Grsecurity hardened Ubuntu Linux

This is a quick post for users of Ubuntu trying to get a grsec hardened kernel up and running ASAP. Basically, to sum up what Grsec (with PaX) is (mind you grsecurity and Pax are a very large patch written by some of the world's best security researchers) - It's a set of patches for stock Linux kernel that focuses on kernel security. It provides (together with PaX), a role-based access control, address space layout randomisation (ALSR), NX stack segment protection, privilege escalation vulnerability protection, system call and chroot hardening and a lot of other good stuffs *including* protection against zero-day vulnerabilities.
If you are serious about Linux kernel hardening and exploit mitigation, I recommend you use Grsec (and PaX) patches. The installation is pretty straight forward. I am writing it today so as to be able to help new Ubuntu users who want to secure their system. The steps should get you a fully functional hardened kernel up and running. Give yourself couple of hours for the full procedure to complete (well, this totally depends on the number of CPU cores you have running there :-). Without further aduie, here is the note that I've got used to ...
Continue reading


Posted Feb. 4, 2012 by ishwor
Tagged under: grsec hardened linux ubuntu Comments(2)
Permalink Top

VirtualBox Installation on Ubuntu

Installing VirtualBox for any given Linux release (provided that VirtualBox dev have tested it for that release).

Okay straight to the point. Given any host as Linux release (e.g., 3.2.2), one can get VirtualBox up and running using the following method. The reason I write this is so that users also get that *aha!* and at the same time I also get that aha! without bothering to use search engine as I often use VirtualBox (almost exclusively sometimes). Just so you know, Host OS is what *hosts* Virtual Machines (known as guests). So, in this small note, I am trying to run VirtualBox 4.1.8 (latest stable release at the time of writing) on Linux 3.2.2 Host.

 
1. Become root, z master of the universe.
$ su -
 
2. Get the latest and greatest Linux from http://kernel.org/. Don't
install it just yet.
$ tar xf linux-3.2.2.tar.bz2
$ cd /tmp/linux-3.2.2/
   
3. Get the latest and greatest VirtualBox package for your distribution
from https://www.virtualbox.org/wiki/Linux_Downloads. Don't install it
just yet.
 
4. Copy the existing kernel ".config" to youand make modifications to
suit your need.
$ cp ...
Continue reading


Posted Feb. 2, 2012 by ishwor
Tagged under: linux ubuntu virtualbox Comments(0)
Permalink Top

Now it's Nginx time!

I finally got some time this weekend to switch over my website over from Apache to Nginx and everything seems to be working alright at this point. Not that this really deserves a blog post of it's own but we'll see.

Essentially, there are two parts to this website - Django and PHP which are proxied through FCGI using flup and php5-cgi respectively. Easy peasy! :-) Memory utilisation wise, 4 worker processes + 4 php5-cgi + 4 flups use about the same as Apache on WSGI and PHP. So far it seems to me that the page response time is lower on Nginx (inference based solely on ad-hoc web browser load time rather than any specific benchmark). Images and any static resources do load faster on Nginx.
Continue reading


Posted Sept. 18, 2011 by ishwor
Tagged under: django flup nginx php5-cgi Comments(0)
Permalink Top

Scala on OpenBSD

I've always wanted to sort of learn JVM-based functional+OO scripting language so thought that now would be a good time to learn Scala. However, it wasn't available in OpenBSD ports. The following are the steps needed to get it up and running -

1. Download Scala from http://www.scala-lang.org/downloads/distrib/files/scala-2.9.0.final.tgz

2. tar zxf scala-2.9.0.final.tgz

3. Install jdk: pkg_add -vi jdk.

Also, make sure bash is installed: cd /usr/ports/shells/bash, sudo make install.

4. Add full path to the bin in your PATH environment variable (for e.g. ksh/bash) in your ~/.profile or ~/.bashrc (ksh/bash respectively):

export PATH=$HOME/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin:/usr/games:/usr/local/jdk-1.7.0/bin:.

5. Go to the dir you installed scala:

[~/scala-2.9.0.final/bin] $ ./scala
Welcome to Scala version 2.9.0.final (OpenJDK Client VM, Java 1.7.0-internal).
Type in expressions to have them evaluated.
Type :help for more information.

scala> println("howdy sathi!")
howdy sathi!

scala>

All done. Happy Scala'ing! :)

Continue reading


Posted May 15, 2011 by ishwor
Tagged under: openbsd scala Comments(3)
Permalink Top

Tail on browser

Might come handy, so here it is. It basically tails /var/log/messages and sends it as a HTTP response chunk encoded.
Nothing fancy - very simple and nice ;-)
 
var http = require("http")
var spawn = require("child_process").spawn;
http.createServer(function(req,res){
    var tail = spawn("tail", ["-f", "/var/log/messages"]);
    res.writeHead(200,{"Content-Type": "text/plain"});
    tail.stdout.on("data", function (chunk) {
        res.write(chunk);
    });
    tail.on("exit", function (status) {
        if (status !== 0) 
        {
              console.error("tail exited with code " + status);
              exit(1);
        }
        res.end();
    });
}).listen(8000);
 
Node (http://nodejs.org) is very wery callback oriented. What you see above as function(...) within evented calls (tail.on(...)) are anonymous callback functions that are executed on those particular event. If you're someone from Java world, you can think of this as listeners that are waiting on a particular events to occur. Someone from non-Java world might already be familiar with callbacks. 
 
