John Davidson - West 4 Communications

Preventing a “Denial of Service” (DOS) forkbomb

admin — Sun, 26 Feb 2012 06:24:07 +0000

Preventing a “Denial of Service” (DOS) attack on a server is a major part of securing a server.

In a typical denial of service attack, the attacker logs into the server, starts a process that continuously forks a new process until all the resources on the server are used up. At that point the server has in effect been knocked out of service because all it’s resources are being consumed by one user’s dummy processes.

The code below is known as a fork bomb:

$ forkbomb(){ forkbomb|forkbomb & } ; forkbomb

Limiting the maximum resources available to users and groups is an important part of configuring a production system. To limit resources, you must add the user name, group or all users to /etc/security/limits.conf file and impose process limitations.

Understanding tne “/etc/security/limits.conf” file

Each line describes a limit for a user in the form:

Where:

can be:
a user name
a group name, with @group syntax
the wildcard *, for default entry
the wildcard %, can be also used with %group syntax, for maxlogin limit

can have the two values:
“soft” for enforcing the soft limits
“hard” for enforcing hard limits

can be one of the following:
core – limits the core file size (KB)

can be one of the following:
core – limits the core file size (KB)
data – max data size (KB)
fsize – maximum filesize (KB)
memlock – max locked-in-memory address space (KB)
nofile – max number of open files
rss – max resident set size (KB)
stack – max stack size (KB)
cpu – max CPU time (MIN)
nproc – max number of processes
as – address space limit
maxlogins – max number of logins for this user
maxsyslogins – max number of logins on the system
priority – the priority to run user process with
locks – max number of file locks the user can hold
sigpending – max number of pending signals
msgqueue – max memory used by POSIX message queues (bytes)
nice – max nice priority allowed to raise to
rtprio – max realtime priority
chroot – change root to directory (Debian-specific)

# vi /etc/security/limits.conf
# The following will prevent a DOS fork bomb by user guest, group students, faculty or
# pusers

guest hard nproc 300
@student hard nproc 50
@faculty soft nproc 100
@pusers hard nproc 200

The configuration above will prevent anyone in the student group from having more than 50 processes, faculty and pusers group limit is set to 100 and 200. guest can create only 300 processes. Please note that both KDE and Gnome desktop environments launch many process.

Bit Torrent Note

admin — Sun, 26 Feb 2012 04:49:31 +0000

At the coffee ghosts meetup today, Jacara gave me a new Bit Torrent site; “bitsoup.com”.

I also like “kickasstorrents.com”. Torrentfreak.com is the place to find out News about what’s happening in the Bit Torrent World.

uTorrent is my favorite Bit Torrent client for Windows. It’s super compact and efficient because it’s written in C. I like to use Transmission as my client on OSX and Linux.

Thoughts on Samsung Galaxy Note

admin — Sat, 25 Feb 2012 21:30:13 +0000

Over pizza at the Olympia Restaurant on Denman Street with wet flakes of snowing outside, Frank Norman raved to me about the Samsung Galaxy Note. The Note has a 5.3 inch display between the size of a smartphone and tablet, runs Android 2.3.6 (Gingerbread) operating system with UI 4.0 touch interface and supports a stylus for sketching and hand note-taking.

The first distinctive feature is the 5.3 inch display compared to the 3.5 inch display on the iPhone 4S. The extra display size is a plus for me. Since I’m in my early 50′s, I have to take off my glasses to view things on either an iPhone or HTC Magic. The Note is too big to carry in your jeans pocket, but since I usually carry my phone in my oversize jacket pocket, laptop bag or backpack this isn’t an issue.

Every since university engineering days, I’ve wanted a portable device I could use to take notes or jot down a sketch. The Palm Pilot was a step in that direction, but you had to use a special graffiti language to enter notes. The UI 4.0 interface should be able to convert even my hen scratchings into text. The sketchpad sounds perfect for making engineering sketches.

Frank says I can try the Samsung Galaxy Note out this week at the Toronto Dominion Bank Centre near West Georgia and Granville so I’ll update the post once I’ve tried it out for myself.

Here are links to two reviews in Wired magazine.

Region-Free DVD Playback with VLC

admin — Sat, 25 Feb 2012 02:12:57 +0000

Trilby, has a couple of European DVDs that are region-locked. It can be a major pain-in-the butt to get the European DVDs to work in North Anerica.

