ben

1196 Articles

apiculture, self sustainability

Further inspection showed that the comb on the floor was most likely a mis-attached comb that fell from a top-bar. The bees weren’t exactly expanding on it but they weren’t removing it either, it was time to give them some help. Doing so was like playing a game of Operation but it went very smoothly and the bees  were very docile even though I was digging pretty deep in their hive.

Not much in this wreck of a comb but the bees were still tending to some brood in there.

Going at it very carefully.

I’ll leave them to clean the remaining pieces.

Eventually one of the back bars that I had set aside was abandoned of all bees so… I just took it! Not necessarily the best thing to do but I was very eager to taste what the bees were up to. And it was delicious.

From comb,

To sweet nectar.

It tasted very much like a mix between sap & honey, super good.

apiculture, self sustainability

I inspected my hive today and it’s doing great. I drilled a few holes in the part that is currently uninhabited to give the bees some air. I did it early in the morning to lock them inside for the drilling, they took it really well and didn’t care a bit about the ruckus, even after I released them. I continued on merrily with the inspection as if nothing happened.

A few holes for aeration in the middle of the hive, I stapled netting to prevent robbing and to make sure they don’t become an entrance.


Honey!

Today’s surprise though, came with the presence of comb on the floor. I’m not sure if this fell from one of the top bars but I doubt it. I don’t know what to do with it right now, I’ll monitor the situation and decide later whether to remove it or not.

The mess

I.T., unix / linux

Because we don’t necessarily want the home lens to be the default one in Unity, and unlike other lenses it is hardcoded left & right. Here’s a little trick that will let you pick a different lens as the default for when you click on Dash.

edit the file: /usr/share/unity-2d/shell/dash/Dash.qml

replace line 79 “onDashActivateHome: activateHome()” by “onDashActivateHome: activateLens(X)” where X is the index of the lens you want to load (count from left to right starting from 0).

You’ll want to restart Unity for this to take effect.

Done!

I.T., maniacal paranoia, unix / linux

So here we are, 2012 and physical media are going away really fast. We won’t even talk about CDs which have been relegated to the role of plastic dust collectors; hard drives even are being abstracted by a myriad of cloud based solutions. Their purpose is shifting towards a container for the OS and nothing else. Filesystems & their hierarchies become hidden in a bid to remove any need to organize files, rather, you are supposed to throw it all up in the cloud and search on metadata.

While moving away from physical media is convenient and inevitable, I like the hierarchical organization that directories provide. What’s more intuitive than a labeled container with stuff in it?

How can we detach our hard drives from their physical shells, move them around in an omnipresent cloud and keep them secure?

By creating a file, attaching it to loopback & creating an encrypted partition in it!

Here’s how to do it
  • Create a file that will be your soft hard drive with:

[bash]dd if=/dev/zero of=/tmp/ffs bs=1024 count=524288[/bash]

This will create a 512MB file (524288/1024).

  • Make sure that the loopback device #0 is free:

[bash]losetup /dev/loop0[/bash]

You should see something telling you that there is “No such device or address”.

  • Attach the soft hard drive to the loopback device:

[bash]sudo losetup /dev/loop0 /tmp/ffs[/bash]

  • And then make sure it was indeed attached by re-running:

[bash]losetup /dev/loop0[/bash]

  • Create an encrypted partition on your attached soft hard drive:

[bash]sudo cryptsetup –verify-passphrase luksFormat /dev/loop0 -c aes -s 256 -h sha256[/bash]

  • Open your encrypted partition:

[bash]sudo cryptsetup luksOpen /dev/loop0 ffs[/bash]

  • Create a filesystem in it:

[bash]sudo mkfs.ext3 -m 1 /dev/mapper/ffs[/bash]

  • And mount it like a regular disk:

[bash]sudo mount /dev/mapper/ffs /mnt[/bash]

  • When you are done using your encrypted soft hard drive you will want to umount it:

[bash]sudo umount /mnt[/bash]

  • Close it:

[bash]sudo cryptsetup luksClose ffs[/bash]

  • Detach it from loopback:

[bash]losetup -d /dev/loop0[/bash]

These steps can be automated of course. As a quick reminder, using the drive goes “loopback attach -> crypt open -> mount” and when you’re done it’s “umount -> crypt close -> loopback detach”.

That’s it! media-less & secure storage.

