Getting CMD Line FTP to work on Windows with a PFSense Firewall

PFSense Firewall Fix For Windows FTP

With PFSense especially with version 2.2 there is a known bug that it kills Windows Command line FTP (linux and Mac OS FTP though the cmd line work fine), which is a real pain if your on a Windows platform and your trying to automate something where a typical piece of software won't cut it.   There is FTP proxy plugin, but it is in beta, and at least for me it didn't seem to work.  https://forum.pfsense.org/index.php?topic=89841.0  at least it didn't for me.  I'd also rather not open a bunch of ports and have to manage and monitor all the different ports required in the firewall. 

I needed to setup an automated process on a windows client (no choice propriety software requires windows) to FTP text files to a old IBM mainframe FTP.  To work around this issue I found a nice piece of software from IPSwitch called Move It Freely.  You install the software and I highly recommend letting the software create the environmental variable so you can call the software from anywhere in the system.  In your .bat files or VB Scripts if you call ftps instead of ftp it calls the "Move It Freely" client.  Once you are connected make sure you change your transfer type to passive as Windows CMD Line FTP (ftp.exe) defaults with active as does Move it Freely.  That is why in windows FTP you need to put the command QUOTE PASV to enable passive mode.

Documentation for move it freely can be found here. 

https://moveitsupport.ipswitch.com/SUPPORT/mifreely/mifreely.htm#examples

Windows Command Line FTP Info

Here is an example of a bat file to upload a file.

ftps $HOST -user:$Username -password:$Password

cd $directory

prompt

bin

hash

passive

put $FILE

quit

How to Install .NET framework 3.5 on Windows 7 Embedded

You can view the video on the installation of .net 3.5 on my Youtube Channel. 

To install .NET framework 3.5 on Windows 7 Embedded, it is really a easy process once you know how to do it.  This is an update to my previous post, I decided that I would make this one extremely easy to follow with step by step directions.  My other post only worked occasionally, this one I've made sure it has worked every time that you do it.  There are some files you will need before we proceed.

Chrome or Firefox to get the files you will need.
.net verification tool
The full .net 3.5 Framework 

As you know with windows 7 how you would typically install the .net framework is though the add and remove programs.  This is restricted in Windows 7 Embedded.

To add .net 3.5 you typically go though the Programs and Features Category
and select Turn Windows Features on or off

This post will by pass this restriction without doing any registry edits or messing around with security settings.  For the rest of this post I will be working out of the downloads directory.  I've already loaded chrome and have downloaded the .net verification tool and the Full full .net 3.5 Framework 

open cmd prompt as administrator go to your downloads directory

and extract dotnetfx35.exe using command
dotnetfx35.exe /x:

You will get a prompt asking where you want to save the extracted files.  I am saving it to a folder called net35

Once extracted we will need to go to  net35 -> wcu -> dotNetFramework


You will then be prompted to save the extracted files.  I've put mine in a folder called net35

Navigate to net35 -> wcu -> dotNetFramework

run the extract command in the command prompt again and save the extracted files to the same directory

dotNetFx35Setup.exe /x:

inside of dotNetFX30 install the following files
netfx30a_x86
WCF
WCS
WF_32

This will install the essential files for .NET3, which is required before .NET3.5

Go up one directory level and go to the folder TOOLS and Install chwireg

Then go up a directory level find and run the setup application in compatibility mode vista sp1 and as administrator.

You can verifiy that .NET 3.5 SP1 has been installed by using the net_setupverifier

As you can see I have .NET 2 SP2, .NET 3 SP2 and .NET 3.5 SP1 all installed.

A couple other tools you may want to use or look at using once the frameworks are installed.

.NET Repair Tool go to https://support.microsoft.com/en-us/kb/2698555

.NET Clean-Up Tool http://blogs.msdn.com/b/astebner/archive/2013/11/06/10464416.aspx

Veeam Backup and Recovery

If you need to make a name change to the server that is installed with your veeam backup and recovery software there are a couple things you will need to change if you don't want to uninstall and reinstall the software.

