=== Encrypt and automaticly mount external harddrive with debian ===

In my last blogpost i showed you how you can acutal get your usb devices to be encrypted.

Now let's suppose you have a lot of devices that needs to be encrypted as well as automaticly mounted on boot up.

One Word before we begin. This does only make sense if you fully encrypt your root filesystem. Since we will deploy the keys in here needed to automaticaly mount and decrypt these. If this filesystem is encrypted nobody should be able to access those keys when the disk with main root filesystem isn't mounted.

For this i assume you have a partition /dev/sdb1 on your device which already is encrypted.

(1) First let's figure out the uuid of the harddisk we want to decrypt. Note that we are using the UUID of the partition that was encrypted here not the one where the device gets mapped to.

blkid /dev/sdb1 
>> /dev/sdb1: UUID="056bb8d6-cdf6-4081-23d9-cdef8bf7c18b" TYPE="crypto_LUKS" 

(2) Now as root user we are editing the file /etc/crypttab 

#devicealias #uuid #key  #encrption method
crypt_sdb1 UUID=<from blkid> /etc/cryptkeys/crypt_sdb1.key luks

(3) Next edit the /etc/fstab accordingly
/dev/mapper/crypt_sdb1    /mnt/Backup    ext4 auto,defaults   0   0

Great we have created the entries in both files. All we need todo is to create the keys. I suggest that you are put keys in /etc/cryyptkeys as i configured the /etc/crypttab but you could of course put them anywhere you like. However if you do this you need to change the entry in the /etc/crypttab file. So create the directory in /etc and make it readable and accessable to group and user root only.

(4) The following command will create a key
dd if=/dev/urandom of=/etc/cryptkeys/crypt_sdb1.key bs=4k count=1
chmod 400 /etc/cryptkeys/*

(5) As the final step add the key to luks. When asked for a password you must enter your current used password you were using when you were encrypting this partition in the first place
cryptsetup luksAddKey /dev/sdb1 /etc/cryptkeys/crypt_sdb1.key

=== Lockdown USB Devices ===

One fundamental security issue to face is that an unwanted person has usb-access and steal your files or even drop trojans or backdoors on your computer. It seems to be neccessary to lock up the usb devices.

I do this by

(I) whitelist the usbdisk that i had bought.

(II) encrypt the filesystem they are using.

The benefits for this is that only your devices can be used. and that nobody is able to access the usb devices you are using other but you. The disadvantages of this that you are the only person how can transfer data via usb to your pc.

(I)
To lockup and whitelist usb devices i luckily found this article in the internetz. Its a bit diffifcult to understand so will explain here how i did it.

(1) First lockup the usb stack by using the script i wrote Basicaly it disables the kernels access to the usb stack after startup by passing the "0" bit to the specific /sys subsystem located in the files

/sys/bus/usb/devices/usb?/authorized_default

You should copy this script to /etc/init.d/usblock. Note: There is no .sh filename extension and add the script as startup service:

chkconfig -a usblock

At this point you do not need to start the script.

(2) Suppose you have a usbstick which is currently mounted from /dev/sdb1. Best practice would allowing the mapping of the usbstick by using something unique like the usb serial number. To get this number run the following command:

udevadm info -a -n /dev/sdb1|grep ATTRS{serial}

ATTRS{serial}=123456789ABC

(3) Thanks to the article i mentioned above i was able to setup the required udev rule in /etc/udev/rules.d/01-udevlockdown.rules:

+++
# Script by Adrian Crenshaw
## With info from Michael Miller, Inaky Perez-Gonzalez and VMWare
#
## By default, disable it.
ACTION=="add", SUBSYSTEMS=="usb", RUN+="/bin/sh -c 'for host in
/sys/bus/usb/devices/usb*; do echo 0 > $host/authorized_default; done'"
#
## Enable hub devices. There may be a better way than this.
ACTION=="add", ATTR{serial}=="123456789ABC", RUN+="/bin/sh -c 'echo 1>/sys$DEVPATH/authorized'"
## add further lines like above to allow more devices
+++

(4) Now start the usblock "service":

service usblock start
service usblock status

and restart the udev service

service udev restart

and test your result by plugging in the device you just setup and an other usb drive. The result should be that the first one should get mounted normaly according to further udev rules in /lib/udev/rueles.d/ whereas the second device should be ignored.

(5) Whenever you need to add new device rules. Remeber that you first have to disable the usblock by using:

service usblock stop

before you can deploy new whilelist rules following steps 2 to 4.

