Author: Frank Lee

We’ll be meeting at Social House in South Riding tomorrow evening, starting at 1830 til whenever. A great opportunity for noobs and strangers to prove their worth for elevated Discord status and invites to the private meetups.

Bring badges, wear swag, show your defcon colors. We’ll be easy to spot. If the weather holds out as planned we’ll try to hang outdoors.

This week’s DC540 meetup will be HYBRID. In person for those who want to share a common space and a common table, and virtual for those who can’t make it out. Tune into the Discord for topics.

NEXT week, 3/7, will be virtual only due to stuff going on.

I do a lot of closed network design for projects. Island networks for developer teams, with no internet, but all the collaboration accoutrements a productive team might need. Authentication, repositories, build systems, file sharing, email, SSO, etc.

Yesterday one of them blew up. The collaboration suite stopped working. My first theory was that something ran out of space. And I was right, but not the collaboration suite itself. Turns out the LDAP server which handles authentication ran out of space, and the collaboration suite died because it couldn’t contact the LDAP server.

But wait, why did the LDAP server run out of space? All it’s doing is LDAP and DNS.

And the journey begins.

A while back, I had disabled recursive DNS queries because someone’s chatty MS product was spewing so many DNS lookups that would never resolve, and those queries were subject to a timeout, and those backed up queries created a logjam that prevented legitimate queries for local assets from getting through. Disabling/disallowing recursive queries seemed to shut everyone up, since the queries were immediately denied rather than waiting for the timeout, so I moved on.

Yesterday’s problem was a bit more intense. Someone had pulled an email from outside the system into Outlook on the closed system. Not a problem, right? Well, Outlook is downright screwy sometimes. Just the act of doing that caused that user’s Outlook to spew over 600 DNS queries per second, and since the DNS server had defaulted to query logging, it resulted in 20+ GB of query logs, to the tune of 46 million queries in less than 60 hours.

This seemed slightly excessive to me.

I know I could have just turned off query logging, but I thought of another approach that might stop the noise without sacrificing query logging, because, you never know how that information might help. Also, that doesn’t STOP the traffic, it only stops recording the traffic. So I took all the domains from the chattiest queries — by far the highest was from that clearly broken Outlook process, an infinitely-repeating query to an outlook mobile / O365 address on msedge.net — and created fake authoritative zones on my DNS server. I was almost surprised that that shut things up immediately. Because I left query logging on, I could see an immediate effect. I guess an authoritative no is enough to shut things up in cases where a denied query might not.

All this is to say, really, I think 99% of people really have no idea just how much communication goes on behind the scenes in their so-called private networks. This is a set of clients that have never touched the Internet. Fresh out of the box, with updates applied from WSUS offline bundles, and I’ve got hundreds of thousands of queries to Facebook, Twitter, Ebay, Amazon, Google, MS and more. None of it was initiated by the user. This is all of that “user as product” bullshit.

Nice in-person meeting last night. One attendee brought his portable modular synth case. I wish we would have gotten around to plugging it in, I’m interested in the sounds of some of the modules.

Sorry to those who were hoping we’d be virtual as well. Maybe you had your own separate meeting. Maybe DC540 has forked now.

We discussed yet another new direction for this year’s badge. Sounds fun and intriguing. Even more so if people run with the idea.

A discussion came up about the state of CentOS replacements after CentOS’ shift to an upstream rolling distribution model. I thought I’d share this writeup by computingforgeeks, which summarizes the four main contenders, mainly in order to battle one member’s contention that “only four people use Rocky.”

My two favorite reasons for upgrades are expanded capabilities and simplified workflow.

I recently upgraded my mixing board/recording console from a Tascam DP-24SD to the Model 24. They’re both 24-track recording consoles, but the operation is night and day.

First, the DP-24SD only has 8 real-time input channels. This is fine for someone who wants to lay down tracks one or several at a time, but not for someone like me whose primary limiting factor was “too many sound sources.” The Model 24 can actually receive 24 channels of audio at once. Bye bye rack-mount submixer, hello modular synth sound sources!

Second, while the DP-24SD was really capable, with panning, effect sends, per-channel EQ, etc., all of that was controlled in a menu. When your’re in a zone making bleep bloop sounds, it takes you out of the zone to have to navigate menus. The 24 has dedicated knobs for panning, FX send, EQ, etc. for each channel. It’s like the gear I learned to do this stuff on back in the day. Except now it records 24 tracks to an SD card.

The end result of these improvements is that making music gets me high again. Instead of frustrated menu-navving, I’m tweaking sounds and levels in real time and doing more, with less context-switching. It’s a more organic relationship between myself and my analog synths.

And yes, it’s messy. I find myself changing my wiring choices every time I fire it up. In real time. On the fly. Someday the semimodulars and the modular stuff will be closer together. Until then, here we are.

It’s a similar upgrade decision tree for the laser engraver. I found myself deciding not to try new things a few times because it would require a height adjustment. Two hex screws to loosen, move the laser head to the new height, and then tighten again. A recipe for stripped screws, and a pain in the butt. Found the plans for this on thingiverse, installed it, now changing the height is just turning the knob. SO much easier to adjust the height for wood, leather, aluminum, or even the roller attachment.