For the Backup Service you need to change these two registry keys

Veeam refers to the local computer name in a couple of registry entries and promptly stopped working.

The keys for the backup service are:

HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\SqlServerName

HKLM\SOFTWARE\Veeam\Veeam Backup Catalog\CatalogSharedFolderPath

For the SQL database service it is in

HKLM\SOFTWARE\Microsoft\MSSQLServer\LASTCONNECT

Printing a customized fixed header from MS Excel on every page

How to set a number of columns or rows in MS Excel to print on every page.  This should apply to MS Office 2007 and later.

In MS office ribbon go to the Page Layout Tab -> Print Titles

Then you will see this page setup pop up screen.

In the rows to repeat at top put in the range that you want to put on every page.  In this case I want rows 33 to 36 to repeat on every page I print.

Then select print preview to see the rows repeated on the top of every page.

Then Print your document.

Cyptowall 3. From Infection to Recovery.

Cyptowall 3.  From Infection to Recovery.

Disclaimer - for protection of the companies and their staff involved I will not name or reference them any other way then "The Company" and "Staff". 

 

A few companies I've consulted with were hit with Cryptowall version 3.  The entry point was a staff member who opened something in the email they shouldn't have.  Their computer was protected with a "tier 1" anti-virus (For the record I use the term "Tier 1" very loosely.  The infected machines were using all up-to-date well known corporate anti-virus).

After the staff member opened the email attachment I'm told the anti-virus had claimed it blocked the infection, it however did not.  The virus ran until the staff member went home; there was no alerting the IT staff due to a lack of procedural operations if such an event were to occur.  Also IT staff being contractors or on call.   The virus encrypted almost all files on all mapped network windows file shares.  1/5 of all the files were encrypted and 1/2 of all the files were infected on all the shared drives for all users.
 

It is well known and documented that once infected with a ransomware the only course of action is to recover from an offline backup or pay the ransom.  As all the most recent files were encrypted the oldest backup were 1 to 2 weeks old which was an acceptable lost to the organizations involved.  Due to the size of the file shares doing an offline backup every night was not an option for the company; the backup drives are rotated weekly.  Archiving files are also not considered a high priority due to the price and size of hard drives.  The time to sift through and decide what projects and files can be archived can be time consuming. 

I was however able to get back approximately 2/3 of the differential data from the drives using some recovery software and specifying the date range from the last backup to the day before the virus infected the system.  My preferred choice of recovery software for windows is Active Undelete.

The software is very intuitive, reasonably priced and has helped me recover more files for clients from accidental deletion, dead hard drive or an accidental format. I ran a full drive scan, took about 6 hours through USB 3 on a laptop to recover the differential data.  Of that differential data 80% of the data appeared to be uncorrupted,usable and accurate as of the day modified.

I will be doing a follow up post on this for a backup solution that is ransomware resistant to with-in 24 hours from the time of the infection.  It really is a post you don't want to miss.

Cisco did a very good blog post on the technical aspects of cryptowall 3.

http://blogs.cisco.com/security/talos/cryptowall-3-0

Here are some links on the very first type of this crypto-ransomware cryptolocker.
http://en.wikipedia.org/wiki/CryptoLocker

The TWIT network did a great breakdown on cryptolocker on Security Now!
http://twit.tv/show/security-now/427

Build your own cloud

I've been in the computer industry for over 12 years and the biggest changes I've seen is the move to third party cloud services such as Dropbox, Box, Google Drive, One Drive, etc.  It has never been easier to send and receive files, especially for printing or getting photos from a photographer after a job is finished.  I've been a production manager for a print company and the easiest way we could get large oversized files to us was to try and have a ftp server with a java applet that worked about 70% of the time or a step by step PDF the links to a ftp program and hope the user was techy enough to follow the instructions.  I've help on some projects where I used a web based file manager like extplorer to create something like Dropbox only without someone needing to sign up and become a member of the cloud service but it never really worked quite right and it required more technical knowledge for creating users with proper directories.

