encfs provides an encrypted filesystem in user space, which means you don't need to encrypt a full partition, but rather you can create an encrypted filesystem on the fly.

Creating an encfs filesystem

$ mkdir /home/adotti/.work /home/adotti/work
$ encfs /home/adotti/.work /home/adotti/work
Creating new encrypted volume.
Please choose from one of the following options:
enter "x" for expert configuration mode,
enter "p" for pre-configured paranoia mode,
anything else, or an empty line will select standard mode.

Pre-configured paranoia mode was enough for my needs, so I simply typed p.

Paranoia configuration selected.

Configuration finished.  The filesystem to be created has
the following properties:
Filesystem cipher: "ssl/aes", version 2:1:1
Filename encoding: "nameio/block", version 3:0:1
Key Size: 256 bits
Block Size: 512 bytes, including 8 byte MAC header
Each file contains 8 byte header with unique IV data.
Filenames encoded using IV chaining mode.
File data IV is chained to filename IV.

New Encfs Password: 
Verify Encfs Password:

Using the encrypted filesystem

At this point my new encrypted filesystem is ready to be used:

$ encfs /home/adotti/.work /home/adotti/work
EncFS Password:

Note that while files are encrypted, files metadata are not. Size, permissions and the number of files remain visible.

Some days ago I received an email reminder for one of my several online accounts; I was asked to perform a password change, as a new password expiration policy was enforced.

I went on-line, supplied the information required in a web form and clicked on the "Confirm" button. The connection was unencrypted - I guess some more policies should have been enforced too ;). Few minutes later I received a confirmation email: the processes was successfully completed and I'd have been able to log in with the new password. I tried several times, using both the new and the old ones. No way.

I then decided to try the "I forgot my password, oh stupid moron I am" way... I got the password emailed to me and I noticed that all uppercase letters were lover cased!

I suggest this nice reading for further policy related decisions.

I've never had a good occasion to use custom chains with netfilter. The usual setups I had to prepare were simple enough to achieve the required results using the built-in chains.

Few days ago I had to configure another box to act as a firewall, so I decided to try out custom chains:

#===============================================================================
#
# CUSTOM CHAINS
#
#===============================================================================

# Chain for packets coming from the internet

$IPTABLES -N internet-allowed

$IPTABLES -A internet-allowed -p tcp -m state --state NEW --dport $SSH -j ACCEPT
$IPTABLES -A internet-allowed -p tcp -m state --state NEW --dport $MUNIN -s $MUNIN_MASTER -j ACCEPT

# Chain for packets coming from the wireless network

$IPTABLES -N wireless-allowed

$IPTABLES -A wireless-allowed -p tcp -m state --state NEW --dport $CHILLI -j ACCEPT
$IPTABLES -A wireless-allowed -p tcp -m state --state NEW -m multiport --destination-port $HTTP -j ACCEPT
$IPTABLES -A wireless-allowed -p udp --dport $DNS -j ACCEPT

# Chain for packets coming from the wireless network and forwarded to the
# internet

$IPTABLES -N wireless2internet

$IPTABLES -A wireless2internet -p tcp -m state --state NEW -m multiport --destination-port $HTTP -j ACCEPT

#===============================================================================
#
# INPUT CHAIN
#
#===============================================================================

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT -i $LOIF  -j ACCEPT

$IPTABLES -A INPUT -i $EXTIF -j internet-allowed
$IPTABLES -A INPUT -i $EXTIF -j LOG --log-prefix "IN EXT REJ: "

$IPTABLES -A INPUT -i $INTIF -j LOG --log-prefix "IN INT REJ: "

$IPTABLES -A INPUT -i $TUNIF -j wireless-allowed
$IPTABLES -A INPUT -i $TUNIF -j LOG --log-prefix "IN TUN REJ: "

#===============================================================================
#
# FORWARD CHAIN
#
#===============================================================================

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -i $EXTIF -j LOG --log-prefix "FW EXT REJ: "

$IPTABLES -A FORWARD -i $INTIF -j LOG --log-prefix "FW INT REJ: "

$IPTABLES -A FORWARD -i $TUNIF -o $EXTIF -j wireless2internet
$IPTABLES -A FORWARD -i $TUNIF -j LOG --log-prefix "FW TUN REJ: "

Although they were not strictly needed, I think they are good to improve readability anyway, as you can see from the previous snippet of the firewall script.

