Techie-Log

Perl @INC (path for perl libraries) -- sleuthkit/autopsy error

2007-11-05T12:52:00.000-08:00

Autopsy/Sleuthkit Error in console when trying to create timeline:

Can't locate Date/Manip.pm in @INC (@INC contains: /home/me/Desktop/sleuthkit-2.09/src/timeline//../../lib/ /etc/perl /usr/local/lib/perl/5.8.8 /usr/local/share/perl/5.8.8 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl .) at /usr/local/sleuthkit/bin/mactime line 50.
BEGIN failed--compilation aborted at /usr/local/sleuthkit/bin/mactime line 50.

Fix:
What is @INC?

Appending to Perl's @INC array

The @INC array is a list of directories Perl searches when attempting to load modules. To display the current contents of the @INC array:

# perl -e "print join(\"\n\", @INC);"
Add the directory to the PERL5LIB environment variable (in the same terminal window where autopsy will be started):
# export PERL5LIB=/usr/local/sleuthkit/lib

http://www.brandonhutchinson.com/perl_inc.html
http://www.wellho.net/mouth/588_Changing-INC-where-Perl-loads-its-modules.html

Forensics - USB drives

2007-11-02T05:21:00.000-07:00

Windows Forensics and Incident Recovery

http://www.networksecurityarchive.org/html/Computer-Forensics/2005-02/msg00001.html

1. When you connect a USB storage device to a Windows system
(2K, XP, 2K3), Registry keys are created. If they don't
already exist, the HKLM\System\CurrentControlSet\Enum\USBStor
key is created. Beneath that key, a subkey containing the
vendor name is created, and beneath the "vendor key", a key
with a unique name is created for each device (I'll call this
the "unique key"). On a test XP system, it looks like this:

HKLM\System\CurrentControlSet\Enum\USBStor
\Disk&Ven_LEXAR&Prod_DIGITAL_FILM&Rev_/W1.
\7&276114a5&0&______________040719030000008093F300000000000&0

Juniper (NetScreen) Firewall, PPTP stopped working after upgrade

2007-09-18T08:57:00.000-07:00

You should be using the NetScreen-Remote client. But you might be using PPTP since the VPN client does not yet support Vista.

Anyway, in the upgrade to v5.4.0R6, I found that PPTP into a MIP of the Firewall was no longer working.

PPTP is a service installed by default. I created a new service called pptp-custom and put in the correct definition, which is: TCP port 1723, and IP protocol 47. After I replaced the NetScreen "PPTP" with my own "pptp-custom" in the inbound rule, PPTP was able to work again.

I guess the service definition had changed in the upgrade.

Juniper (NetScreen) Firewall - How to configure a traffic shaping policy

2007-09-11T07:36:00.000-07:00

1.       You can create a high priority traffic policy for specific
traffic. Please refer following document:
http://Kb.juniper.net/KB4201

2.       You should set the external interface bandwidth to match the internet
pipe (even if there's another 100mbit router hop). Setting up BW greater than or lower than the actual BW can cause
drop in packets due to calculation mismatch. This is how the fw knows what the external limit is.

keywords: bandwidth shaping, QoS, bandwidth limit, guaranteed bandwidth, ScreenOS

"inbound packet failed validation" netscreen

2007-09-06T06:28:00.000-07:00

Connecting to NS25 running 5.4R6 using NetScreen-Remote VPN client 8.x.

Seen on NetScreen-Remote log viewer:
"inbound packet failed validation" netscreen

But pings into the network work fine...

Persistent connection from Windows XP home to a domain share

2007-09-03T14:27:00.000-07:00

C:\> net use P: \\mydomain\sharename /user:jsmith /savecred /persistent:yes

Change Microsoft Office default install source location

2007-05-30T09:52:00.000-07:00

As an administrator, run:

C:\>MSIEXEC /i e:\data1.msi REINSTALL=ALL REINSTALLMODE=vomus /qb

(This was MS Office 2000, so that's why the path is to the msi file data1.msi).

Window will pop up and bar will move across, finally it will finish on its own.

Turn off ipv6 in RedHat Fedora

2007-05-12T06:55:00.000-07:00

To disable IPV6: As root, you must add the line: "alias net-pf-10 off" (without quotes)
to the end of your /etc/modprobe.conf file.