I learned about owncloud last year from a google plus post and I found the project interesting and the thought of having my own 500gb cloud storage is pretty awesome.  I did a default install on a Linux php mysql platform, and it had a default limit of 2 GB  per upload.  I have a 50 mbps connection through telus so I have 10 up 50 down a 400 GB bandwidth cap.  This worked really well and it does not require more then basic computer skills to setup users and share files.

The user setup is really straight forward.  After a successful setup you can login and start creating users.  Go to where your name is and click on it; it is an actionable button and select users.  You will then see a screen much like this one.  To create a user simply put in a username and password and hit create;  That is it.  It's that simple.

You can get really crazy and setup different user groups, and have granular control of things on the server.  Some great use cases that I've setup others using the other software would be for submitting content for a contest, gallery or a website, large project collaboration, the list goes on.  Since you have control of the server you don't  have to go though the hassle of having the users create online accounts with Google, Microsoft, Dropbox or any other cloud storage service.  You can login, setup the user, and email them the URL or make a shortened URL via bit.ly and include their username and password.  They do the rest with the web browser and as you can see by the image below it is extremely straight forward.

New lets you create a new file but the main one we are interested in is the upload icon next to the new.  It will upload a file from the computer to your owncloud.

As you can see when you hover over a file in owncloud you get options as to what you want to do with it.  In this case share it.

If the person has your owncloud name in this case "demo" they can share it with you and it will end up in your owncloud, however they can also send it to you via email link and password protect it and set an expiration time for that access.  If you are setting this up as a "file drop solution" the drive that users upload files to could be shared out and accessed by those with the proper share path and username and password to access the files, making it extremely easy to access the files that are uploaded.

This is extremely impressive technology for an open platform, and that the community edition is free, is even better.  The site is also mobile responsive and works well in the browser, but if you want the app it's going to cost you a whole $1.00 on both Android and iOS.  There are also desktop apps for Windows, Mac OS and Linux.  You can also specify whether you want to enforce https or use either http and https depending on what your needs are and how your server is setup.

How to install and Remove Java on Ubuntu

Install Oracle Java in Ubuntu by PPA 

This provides instructions on how to install the Oracle Java JDK (which includes Java JDK, JRE and the Java browser plugin). The PPA provides the full Oracle JDK package. 

To add the PPA and install Oracle Java 7 in Ubuntu use this: 


sudo add-apt-repository ppa:webupd8team/java

sudo apt-get update
sudo apt-get install oracle-java7-installer 

To add the PPA and install Oracle Java 8 in Ubuntu use this: 

sudo add-apt-repository ppa:webupd8team/java
sudo apt-get update
sudo apt-get install oracle-java8-installer 


If you want to see your version of java run the following command in the terminal: 

java -version

It should return something like this 

Java version "1.7.0_51" (version 7) or "1.8.0" (version 8) 
Java(TM) SE Runtime Environment (build 1.7.0_51-b13) - version 7
Java(TM) SE Runtime Environment (build 1.8.0-b132) - version 8
Java HotSpot(TM) 64-Bit Server VM (build 24.51-b03, mixed mode) - version 7
Java HotSpot(TM) 64-Bit Server VM (build 25.0-b70, mixed mode) - version 8 

If the Java version in use is not 1.7.0, you can try to run the following command in the terminal: 

sudo update-java-alternatives -s java-7-oracle 

The installer requires you accept the Oracle license before the installation begins. This is only required once. If you need the installation to be automated, you can run the following command to automatically accept the Oracle license: 

Version 7

echo oracle-java7-installer shared/accepted-oracle-license-v1-1 select true | sudo /usr/bin/debconf-set-selections 

Version 8 

echo oracle-java8-installer shared/accepted-oracle-license-v1-1 select true | sudo /usr/bin/debconf-set-selections 

Setting Java environment variables To automatically set up the Java 7 environment variables, you can install the following package:

sudo apt-get install oracle-java7-set-default 

 If you've already installed oracle-java6-set-default or oracle-java8-set-default, they will be automatically removed when installing oracle-java7-set-default (and the environment variables will be set for Oracle Java 7 instead). Switch back and forth between Java 7 and 8

Switch to Java 7

sudo update-java-alternatives -s java-7-oracle 

 And, switch back to Oracle Java 8 using: 

 sudo update-java-alternatives -s java-8-oracle 

If you get some warnings when running these two commands, ignore them.


