Archives par mot-clé : hack

Nautilus – GLib Library Hack to sort file like LS

Code, Linux, Système, , , , , , ,

You can find my github project at https://github.com/heralight/GlibSortFileNameHackLibrary

For years, everybody list files on unix based on LC_COLLATE.
Then Gnome developpers decide to interpret number in filename…

Strange choice, and we cannot personalize this.

ls show something like

001  004  1  A  B  a  b

and for example, nautilus show:

1 001  004  A  B  a  b

This behavior use command g_utf8_collate_key_for_filename from Glib library.
Thank you to
* https://bugs.launchpad.net/ubuntu/+source/nautilus/+bug/322271
* https://bugzilla.gnome.org/show_bug.cgi?id=355152
* https://bugs.launchpad.net/ubuntu/+source/thunar/+bug/684317
* + 30 related bugs opened

This little override this function with g_utf8_collate_key.

Pre-required

Compilation dependencies

sudo apt-get install libglib2.0-dev

Generate

make all

Install and usage

To override this behavior, this library need to be preload before each program who use Glib library.
Todo that you can

set it before call from command line or from .desktop shortcut:

LD_PRELOAD=/pathToYourLib/glibSortFileNameHack.so nautilus

set globally on gnome session:

echo "export LD_PRELOAD=/pathToYourLib/glibSortFileNameHack.so" >> ~/.gnomerc

and restart your gnome session. Be careful, this settings produce effect on whole gnome session.

or more simply

make install

this command will create a libs directory in your home, copy library, and append LD_PRELOAD to ~/.gnomerc

Troubleshooting

Before open an issue, please follow this guide

Test required

to verify that it works, create some dummy files.

e.g.:

touch 001
touch 004
touch 1
touch 4
touch a
touch A
touch b
touch B

ls will show:

001  004  1  4  a  A  b  B

nautilus on a standard installation will show:

1 001 4 004  a  A  b  B

With hack nautilus will show

001  004  1  4  a  A  b  B

Nautilus

before anything, kill any nautilus process

ps -aux | grep nautilus
kill -9 nautilusProcess

launch it from lib directory to test it:

LD_PRELOAD=./glibSortFileNameHack.so nautilus .

Related bug : https://bugzilla.gnome.org/show_bug.cgi?id=754777

Enjoy !

Port Knocking – Sécurisez votre réseau – Tomato firmware

Linux, Non classé, Sécurité, Système, , , , , , , , , , , , , , , ,

Si vous cherchez à faire du port knocking sur votre routeur asus avec un firmware Tomato, je vous conseil la lecture de ce blog.

Article très bien fait, mais je vais vous le résumé pour avoir un forward d’un port ssh d’une de vos machines internes vers le routeur puis votre box internet.
Pour plus de détails et d’information de débuggage, référez-vous à ce blog.

But

Machine1
Ssh Port 22
|
Routeur Tomato
28322 + Port Knocking
|
WAN

Howto

Dans Administration->Scripts->Firewall

Ajouter

KNOCK_STEP_TIMEOUT_SEC=25
KNOCK_WEB_ADMIN_TIMEOUT_SEC=300
KNOCK_INTERFACE="br0"
KNOCK_PORT1=28350
KNOCK_PORT2=27334
KNOCK_PORT3=29837
KNOCK_HONEY_PORT_SEQ=4049,28051,27024,28026,29074,15076


 
# Load iptables modules
modprobe xt_recent
 
# Knock chains
iptables -t nat -N knock2 2>/dev/null
iptables -t nat -F knock2
iptables -t nat -A knock2 -m recent --name knock1 --remove
iptables -t nat -A knock2 -m recent --name knock2 --set
iptables -t nat -A knock2 -j LOG --log-level info --log-prefix "IN KNOCK2: "
 
iptables -t nat -N knock3 2>/dev/null
iptables -t nat -F knock3
iptables -t nat -A knock3 -m recent --name knock2 --remove
iptables -t nat -A knock3 -m recent --name knock3 --set
iptables -t nat -A knock3 -j LOG --log-level info --log-prefix "IN KNOCK3: "
 
iptables -t nat -N knock_deny 2>/dev/null
iptables -t nat -F knock_deny
iptables -t nat -A knock_deny -m recent --name knock1 --remove
iptables -t nat -A knock_deny -m recent --name knock2 --remove
iptables -t nat -A knock_deny -m recent --name knock3 --remove
iptables -t nat -A knock_deny -j LOG --log-level warn --log-prefix "KNOCK DENIED: "
 
iptables -t nat -N knock_scanned 2>/dev/null
iptables -t nat -F knock_scanned
iptables -t nat -A knock_scanned -m recent --rcheck --name knock1 \
 --seconds $KNOCK_STEP_TIMEOUT_SEC -j knock_deny
iptables -t nat -A knock_scanned -m recent --rcheck --name knock2 \
 --seconds $KNOCK_STEP_TIMEOUT_SEC -j knock_deny
iptables -t nat -A knock_scanned -m recent --rcheck --name knock3 \
 --seconds $KNOCK_STEP_TIMEOUT_SEC -j knock_deny
 