You might also have to add (wouldn't hurt, I put both and it worked for me):
"alias ipv6 off"

Secure Deletion in Linux

2007-03-20T06:55:00.000-07:00

Securely delete files recursively in Linux:
find . -name *.tar.gz -type f -exec shred -u {} \;

Kubuntu: Virtualbox packages needed

2007-03-16T23:58:00.000-07:00

me@splatform:~/Desktop$ sudo apt-get install ./VirtualBox_1.3.8_Ubuntu_edgy_i386.deb
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package .
keith@splatform:~/Desktop$ man apt-get
Reformatting apt-get(8), please wait...
keith@splatform:~/Desktop$ sudo dpkg -i ./VirtualBox_1.3.8_Ubuntu_edgy_i386.deb
Selecting previously deselected package virtualbox.
(Reading database ... 100143 files and directories currently installed.)
Unpacking virtualbox (from .../VirtualBox_1.3.8_Ubuntu_edgy_i386.deb) ...
dpkg: dependency problems prevent configuration of virtualbox:
virtualbox depends on libxalan110; however:
Package libxalan110 is not installed.
virtualbox depends on libxerces27; however:
Package libxerces27 is not installed.
dpkg: error processing virtualbox (--install):
dependency problems - leaving unconfigured
Errors were encountered while processing:
virtualbox
me@splatform:~/Desktop$

See http://www.virtualbox.org/ticket/34
They say:
1. Install packages "libc6-dev" and "linux-libc-dev" 2. Uninstall 1.3.2 package 3. Install 1.3.4 package
Now you should be running 1.3.4 with no problems.

BUT:
me@splatform:~/Desktop$ sudo apt-get install libc6-dev linux-libc-dev
Reading package lists... Done
Building dependency tree
Reading state information... Done
libc6-dev is already the newest version.
linux-libc-dev is already the newest version.
You might want to run `apt-get -f install' to correct these:
The following packages have unmet dependencies:
virtualbox: Depends: libxalan110 but it is not installable
Depends: libxerces27 but it is not installable
E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution).
me@splatform:~/Desktop$
Did that, removed virtualbox, those pkgs were still there. Reinstalled virtualbox, same complaints.

Service commands

2006-06-09T11:18:00.000-07:00

Commands for the service:
# service ntpd start|stop|restart

Set it to start on boot:
# chkconfig ntpd on

Check if it's running (returns process #)
# pgrep chkconfig

All about SELinux

2006-06-09T11:14:00.000-07:00

http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/rhlcommon-section-0068.html

Check it:
# sestatus (output tells what config file says, and the current status too)
Enable it:
# setenforce 1
Disable it:
# setenforce 0

See /etc/selinux directory for config file.

Why does this process crash?

2006-06-09T10:57:00.000-07:00

See http://www.redhat.com/archives/rhl-devel-list/2005-May/msg00026.html

Example: ntpd, crashes immediately:
Install gdb and the debug symbols for the executable:
# yum install gdb
# yum install ntp-debuginfo
# yum install which (I needed that utility to use the execstack specifically)

# gdb (gdb) set args -n -u ntp:ntp -p /var/run/ntpd.pid (gdb) run
(gdb) run Starting program: /usr/sbin/ntpd -n -u ntp:ntp -p /var/run/ntpd.pid

Program received signal SIGSEGV, Segmentation fault. 0x00cbed30 in vfprintf () from /lib/tls/libc.so.6 (gdb) bt
I used the execstack workaround.

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=145258

on 2005-04-25 03:47 EST

I can confirm that whis bug exists in up2dated FC3. I think it can have
something in common with bug #151262 (duplicate or depend).

There's a workaround for this issue. If an ntpd is started with:
    setarch i386 -L ntpd -u ntp:ntp -p /var/run/ntpd.pid
it doesn't crash.

on 2005-04-25 11:17 EST

Another workaround:
Disable exec-shield-randomize by
    echo 0 > /proc/sys/kernel/exec-shield-randomize
or
    echo kernel.exec-shield-randomize = 1 >> /etc/sysctl.conf

on 2005-04-26 07:05 EST

Yet another workaround:

execstack -s /usr/sbin/ntpd

As I understand it, it alters the binary:

rpm -V ntp
..5......   /usr/sbin/ntpd

but the rest of the system is unaffected.

Also, you can undo the change with:

execstack -c /usr/sbin/ntpd

which restores the old binary (rpm -V won't report it as changed).

What package provides this file?

2006-06-09T10:56:00.000-07:00

# rpm -qf /usr/bin/which
which-2.14-5

Cisco Switch ntp

2006-01-11T14:40:00.000-08:00

myswitch (enable) sho ntp

Current time: Wed Jan 11 2006, 22:25:39 EST
Timezone: 'EST', offset from UTC is 0 hours
Summertime: 'EST', disabled
Last NTP update:
Broadcast client mode: enabled
Broadcast delay: 3000 microseconds
Client mode: enabled
Authentication: disabled

NTP-Server Server Key
---------------------------------------- ----------
tick.usno.navy.mil -