How to Remove Oracle Java To remove java on your system and want to go back to OpenJDK or remove java completely, all you have to do is remove the Oracle JDK7 Installer and the previous Java (OpenJDK, etc.) version will be used: 

sudo apt-get remove oracle-java7-installer 

sudo apt-get remove oracle-java8-installer    


Special thanks to webupd8.org for their great tutorial for which this is based.

Disable Encryption on Ubuntu VNC Server

In Ubuntu starting with 14.04 a change was made in the VINO server (VNC) to have encryption on by default. Of course this breaks many of the VNC Clients on windows, so to allow windows users access to the linux server via VNC there are 2 ways to update the VINO server to disable encryption.




Option 1 - Command Line:

edit ~/.bashrc and on the last line add

dconf write /org/gnome/desktop/remote-access/require-encryption false

save the file and reboot the system

Option 2 - GUI

On the linux server open the terminal and install dconf-editor

sudo apt-get install dconf-editor 

Open the program it Navigate to: 

org  >>  gnome >> desktop >> remote-access and Disable "require encryption"


After doing this your windows VNC client will have no problem connecting to the Ubuntu Server using Screen Sharing.

Troubleshooting Tip:  If your having problems with the screen redraws make sure your using the XORG driver.  Using the proprietary driver can cause redraw issues with VNC

Removing Java Runtime from OS X

Java 8 removes the Medium Security
Setting in OS X

Removing Java From OS X

Since Java 8 came out you no longer have the ability to run self signed java runtimes.  This is a good thing from a security perspective but some devices like iKVM's use java self signed certificates to allow access and if your running Java 8 and OS X you might have a problem.  My solution to this was to uninstall java 8 using the following commands

sudo rm -rf /Library/Java/JavaVirtualMachines/jdk{version}.jdk

sudo rm -rf /Library/PreferencePanes/JavaControlPanel.prefPane

sudo rm -rf /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin

Then I installed the latest version of Java 7 which will only be available until April 2015, but it will still be made available though the Java Archive.

Expanding a FREENAS ZFS volume by drive replacement

Freenas is a great NAS solution especially given the price and the hardware of other NAS solutions; Freenas offers the best performance, expandability, value and flexibility in a NAS solution.  Freenas can provide NFS, Samba and Apple shares so the platform you want to use really doesn't matter what the client machine is.

Just reciently I've found my self down to 100GB of my 6.4 TB NAS and decided it was time to upgrade my storage space.  Now upgrading storage space on freenas isn't as simple as just replacing a bunch of drives; you must replace them one at a time and you wait for the drive to be completely replaced (resilvered) before replacing another drive otherwise you risk data corruption or loss.  By default the auto grow is set to off so if you want to grow the space on your nas you must enable the auto expand feature in freenas.  As always you should have another backup of this data.

So on your FreeNAS server you want to login via SSH or use the shell console provided in the web interface.  Type the following command.

zpool set autoexpand = on {your volume name}

Once that is enabled you may now grow your freenas storage by replacing drives.  As for myself I've replaced 4 320GB drives with 4 1TB drives moving my NAS from 6.4 GB to 8.3GB of storage space and to replace the drives it is a daily process with replacing a drive once a day until they are done.

