HK blog

 I made today a quite simple BASH script that allows to connect two devices running Wireguard (tested with Debian Linux 12, but should work with any device) You can check it out (and fork it if you want) in this Gitlab Page This is the source code as of now, but I could modify it later (any suggestions are welcome) : #!/bin/bash # # AUTOWG written by Hamdi KADRI  # No copyright in any form or kind # This script is intended to create configurations for  # a point-to-point Wireguard connection between a server # and a client (/30 network) # # Step zero: declare configurations as variables servercfg="[Interface] Address = <serverwgIP> SaveConfig = true ListenPort = <port> PrivateKey = <server-privatekey> [Peer] PublicKey = <client-pubkey> AllowedIPs = <clientwgIP> " clientcfg="[Interface] PrivateKey = <client-privatekey> Address = <clientwgIP> [Peer] PublicKey = <server-pubkey> AllowedIPs = 0.0.0.0/0 EndPoint = <serverIP...

 Je propose ici mon avis sur la vulnérabilité "liblzma" du package "xz" que je trouve très "overrated". Il semble que le backdoor CVE-2024-3094 a été très mediatisé, bien que l'impact n'est pas très significatif sur les serveurs en production. Je comprends l'importance des systèmes Linux (qui font tourner Internet) mais ça donne aussi un faux sentiment que la philosophie Opensource a échoué.  - D'une part, les distributions "production ready" qui sont en général connues en tant que "Stable" ou même "LTS" ne déploient pas les dernières versions de XZ. Exemple : Debian, Ubuntu Server 22.04 LTS , RedHat Enterprise Linux, SUSE Linux Enterprise Server, etc. ont toutes des versions de XZ plus anciennes que celle impactée. C'est une philosophie de ne pas déployer les dernières versions des packages avant d'avoir une assurance totale de leur stabilité, surtout dans les environnements de production et les serveu...

 Being an old school user who was very dependant on RSS feeds to keep me updated on my favourite subjects, I spent a lot of time looking for something that could do this in 2024. Surprisingly, I found a tool called "NewsFlash" which looks like it was tailored exactly for people like me, people who can't live without Slashdot , TheHackerNews and TechCrunch ! I am currently daily-driving Linux Manjaro for more than two years on my personal laptop (while unfortunately I have to work on a Win11 system for my regular job) and, being based on Arch Linux, the cutting edge community-driven Linux distribution, Manjaro is able to provide the latest and greatest opensource (and sometimes proprietary) software via its default repositories. You don't even have to do anything "geeky" to install NewsFlash (or any other package in the repositories) since the Pamac Software Manager is really becoming easy and powerful at the same time! This is NewsFlash, very simple and eas...

 In my last post I tried to simulate a site2site VPN connection using Wireguard via VyOS, my favourite router. It was very easy to implement but the performance was not that great on GNS3. It was not a VyOS issue at all, GNS3 is just a simulation tool and we can't expect real world performance in it, even if it uses Qemu and Linux virtual networking for that end. To prove that, I made the following simple iperf3 test using 3 VyOS routers on GNS3 : No VPN, just simple routing via connected routes through VyOS1.3-3. The result was similar to my Wireguard throughput test, of course considering the header size of Wireguard packets : In my Wireguard test, I reached a bitrate of 53.8 Mbps, which is almost 76% of total bandwidth, and it's a good result, but I had to verify if VyOS is able to route at a greater bitrate. For just that, I created a VyOS VM on VirtualBox and connected two other VyOS VMs to it's interfaces, and made an iperf3 test. The result was clearly better : Reach...

 This is something I had in mind but didn't find the time to accomplish before. It just took a very cold day to convince me that I have to play with Wireguard on VyOS. I used GNS3 of course, on my personal Linux laptop to create this setup. Of course the performance was not that great since it is just a simulation.  In real life, I am using Wireguard on a 10 years old Raspberry Pi Model B and amazingly with just a 700MHz single core ARM CPU and less than 512 MB of RAM I had a decent and stable permanent Wireguard tunnel. (My bandwidth would reach 24 Mbps without issue) Back to my simulation, this is what it looks like : Quick explanation: the VYOS routers labeled IPERF1 and IPERF2 are only used for an iperf3 test, which was able to reach about 50 to 60 Mbps each time. It ain't much but it was honest (and free) secure bandwidth! I won't get into the details of this setup but I will just post the two most important configurations : R-East and R-West : #### VYOS WireGuard Site...

