Warning: preg_replace(): Compilation failed: escape sequence is invalid in character class at offset 4 in /home/customer/www/theunixtips.com/public_html/wp-content/plugins/resume-builder/includes/class.resume-builder-enqueues.php on line 59
Internet/Unix Admin

mimikatz : Export non-exporteable Private certificate from Symantec PKI

Posted on by Vishal Jain

Recently our organization started to provision Private certificates using Symantec Managed PKI Service. It has lot more appeal for IT admins because it takes out all user intervention which always creates support nightmares.

Previously I had direct access to the private key so it was easy to export it to all my devices and use for VPN and other secure stuff that needed to verify that I am indeed the real user. Because Symantec PKI is not available for Linux, it broke the VPN access from my Ubuntu system. Naturally I started to look for ways to export the key out of windows system. So here is what I did to get me out of the bind.

How to export certificates

First I installed Symantec PKI client on a windows 7 system. That was a no brainer because there was no other choice. I did not try with Windows 8 so YMMV. The main issue was that Windows certificate manager showed that the private key was not exportable. If it was then my quest would have been over right there. But I had to take another step. Mimikatz was the answer which marks them exportable and also allows to export them. Note: The patching that it does only lasts for that session. Once you reboot windows system you have to patch again using mimikatz. I used latest version which is 2.0 at the writing of this post.Continue reading →

Bash/Shell Scripts/Unix Admin

postfix : Configure outgoing relay server

Posted on by Vishal Jain

Update /etc/postfix/main.cf and add the name of your outgoing/relaying mailhost as “relayhost”. Ensure that the relay server is accepting your email first.

e.g. if the outgoing relay is mailhost.xyzserver.com sendmail configuration should look like following.

# INTERNET OR INTRANET

# The relayhost parameter specifies the default host to send mail to
# when no entry is matched in the optional transport(5) table. When
# no relayhost is given, mail is routed directly to the destination.
#
# On an intranet, specify the organizational domain name. If your
# internal DNS uses no MX records, specify the name of the intranet
# gateway host instead.
#
# In the case of SMTP, specify a domain, host, host:port, [host]:port,
# [address] or [address]:port; the form [host] turns off MX lookups.
#
# If you're connected via UUCP, see also the default_transport parameter.
#
#relayhost = $mydomain
#relayhost = [gateway.my.domain]
#relayhost = [mailserver.isp.tld]
#relayhost = uucphost
#relayhost = [an.ip.add.ress]
relayhost = mailhost.xyzserver.com

After that restart postscript.

service postscript restart

 

Bash/Shell Scripts/Unix Admin

Find the process monopolizing the CPU without using “top”

Posted on by Vishal Jain

Lets say you are on a system where top is not available (or other tools similar to it). Sound incomprehensible but believe me. There are systems which do not have any of those great tools available. So how do you find the process eating up most CPU? The humble ps command provides pcpu which is CPU percentage used by a process. Here is how.

ps -eo pcpu,pid,ruser,args | sort -r -k1 | less

This will give in reverse sort order the “pid” that is taking up most of pcpu and the ruser (real user) with args. So there you have it.

Unix Admin

Setup WebEx on 64 bit Ubuntu 12.04 using 32 bit Oracle Java

Posted on by Vishal Jain

WebEx would not work on Ubuntu 12.04 64 bit with default configuration. It requires 32 bit java. WebEx control window would launch but desktop sharing, application sharing, white-board etc. do not show up. Neither I could see other people’s shared content nor I could share mine even if I am the host of the meeting.

Starting Firefox from command line on a terminal shows ELFCLASS32 error from WebEx shared objects. So it was clear that WebEx would not work on 64 bit system as is and would need 32 bit java to work. Because I use 64 bit system I do not want to downgrade to a 32 bit version just for the sake of WebEx.

In brief, these three steps cover the fix.

  1. Install 32 bit Oracle Java locally. Oracle Java is must and OpenJDK would not cut. Warning: because it is local installation, user would need to manually keep on updating as new java becomes available. Recently there have been many releases from Oracle which came with very little time in between addressing major security issues so this would be concerning.
  2. Install Firefox locally so it can be configured to use this 32 bit java. Add a different profile and use a different theme so it does not conflict with the native Firefox and clearly stands out if both are running.
  3. (Optional) Add shortcut in Unity HUD for quick access.
    Continue reading →
Unix Admin

Add a custom script in Unity HUD

Posted on by Vishal Jain

Here is how to add a custom script in Unity HUD/dash for quick access. /usr/share/applications directory has all shortcuts for Unity desktop. So create a file named “mycustomscript.desktop” (or any_name_you_like.desktop) there which has information about the custom script. Additionally an icon could be added by pointing to an image. Files in /usr/share/applications directory have to be created as root.

