Pause container image

 The pause container image can be used to create a container that does *Nothing*

Kubernetes uses this 'docker.io/kubernetes/pause' to set up a pod.

This article explains this well : https://www.ianlewis.org/en/almighty-pause-container 

Single line command to create self signed certificate

 

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 -nodes

Certificate with extensions:

openssl req -x509 -nodes -newkey rsa:2048 -keyout key.pem -out server.pem -days 7300 -subj '/CN=My Name/C=US/OU=My Unit/O=ACME' -addext "keyUsage = digitalSignature, keyEncipherment, dataEncipherment, cRLSign, keyCertSign" -addext "extendedKeyUsage = serverAuth, clientAuth"
 

 

Boot into BIOS on ubuntu after UEFI boot

 

 

efibootmgr -n 0

Create a certificate with any expiry date

Create a certificate with any expiry date

1. Create CA certificate and private key key

a. openssl genrsa -out ca.key 2048

b. openssl req -new -x509 -key ca.key -out ca.crt

2. Generate CSR

openssl req -out server.csr -new -newkey rsa:2048 -nodes -keyout  server.key

3. Sign the CSR and create certificate

openssl ca  -policy policy_anything -out clientcert.pem -startdate 190221080000Z -enddate 190221090000Z -cert ca.crt -keyfile ca.key -infiles server_anil.csr

These commands have to be executed for the above command to succeed:

mkdir -p demoCA/newcerts
touch demoCA/index.txt.attr
touch demoCA/index.txt
echo '01' > demoCA/serial

4. Reference 

How to setup your own CA with OpenSSL -  https://gist.github.com/Soarez/9688998 

SSL/TLS record structure

Below is the structure of SSL/TLS record:

Capture ssl master keys from any openssl application

Just follow the instructions (in comments) in the c file.

https://git.lekensteyn.nl/peter/wireshark-notes/tree/src/sslkeylog.c

Update: Newer openssl has '-keylogfile ' option, using which, session keys can be logged into a file

Create a client certificate signed by a CA certificate

#!/bin/bash

#script to generate client cert-key pair signed by ca cert-key pair

#create cert signing request
openssl req -nodes -keyout anil.ca.key -subj "/C=US/ST=IL/L=Chicago/O=testers unlimited/OU=tester/CN=clisigner/emailAddress=clisigner@signer.com" -new -out anil.ca.cert.csr

###Generate the certificate using csr
openssl x509 -in anil.ca.cert.csr -out anil.ca.cert -req -signkey anil.ca.key -days 365

#create cert signing request for client cert
openssl req -nodes -keyout anil.cli.key -subj "/C=US/ST=IL/L=Chicago/O=testers unlimited/OU=tester/CN=client/emailAddress=client@client.com" -new -out anil.cli.cert.csr
###Generate the certificate using csr
openssl x509 -in anil.cli.cert.csr -out anil.cli.cert -req -signkey anil.cli.key -CA anil.ca.cert -CAkey anil.ca.key -days 365 -CAcreateserial


## verify certificate signature
openssl verify -verbose -CAfile anil.ca.cert anil.cli.cert


echo " Netscaler does not accept private key in format generated above"
echo "So, use this command to encrypt it"
echo "openssl rsa -in anil.ca.key -passout pass:123456 -des3 -out anil.ca.key2"

Adding new path to library search on Linux

If you want to a path (directory) to be looked into for a shared library, without adding it to LD_LIBRARY_PATH, then ad the path to /etc/ld.so.conf and run ldconfig

i.e

1. Add directory to /etc/ld.so.conf
2. run ldconfig

Remove password and merge PDF files in ubuntu

To remove password :

for file in *.pdf ; do qpdf --password=anil6053 --decrypt $file ./nopw/$fil
e; done


To merge pdf files,

pdftk *.pdf cat output mergedfile.pdf


If there are cases where some online tool has a limit on size of pdf file that it accepts, then the size of pdf can be reduced using the below command. You will of course loose some resolution...

Command to reduce the size of pdf :

gs -sDEVICE=pdfwrite -dCompatibilityLevel=1.4 -dPDFSETTINGS=/screen -dNOPAUSE -dQUIET -dBATCH -sOutputFile=smaller.pdf large.pdf

Extract layer 7 data from packet capture

If you want to extract the tcp payload of a set of packets (A tcp stream for example) Below command comes handy.

tshark -r test.pcap -2 -R"tcp.port==444" -T fields -e data  | tr -d '\n' | xxd -r -p > layer7_data

xxd converts ASCII hex to binary.