(II)

(1) To encrypt your usb-sticks you need first to unmount them by using

umount /dev/sdb1

and using luksformat to encrypt and reformat (!) the device. In this step data which is not saved will get lost.

luksformat -t vfat /dev/sdb1

 

thats it for the start of this year. 

This is my bashrc ...

based on debian 7 (wheezy) with systemd

# Dont Save duplicated history lines and remove these form the history file
HISTCONTROL=irgnoredups:erasedups

# show the date and time when the command was actually executed
HISTTIMEFORMAT="%F-%M-%S --> "

# ignore these command and receord them never to the history
HISTIGNORE="su":"su *":"sudo *":"sudo":"his":"his *":"history":"history *":"halt":"reboot":"apt-get *":"apt-cache *":"aptitude *":"dpkg *"

#CDPATH can be confgiured to have a list of fast available and often used paths
#use colons to add more , make sure using the . and .. so you always can cd into a directory whenver it is present in your $PWD and in another
CDPATH=.:..:/usr/share/:/media/:/home/l1zard/workspace/:/media/

# #functions
# this function is to search certain keywords in certain section
section()
{
if [ $# -eq 2 ]
then
apropos $1|grep \^\.\*[[:blank:]]\($2\) || echo "sorry no entry for $1 in section $2"
else
echo "Usgae: section word number"
fi
}


# function traffic lists open ports for user
traffic()
{
ping -c3 google.de && watch -n 10 lsof -i || echo "no network connecttivity"
}

# function to list kernel threads
showthreads()
{
if [ -z "$1" ]
then
ps -A u |sort -k5 -n|awk '{if($5 == 0){print}}'
else

ps -A u|sort -k5 -n|awk '{ if($5 == 0){print }}'| grep $1
fi
}


# function returns status information about the battery health (which is how good the baateries live is in general) and its status (which return how long it takes until the battery needs the next charge)
battery ()
{
case "$1" in
# returns the percentage of battery charge when discharging
"load")
now=$(cat /sys/class/power_supply/BAT0/energy_now)
full=$(cat /sys/class/power_supply/BAT0/energy_full)
out=$(echo $now/$full*100 | bc -l | cut -c 1-5)
echo "Charge: "$out"%"
;;

# returns the battery health. that is the percenatge of the maximal capacity
"health")
design=$(cat /sys/class/power_supply/BAT0/energy_full_design)
current=$(cat /sys/class/power_supply/BAT0/energy_full)
out=$(echo $current/$design*100 | bc -l | cut -c 1-5)
echo "Capacity: "$out"%"
;;

*) echo "Usage: battery load|health"
esac
}


# function cl to list and cd into a directory at the same time
cl()
{
if [ -z $1 ]
then
cd $HOME
ls
else
cd "$1"
ls
fi
echo "Content of $PWD:^^^"
}


# top 10 processes consuming the most cpu-time
top10()
{
if [[ -n $1 && $1 == "-m" ]]
then
ps auxf | sort -nr -k 4 | head -10
else
ps auxf | sort -nr -k 3 | head -10
fi
}

# function to get translate from dings default dictionary
translate ()
{
clear
tr \| \n < /usr/share/trans/de-en|grep --color $1
}

# little function to search for words in rfcs installed locally
rfcfind()
{
zgrep --color $* /usr/share/doc/RFC/rfc-index.txt.gz || echo "no subject found in rfc for $*"
}

# little function to access locally installed rfcs easily
rfc()
{
find /usr/share/doc/RFC/ -name rfc${1}.txt.gz -exec zless {} \; || echo "rfc ${1} does not exist"
}

# function to create and change into a directory in one step
# function adopted from O'Reilly Coookbook
mcd()
{
local NEW_DIR='_command_failed_'
if [ -z "$1" ]
then
echo "mcd: <Datei> [nnn]"
return 1
fi

if [ -d "$1" ]
then
echo "$1 exists"
NEW_DIR="$1"
else
if [ -n "$2" ]
then
mkdir -p -m $1 "$2" && NEW_DIR="$1" || return 1
else
mkdir -p "$1" && NEW_DIR="$1" || return 1
fi
fi

cd "$NEW_DIR"
}


##
# funkctions for systemctl
all()
{
echo "Functions for systemctl to handle more easily:"
echo "failed"
echo "loaded"
echo "masked"
echo "active"
echo "inactive"
echo "waiting"
echo "running"
echo "plugged"
echo "mounted"
echo "exited"
echo "dead"
echo "elpased"
}