DVD region codes are a digital-rights management technique designed to allow film distributors to manage releases by region including release date, content (censored versions for different regions), and differential pricing by market (different prices for different regions). The region code restricts the area of the world in which the DVD can be played. The American DVD Copy Control Association in California requires that DVD-player hardware manufacturers incorporate the regional-playback control in retail DVD players.

The best way to get around the DVD-region lock is to use the excellent, free and open-source VLC media player. I have included a link to the free player on the Downloads page.

Wikipedia Reference recommending VLC.

VLC ignores region coding. Disable the annoying DVD player app that comes with OSX or Windows. Open the disc with VLC and it plays. No firmware zapping necessary.

script to automatically update server

admin — Mon, 13 Feb 2012 19:13:53 +0000

This is a script that I use to automatically update non-critical Debian/Ubuntu servers.

sudo apt-get update -y && sudo apt-get install -y && apt-get upgrade -y && apt-get dist-upgrade -y && "Done Updating"

Notes
The && runs the following command only if the previous commands exits successfully.

The “-y” switch responds automatically answers yes to the shell prompts.

Missing PATH

admin — Mon, 06 Feb 2012 20:46:01 +0000

A developer installed some Ruby gems on a new install of Ubuntu 10.10. After a few failures trying to run the gems, he realised that they failed because his PATH value did not contain the directory for the new gems.

He then executed the following command in his current shell;

PATH=$PATH:/path/to/gem
export PATH


When he echoed the PATH, he could see the modified PATH. But whenever he opened a new tab on the console, or restarted it, the changes were missing.
What did he do wrong?
PATH=$PATH:/path/to/gems

export PATH
only changes the environment for the current shell. Its good for testing.
Opening a new tab, or closing and reopening terminal creates a new shell with the old environment.
The lines must be added to ~/.profile , ~/.bash_profile or ~/.bashrc to change the environment for all of this user's shells.
To change the default PATH for all users globally you need to modify /etc/profile.



Google Apps Access
johndvan — Sat, 09 Oct 2010 04:58:40 +0000
Google now provides ultra-reliable fast hosting and mail services for your business. West 4 Communications can get your site up and running with Google Apps.
Encrypted secure access to email for your domain:
https://mail.google.com/a/yourdomainname
for example 

https://mail.google.com/a/west4.ca	
The https protocol uses encryption to protect your log-in credentials and email contents.
Encrypted secure access to cPanel dashboard for your domain:
https://www.google.com/a/cpanel/yourdomainname
for example:

https://www.google.com/a/cpanel/west4.ca



Improve your Google Ranking – Use Caching To Speed Up Your Site
johndvan — Fri, 24 Sep 2010 04:56:58 +0000
Google loves fast sites. So how can you speed up your site without spending a lot of cash on a dedicated super fast server. Use caching (pardon the pun)!
Content Management Systems (CMS’s) like WordPress and Joomla are incredibly powerful. Each time someone visits your site, the CMS generates each page from scratch. It can be a lengthy process to build everything you see. First it will process the PHP code which will make numerous calls to your database and finally output HTML for your web browser to display. On some sites this could happen between 20 to 200 times per page! Multiply all that work times hundreds of users and your website can drag to a crawl.
If you enable caching each page is only generated for the first visitor. The caching mechanism then saves the data and serves every subsequent visitor the final result.  When a page is added or updated the caching mechanism is triggered and a fresh page will generated for the next visitor, saved and served to all the following visitors. This speeds up WordPress by a huge factor. 
Trust me, you want it, your visitors will thank you for using it and Google will be bless you. After testing a variety of caching applications West 4 Communications recommends using Hyper-cache. West 4 Communications engineers can expertly configure your site using Hypercache.



Improve Google Ranking Tip: Redirect Missing Pages
johndvan — Thu, 23 Sep 2010 23:27:32 +0000
So, here’s the quick story. You start a website. You add pages and delete pages trying to hit the Google sweet spot that brings in traffic. It’s normal to delete or rename as much as half the pages on your site within the first year.
But what about those pages you deleted or renamed. Often they have been indexed by the Google search engine during it’s daily or weekly visits. And if the pages are in the index Google is sending people to those missing pages expecting to find what they are looking for. Only to get an error page. This is very disappointing. Is the person going to stay on your site looking for the missing page? Not likely. Google doesn’t like disappointing people so your site gets moved further and further down in the index. Missing pages can keep your site from improving it’s ranking or even leads to drops in your ranking.
What’s the solution? Set your site up to redirect people to another page if the page they’re looking for isn’t found. This is call a 302 redirect and can be set up using the .htaccess file on your site. 
At West 4  we regularly monitor your site for missing pages and create redirects to the renamed page or an alternate page with suitable content. We build this into all the websites that we set up and can add this feature to any website. 