# 1st knock: KNOCK_PORT1
iptables -t nat -A PREROUTING -i $KNOCK_INTERFACE -p tcp --dport $KNOCK_PORT1 \
 -m state --state NEW --tcp-flags SYN,RST,ACK SYN \
 -m recent --set --name knock1
 
# 2nd knock: KNOCK_PORT2
iptables -t nat -A PREROUTING -i $KNOCK_INTERFACE -p tcp --dport $KNOCK_PORT2 \
 -m state --state NEW --tcp-flags SYN,RST,ACK SYN \
 -m recent --rcheck --name knock1 --seconds $KNOCK_STEP_TIMEOUT_SEC -j knock2
 
# 3rd knock: KNOCK_PORT3
iptables -t nat -A PREROUTING -i $KNOCK_INTERFACE -p tcp --dport $KNOCK_PORT3 \
 -m state --state NEW --tcp-flags SYN,RST,ACK SYN \
 -m recent --rcheck --name knock2 --seconds $KNOCK_STEP_TIMEOUT_SEC -j knock3
 
# To stop port-scans from randomly finding the sequence
iptables -t nat -A PREROUTING -i $KNOCK_INTERFACE -p tcp \
 -m multiport --destination-port $KNOCK_HONEY_PORT_SEQ \
 -m state --state NEW --tcp-flags SYN,RST,ACK SYN -j knock_scanned

###############################################################################
# Port forwards after knock
 
# forward port 3124 to ssh of 192.168.1.10:22
iptables -A wanin -i $KNOCK_INTERFACE -p tcp --dport 3124 \
 -m state --state NEW --tcp-flags SYN,RST,ACK SYN \
 -m recent --rcheck --seconds $KNOCK_STEP_TIMEOUT_SEC --name knock3 \
 -j ACCEPT
 
iptables -t nat -A PREROUTING -i $KNOCK_INTERFACE -p tcp --dport 3124 \
 -m state --state NEW --tcp-flags SYN,RST,ACK SYN \
 -m recent --rcheck --seconds $KNOCK_STEP_TIMEOUT_SEC --name knock3 \
 -j DNAT --to-destination 192.168.1.10:22
 
# FTP
iptables -A wanin -i $KNOCK_INTERFACE -p tcp --dport 21 \
 -m state --state NEW --tcp-flags SYN,RST,ACK SYN \
 -m recent --update --seconds $KNOCK_WEB_ADMIN_TIMEOUT_SEC --name knock3 \
 -j ACCEPT
 
iptables -t nat -A PREROUTING -i $KNOCK_INTERFACE -p tcp --dport 21 \
 -m state --state NEW --tcp-flags SYN,RST,ACK SYN \
 -m recent --update --seconds $KNOCK_WEB_ADMIN_TIMEOUT_SEC --name knock3 \
 -j DNAT --to-destination 192.168.1.10
 
###############################################################################
# Ports open from WAN to this router after knock
 

# SSH on local router (ssh port has been changed to 3123)
iptables -A INPUT -d 192.168.1.1 -p tcp --dport 3123 \
 -j ACCEPT
 
iptables -t nat -A PREROUTING -i $KNOCK_INTERFACE -p tcp --dport 3123 \
 -m state --state NEW --tcp-flags SYN,RST,ACK SYN \
 -m recent --rcheck --seconds $KNOCK_STEP_TIMEOUT_SEC --name knock3 \
 -j DNAT --to-destination 192.168.1.1

Adapter les paramètres suivant à vos besoins.

interface réseau recevant le flux d’ouverture
KNOCK_INTERFACE= »br0″
knock port 1
KNOCK_PORT1=28350
knock port 2
KNOCK_PORT2=27334
knock port 3
KNOCK_PORT3=29837
une séquence permettant de perturber les scanners de ports
KNOCK_HONEY_PORT_SEQ=4049,28051,27024,28026,29074,15076

pour tester:

// test - port fermé
~$ ssh [email protected] -p 3124
ssh: connect to host 192.168.1.1 port 3124: Connection refused

// ouverture par port knocking
~$ ssh [email protected] -p 28350
ssh: connect to host 192.168.1.1 port 28350: Connection refused
~$ ssh [email protected] -p 27334
ssh: connect to host 192.168.1.1 port 27334: Connection refused
~$ ssh [email protected] -p 29837
ssh: connect to host 192.168.1.1 port 29837: Connection refused

~$ ssh [email protected] -p 3124
[email protected]'s password: 
// OK -port ouvert !!
// Ctrl+c + attendre 30s

~$ ssh [email protected] -p 3124
ssh: connect to host 192.168.1.1 port 3124: Connection refused
// port fermé - timeout OK

[EDIT 2016] Actuellement je n’utilise plus le port knocking mais le « Single Packet authentication » car plus sécurisé, un article bientôt.