Tested on: Ubuntu 12.04 64b

I.T., maniacal paranoia

Download

crackzor_1.1.c.gz

Previous versions:

crackzor_1.0.c.gz

Quick start
  1. Download & extract with “tar zxvf crackzor_1.0.tar.gz”
  2. Make sure you have the right packages in place

    [bash]sudo apt-get install build-essential libopenmpi-dev openmpi-bin libssl-dev[/bash]

  3. Compile with

    [bash]mpicc -O3 crackzor.c -o crackzor -lm -lssl -lcrypto[/bash]

  4. Create a file called “machines” containing a newline separated list of every machine that are in your cluster, for example:

    [code]machine00.domain.com
    machine01.domain.com
    machine02.domain.com
    machine03.domain.com
    machine04.domain.com[/code]

  5. Open MPI uses SSH for communication between nodes, as such, you need to make sure that the node you will be launching crakzor from is able to do SSH key based authentication to all the other nodes in the cluster. For my example above, if machine00 is where you will be working from, you will want to

    [bash]ssh-copy-id machine0X.domain.com[/bash]

    where X E [0,4] (yes, machine00 needs to be able to SSH to itself).

  6. You now need to disseminate your executable across all the machines that will be running it:

    [bash]for machine in `cat machines`; do scp crackzor $machine:~; done[/bash]

    Pro-tip: having network storage attached to all the machines makes this step unnecessary.

  7. Run with:

    [bash]mpirun -npernode Y -machinefile machines crackzor fbade9e36a3f36d3d676c1b808451dd7 abcdefghijklmnopqrstuvwxzy 1 1[/bash]

    where Y is the number of cores each machine in your cluster has. If you are running this on machines with 2 CPUs with 8 cores each, Y = 8 * 2 = 16.

Tested on Ubuntu 10.04 64b / Ubuntu 12.04 64b / Ubuntu 14.04 64b

Screenshots

[bash]mpirun -npernode 16 -machinefile machines ./crackzor 7ca4793dcdff46ecda38e48d65b6c913 abcdefghijklmnopqrstuvwxzyABCDEFGHIJKLMNOPQRSTUVWXYZ 1 7[/bash]

This is what “htop” looks like with a bunch of processes spawned & hammering every core:

Statistics

For the purpose of testing crackzor, we give it the md5 hash of an 8 character word and tell it to bruteforce it up to 7 characters. This insures that we will compute every permutation up to 7 character longs. The characters I asked it to permute are “abcdefghijklmnopqrstuvwxzyABCDEFGHIJKLMNOPQRSTUVWXYZ”, our sample space size is thus 52^7 + 52^6 + 52^5 + 52^4 + 52^3 + 52^2 + 52^1 = 1,048,229,971,204.

Here is the raw data, and here it is graphed:

I wish it would show the linear progression more but 3 things got in the way:

  1. approaching the machine’s actual number of cores on the Dell blades leaves little room for linear expansion
  2. which is emphasized in a multiuser environment where other users run other computation
  3. the EC2 bar flattens the graph a bit but I still wanted to show how it compares

Ideally I would run through a few iterations of EC2 to observe its progression but hey, it’s expensive :).

Limitations
  • Right now, the only hashing algorithm supported by crackzor is MD5. It can very easily be expanded upon.
  • I also may not be using the fastest MD5 method with the fastest call, distribution is what I’m interested in.
  • Distributing password cracking among multiple machines is throwing linear resources to an exponential problem!
apiculture, self sustainability

Well, this is it. After much prep work I have finally released my first package of bees in the hive. Everything did not go according to plan, the candy separating the queen from the rest of the colony had already been eaten. As a result the queen did not get a chance to be released by the workers. I managed to keep her in there while I was releasing the remaining 3lbs of bees. Things went well other than this and I am hopeful that she’ll be accepted by the others as they had been traveling together for a while. I’ll try and locate her in a couple of days and if I can’t find her, I will rush order another queen. It’s nice that I get another shot if needed.

All the extensive information I gathered online (various blogs, Youtube videos) prepared me pretty well for what to do. Nothing however can prepare you for the experience of handling a liquid-like swarm of buzzing bees. It was very impressive & I was definitely glad I got a full suit. Not that they were even really pissed at me for shaking them in their new hive. But it felt like a wrong move could change everything for the worse very fast. I eventually learned to trust my suit.

