Verifying that a SSL Certificate matches a Key

When configuring SSL under apache, if an error is made, Apache is unlikely to start. This can be a bit of a problem. So when a non-technical person provides you with CRT/KEY and you are expected to install that pair into Apache, while incurring minimal downtime, it can be useful to check the pairs validity before starting. The relevant portion of the key/crt pair is the modulus. It can be checked using the commandline openssl tools.

openssl x509 -in filename.crt -modulus -noout | openssl md5
openssl rsa -in filename.key -modulus -noout | openssl md5

If you want to be ambitious, verify the certificates date ranges as well

openssl x509 -in filename.crt -dates -noout

Hardware Tokens Followup

I was contacted by someone trying to get a Gemalto Ezio Time Token to work with Google Authenticator. It looks like it would be a slightly better solution than the Gooze token because it uses the correct step window (The pam lib wouldn't require being patched). Unfortunately, the only place I can find to purchase them (For use with AWS by Amazon) doesn't provide the seed/key, so no dice. Hopefully they become available with the seed, because they look like nice devices.

Sending File Attachments from the Shell

There is bad news and more bad news on this subject.  The first bad news is there is no simple, standard, default tool that will allow you to do this on the commandline.  The second bad news is that the old standard way to do this seems to have been stopped as a security problem in Outlook.  Specifically, you used to be able to use the 'uuencode' tool piped to 'mail' to accomplish this, but Outlook no longer interprets that as an attachment (probably to fight the spread of viruses).

The old way of doing it

uuencode filename.csv filename.csv | mail -s 'Subject of email' recipient@domain.com

'uuencode' was a fairly common tool and was packaged for most Linux variants and was even installed by default on some.  Now we have to scavenge a bit, but the tool I have used most is 'mpack'.  It is packaged for both Debian and Ubuntu by the distribution, and you can find pre-rolled versions for Redhat/CentOS/etc.  Once you get it installed, using it is easy.

The new way of doing it

mpack -s 'Subject of email' filename.csv recipient@domain.com
echo

Hopefully the target doesn't move again.

Space, I need space

This is nothing new, but it bears repeating so here we are.  Spaces in filenames under Linux are an annoyance, but one that isn't that hard to deal with.  How do I deal with them?

In one offs, the \.  So `ls Annoying\ File\ With\ Spaces`

How to kill the space?

rename 's/ /_/' *

will replace spaces with _ for all files/dirs in the current directory.

How to deal with spaces while using find?

find . -name \*wav -print0 | xargs -0 ls

This terminates files with the null character instead of a space. Both xargs and find need to do this.

ionice is Pretty Darn Nice on IO

I have not often used 'ionice' but I really should be. 'ionice' does for disk IO on linux what standard 'nice' does for processor load. The standard implementation of ionice under linux allows for 3 settings, "Best Effort" "Idle" and "Real Time". The Best Effort setting is the default setting for new processes. Real Time grants priority access above Best Effort. And "Idle" is granted disk access only when another process is not trying to access disk. In this case, we are interested in Idle.

Class:
0 = 2 = None = Best Effort (Medium Priority)
1 = Real Time (High Priority)
3 = Idle (Low Priority)

A standard example would be:

ionice -c3 aide.wrapper --update

This can be used in combination with standard 'nice' to create a uber nice process

ionice -c3 nice -n 19 aide.wrapper --update

References:
Fried CPU
switch-sched.txt in Kernel Source

Getting Medieval on Linux Shutdown

Until today, I had never run into a circumstance where I couldn't reboot a linux box with the 'reboot -f' command.  A reboot this way is definitely not recommended, as it bypasses the system shutdown, doesn't unmount disks, etc.  So always try to use your typical 'shutdown -r now' type of reboot first.

If your machine has a disk error, it is possible that 'shutdown -r now' will never complete.  That is when you can try 'reboot -f'.  If that doesn't complete you have to kick it up a notch and utilize Magic SysRq.

First enable Magic SysRq:

echo 1 > /proc/sys/kernel/sysrq

Then use it remotely to reboot the machine at a very low level:

echo b > /proc/sysrq-trigger

No guarantee you will be able to remotely access that machine again, but it will be going down.

Thanks to http://blog.mohammadzadeh.info/index.php/howto-force-a-immediate-reboot

Windows 8 and Office 2013

I wrote the following for my works intranet forum.  I figured it would serve decently here as well


Having had an opportunity to play with both Windows 8 and Office 2013, I figured I would create a topic here to allow people to see some comments about them.


When you first login to Windows 8, you are presented with a start screen that looks like the Windows Phone, a full screened tiled view that has various tiles to launch apps, software, view news, etc.  One of those tiles is "Desktop"

Once you are at the Desktop, it will look similar to Windows 7, but with a couple of major caveates.
1) No Start button.  There are various third party start button applications, including a decent (if a bit ugly) one that is distributed via Ninite.com.  This fails in my opinion in a business environment where change can be difficult for some people to deal with.
2) It's hip to be square.  There are no rounded corners and curves in Windows 8.  It is designed for full screen on a tablet not on monitors, so the asthetic is that everything be full screen.  This fails in my opinion in a business  environment, where you are more likely to have large monitors and multiples.
Because Microsoft is turning your desktop into a glorified handset, they are pushing "Apps"  Apps are a different paradism than software in how you purchase, maintain, how much they cost, etc etc.  But the big thing is it seems that apps are updated through the MS App Store, not through Microsoft Update which still handles the Operating System, and core software from Microsoft.  Again a big fail for business in my opinion.

Anti-virus is built in to Windows 8 by default.  This is something they should have done 15 years ago, but now it is actually not a great thing for businesses because it conflicts with managed anti-virus.  Specifically, we have no way to have an integrated control panel where we can view the anti-virus status of all the machines under our care with it.  We need to use third party AV, and that can't be installed until Windows Defender is disabled.

Office 2013:
The good:  Multiple windows are back, so you can easily put one spreadsheet on one monitor and a different on the other and work efficiently.

The bad:
Visually I think Office 2013 is awful.  It has inherited the squareness of Windows 8, it also has a terrible color scheme.  These two things added together get rid of all the visual queues I used to tell the end of one window and start of another.  Some of this may be the fact that I am color blind, but there is a decent populace of color blind people.

How emails are visually identified as unread changes, and again I find it less visual obvious than earlier versions.



I guess those are my initial comments, feel free to chime in and disagree with me, tell me how smart I am, etc etc.