We’re opening up the basement for an in-person meetup tomorrow evening. The usual location at the usual time. Masking is still encouraged.

I’ve been working on calibrating and documenting the laser engraver settings. I also added a 3d-printed height adjustment mechanism, which is amazing. If you want to bring home a souvenir, open up GIMP and create yourself a business card. 84x54mm, or 54x84mm if you want it vertical. I have several colors of coated aluminum business card blanks to choose from, and I’ll be happy to burn you one while you’re here. This is from a recent commissioned request.

If we have enough cats to herd, we’ll talk about the official organization and maybe even elect a board. Bring a snack or bev to share if you’re so inclined, or just mooch. Your choice. We’re all family here.

If you’ve never been and you’ve been vetted and have the address, come on out. If you’re a complete stranger, consider getting to know us in the Discord for a meeting or two.

Got the news in the mail this weekend. The process took 7 months once the corporate structure was correct. Feel free to join the discord this evening. We currently meet on Mondays at 1830 Eastern time. Virtual only until Covid lightens up.

Meetup this evening in the Discord @1830ish. The decision was made to stay virtual-only until Omicron loses some momentum. Don’t want to participate in the spread. Taking advantage of the downtime to refresh the space.

I know a bunch of you are traveling or otherwise engaged with family and holiday activities. Therefore, there will be no in-person meetup on Monday 12/27.

However, I will likely be online, assuming I make it home on time. I have to pick up some auction stuff in Maryland in the afternoon.

I’m very excited about the badge discussion we had last week, and look forward to further discussions with those who have been read in to the project. I’d like to see what thoughts you’ve had since last week.

So I finally put shiny white wallpaper on that long table at which we normally convene, and I thought, since it’s starting to shape up in there and the table is clear, perhaps we should have a minor little holiday gathering of some sort, and maybe our little death cult could recreate the last supper?

In other words, hybrid again Monday, I’ll restock the beer by then. Dress in your holiday finery. Be photogenic unless you’re in the witless protection program. We can discuss food options in the Discord over the weekend.

Show up in person or stay virtual if you must. We’re getting a little better at Hybrid.

Maybe we can talk Kevin into walking us through an RE challenge.

Maybe we’ll talk someone into drinking Malört.

Maybe the asteroid will show up early and obliterate us all.

I’ll be burning wood again during the meeting. If anybody wants to burn a custom holiday ornament, I have extra blanks. Bring a round image. 85mm x 85mm at 300dpi is optimal, but the software is very forgiving.

Actually, no, I take that back. Making that association would give evil a bad name. Parallels hijacks media file associations and routes them to Windows VM!

Installed Parallels on my M1 Macbook Air so that I could have a Kali VM when I needed it.

Eventually installed a Windows VM for reasons.

Then I noticed that Parallels had hijacked some of my media file associations so that when I clicked on MP4 or AVI files, default behavior became “Launch Windows VM and play it using Windows Media Player.” On what planet is this desired or acceptable behavior?

Of course, I undid it. Finder/file/Get Info/Open With/make change/for all. But part of me wants to meet the people that thought that would be a good idea and educate them with a hemlock cocktail. Is this simple pseudo-benevolent scope creep, or is this evil payola? I’d like to believe that the number of people desiring media to play inside a VM is less than 1%. It’s the least efficient way possible to play media. The only thing worse would be if, when you click a media file, someone is dispatched to your door to play it on their phone for you.

This evening we’ll be hybrid. If you just need to get away from your miserable home and have a beer with other adults who know what you’re talking about when you talk nerdy, feel free to come by. We’ll also stream to Discord for those who are too busy and self-important to hang with your friends. 6:30 in the usual place.

If you’re like me and you’ve linked many, many applications to FreeIPA, you probably have a pretty good sense of how to go about it, and in some cases you can use an app’s authentication subsection without even consulting the Great Oracle Of Grand, Legitimate Experience.

At least, this is usually the case with me.

Not so much with Zabbix. The interface was so deceptively simple that it threw me off.

Here’s what I discovered. Some from forums, some from less-than-obvious documentation, and some from twiddling knobs.

1. To even get an LDAP configuration to pass a test and authenticate a user, the bind user needs to be described in a full DN. This isn’t completely out of left field, I’ve seen a few implementations require this, although I prefer just providing a username and password.
2. You also need to add “cn=compat” preceding your base dn in the LDAP configuration page.
3. Here’s where it screwed me. I expected, after passing a test, that if I switched to LDAP authentication it would just work. Not so. There’s a brief mention of it in the docs: “Note that a user must exist in Zabbix as well, however its Zabbix password will not be used.” So here I was trying to authenticate an LDAP user after switching to LDAP authentication, and wondering why it doesn’t work. It’s because this implementation doesn’t sync users.
4. Also the internal Admin user no longer works after you switch to LDAP. I went through a couple rounds of resetting it by MySQL (“update config set authentication_type =0 where configid=1;”) before the light bulb turned on — just uncheck “Case sensitive login” and you can use your LDAP admin user. At that point I created local users to match my LDAP users, and gave them the rights I needed. In the end, it seems like the Zabbix implementation is only using LDAP for authentication. Nothing as fancy as something like Zammad’s LDAP implentation, which maps LDAP groups to roles in the application.
5. One more thing when creating a user, the UI says the password is optional when it’s an external user. This isn’t exactly true. Maybe it won’t be used, but it wouldn’t let me complete the form without a password. So make it a strong one.