Node is very nice - I just hope it continues to grow on server-side use. Comments? xD
Continue reading


Posted Nov. 26, 2010 by ishwor
Tagged under: log node node.js tail Comments(0)
Permalink Top

busybox for android

I've just ported and tested stock busybox-1.16.1 for Android. Also ported is the linux tree(1).

Both of these packages are linked statically so are quite fat.

You can download them from my downloage page. Enjoy!

Continue reading


Posted June 3, 2010 by ishwor
Tagged under: android busybox Comments(0)
Permalink Top

Cool!

Some useful links for the day and status updates-

Lot of cool stuffs were written by Nepali Open source developers and enthusiasts - http://github.com/theinitmag/201005/blob/master/releases/theinitmag06.pdf (Lucid Lynx is covered by Jitendra Harlalka). A wonderful read it's been.

I have been playing around with Rabbitmq, Celery and Django of lately - I'll try to cover them in coming weeks if time permits. One can refer to these links for more info into the whole AMQP microcosm. 

Having up'ed http://slader.com from scratch with Peter Bernheim, it feels much better now. It was a good 4 week marathon working with the team. If you're a Maths geek, do sign up with slader.com :-)

Another interesting project is the APE project (Ajax Push Engine). It uses client and server side script written in JavaScript to accomplish server push for real-time data. More available @ http://www.ape-project.org/ 

Enjoy! :B

Continue reading


Posted May 3, 2010 by ishwor
Tagged under: init lately status update Comments(0)
Permalink Top

Bound vs. Unbound Erlang variable

A pretty decent definition of bound vs. unbound variable. A very good Erlang book is at http://learnyousomeerlang.com/; the author of the book hangs around at #erlang@freenode and overall, he's a great guy who helps folks with problems in Erlang.

http://learnyousomeerlang.com/static/img/un-bound.png

On that note, Erlang is a powerful functional language with the following features:

  • Shared-nothing memory architecture - we don't have to worry about resource locking scheme (deadlock/livelock) since nothing is shared. If you need to name a variable twice use a different variable name.
  • Asynchronous message-passing - means decent performance on multiple cores within an Erlang cluster and worry free variables (they don't need supervisory locks to monitor their state because again it's not shared! :)
  • Functional language properties - A high-order function for control abstractions, anonymous functions and lambda expressions(in spirit of Python)
  • OTP and libraries - Running network applications with about 10 lines of server code and about 6 lines of client code is awesome. I've never seen something like it honestly; Or what about full-on binary IP packet matching (what some folks call packet sniffing) in less than 10 lines?
  • Full-on Exception model - try/catch/throw semantics (like Java)
  • Hot-swappable code on live ...
Continue reading


Posted Feb. 28, 2010 by ishwor
Tagged under: erlang nice why whyerlangrocks Comments(0)
Permalink Top

Write assembly in Python!

Multiple things have happened over the last couple of weeks and few months I spent not blogging.

First, I picked this wonderful post by Robert Kern on python mailing list today that made me blog in the first place; Much thanks owes to him for enlightening mere mortals like me. I am still to play around with it but reading the docs is half the battle done. It is all documented at http://www.corepy.org; if you flip over and start reading the "hello world" side of things at http://www.corepy.org/wiki/index.php?title=CorePy_Basics, it looks ridicolously fun and easy again! I think assembly just became fun again :-)

I'll leave it upto you as to basically what you can do them but essentially to do anything substantial you'd have to pump out a lot of asm using CorePy. One could implement some native assembly code in it and use other python libraries to do some really neat stuff. If you only dabble in Assembly like me and wish to not leave the comfortable rear-view seat of Python's high-level world, then CorePy is for you!

Take a look at this snippet:

  import corepy ...
Continue reading


Posted Feb. 24, 2010 by ishwor
Tagged under: assembly books corepy djangle insteresting python Comments(5)
Permalink Top

Eclipse, Pydev, Epic, Java, ErlIDE all in one

Eclipse IDE, Pydev, Epic, Java IDE, ErlIDE is bundled up and available to download (117Mb) from here . Kindly note, that all the packages and the dependencies were strictly downloaded and tested on Ubuntu 9.04 only. The versions includes:

  • Eclipse IDE- Galileo 3.5 SR1
  • Pydev Release: 1.5.4
  • Epic - Testing: 0.6.35
  • ErlIDE - 0.7.3

All software belong to the respective projects. Kindly use it at your own risk. I am providing it merely because of convenience.

[ishwor@muffin:~]$ sha256sum eclipse+java+pydev+epic+erlide.tar.bz2 8249ae3a489f00f2418b8c6d79d936e98d7d4dfc271093bfa52bf7515ea237e8 eclipse+java+pydev+epic+erlide.tar.bz2

Happy hacking! :)

(update: re-posting because of typo in my RSS template. Apologies)

Continue reading


Posted Jan. 23, 2010 by ishwor
Tagged under: bundle eclipse epic erlide java pydev Comments(2)
Permalink Top



A Django site. Powered by Python.
Developed using djangle