runs and, after about an hour, it completes based largely on the 10GB disk geometry though it bears noting that about 2.2GB of the 10GB volume contained data.

I did not power down the physical machine at this point, despite having a copy, because I know I will have to work to get my VM online and because it will take some amount of time. During this process I can leave the physical machine up and running without much fear of conflicts occurring.

Over on my ESXi box I check the settings and disable the NICs because if this does come online, and it won’t in my case, I don’t want it interrupting another running machine. I can work on the VM without a network card, though, as you will soon see. When I boot the VM it throws an error because it fails to find a bootable drive which is in no way unexpected. One problem I quickly identify is that my VM is booting a Linux Kernel with absolutely no built-in SCSI or SATA module and this is why I get an immediate boot error. The solution is to mount media for this version of Linux and rebuild the Kernel and I choose to do this the lazy way with a Ubuntu 9.04 LiveDVD I have laying around which also necessitates the addition of a second virtual DVD drive. I choose to mount the LiveDVD to my VM and use CTRL-ALT-INSERT to reboot and press the ESC key to get the boot selector. I choose my DVD drive and the LiveDVD boots up without harming the VM. I then mount the .iso for Debian 3.1 to my second DVD drive.

I usually choose to snapshot the VM at this point just in case I do something painfully stupid. There’s some myths about me I should dispel and fortunately I’ve got little ego: I’ve done painfully stupid things but I’ve learned from them.

The next step is to rebuild an analogue of the VM as if it were a physical machine and to do that you need to do a couple different things. First thing I do is create a mount-point for the disk image I’ve converted and I find out what it should be using “fdisk -l” and it tells me I have a swap of 1GB and a 9GB Linux partition at /dev/sda2 and /dev/sda1 respectively. I don’t care about swapspace but I want to be able to manipulate my root partition so I make a mount point and mount it using “mkdir /mnt/root” and “mount /dev/sda1 /mnt/root” which doesn’t give me any errors.

The next step is to mount a few fancy directories using the bind command because we’re going to have to chroot this sucker like so:

mount -o bind /dev /mnt/root/dev

mount -o bind /proc /mnt/root/proc

chroot /mnt/root

So those commands bind the LiveDVD /dev and /proc to my VM’s eventual disk and then I chroot myself into that disk. The side-effect of this process is that my Debian CD is now mounted as /dev/cdrom1 and I can make a mountpoint and mount it to my filesystem in short order.

I also take this opportunity to use a lesser known apt command so I can grab sources from this CD: apt-cdrom -s add /dev/cdrom1

then I run apt-get update to ensure it is added to my apt sources list. It is deceptively simple to assume this is an unnecessary action but it is going to become a requirement for some of the things we need to do. We need to build a new kernel with support for the “new” SCSI disk we’re going to be using and we need to make sure the machine boots properly. This would be another good time to create a snapshot if you’re looking for extra guidance – anything that works, as a rule, you should snapshot – we can delete the snapshots once we’re up and running.

The next thing I did was inspect the bootloader, which was LILO, which I will be replacing with GRUB. The easiest way to accomplish this task is to run “apt-get remove lilo” and then “apt-get install grub” which accomplishes one of the steps. I also snapshot at this point and use CTRL-ALT-INSERT to force a restart. What I see is that now I get a nasty kernel panic instead of just a boot failure. I restore my snapshot to save some time and we can move on to rebuilding our kernel.

First thing to do when rebuilding the kernel is to pop over to /usr/local/src and verify that sources and a kernel config already exist. I find the config linked to /boot/config-2.2.22-gibberish and when I look inside I see that my BusLogic controller is being loaded as a module. I find my sources in /usr/local/src/linux which are the 2.2.22 kernel sources. I am missing initrd-tools so I install those using apt-get. I change my directory to /usr/local/src/linux and run “make menuconfig” to get a config menu for my kernel. I keep it simple and only change the BusLogic support from Module to built-in after loading the config file from /boot/. When I’m done I use “make dep” and then “make kpkg-clean” before installing the newly created kernel using “dpkg -i /usr/src/.deb”

Finally I run “update-grub” and perform one more snapshot before my dry-run reboot.

This time my VM boots up just fine albeit with some errors because I have disabled my VM NICs. This is easily fixed by clicking on the VM in my inventory and clicking settings and lastly enabling the NICs. Bringing my VM online for an unrelated reason required the addition of a static route but otherwise my VM is operating as expected and much more quickly and reliably than the physical machine which I disable on schedule.

And that is how I generally approach this kind of project – the process is fairly similar with RHEL/CentOS/Fedora but Gentoo is another matter – and I hope this has been helpful. It took me a few days to accomplish this.

Mr. Burns comes to town

dk — Mon, 27 Sep 2010 21:00:11 +0000

Jason came and spent a couple hours with us so we went out and had some dinner and afterward, when Stef went to work, I got rid of some more computer equipment I wasn’t using. Hopefully it helps him figure out what his next step is troubleshooting the failure of his PC. I got my HTPC built and soon I’ll post the build log.

Making decisions: designing small networks

dk — Thu, 16 Sep 2010 02:13:58 +0000

Given more than a few choices it is nearly paralyzing to make a good decision. This becomes more challenging in infotech because there are almost always a dozen ways to accomplish any technical outcome. Applied to the design of a small network the engineer is, from minute one, at odds with themselves. I try, even when examining very large networks, to maintain the KISS principle whenever possible and focus on modularizing components whenever possible. Start at the “top” and work your way to the enduser and then work your way back to the gateway(s) checking for redundancies and loops. Although it is never done without consideration I like to use nontraditional components for routing – maybe a particular location has a need that could be fulfilled by a BSD or Linux based routing device – but a modular approach allows you to replace a proprietary device with something perhaps less conventional and, depending on your experience level, you can collect and analyze performance differences and apply that at some later date.