Create encrypted FS in a file #Create a file and allocate its size : here 1GB dd if=/dev/zero of=encrypteddrive bs=1024 count=1048576 #Setup the encrypted file cryptsetup -y luksFormat encrypteddrive (enter passphrase and confirm) #Open the Encrypted device sudo cryptsetup luksOpen encrypteddrive secretdata  (enter password)    #Create an EXT4 filesystem inside the encrypted file sudo mkfs.ext4 /dev/mapper/secretdata #Create a directory to be the mountpoint mkdir ../mp-encrypted #Mount the encrypted FS  sudo mount /dev/mapper/secretdata ../mp-encrypted/ #After use, unmount the encrypted FS and close the encrypted file sudo umount  ../mp-encrypted/ sudo cryptsetup luksClose secretdata Use: #To access Data, open the file and mount it sudo cryptsetup luksOpen encrypteddrive secretdata sudo mount /dev/mapper/secretdata ../mp-encrypted/ #To close after use, unmount the partition and close the file sudo umount  ../mp-encrypted/ sudo cryptsetup luksClose secretdat...

 For a basic usage of GNS3, some configuration is needed after you install "gns3" and "gns3-server" in your Manjaro or Arch Linux machine. Required group permissions for the linux user are "wireshark" (for using the live capture of packets) and "libvirt" (for using virtualization capabilities, required for example for NAT, as mentioned in the previous blog entry). Commands to execute are : sudo usermod -aG wireshark user sudo usermod -aG libvirt user replace "user" with your username for the Linux session. 

Problem: You can't add a NAT connection to your GNS3 simulation, and you get the error : "ERROR template_manager:226 Error while creating node from template: NAT interface virbr0 is missing, please install libvirt" Steps to resolve: 1- Create a file named /tmp/default.xml 2- Paste this content and save: <network>   <name>default</name>   <bridge name="virbr0"/>   <forward mode="nat"/>   <ip address="192.168.123.1" netmask="255.255.255.0">     <dhcp>       <range start="192.168.123.2" end="192.168.123.254"/>     </dhcp>   </ip> </network> 3- Execute the following commands in your shell : virsh net-define /tmp/default.xml sudo virsh net-start default sudo virsh net-autostart default  

 Based on this VyOS knowledge base article  , restarting the routing daemons, like OSPF, would be as easy as typing "restart ospf". But while working on a VyOS 1.3 appliance in GNS3, I couldn't simply do that : it turns out that VyOS now uses FRRouting, and this implies a new command syntax. The correct command to restart ospfd for example is now : "restart frr ospf". The same thing applies for other routing protocols.

Imagine Debian was a rolling release Microsoft doesn't spy on you Imagine Youtube with no ads facebook and twitter too Imagine Apple was cheaper And Sun Microsystems still here Imagine C with no pointers it's easy if you do Imagine there is no secure boot bloatware not on ubuntu Imagine all the systems being free and opensource ! You may say I'm a dreamer But I'm not the only one I hope someday you'll join us And the internet will be as one

( Cet article a été publié originalement dans le magazine de la 7ème édition du Forum DSI International )   L’informatique joue un rôle central dans le monde d’aujourd’hui, et ça va continuer tant que la technologie progresse : la sécurité informatique sera par conséquent un des enjeux principaux de l’humanité.  Le virus, un objet minuscule et inaperçu, a une très grande ressemblance avec les programmes informatiques. Cet agent qui infecte son hôte, généralement une cellule vivante, et se réplique, n’est même pas considéré comme un être vivant. Toutefois, en injectant ses éléments génétiques dans le génome de son hôte, il arrive à se reproduire et envahir plus de cellules, voire des organes entiers.  Le mode opératoire d’un virus informatique n’est pas vraiment très différent. Historiquement, le premier virus informatique, nommé « Creeper », a été développé pour des fins pédagogiques. Il a fallu attendre 15 années pour l’apparition d’un virus informatique en dehors de l’e...

 A man arrives at a hotel after a long train journey, exhausted. He comes into a communal room and sees three other guys who are drunk and talking loudly. They are cracking anti-government jokes and laughing at Khrushchev. The man is annoyed that he can’t sleep so he hatches a plan. He walks out into a corridor and asks a staff member to bring him a cup of tea. He then comes back into the room and starts talking to the noisy fellows:  “Comrades, you shouldn’t joke like that here. Every room is bugged, you know...”  “Nonsense! Who would listen to us?”  “Well, let me show you”  The man walks up to a socket and says into it:  “Comrade major, can I have a cup of tea please?”  Sure enough, the staff member soon enters with a cup of tea.  “See, told you.”  The three men are pale and quiet for the entire night, so the tired man finally gets some good sleep.  He wakes up the next morning alone. He walks downstairs and asks the receptionist about...