Recentemente abbiamo installato in azienda una VPN usando openvpn. Installazione pulita e grande beneficio di accedere alle risorse della rete aziendale anche quando non si è fisicamente presenti in loco.

Purtroppo però, nella mia personale situazione, mi sono trovato ad affrontare un piccolo problema di DNS.

A casa, le mie macchine sono collegate in rete e appartengono tutte al dominio home.local; ho un server DNS privato che provvede alla risoluzione dei nomi per questo dominio fasullo e mi permette di accedere ai vari servizi. Anche in ufficio i servizi sono raggruppati su server locali appartenenti ai dominii office.local ed office.dmz, ed un DNS provvede alle risoluzioni necessarie. Fare giochi con il file resolv.conf non ha portato ad alcun risultato - ed /etc/hosts non è nemmeno da prendere in considerazione - in quanto, comunque la si girasse, qualche dominio privato risultava comunque non raggiungibile.

Sfruttando il fatto che la macchina che crea il tunnel VPN ha anche un DNS (il solito bind), ho trovato questa soluzione, che probabilmente non è la migliore, ma nel mio caso si è rivelata decisamente efficiente.

Per i dominii privati dell'ufficio ho creato nel file di configurazione di bind delle zone di tipo forward:

zone "office.local" {
        type forward;
        forward only;
        forwarders {
                192.168.10.1;
        };
};

zone "10.168.192.in-addr.arpa" {
        type forward;
        forward only;
        forwarders {
                192.168.10.1;
        };
};

Questo mi ha permesso di sfruttare il DNS locale per le normali risoluzioni (casa/internet) e di appoggiarmi al DNS dell'ufficio solamente per le cose inerenti ai servizi aziendali.

ronin:~# adcfw-log -s prefix /var/log/syslog

adcfw-log - PREFIX SUMMARY: 14634 entries

TOTAL PACKETS     PREFIX
===========================================================
         9978     IN REJ TCP
         4623     IN REJ UDP
           33     IN REJ ICMP

Se a questo aggiungiamo anche che nelle ultime settimane lo spam è praticamente raddoppiato, comincio a sentirmi come la protagonista di" Welcome to the jungle" dei Guns'n'Roses :)

Recentemente ho cercato di migliorare la mia gestione dell'uso di gpg per firmare le e-mail quando ne ho necessità. Non ne faccio un sistematico, ma ci sono diverse situazioni in cui mi è utile apporre la mia firma digitale ai messaggi in uscita.

La versatilità di Mutt offre un discreta quantità di parametri di configurazione, e bisogna dire che i default impostati sono saggi e consentono un'uso di gpg praticamente immediato. Ho comunque limato qualche piccolo spigolo. Questo è il pezzo di configurazione personalizzato che ho aggiunto al mio muttrc:

# non firmare automaticamente tutti i messaggi in uscita
#
unset crypt_autosign

# non cifrare automaticamente tutti i messaggi in uscita
#
unset crypt_autoencrypt

# cifra automaticamente le risposte a messaggi cifrati
#
set crypt_replyencrypt

# firma automaticamente le risposte a messaggi firmati
#
set crypt_replysign

CurrPorts

CurrPorts displays the list of all currently opened TCP/IP and UDP ports on your local computer. For each port in the list, information about the process that opened the port is also displayed, including the process name, full path of the process, version information of the process (product name, file description, and so on), the time that the process was created, and the user that created it. In addition, CurrPorts allows you to close unwanted TCP connections, kill the process that opened the ports, and save the TCP/UDP ports information to HTML file , XML file, or to tab-delimited text file. CurrPorts also automatically mark with pink color suspicious TCP/UDP ports owned by unidentified applications (Applications without version information and icons)

IPNetInfo

IPNetInfo is a small utility that allows you to easily find all available information about an IP address: The owner of the IP address, the country/state name, IP addresses range, contact information (address, phone, fax, and email), and more. This utility can be very useful for finding the origin of unsolicited mail. You can simply copy the message headers from your email software and paste them into IPNetInfo utility. IPNetInfo automatically extracts all IP addresses from the message headers, and displays the information about these IP addresses.