I went back to install an electric fence with a friend the next morning (bears & skunks are an issue in the area), no buzzing was to be heard. Nothing at all, I opened a couple of bars and couldn’t see a thing. Finally I found them on a few bars and disturbing them made the whole swarm start the day. It was super cool to see them do their thing.

The hive in its final location, with a new roof & fenced in to withstand the local wildlife

The hive actually faces an orchard which is starting to bloom, perfect timing for some pollination help. I intend on taking more pictures in a few days.

apiculture, self sustainability

The bars’ width is already at the optimal length at which bees build their combs, but to make sure they get it right we guide them by pouring wax along the middle of the bars. Supposedly they’ll know to expand on it.

Might as well use the remaining wax for something

I.T., unix / linux

Not all cron jobs are created equal, and some of them can afford to fail sporadically before we need to worry about them. Maybe they rely on a third party server, and we don’t want the occasional fail to pollute our inbox.

Here is a little cron job wrapper I created that will suppress stderr but keeps track of the job’s returned exit codes. Above a certain threshold of consecutive abnormal exits it doesn’t suppress stderr anymore.

[bash]

# if the counter file doesn’t already exist we create/initialize it
if [ ! -f /tmp/counter_ri7g3 ] ;
then
echo 0 > /tmp/counter_ri7g3 ;
fi ;

# we pull the current counter
counter=`cat /tmp/counter_ri7g3` ;

# if the counter is still small, we send stderr to /dev/null
if [ $counter -lt 5 ] ;
then
$1 > /dev/null 2>&1 ;
# otherwise stderr will follow its normal path and find its way to email
else
$1 > /dev/null ;
fi ;

# lastly if running the $1 resulted in an abnormal exit, the counter is incremented
if [ ! $? = 0 ] ;
then
counter=`cat /tmp/counter_ri7g3` ;
echo "$counter+1" | bc > /tmp/counter_ri7g3 ;
# and if $1 exited normally, we reset the counter
else
echo 0 > /tmp/counter_ri7g3 ;
fi ;

[/bash]

a cron entry calling it looks as such:

[bash]

30 * * * * root /usr/local/bin/cron_wrapper "/path/to/script arg_1 arg_2"

[/bash]

I.T., maniacal paranoia

Download

ipv6_surface_analyzer_1.0.tar.gz

Quick Start

    1. make sure that nmap, ifconfig & arping are installed and in your path
    2. run as root

    tested on Ubuntu 11.10 64b

    Screenshot

    (actual ips obfuscated)

    Purpose

    With more devices coming IPv6 ready out of the box, a shadow network is emerging that nobody is paying attention to.

    There’s Joe sysadmin, configuring a tight firewall for this new server, default deny, very restrictive & all. This is great but did he realize that there is nothing in front of IPv6? We are used to setting up iptables, ipfw, et cetera. Unfortunately ip6tables & ip6fw too often get forgotten.

    With IPv4, a device was manually configured or wasn’t configured until it got an address from DHCP. With IPv6 a device that is not manually configured will hop on the network with a link-local address and try to further discover its settings. In fact, IPv6 reserves a range of addresses for network discovery, these link-local addresses are based on the device’s mac address.

    Here is what ipv6_surface_analyzer.py does:

    • iterate through a given IPv4 range
    • for each address in the range, discover if a host sits behind it
    • port scan potentially found host on IPv4
    • infer IPv6 link-local address of host based on its mac address
    • port scan inferred IPv6 address

    The purpose of which is to establish by how much your attack surface is augmented by link-local IPv6.

    This threat threat is somewhat mitigated by its local nature and there are 2 reasons why:

    1. link-local isn’t routed and thus your visibility is bound to networks you have a presence on.
    2. Getting a host’s mac address is only possible while being on the same network.

    Local as it may be, having a shadow network providing a way to circumvent firewalls is quite risky.

    all out geekery, I.T.

    Here’s another project that’s been on the back burner for a while: my new Mame box:

    This is the 5th arcade cabinet I turn into a Mame box. Gutting them always breaks my heart but having all the games in one cabinet with original artwork is very much worth it. The X-men cabinet is spacious, easy to work with and looks great.

    The buttons and joysticks were bought from X-arcade: www.xgaming.com

    And the control board to make them interface with a PC is an Ipac2: www.ultimarc.com

    all out geekery, I.T.