 

It's the best way to test your  new machine. The tool doesn't require any installation, and the result is clear and simple. PS: I installed an external monitor to force the benchmark tool to test my Nvidia GeForce GTX 1660TI since it can't test it in normal mode. Results: UserBenchmarks: Game 62%, Desk 94%, Work 65% CPU: AMD Ryzen 7 4800H - 90.3% GPU: AMD RX Vega 8 4000 (iGPU) - 15.2% GPU: Nvidia GTX 1660-Ti (Mobile Max-Q) - 60.9% SSD: WDC PC SN530 SDBPNPZ-512G-1006 512GB - 223.8% RAM: Micron 8ATF2G64HZ-3G2E1 CT16G4SFRA32A.C8FE 32GB - 104.3% MBD: HP Pavilion Gaming Laptop 15-ec1xxx Comment: Very good CPU, decent GPU even for gaming, and a very fast NVMe drive. I'm quite satisfied with it.  AMD Ryzen is really performant and is considered the best CPU to go with nowadays for PCs and Workstations.  The Western Digital NVMe Drive is also amazing. Its read/write speed is impressive. Despite the weird look, this laptop is very good from a performance point of view. Full Benc...

 Si vous désirez que votre pavé numérique soit toujours activé dans Windows, voici la procédure : Cliquer avec le bouton droit sur le bouton démarrer et choisir "Exécuter" Taper "regedit" puis Entrée Naviguer dans l'éditeur de registre comme suit : "HKEY_USERS" --> ".DEFAULT" --> "Control Panel" --> "Keyboard". Double-cliquer sur "InitialKeyboardIndicators" Dans le champ "Données de la valeur" changer la valeur à "2147483650" Cliquer sur "OK" pour valider, quitter l'éditeur de registre et redémarrer la machine. Dorénavant, le pavé numérique sera actif par défaut !

If you are using Hypnotix for IPTV on Linux Mint or Other distro, there is an issue with editing or removing IPTV providers. According to this GitHub issue , it is related to a python script that should be modified. You need to be root to correct this issue. Steps : 1- Open the terminal and "sudo su" to earn root privileges 2- "cd /usr/lib/hypnotix" 3- Open the file "hypnotix.py" in your editor, for example "nano hypnotix.py" 4- Search for the string "name=provider.name" and replace it with "provider.name" 5- Save and close the file

 If you need to create a standard ASA ACL from/to Tunisian public IPs (for VPN for example), you can use this object group. object-group network Tunisia-Pool  network-object 102.104.0.0 255.248.0.0  network-object 102.128.0.0 255.255.192.0  network-object 102.141.204.0 255.255.254.0  network-object 102.152.0.0 255.248.0.0  network-object 102.164.112.0 255.255.254.0  network-object 102.168.0.0 255.248.0.0  network-object 102.24.0.0 255.248.0.0  network-object 102.240.0.0 255.252.0.0  network-object host 129.242.25.232  network-object 154.104.0.0 255.248.0.0  network-object 154.72.224.0 255.255.240.0  network-object 157.167.110.0 255.255.255.0  network-object 160.156.0.0 255.252.0.0  network-object 164.160.0.0 255.255.252.0  network-object 165.50.0.0 255.254.0.0  network-object 169.255.68.0 255.255.255.0  network-object 169.255.70.0 255.255.254.0  network-object 192.68.138.0 255.255.255.0  ...

If you like Seafile, you can deploy it in your organization easily. I did that a couple of years ago and it is always working fine under Debian (my favourite distro). However, today I thought of deploying a second server, which will be more important. Following the setup procedure under CentOS, everything was fine (I used this link :  https://manual.seafile.com/deploy/using_mysql.html ) but the web interfacewasn't working! I checked Firewalld, SELinux, MariaDB, Logs everywhere... Nothing was really weird, except a new file that I wasn't used to it : gunicorn.conf! Well, that file was a new addition to Seafile starting from 6.3! and it seems that in my configuration, the server was bound to... 127.0.0.1:8000! I just changed that, restarted Seafile and Seahub, and it worked! Hoping that would help someone, someday :)

Environnement : VMware Workstation, VyOS 1.2.0 et Windows 7 Schéma : [laptop1]--[R1]--[R]--[R2]--[laptop2] laptop1 : 192.168.111.2/24 sans passerelle laptop2 : 192.168.111.3/24 sans passerelle R1 : eth0 vers R : 172.30.30.2/29 eth1 vers laptop1 : sans adressage R : eth0 vers R1 : 172.30.30.1/29 eth1 vers R2 : 172.31.31.1/29 R2 : eth0 vers R : 172.31.31.2/29 eth1 vers laptop2 : sans adressage Configuration sur R1 : set interfaces bridge br0 aging 300 set interfaces bridge br0 max-age 20 set interfaces bridge br0 priority 0 set interfaces bridge br0 stp false set interfaces ethernet eth1 bridge-group bridge br0 set protocols static route 0.0.0.0/0 next-hop 172.30.30.1 set interfaces l2tpv3 l2tpeth0 bridge-group bridge br0 set interfaces l2tpv3 l2tpeth0 destination-port 10000 set interfaces l2tpv3 l2tpeth0 encapsulation udp set interfaces l2tpv3 l2tpeth0 local-ip 172.30.30.2 set interfaces l2tpv3 l2tpeth0 peer-session-id 1 set interfaces l2tpv3 l2tpeth0 pe...