Anyhow, I hope this helps someone someday. I found precious little online, and if I had it spelled out for me like this when I was looking, I would have been finished much faster.

Friend of mine ground-scored a laptop that was left in a college locker at the end of the school year. Visible screen glass damage from a violent corner drop, but still powered up and displayed just fine. Cute little unit, a Lenovo Flex 3. The screen flips around 360 to turn it into a tablet.

Anyhow it hadn’t been wiped. Windows 10, one known username, password unknown. A quick Google gave me something to try. Boot Windows 10 USB installer, go to command prompt, copy c:\windows\system32\cmd.exe into c:\windows\system32\sethc.exe (the sticky-keys notifier).

Boot the machine normally, and when it gets to the login, hit left-shift five times. Instead of the sticky-keys notifier, you get a command prompt. All I had to do at that point was change the user’s password:

net user (username) (new password)

I could immediately login as that user. Not much in terms of payload immediately visible. Hardly anything in documents, fewer than 30 photos saved, no custom apps. Oh wait, let’s launch mail (this machine is not connected to the Internet). Bingo, user’s complete historical Gmail up until the machine was last used. Conveniently saved to the laptop for me to rifle through looking for other useful data.

Moral of the story? Encrypt your home directory.

I suspect if I gave it internet access it would try to reach out to Google and raise an alarm for suspicious login and force reauthentication. Would that cause me to lose the existing emails I have already correct: That’s a question for another day.

Per group vote, and also because I have another meeting tonight, this evening’s weekly DC540 meetup will be virtual. See you in the Discord @ 1830.

My daughter is obsessed with planners. Her class notes are works of art. She’s done bullet journaling. Her last planner was a Passion Planner. She’s home from school for a couple of days and showed me her latest acquisition. It’s a Hobonichi Techo Cousin. It’s got pages for viewing a month at a time, a week at a time, and then a page per day. Every page is high-quality bleed-resistant paper with small graphs, which is very conducive to writing neatly with small handwriting. I was instantly attracted to it.

https://amzn.to/3C8NLqV (affiliate link, obvs)

Then she showed me how the cover is already starting to bend, so everyone usually gets covers for it.

The journal is $54 on Amazon. This seems like a lot, but with so many pages of very thin high-quality paper, it’s probably still a good price. But the covers — my god, there are covers people are charging over $100 for. I guess in the planner cult, you’re judged on how elite your planner cover is. 🙂

There is also a five-year version of the Hobonichi. Can you imagine a five-year planner? I cannot.

I’ve been taming my homelab network. All the VMs I’ve installed to try out software that I eventually deploy at work, the few administrative VMs I need for my own “stuff,” etc., and I was pleasantly surprised. Turns out that most of my stuff is reasonably up to date, a bunch of CentOS 8 VMs, a few recent Rocky 8 instances, a few Ubuntu servers, and one lone CentOS 7 instance.

So I decided I no longer want to support CentOS 7, and since everything’s on ESXi, it’s easy to attempt the CentOS 7 to 8 update I found here: https://www.tecmint.com/upgrade-centos-7-to-centos-8/

Everything sailed smoothly until the actual package update step. Obviously it’s a lot of packages, etc., a lot of opportunities for things to go wrong. And a couple wrinkles did expose themselves. One was MariaDB and the other was the FreeIPA client. And since I took a snapshot before starting, I felt pretty free to experiment.

So fuck it. I backed up the MariaDB database itself just in case, and deleted the package.

The fuck it, I can recreate the FreeIPA config if need be. Deleted the package.

Some other minor stuff came up as blockers, the rpmconf package, etc., deleted them too.

Ran the upgrade, it went all the way through. Then I simply reinstalled the MariaDB server and the FreeIPA client using dnf, and they both picked up their original configurations and just worked. I love it when that happens. No there’s no more CentOS 7 on my network.

Hope y’all can make it. How’d you spend your weekend? I worked a bunch Saturday, made some hellacious progress on a project I’m involved in. Then I saw Dune with my kid on Sunday. Spent all the in-between time laser-burning holiday ornaments and taming my home network with Ansible, Zabbix and Observium.

An unnamed member left his bottle of Four Roses Single Barrel last week, and it’s taking a bit of restraint for me to ignore it. But the way I see it, liquor that’s brought to an in-person meetup is not a donation; it stays where it was left until the next in-person meetup.

These are the blanks I chose for the holiday ornaments:

https://amzn.to/3BWO4Ff

It’s a nice set, it comes with 100 ornament-shaped blanks that burn pretty evenly. On my engraver I have S-MAX set to 325 and a speed of 1000. The set also comes with string. Here’s an example of an ornament I burned with a photo of the UU Church in Leesburg:

Now that’s got me thinking I should make some DC540 ornaments. Open to suggestions for design.