    The converter

    It can also be addressed directly via:
    https://ben.akrin.com/ipv6_mac_address_to_link_local_converter/?mode=api&mac=52:74:f2:b1:a8:7f
    for all your API needs.

    The math

    Link-local IPv6 addresses are used as part of the IPv6 network auto-configuration process. Instead of getting an address via DHCP, a NIC will hop on the network with a link-local IPv6 address and with this will have to ability to do further configuration automatically (soliciting neighbors, router, et cetera).

    This link-local IPv6 is infered from the NIC’s mac address.

    A mac address is 48 bits, an IPv6 address is 128 bits. Here’s the conversion process step by step:

    1. take the mac address: for example 52:74:f2:b1:a8:7f
    2. throw ff:fe in the middle: 52:74:f2:ff:fe:b1:a8:7f
    3. reformat to IPv6 notation 5274:f2ff:feb1:a87f
    4. convert the first octet from hexadecimal to binary: 52 -> 01010010
    5. invert the bit at index 6 (counting from 0): 01010010 -> 01010000
    6. convert octet back to hexadecimal: 01010000 -> 50
    7. replace first octet with newly calculated one: 5074:f2ff:feb1:a87f
    8. prepend the link-local prefix: fe80::5074:f2ff:feb1:a87f
    9. done!

    Going the other way

    A converter to do the same operation in reverse is available here.

    Comments

    There have been a few interesting comments on this post, I encourage you to read them if you want to learn more about this mechanism. Specifically:

    apiculture, self sustainability

    Modeling in Google Sketchup really helped make building fast & seamless. The 2x12x16 are very thick so the hive weights a ton, on the other hand joining pieces was really easy as there is much surface for glue and screws. And I hope this will provide some good insulation against New England winters.

    3D modeling / printing, apiculture, I.T., self sustainability

    Here’s a Google Sketchup design for a simple top-bar beehive.

    Some pics:


    Notes:

    Only 2 measurements really matter in the design of a top-bar beehive: the angle of the side panels (70 degrees) & the width of the top bars 35mm. They both pertain to bee behavior and this design has them both optimized. From what I gather, other measures are quite forgiving.

    This design is simple & well researched, I do not know yet how it will fare in practice, more to come on that.

    Material:

    All you’ll need as far as wood is concerned is a couple of 2x12x16 and a 3/4″ sheet of plywood:

    Lastly, all units are in millimeters but based on standard lumber sizes available at the hardware store.

    miscellaneous

    My wife & I have just released our first children story! As an app for iOS devices. This is the achievement of what started innocently as a small project reading stories to mp3. Months of work, huge investment for the art, it feels great to have put this project behind us.

    My only hope now is that the market gods will treat us well.

    Here it is in all its glory:
    English version: http://itunes.apple.com/us/app/id480065432
    Hungarian version: http://itunes.apple.com/us/app/id480080998
    French version: http://itunes.apple.com/us/app/id480175112

    I.T., maniacal paranoia, unix / linux

    The problem with PAM based 2FA:
    • PAM does not get called when the SSH daemon does key based authentication. So your 2FA there only works with password authentication. This might be something you want but maybe not.
    • A PAM module based solution to 2FA is harder to implement
    The solution: Poor man’s 2FA!

    It is possible to add the ForceCommand directive to your sshd_config. Like the name suggests it simply runs a command after authentication and before the shell is spawned. This is a good spot to add an extra check, say another factor for authentication.

    The code:

    [bash]#!/bin/bash
    trap "echo "I’m sorry Dave. I’m afraid I can’t do that."; sleep 1 ; kill -9 $PPID ; exit 1" 2 20
    code=`od -a -A n /dev/urandom | head -2 | tr -d ‘ ‘ | tr -d ‘n’ | sed ‘s/[^a-zA-Z0-9]//g’ | awk ‘{print substr($0,1,5)}’`
    echo -e "Subject:$code\nFrom:root@server <root@server.com>\n2FA code in subject" | sendmail phone_number@carrier.com
    read input
    if [ $code = $input ];
    then
    `awk -F: ‘($1 == $LOGNAME) { print $7 }’ /etc/passwd`
    else
    kill -9 $PPID
    fi[/bash]

    That’s it really, save this to an executable file, replace the obvious variables and ForceCommand its ass.

    Theme by Bloompixel. Proudly Powered by WordPress