I’ve been analyzing a smaller network for a few days, accumulating data, and trying to simplify unnecessarily complex segments. The inter-relatedness of all things, however, slows the process and I find myself repairing things as I go. Given a clean slate I wonder what decisions I’d make…

I’ve almost completed the HTPC – I completed the assembly, installed my OS, patched everything, updated all my drivers, updated all software after running Secunia’s vulnerability scanner, and started messing with the network. ‘Mo’s wireless access points are starting to pay their way – after installing dd-wrt on each of three and setting up 2 as repeaters for my wireless segment – my wireless network extends about three times it’s former distance. Of course this also raises questions about how I’m authenticating and whether I want to finally incorporate RADIUS or TACACS on the network. I don’t think I do. Soon I’ll be recording television shows while I watch other television shows – the manchild geek’s dream.

Fall is a good time for projects – it gets colder, damp, and the leaves change – and if I don’t have a project I succumb to seasonal nostalgia. Stefani wants to see the Etsy offices so I feel like I’m going to be owing Chris a favor soon.

Also I’m well aware I owe some project updates – I build a couple routers and wrote up a comparison of JunOS, Untangle, Smoothwall Express, and a basic BSD router running openBGP.

June: a year in review

dk — Thu, 24 Jun 2010 17:36:46 +0000

It feels like June has been going on altogether too long though, given the number of things I’m working on, it should have flown by. June is a month that has defied expectations. I’m taking Network Performance Testing this quarter, against my better judgement, and so far it seems to be a pretty enjoyable class: identifying the relationship that exists between business and technical objectives, trade-offs associated with different priorities, etc. The distance model, which I expected to take to quickly, is unfortunately awkward and, although it is no fault of theirs, my group struggles to maintain reliable and consistent communication. Such is the way of things.

I built my HTPC on Windows 7 (64bit) using an Asus P5G43T-M, a Core 2 Quad, 4GB of DDR3, a simple SAS/SATA RAID controller, a pair of 500GB SATAII drives, and a Hauppage dual-input media center kit. Still futzing with the config though – I considered a SageTV build on Debian or another Linux kernel, but scrapped it.

‘Mo, who abandoned me (see what I did there?), also left me with a few parting gifts in the form of wireless routers so my neighborhood now resonates with the strength of my wireless network. I’m going the DD-WRT route and will engineer a RADIUS server for authentication. You know. When there’s time.

I started distilling much of my older hardware into 2 primary groups: keep and jettison. I’ll eventually get this packrat mentality under control.

I received some really great LPGA tickets, too, with unlimited access to the corporate/hospitality areas for this weekend so expect zero productivity.

I’ve been working on a new virtualization setup at the office – several ESXi hosts in parallel, vCenter in a VM, vMotion, vStorage, Fault Tolerance, and a VM library accessible for loading shelved VMs.

VoIP, Network redesign, and Solaris licensing is really dragging, though.

Windows XP Corrupt Profile

dk — Tue, 08 Jun 2010 00:46:02 +0000

I was an early Windows XP adopter having been an early Windows Server 2000 adopter. Segue: I received a beta copy of Windows 2000 about a year before the official release and I used that copy until XP was available. So here we are in the year 2010, nearly a decade after XP became my Windows environment of choice (when I needed a Windows environment) and I encounter a unique Windows issue for the very first time – my user profile somehow became corrupt.

This manifested in a strange way – during the normal boot process the XP login screen comes up and all profiles are available and, upon selecting a profile, the login process begins. However, shortly after beginning the login process, a strange error pops up indicating that login is not possible because the login profile has likely been damaged.

MSKB article 811151 has a couple suggestions but, from what I gather, this isn’t something you so much recover from as you “fix.” I tried, unsuccessfully, to perform a Windows restore – the initial suggestion – and later created a second user and followed the KB instructions to move all settings to this new user. I consider myself fortunate that this was a success. All I lost was a couple hours.

HTPC: Undiscovered Country

dk — Wed, 26 May 2010 01:02:54 +0000

I don’t have cable TV, so I can’t get a hardware DVR from my cable provider, but I find myself in need ot a DVR – so I’m building one. I got myself an Asus P5G43T-M Pro, an Intel E5570, an X-master chassis, a couple terabyte SATA drives, and 4 Gigs of DDR-3. I’m still waiting on the PCI-e tuner cards, though.

The software I need to do some thinking about – although I enjoyed struggling with the XBMC I think my primary contenders are Windows Media Center and SageTV.

One test-takers record of the GCFA prep

dk — Fri, 07 May 2010 12:28:20 +0000

Over here there you can find a 2 part introduction to one test-taker’s preparation for the GIAC GCFA exam. It’s interesting if only because I’ve never know anyone to talk about the GCFA prep. I was unaware that the exam is open-book and open-notes – so you can build your own cheat-sheet and bring it with you. I’ve directly linked the posts below:

part 1

part 2

Earth Week

dk — Sun, 02 May 2010 20:35:30 +0000

I know Earth week came and went already but it kept me busy: I virtualized or decommissioned a dozen servers and workstations and replaced 11 CRTs with clean LCDs. The total wattage amounts to nearly 24,000 watts and included 4 SunBlades, 3 Dell Workstations, 2 Sunfire workstations, a Java workstation, and 2 Gateway servers as well as a number of enormous CRTs. The side effect of this project was a drop in average temperature in one server room of 6.6 degrees. I used this as an opportunity to perform some much needed cable management as well.

Over the coming week I have a handful of machines marked for decommission and a half dozen new LCDs to deploy.

I’ve been looking into parallel processing lately – one of our products is fairly java intensive and it would be interesting to see what distributed compiling would do for it.