Key Number Mode
---------- ---------
myswitch (enable)

myswitch (enable) set ntp broadcastclient dis
NTP Broadcast Client mode disabled
myswitch (enable) clear ntp server tick.usno.navy.mil
NTP server tick.usno.navy.mil removed.
myswitch (enable) set ntp server 0.pool.ntp.org
NTP server 0.pool.ntp.org added
myswitch (enable) set ntp server 1.pool.ntp.org
NTP server 1.pool.ntp.org added
myswitch (enable) set ntp server 2.pool.ntp.org
NTP server 2.pool.ntp.org added
myswitch (enable) get ntp
Unknown command "get". Use 'help' for more info.
myswitch (enable) sho ntp

Current time: Wed Jan 11 2006, 22:30:13 EST
Timezone: 'EST', offset from UTC is 0 hours
Summertime: 'EST', disabled
Last NTP update:
Broadcast client mode: disabled
Broadcast delay: 3000 microseconds
Client mode: enabled
Authentication: disabled

NTP-Server Server Key
---------------------------------------- ----------
ecoca.eed.usv.ro -
debian.ciencias.uchile.cl -
233.Red-80-59-234.staticIP.rima-tde.net -

Key Number Mode
---------- ---------
myswitch (enable) set timezone EST -5
Timezone set to 'EST', offset from UTC is -5 hours
myswitch (enable) set summertime EST recurring
Usage: set summertime [enable|disable] [zone_name]
set summertime recurring [
[offset]]
set summertime date
[offset]
(week: Week of the month (first,second,third,fourth,last,1..5)
day: Day of the week (Sunday, Monday,...,Saturday)
month: Month of the year (January, February,...,December)
date: Date of the month (1..31)
year: 1993..2035
time: time in format of (hours and minutes)
offset: 1..1440 minutes (default 60)
setting recurring with no option will reset to default (US summertime))
myswitch (enable) set summertime enable EST
Summertime is enabled and set to 'EST'
Start : Sun Apr 2 2006, 02:00:00
End : Sun Oct 29 2006, 02:00:00
Offset: 60 minutes
Recurring: yes, starting at 02:00am of first Sunday of April and ending on 02:
00am of last Sunday of October.

myswitch (enable) sho ntp

Current time: Wed Jan 11 2006, 17:32:03 EST
Timezone: 'EST', offset from UTC is -5 hours
Summertime: 'EST', enabled
Start : Sun Apr 2 2006, 02:00:00
End : Sun Oct 29 2006, 02:00:00
Offset: 60 minutes
Last NTP update:
Broadcast client mode: disabled
Broadcast delay: 3000 microseconds
Client mode: enabled
Authentication: disabled

NTP-Server Server Key
---------------------------------------- ----------
ecoca.eed.usv.ro -
debian.ciencias.uchile.cl -
233.red-80-59-234.staticip.rima-tde.net -

Key Number Mode
---------- ---------
myswitch (enable)

Cisco Switch Commands

2006-01-11T14:15:00.000-08:00

sho port 4/21

set spantree portfast 5/47 disable
set port speed 5/47 100
set port duplex 5/47 full

set port name 5/12 2nd floor users

sho port counters 5/33
clear counters

myswitch (enable) show port 2/41
* = Configured MAC Address

Port Name Status Vlan Level Duplex Speed Type
----- ------------------ ---------- ---------- ------ ------ ----- ------------
2/41 servers connected 12 normal a-full a-1Gb 10/100/1000

Port AuxiliaryVlan AuxVlan-Status
----- ------------- --------------
2/41 none none

Port Security Violation Shutdown-Time Age-Time Max-Addr Trap IfIndex
----- -------- --------- ------------- -------- -------- -------- -------
2/41 disabled shutdown 0 0 1 disabled 205

Port Num-Addr Secure-Src-Addr Age-Left Last-Src-Addr Shutdown/Time-Left
----- -------- ----------------- -------- ----------------- ------------------
2/41 0 - - - - -

Port Flooding on Address Limit
----- -------------------------
2/41 Enabled

Port Send FlowControl Receive FlowControl RxPause TxPause Unsupported
admin oper admin oper opcodes
----- -------- -------- --------- --------- ---------- ---------- -----------
2/41 on on desired on 0 77742 0

Port Status Channel Admin Ch
Mode Group Id
----- ---------- -------------------- ----- -----
2/41 connected auto silent 472 0

Port Status ErrDisable Reason Port ErrDisableTimeout Action on Timeout
---- ---------- ------------------- ---------------------- -----------------
2/41 connected - Enable No Change

Port Align-Err FCS-Err Xmit-Err Rcv-Err UnderSize
----- ---------- ---------- ---------- ---------- ---------
2/41 - 0 0 0 0

Port Single-Col Multi-Coll Late-Coll Excess-Col Carri-Sen Runts Giants
----- ---------- ---------- ---------- ---------- --------- --------- ---------
2/41 0 0 0 0 0 0 0

Last-Time-Cleared
--------------------------
Tue Nov 1 2005, 00:34:31

Idle Detection
--------------
--
myswitch (enable)

Nessus--Installation

2006-01-02T18:09:00.000-08:00

Nessus 3.0 comes in an rpm now and is pretty easy to install.