Get openerp working from source

• Run openerp from source
  • Download source using bazaar
    • Install bazaar
    • Configure bazaar for launchpad repository
    • download(branch) source
  • Get the server running from source
    After getting the sourced using bzr, run openerp-server.py
  • Get the web client running from source
    install python-cherrypy python-formencode This error can be seen at the core (server): [2013-04-11 16:00:31,280][template1] ERROR:db.connection_pool:Connection to the database failed Traceback (most recent call last): File "/home/advaith/openerp/bzr/openerp/server/bin/sql_db.py", line 303, in borrow result = psycopg2.connect(dsn=dsn, connection_factory=PsycoConnection) File "/usr/lib/python2.7/dist-packages/psycopg2/__init__.py", line 179, in connect connection_factory=connection_factory, async=async) OperationalError: FATAL: role "advaith" does not exist
  • Get GTK Client running from source.
    ./configure make make install /usr/local/bin/openerp-client
  • Install and configure postgresql for openerp
    Follow steps from this link : http://doc.openerp.com/v6.1/install/linux/postgres/index.html The links talks about creating role openerp. But I created role 'advaith' as suggested in error message
  • Once postgresql is installed and configured,you can access create database.

Share files using remote desktop

You can share a folder on the client machine so that it's available for read and write on the server to which you do remote desktop.

use the -r option of rdesktop.

rdesktop 172.16.229.23 -r disk:share=/tmp

On remote machine, you can see an new drive with name 'share on '. You can read/write files from the drive.

Test HTTPS sites using openssl

We often use telnet to connect to a web server and test it.
But telnet cannot be used when the site is HTTPS (SSL).
openssl command can be used to do this.

For example:
openssl s_client -connect encrypted.google.com:443

-quiet can be used if you want the connection to be closed once done. This is useful when you use this within scripts.

Below command can be used in a script:

 openssl s_client -tls1 -ign_eof -connect 10.102.34.122:443 <GET /
EOFH

shell script to download youtube video

Here is a shell script that I wrote to download youtube video (given the video URL)

This is based on youtube-dl (that's in python) tool that is available in ubuntu software repository.

I came to know that across the globe use my tool. The get in touch whenever it stops working.

How to generate and examine windows core dumps

How to generate and examine windows core dumps

• Generating core dump.
  1. install windbg(Debugging Tools for Windows). (download here : http://www.microsoft.com/whdc/devtools/debugging/installx86.Mspx)
  2. run windbg. (Start Menu->Programs->Debugging Tools for Windows->WinDbg)
  3. Attach to the process (using GUI, File->Attach to a Process... [f6])
  4. run the command

      .dump /ma c:\cpdump.dmp 

     as described here (http://wiki.zimbra.com/index.php?title=Creating_a_Core_Dump_from_a_Running_Process_using_WinDbg)
  5. This will generate the file c:\cpdump.dmp
  6. compress(zip) the file c:\cpdump.dmp and send it across

• Observing the dump file.
  1. run command

     ~*kb

     to see all the thread stacks.
  2. More information here (http://windowsitpro.com/article/articleid/21217/using-the-windbg-debugging-tool.html)

Look at help-->contents (.chm) for detailed reference

You will not be able to see symbols in the dump file if you don't have the symbol database (.pdb) file for your application. The /Z7 option that puts the symbol information in the .obj files did not help.

gotcha : when /Zi option is used and code compiled through ssh session, the com,piler fails. Running the build through windows command prompt works !


I had to compile the product with /Zi (for cl.exe) option that created vc80.pdb file.
Then during linking, use /DEBUG /PDB:/path/to/.pdb . The .pdb file generated in the link step can be used with windbg

reference:
http://msdn.microsoft.com/en-us/library/yd4f8bd1%28v=vs.71%29.aspx
http://msdn.microsoft.com/en-us/library/yd4f8bd1.aspx

you can also extract pdb from an executable that is compiled with /Z7 option (as documented here) . did not work for me though
http://support.microsoft.com/kb/258205

gratuitous ARP

what is ARP?

Arp is a protocol that is used to map ip addresses to corresponding MAC addresses. This is referred to as neighbour discovery. (ipv6 uses icmpv6 instead of ARP).
Arp is used by a machine when it wants to send an ip packet to another machine on the same LAN segment (physical LAN).

• The sender issues a 'Who has' ARP broadcast query. The machine that owns the IP address responds with the corresponding MAC address.
• The sender uses this MAC address as the destination address in the datalink packet and injects the packet on to the wire.

gratuitous ARP

gratuitous ARP is an ARP reply that is sent when there is no request. And it is a broadcast while normal ARP replies are not broadcast. This results in all machines in the segment updating their ARP cache.


Why is gratuitous ARP important

gratuitous ARP is useful to let other machines on the same subnet know any change in IP address configurations. This is particularly relevant in High Availability scenario where the active machine goes down and the standby machine takes over the new IP. If a gratuitous ARP is not sent here, the gateway(of this subnet) will continue to forward the IP packets to previously active machine.