 [Desktop Entry]
 Version=1.0
 Type=Application
 Terminal=false
 StartupNotify=true
 Icon=/home/vishalj/Pictures/mycustomscript.jpeg
 Name=MyCustomScript
 Comment=My Custom Script for X, Y and Z
 Exec=/home/vishalj/scripts/mycustomscript.sh
 Categories=Application;Productivity

Then run sudo update-desktop-database after which you will be able to use Unity HUD for invoking the custom script. Also note that each time you update a .desktop file you have to run update-desktop-database.

Internet/Network Tools/Unix Admin

vpn : Split Tunnel Concept

Posted on by Vishal Jain

Once a user starts a vpn client to connect to company extranet, all network traffic is diverted to the vpn tunnel. Routing gets setup by VPN client such that everything would go down the tunnel. Split tunnel can fix that by keeping traffic for internet from tunnel and only direct extranet traffic to the tunnel. But it comes with few risks on its own. Lets review the concept for a minute.

The VPN tunnel can be configured to work in two modes.

  1. Mandatory (default)
    While a client tunnel is established in mandatory mode, all client traffic is tunneled through it by default. This is the default vpn mode. So accessing yahoo.com will go through vpn tunnel to company extranet which will then route it via its own internet connection after applying access policy etc.
  2. Split Tunneled mode
    Split Tunneling allows configuring specific network routes that are then tunneled and sent to the client’s Extranet adapter; any other traffic goes to the local PC Ethernet or Dialup adapter interface. So Split tunneling allows the user to get access to the Internet or print locally even while the system is tunneled into the company Extranet. But this comes with a security issue because it opens a backdoor into the secure office network from internet via the home system. A hacker can exploit the home system and can use that as a jump box to get into the company network. Or if the system at home is infected it will further that infection into office network. That is why organizations want vpn users to ensure they are up to date and have anti-virus installed and most will provide vpn clients that are tightly controlled to enable the Default mode.Continue reading →
Misc/Open Source Tools

xming : Client 4 rejected from IP

Posted on by Vishal Jain

If you are getting following error in xming log:

Xming.exe: client 4 rejected from IP XXX.XXX.XXX.XXX

Here are two solutions.

  1. Secure method: Edit: X0.hosts (in the installation directory) and add the ip you want allow. e.g. 
    localhost
XXX.XXX.XXX.XXX

    Restart Xming.

  2. Insecure method: Add the “-ac” option to the Xming desktop shortcut. Modify the Desktop Xming shortcut to include the arguments: “:0 -clipboard -multiwindow -ac”. The ac option accepts client requests and quells the error above. Start Xming using the shortcut you just created. Warning: This is same as “xhost +” which will grant anyone access. So only use Xming option -ac or “xhost +” on trusted networks, never on public ones. OR use the solution 1 of additing IP address of known systems on which you will be running X applications..
Misc

VPN : Connecting to Nortel VPN from Linux

Posted on by Vishal Jain

I moved to Ubuntu full-time a while back. See the first part Migrating from Windows to Linux. But VPN into my office from Linux remained an open issue because my organization uses Nortel Contivity. Ubuntu comes with vpn client but that does not work with Nortel. Then I found vpnc-nortel branch of vpnc open source project that can connect to Nortel vpn servers. In this series I will explain how to connect to Nortel VPN from Ubuntu. You may need to tweak few of these instructions for your favourite Linux version. I am on Ubuntu 11.10 x86_64, using vpnc version 0.5.3-481.

Continue reading →

Misc

Migrating from Windows to Linux

Posted on by Vishal Jain

What would one need to move off of Windows in corporate world? A replacement for Microsoft Office Suit. Linux has LibreOffice as replacement for MS Word, Excel, Power Point etc. If you are a power user of these tools then it will be difficult to migrate to LibreOffice but hey that is a start. If for Outlook, your organization provides access via WebMail interface, then you are in clear with using any email client on Linux that supports Pop or IMAP by making use of DavMail. Though Evolution support a direct access to WebMail or even MAPI, but Evolution itself is very thick and sometimes slow. Then came out Ubuntu 11.10 which provides Thunderbird as the default email client with integration to desktop and Unity. Perfect.

Here is the list of replacements that are available on Linux. I will cover setup for DavMail and Thunderbird in another post.Continue reading →