Getting a Buffalo USB Wireless N adapter WLI-UC-GN to work on OSX 10.5.8
johndvan — Sat, 30 Jan 2010 03:15:46 +0000
All of Apple’s laptops come with a built-in WiFi adapter called an Airport. But I needed a second WiFi port for a client application. I didn’t anticipate any issues with just adding a USB wifi adapter.
However after checking out the three Mac stores in downtown Vancouver, Simply Computing, WestWorld and Mac Market I came up dry. No one even wanted to talk about using a USB wireless adapter on a Mac laptop. The consensus seemed to be it was impossible.
Well fortunately RAlink develops drivers for all their wireless chipsets that enable them to work with Windows, Linux AND Mac! The chipsets are used by a variety of manufactures to build WiFi N USB adapters.Here’s what I did to get  the Buffalo WLI-UC-GN Wireless N USB dongle working with OSX 10.5.8, Darwin kernel 9.8.0. It took me a couple of days to get it running. Hopefully this post will help someone else get their Buffalo Wifi adapter running with fewer hassles.
Here’s a related forum thread Insanely Mac Forum Thread. I got the idea for the fix from ayenon – the site is in Japanese, but you can get the main idea by looking at the screen print.
I chose the Buffalo Wireless N USB dongle WLI-UC-GN because it uses the Ralink chipset which is well supported on Macs. And it was on sale for about $40 at NCIX in Vancouver.
I installed the driver, rebooted and plugged the dongle in. The dongle showed up in System Profiler, but the blue activity light on the USB dongle stayed on constantly. On a properly installed dongle the activity light should be flashing.  I also got a “No Device” status when I opened the Ralink Utility. The problem boiled down to an incorrect product id in the info.plist file for the device’s driver.
The Buffalo USB dongle uses the Ralink 2870 chipset. (Google “Buffalo WLI-UC-GN chipset”
1. Download the Macintosh drivers version 2.0.1.0 from RAlink Macintosh Drivers.  The drivers for for Buffalo WLI-UC-GN are labelled USB(RT2870 /RT2770 /RT307X /RT2070 /RT3572).
2. Plug in the Wifi dongle and verify it is showing up in System Profiler.

Click Apple =>About this Mac => More Info => USB => 802.11n WLAN
Verify that the device is being recognized and has enough current:
Current Available (mA):	500

Current Required (mA):	450
3. Write down the Product ID and Device ID for the WLI-UC-GN, This should be the same for everybody.
Click Apple =>About this Mac => More Info => USB => 802.11n WLAN

The Product ID 0x014f   or 335 in decimal

The Device ID 0×0411    or 1041 in decimal
4, Open up /System/Library/Extensions/RT2870USBWirelessDriver.kext/Contents/Info.plist  using nano and scroll down until you reach the information related to Buffalo.
There are 3 entries 2870-1, 2870-2 and 2870-3.
The Product ID in the third entry needs to be changed from 336 to 335 to match the settings from system profiler above.
Write the file out.

Exit
4. Delete /System/Library/Extensions.mkext
cd /System/Library

sudo rm -R Extensions.mkext
5. Reboot  (You should see a message {“Updating Boot Caches”)
6. Remember to boot with the -f parameter.
Important! While the system is loading the blue activity light on the WLI-UC-GN should start flashing. If the light on the dongle stays blue constantly it is not installed correctly.
If the blue light on the dongle is flashing you can go on to the next step.
7. Go into System Preferences and add another device for the USB Wifi dongle.
Apple =>  System Preferences => Network

Click on the + sign in the lower left. An additional drop down menu entry will appear in the list for “Ethernet”. Highlight it and click create. Click Apply.
8. Go into the Applications => RAlink utility => Site Survey and you should see the Wireless access points.
9. Add a profile for your wireless access point.
10. Open terminal and delete /System/Library/Extensions.mkext again. Reboot again. When the system starts the USB dongle light should be flashing. Open the Ralink Utility and verify that you’re connected. Check the link status. Open Firefox. Enter the URL google.com and verify that you are connected.
In OSX the internal ethernet adapter is usually configured as en0, airport adapter is configured as en1 and your new usb adapter should be en2. After installing the driver correctly you should be able to type “ifconfig en2″ into terminal to find out how the dongle is configured.
Done!