Backing up your Android Phone's Stock Rom and Recovery

Backing up your Android Phone's Stock Rom and Recovery

Have you ever wanted to mod your new android phone but wanted a way to get back to the factory settings without having to mod the phone first?  It is possible to do but you need a few things, the Android Dev tools, fast boot, and some command line know how.  For this example I will be using a HTC One X on the Telus Network.

With HTC you have to get a developer token which can be obtained from http://www.htcdev.com.  You will have to sign up as a dev to get your developer token.  HTC has a great tutorial on how to unlock your bootloader on the htcdev site.

Once your bootloader is unlocked you can now download a 3rd party rom manager (don't worry we are just going to boot off it; were not installing it yet - also make sure you have enabled USB Debugging in the developer tools).  I used TWRP, it is more compatible with my device then clockworkmod is.  Once downloaded (I renamed the downloaded rom manager to recovery.img) and moved it into my fastboot directory on my computer.

Here is a look at the fastboot directory on my computer

Now the fun can begin; make sure you have all the files you need in the directory your working out of, in my case the fastboot directory.  Your phone should be plugged in via usb to your computer then I used adb to reboot my phone into the bootloader

C:\fastboot>adb reboot bootloader

Then I booted off the recovery.img file in my fastboot directory.

C:\fastboot>fastboot boot recovery.img

Then your phone should boot off the custom recovery rom without installing it.  Then you can make a backup using the recovery rom.  Once done reboot into the phone's system and load a file manager like ES File Explorer to get the files off using dropbox or some other means.

Now you have a backup of your stock phone and you can now mod your phone to your heart's content.

Update:  I forgot to mention that with HTC you also have to update your boot.img file using the commandline interface.  To get the boot.img file you can get it by extracting it from your backup or the zip file from your thrid party rom like cyanogenmod.

C:\fastboot>fastboot flash boot boot.img

Freenas Format Error: Operation Not Permitted

Freenas Format Error

If your trying to erase a drive in freenas and you get an error "Can't Erase Drive /dev/: Operation not permitted it is happening because of GEOM's protection of the MBR of the disk drive.

To solve this turn off the sysctl variable from the console.

sysctl kern.geom.debugflags=0x10

Connecting A Mac To A Windows Share

Connecting A Mac to a Windows Share

With the exception of mobile devices we still live in a "Windows World" and with the latest version of OS X comes an update on how to connect to a windows share using SMB2 instead of SMB.

On Mac OS X (Pre Mavericks or 10.9) we connected to a windows share using smb.

From the Finder press the "Command" + "K" keys or go to the "Go" menu and select Connect to Server.  In the server address field put in either smb for pre 10.9 or cifs for 10.9

On a workgroup it looks something like this:

smb://thecomputer/sharedfolder

On an active directory the samba setup it looks more like this

smb://domain.ext/dfs/sharedfolder on a domain using a DFS Share

Now on OS X Mavericks we use cifs to connect to the windows shares.

cifs://thecomputer/sharedfolder on a workgroup and 

cifs://theremotecomputer/sharedfolder$ on a domain using a DFS Share

If you are not logged into the domain or if the share doesn't have anonymous access it will prompt you for a username and password.

How to ssh into a Linux/Unix System without a password

Login to a Linux/Unix System without a password 

Setting up SSH/RSH Keys for Remote Administration Under Linux/Unix can be one of the most time saving things you can do.  I've set this up because I am managing a dozen Linux based kiosks based Lubuntu Linux and Mozilla FireFox on that need to remotely shutdown and startup.

For managing the kiosks I am using Ubuntu 12.04 LTS, on a VLAN network.  This server also remotely shuts down some Windows based stations and is used for Imaging using the FOG project.  I need to update the RSH Public and Private Key because I have replaced the server.

Setting up RSH Public and Private keys are trivial but this allows me to control the systems without having to enter a password every time I want to do something to the computer (besides something that requires root privileges).