failed ()
{
systemctl --no-pager --all|grep --color failed
systemctl --no-pager --all|grep --color error
}

loaded ()
{
systemctl --no-pager --all|grep --color loaded
}

masked ()
{
systemctl --no-pager --all|grep --color masked
}

active ()
{
systemctl --no-pager --all|grep --color active
}

inactive ()
{
systemctl --no-pager --all|grep --color inactive
}

waiting ()
{
systemctl --no-pager --all|grep --color waiting
}

running ()
{
systemctl --no-pager --all|grep --color running
}

plugged ()
{
systemctl --no-pager --all|grep --color plugged
}

mounted ()
{
systemctl --no-pager --all|grep --color mounted
}

exited ()
{
systemctl --no-pager --all|grep --color exited
}

dead ()
{
systemctl --no-pager --all|grep --color dead
}

elapsed ()
{
systemctl --no-pager --all|grep --color elapsed
}
##


# add /sbin to PATH to avoid anoying message
# add ~/bin to PATH
export PATH=$PATH:/sbin:/usr/local/sbin:/usr/sbin:~/bin

test -s ~/.alias && . ~/.alias || true


## make less more friendly for non-text input files, see lesspipe(1)
[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"

# uncomment for a colored prompt, if the terminal has the capability; turned
# off by default to not distract the user: the focus in a terminal window
# should be on the output of commands, not on the prompt
#force_color_prompt=yes

if [ -n "$force_color_prompt" ]; then
if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
# We have color support; assume it's compliant with Ecma-48
# (ISO/IEC-6429). (Lack of such support is extremely rare, and such
# a case would tend to support setf rather than setaf.)
color_prompt=yes
else
color_prompt=
fi
fi

if [ "$color_prompt" = yes ]; then
PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '
else
PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '
fi
unset color_prompt force_color_prompt

# If this is an xterm set the title to user@host:dir
case "$TERM" in
xterm*|rxvt*)
PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\h: \w\a\]$PS1"
;;
*)
;;
esac

# enable color support of ls and also add handy aliases
if [ -x /usr/bin/dircolors ]; then
test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"
alias ls='ls --color=auto'
alias dir='dir --color=auto'
alias vdir='vdir --color=auto'

alias grep='grep --color=auto'
alias fgrep='fgrep --color=auto'
alias egrep='egrep --color=auto'
fi

## Nice greeting
echo -e '\E[32m Viel Spaß am Gerät!'; tput sgr0
## show the todo script i wrote everytime i open a shell
todo

## aliases set by user
alias df='dfc -sWT'
alias pine='alpine'
alias vimpdf='apvlv'
alias his='history'
alias last10='tail ~/.bash_history'
alias del='rm -i'
alias emacs='/usr/bin/emacs-nox'
alias fstat='stat -c "%a %n"'
alias hd='hexdump -C'
alias nameservers='grep 'nameserver' /etc/resolv.conf'
alias route='route -n'
alias vusers='cut -d: -f1 /etc/passwd'
# aliasses make the live with python more easier
alias py='/usr/bin/python3'
alias pydoc='pydoc3'
alias pyhelp='w3m /usr/share/doc/python3.2/html/index.html || echo "E: python documentation not installed, linked to wrong location or w4m not installed"'
alias ntpdate='/usr/bin/ntpq -p'
alias h='man'
alias lconfig='cd ~/.local_gitrc'
alias release='cat /etc/debian_version'
alias halt='sudo shutdown -P now'
alias reboot='sudo reboot'
alias update='sudo apt-get -y update && sudo apt-get -y --ignore-hold upgrade && sudo apt-get clean && sudo update-command-not-found && sudo  freshclam && sudo -k'
alias netstat='sudo /usr/bin/watch /bin/netstat -patunel'
# aliasses for systemctl
alias systemctl='systemctl --no-pager --all'
alias india='TZ=Asia/Kolkata date'
alias synaptic='gksu synaptic &'
alias deborphan='sudo gtkorphan'
alias gtkorphan='sudo gtkorphan'
alias fusebundlegen='avira_fusebundlegen'
alias howto='w3m /usr/local/share/doc/HOWTO/index.html'

Color your df command

Working with the shell is good, right?!  It unleashes the power of your operating system and enables you to communicate and interact with the kernel to get informations managed by your system or to tell the system exactly what you want. One information i use quite frequent is how much disk space each file system has left using the df command.

This program shows you a summary on how much disk space you have available on each mounted file system and how much space in total can be used on each mounted file system.