Generally when an IP address is configured on a machine, the machine's network stack will send a gratuitous ARP.But some OSes(Like Linux) don't do that. This can be overcome on Linux by manually sending a gratuitous arp using arping command's '-A' option as follows.

arping -q -c 3 -A -I

AIX issues a gratuitous ARP when ip is configured on one of it's interfaces using ifconfig.

SQLite

I got to know about SQLite when I tried using a tool called "almanah" which is a simple diary.
"almanah" stores all the information in a file /Your/home/.local/share/diary.db.
did some search and found that this was a SQLite database file. Also figured how SQLite works. it's pretty simple.

SQLite is a set of libraries that you can link with your application. It gives a set of API's so that you can execute SQL statements as you would do with any DBMS. The difference here is that there is no other DBMS process, and everything is stored in the SQLite database file. check out this link, it's straightforward.

I was looking for a tool that would help me extract the contents of the diary into a text file.
Found this tool called "sqlite3" on linux. This is like a shell for SQLite.
run it
$ sqlite3 /Your/home/.local/share/diary.db
sqlite> .tables
entries entry_attachments entry_links
sqlite>

It shows 3 tables entries,entry_attachments and entry_links

doing a "select * from entries" gives all the entries in the diary.

the below command can be run to do it with a single command.
$sqlite3 ./diary.db "select * from entries"

Recover deleted files from deleted partition

I never thought recovering files would be so easy. I had deleted my personal files on old Laptop to return it.
I also repartitioned the disk using the Ubuntu install CD.

But I later realized later that I had deleted something that I had not backed up(so naive).

There are two Linux tools that I found useful.
1) testdisk
2) photorec

There is a project called SystemRescueCd which includes useful tools to recover data.

I used "test disk" tool to recover the deleted partition I was not able to restore the partition as such. But was able to browse files using the tool itself.

There is another tool called  "photorec" which I used to recover deleted files of that partition.

you can use the SystemRescueCd bootable cd or boot using ubuntu live cd and install the tools you want and use them as I did.

Blogged with the Flock Browser

analyze extremely large packet capture(tcpdump) file

I recently had to analyze an extremely large packet capture file to resolve a customer issue.
wireshark would crash trying to load the file(around 375 MB).
You start thinking 'why did the client not capture packets only when the problem occured?'.
But, I quickly realised that tcpdump can be used with the capture file as input and filters can be applied to extract packets of our interest.

In this case I was interested in packets that had a particular ip address. So used the below command to extracted those packets into another pcap file.

tcpdump -r [largefile.pcap] -w [filteredFile.pcap] [filter]

And now I have a pcap file that wireshark can load so that I can take a good look at what is happening.

The state of the internet reports from akamai

Akamai is publishing quarterly report on the internet called "The state of the internet"
These reports can be found here http://www.akamai.com/stateoftheinternet/
It can be downloaded after quick registration.

The reports give interesting insights into how internet works.

interesting things I found, relating to india:

1) Reliance Globalcom is a big player in cable connectivity
sinip--
"In April 2008, Reliance Globalcom used satellite imagery to identify two ships that were in
the area of the original cable cuts, and that had improperly dropped anchor in the area.18
The owners of one of the ships paid $60,000 in damages to compensate for repairs, while
the second ship was impounded in Dubai."

2) Some good things happening for india
snip--
"A consortium of 16 telecommunications firms has contracted to build a 15,000 km
submarine cable system linking India with Europe via the Middle East. The Europe India
Gateway (EIG) will cost $700 million and add 3.84 Tbps of capacity. The EIG consortium
includes firms from the US, Europe, Africa, the Middle East and India – including AT&T,
Verizon, BT, Cable & Wireless, MTN, Telecom Egypt, Omantel, Saudi Telecom Company,
du, Bharti Airtel, Gibraltar’s Gibtelecom, PT Comunicacoes of Portugal, Djibouti Telecom,
Maroc Telecom, Libya Telecom and Technology, and Telkom South Africa. Initial landings
are for the cable are planned for the UK, Portugal, Gibraltar, Morocco, Monaco, France,
Libya, Egypt, Saudi Arabia, Djibouti, Oman, the United Arab Emirates, and India.

At least two other new cables serving much the same route as the EIG are also currently
being planned. Tata Communications is leading the consortium behind the IMeWe
system, due to add another potential 3.84 Tbps to the route when it goes live in 2009.
Also backing IMeWe are Etisalat, France Telecom, Ogero of Lebanon, PTCL of Pakistan,
TIS Sparkle of Italy, as well as EIG investors Bharti Airtel, Telecom Egypt and STC. Tata is
also behind the TGN Eurasia Cable System, set to link Mumbai with Paris, London and
Madrid via Egypt, with Seacom and Telecom Egypt as fellow sponsors.36
Along these lines, research firm Telegeography’s annual Global Bandwidth Research
Service noted that 25 new submarine cables will be built over the next three years"