The gui client is now "NessusClient" and requires a few packages to compile and install like the way 2.x did. You will need:
openssl
openssl-devel
gtk2
gtk2-devel

"False error message When it asks for gtk+2 it's really looking for gtk2"

Now when you do a "find / -name gtk+-2.0.pc" you find it in /usr/lib/pkgcconfig

Now ./configure will work. (It is ok to remove gtk+)

Nessus info

2005-12-29T12:16:00.000-08:00

To run Nessus and nmap effectively:
Version 3.0 came out in Dec 2005.

If you get errors on startup, like:
Nasl binary storage: ... bad address
(This would have happened after killing the daemon after it was starting up registering its plugins). Then kill nessusd and restart it with -R:
/sbin/service nessusd stop
(or just kill it)
and run
/opt/nessus/sbin/nessusd -R
Then start the daemon normally:
/sbin/service nessusd start
or
/opt/nessus/sbin/nessusd -D.

When scanning and reading input from nmap, it only reads -oG Grepable files now. So run nmap like this:
nmap -sS -sV -O -p 1-63335 -P0 -oG myhost.out myhost
Then when you run nessus client (/usr/local/bin/NessusClient) you can select the file in the nasl plugin section. Specify the file, make sure it's readable by the client. I left the rest there as defaults but removed the "ping remote host first" in the next section down under nmap (Nasl wrapper) section.

Then when you specify the targets in nessus in the target section, put it in as a range. 1.2.3.4-10. I haven't had luck putting it as a network with a /28 or whatever.

nmap has an option to output into several major file formats at once (-oA). It's worth it to use that so you have the results in something you can read as well as use for nessus input.

So the command to use is:
nmap -sS -sV -O -oA myhost.out -P0 -p 1-65535 myhost

Miscellaneous:
When you update the plugins, kill the daemon first and restart it. I read that otherwise, the daemon won't know about the new plugins.

Find Linux version

2005-08-05T17:23:00.000-07:00

Q:
How can I tell what version of Linux I am using?

# cat /proc/version
- or -
# uname -a

Linux FS tips

2005-08-04T22:16:00.000-07:00

Just restored a system on ext3 filesystem. Backup was taken from a live server with ext2 filesystem, so fsck runs and has problems saying fsck is too old and doesn't support the filesystem:
Your system appears to have shut down uncleanly
Press Y within 1 seconds to force file system integriry check...
Checking root filesystem
fsck.ext3: Filesystem has unsupported feature(s) (/)
e2fsck: Get a newer version of e2fsck!

I had tried to boot under the other LX version and did an fsck on the unmounted filesystem from there, but it didn't find anything. So I tried the -f flag for force:
umount /dev/hda2
fsck -f /dev/hda2

If foudn errord and fixed them, but when I rebooted back on the restored system, I get the same error.

I wonder what i did last time I solved this issue... I think I copied the files in. Or maybe yum or rpm have an option to upgrade a package on a target system. I could do rpm to find out what files are involved in each package to be upgraded...

Next, I am trying to convert the ext3 back to ext2:
From the site: http://forums.devshed.com/archive/t-104010/Anyway-to-write-to-EXT3-filesystem-from-windows

You can easily change a partition between ext2 and ext3, considering that the onlt difference is that ext3 is a journaling filesystem.
To convert from ext3 to ext2, do "tune2fs -O ^has_journal /dev/X" (where X is the partition). Then if you want, delete the .journal file
To convert from ext2 back to ext3, do "tune2fs -j /dev/X"

NetScreen VPN Client errors

2005-02-04T20:34:00.000-08:00

ns-5XP, Netscreen remote v8.3.

on Netscreen:
"Rejected an initial Phase 1 packet from an unrecognized peer gateway."
Client keeps retransmitting.

This was due to a space character after the email address (id) being used on client. so the server didn't recognize it.

Now, get on ns: (logs chronological from bottom)

2005-02-04 9:25:29	info	IKE<2.3.9.9> Phase 1: Retransmission limit has been reached.
2005-02-04 9:24:41	info	IKE<2.3.9.9> Phase 1: Responder starts AGGRESSIVE mode negotiations.

client gets:
peer is nat-t draft compatible
nat is detected for client
hash payload is incorrect
sending blah blah incorrect NOTIFY:INVALID_HASH_INFO
Discarding IKE SA negotiation
my cookie is...
his cookie is...
RECEIVED blah blah
Received message for non-active SA.