The dfc (df color) command which can be downloaded from here  makes the output of df more colorful and more human readable than the old df one.

df -sW

Once you have finished downloading the the file unpack it:

tar  xvfz dfc-3.0.0.tar.gz

and change into the directory dfc-3.0.0. To install dfc

(1) first create the "build "directory beneath:

(2) Using opensuse install patterns-openSUSE-devel_C_C++ and cmake by issuing

    zypper in patterns-openSUSE-devel_C_C++ cmake

(3) Change into the build directory and issue the following command instructing cmake to create the the make files and configure the source code:

    cmake .. -DPREFIX=/usr/local -DSYSSCONFDIR=/etc -DCMAKE_BUILD_TYPE=RELEASE

(4) Finally compile and install the program by typing:

    make && sudo make instal

(5) If you need Manpages. And i suggest you install them as root user copy the man files from the directory  you unpacked to /usr/local/share/man/man1/ and change the permissions of the dfc.1 file to 755.

    cp /home/hansel/playground/dfc3.0.0/man/dfc.1 /usr/local/man/man1/dfc.1
    chown root:root /usr/local/man/man1/dfc.1 && chmod 755 /usr/local/man/man1/dfc.1

To finally replace the dfc command with the one from the coreutils package you can use an alias. Setting:

    alias df='dfc -sW'

will give you an output like in the picture. Note that the -h option no longer gives you the so called human readable since it is human readable already but does show you the help for dfc. The nice thing is that dfc can actually determine cgroups and so called kernel pseudo file systems which are created by the kernel itself when the system boots up and does'nt show them. To show all File systems including cgroups and kernel pseudo filesystms you can use the -aoption. Also you are able to filter the file system types. For example -t ext4.vfat,ntfs only shows the disk statistics for those particular file systems.

Options:

-h  help
-s  shows a summary and sums up all values used in by the filter
-W displays the full text path of both the mount points and the device files used by the devices
-a show information about all (psuedo file systems included) file systems
-t  filter the output by file system

Also i will build a rpm which unfortunately i am not allowed to provide to due the authors strict copyright. Maybe i can post or link to the spec file.

Getting frozenbyte games to run in opensuse 12.2

For those of you who running opensuse 12.2 and have bought the humble frozenbyte bundle this is a short instruction how you are able to run these games.

Basics:
(1) Install the game in $HOME/trine for example. You have to make sure that the installer is marked executable.  (In fact i will use trine here as my example for this short guide but it works for all other frozenbyte games as well.)

(2) After installing the game go to the destination folder and copy your lib32 folder to lib32_bak
and create a new lib32 folder using mkdir. Replace all libraries in lib32 folder with the one installed
by zypper/yast. Usually these libraries are found in /usr/lib/ and /lib according to FHS and LSB.

    a) If you cannot find a library try to install them natively with zypper and copy them from there
       original places into the lib32 directory.
    b) If  a library is called /usr/lib/libboost_regex.so.1.49.0 but in lib32 libboost_regex.so.1.35.0
       is required just copy /usr/lib/libboost_regex.so.1.49.0 to lib32/libboost_regex.so.1.35.0 in the trine
       install folder.

Most of the addidional libraries can be found in the addidional opensuse repositories. Only libNxCharacter.so, libNxCooking.so, libPhysXCore.so and libPhysXLoader.so.1 are leaved as original. These are the Nvidia PhysX libraries.   

Setting LD_LIBRARY_PATH="/usr/bin:/lib/$HOME/trine/lib32" should also work but causes the game to crash. Also you may want to create symbolic links to these particular libraries instead  of copying them. But i didn't trie this out.

Trine does not save games by default. To get this working you must delete $HOME/.frozenbyte/trine/profile and replace this directory with the one you find in the games destination path which you have had chosen when you issued the installer.

When you start the game do not use the launcher. Just start the game by executing trine-bin32. If you need to make changes use the .frozenbyte/trine/configs/options.txt and configure this file.

To install the games globally i recommend you moving the game folder to /usr/local/games and create the following startscript in /usr/local/bin:

#!/bin/bash
/home/l1zard/bin/trine/trine-bin32

exit 0

For survivor you need a different script:

#!/bin/bash
cd /usr/local/games/survivor
./survivor-bin

exit 0

I don't know why is that

If you want to debug more missing or failed libraries you can issue strace -o trace.log -f -e trace=open,read trine.

What works: Starting and Playing the game.
What does not work: Some Pictures are not rendered and therefore are not shown in sequences.