The first thing I do on the computer I want to control the other computers with is generate a public and private key.  I've done this in a .ssh directory using the Terminal

$ mkdir -p $HOME/.ssh
$ chmod 0700 $HOME/.ssh
$ ssh-keygen -t dsa -f $HOME/.ssh/id_dsa -P ''

This should create two files, $HOME/.ssh/id_dsa (private key) and $HOME/.ssh/id_dsa.pub (public key).

In my case I'm using a script called dafturn-ofris which is kind of a steady state script for linux which prevents users from making changes to the system and rebooting restores the system to the state it was frozen in.  So I unfreeze the client system (the system I want to control remotely) and copy the public key from the "Server" to the client; I used SCP to accomplish this.

On the computer you created the key on open the Terminal move to the directory you generated the public key.  In my case it is the .ssh folder in the $HOME directory of the user I'm logged in as.

$ scp id_dsa.pub username@remotehost:directory/to/save/it/in/

Enter in your password and this will complete the file copy.

Then login the remote client move into the directory where you saved the public key and run the following commands.

$ cat id_dsa.pub >> $HOME/.ssh/authorized_keys2
$ chmod 0600 $HOME/.ssh/authorized_keys2

Depending on the version of OpenSSH your using the following commands may also be required.

$ cat id_dsa.pub >> $HOME/.ssh/authorized_keys
$ chmod 0600 $HOME/.ssh/authorized_keys

An alternative is to create a link from authorized_keys2 to authorized_keys; your choice.

$ cd $HOME/.ssh >> ln -s authorized_keys2 authorized_keys

Now you should be able to remote into the client computers you want to control from the server computer without being prompted for a password; with the exception of root access.  I use this for running rsh command that remotely shuts down client stations when its closing time.

Source Credit: http://csua.berkeley.edu/~ranga/notes/ssh_nopass.html

Creating A Secure Password

Creating a Secure Password

Password security is critical to your online life. If you don't have a secure password you will be easily hacked, many passwords are set to be 12345 or password.  

Here is an example of a bad password. https://www.youtube.com/watch?v=a6iW-8xPw3k

The best passwords have upper and lower case, numbers and alternate characters like underscores, dashes, asterix and are long typically over 8 characters; 8 characters would be a minimum length for a password today. Try remembering this password created by Data on Star Trek The Next Generation.

Creating a good password is hard, and making one you can remember is even harder but not impossible. 

Elements Every Password Should Have: 

• Be longer then 8 characters should be more like 20
• Not be a dictionary password 
• Should have at least 2 numbers
• Should have at least 2 capitals 
•  It should have at least one alternate character
• Should not be the SAME PASSWORD on every site.

Here is a form to help you create a good password; please fill out the following:

Favorite Animal/Colour/Activity: ______________________________________ 

 Favorite Object/Word/Family Member: ________________________________

Select one of the or more of the following characters: ! @ # $ % ^ & * ( ) _ - + = | ? / 

Put down your favorite Number ____________________ 

(if your favorite number is a single digit please put a 0 in front of it. Ie. 01) 

Example: 

Favorite Animal/Colour/Activity: __cat_ 

 Favorite Object/Word/Family Member: _orange_ 

 Select one of the or more of the following characters: ! @ # $ % ^ & * ( ) _ - + = | ? / Put down your favorite Number ______24_______ 

Your password can be OrangeCat@24 or other variants can be used what ever is easiest to remember.

Password Testers

Microsoft Password Checker

http://www.passwordmeter.com/ 

http://howsecureismypassword.net/ 

Password Generators

http://www.testyourpassword.com/ 

Crazy Password Generators 

https://www.grc.com/passwords.htm 

https://www.grc.com/ppp.htm 

Top 500 Worst Passwords 

For the regular user expecting them to change their password every two weeks for all their online services is pretty crazy.  However for them to have a tiered password system or create a good password that is related to the site you are visiting but not obvious using the rules shown above.  For example if I create a hotmail account I might make my password something like MyOrang3h0tM@!lAcc0unt24

And in case your wondering it would take an average desktop over 18 trillion years to crack my password.  How about yours, try it out on http://howsecureismypassword.net/