Building a new kernel for the Nexus Player

I bought a cheap Micro USB (OTG) to USB hub with built-in Ethernet from Ebay for my Nexus Player. It seemed like the perfect way to make use of the single USB port available.

micro-usb-ethernet-usb

Once I got it, I realised the Ethernet used a Davicom chipset and while it did have good Linux support with the dm9601 module, it wasn’t enabled in Android kernels.

As I started looking at guides for compiling kernels for Android, I found that they didn’t quite work properly for the Nexus Player.

Most Android devices are ARM based, but as the arch of the Nexus Player is x86, there’s some minor differences in some of the steps.

Here’s a quick run-down of the steps I did to simply add a new module to the Nexus Player kernel. I’m assuming that you’ve read a few of the more detailed guides or you’ve done some kernel building before.

NOTE: You’ll need to go into OEM unlock on the device. You probably don’t need to be rooted, but I was. YMMV.

First step is to find the kernel version you’re currently running. Connect to the device with adb and run this in the shell:

shell@fugu:/ $ cat /proc/version

We’ll need to get the git commit for the kernel.

In this case:

Linux version 3.10.20-g912890c

The kernel commit is the part after the ‘g’, so ‘912890c‘.

Depending on your Linux distro, you may want to pull Google’s toolchain. I’m using Arch Linux, which has GCC 5.3 and I had a build error, so instead, I just pulled the same toolchain that Google used for their production builds. If you want to match it, just look for the GCC version from the output above. E.g. ‘gcc version 4.8

In my case, I cloned the repository:

git clone https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.8

Add this to your path (substitute the $HOME/android part for your path)

export PATH="$PATH:$HOME/android/x86_64-linux-android-4.8/bin"

Add this CROSS_COMPILE variable to instruct the build to use this new toolchain. This is the prefix of the GCC binaries in the bin directory

export CROSS_COMPILE="x86_64-linux-android-"

Now we’ll clone the Kernel repository. For the Nexus Player (fugu) we’re using:

$ git clone https://android.googlesource.com/kernel/x86_64.git fugu-kernel
$ cd fugu-kernel

We’ll create our own branch to work on, based on the last commit of our current kernel

git checkout -b my-fugu-kernel 912890c

Let’s modify the kernel now

$ export ARCH=x86
$ make fugu_defconfig
$ make menuconfig

We can now make changes to our config.

Once you’re happy, we’ll build it using all our cores:

$ make -j$(nproc)

Once you’re done, you’ll have a kernel image at arch/x86_64/boot/bzImage

Now we’ll update the boot image to include our new kernel.

You’ll want to install the abootimg tool, and get a copy of the boot.img. Best to find it from the Nexus Player factory image, then tar and unzip.

We’ll update our factory boot.img and include our new kernel only:

$ abootimg -u boot.img -k (kernel path)/arch/x86_64/boot/bzImage 
reading kernel from (kernel path)/arch/x86_64/boot/bzImage
Writing Boot Image boot.img

Boot the Nexus Player into fastboot mode, and we’ll test our new kernel (before flashing)

$ fastboot boot boot.img

If you’re happy with it, then don’t forget to flash it:

$ fastboot flash boot boot.img

Success!

For more information, I found this page really useful:

http://softwarebakery.com/building-the-android-kernel-on-linux

 

Posted in Personal at December 19th, 2015. 4 Comments.

P2127 code on a Focus XR5/Focus ST

I had an issue with my 2007 Ford Focus XR5 (aka Focus ST) recently.

I started getting a ‘Steering Assist Failure‘ message appear occasionally when starting my car. Usually I could just turn if off, leave it for a little while then start again and it would be OK, and the car would be behave normally.

Shortly after I got an ‘Engine Systems Fault‘ message and the car entered ‘Low Acceleration Mode‘ to protect itself. Using my OBD-II adapter and the ‘Torque’ Android app, I found the specific error to be:

P2127 – Throttle/Pedal Position Sensor/Switch ‘E’ Circuit Low

Using the magic powers of Google, I found this:

“Finally the P2127 error code was sorted.

When the car is started in the morning the voltage drops below 9v.

9v is the threshold voltage for the all the ECU sensors, first sensor on my car that then schemes there’s k@k in the land is the throttle position sensor.”

Using my very cheap multimeter, I tested the load across the battery. When I turned the key, sure enough, the voltage dropped from 12.43V to 8.3V, sending the throttle position sensor into an error state. Testing the same thing on Bek’s car showed it dropped to about 10.5V which is much healthier.

Once I installed a new battery, everything worked perfectly.

Hopefully this might help someone else, although I’m sure a different type of car would exhibit different symptoms.

Posted in Personal at March 28th, 2014. 5 Comments.

Puppet filebucketing fail with NFS

I’ve got back to Australia and I’m continuing my UK job from home.

So yesterday, I was doing some cleaning up and needed to unmount an NFS share and clean up its mount point directory.

You can see from the Puppet code below that I marked both resources as ‘absent’ to clean them up.

file { '/tmp/install':
    ensure   => 'absent'
}
mount { '/tmp/install':
    ensure   => 'absent',
    device   => nfs-server:/install,
    fstype   => nfs
}

This triggered Puppet to start filebucketing everything it could from the NFS share and subsequently filling up the root filesystem. I managed to revert my commit fairly quickly, but a large number of hosts in our infrastructure had already picked this up. This included both development and production systems.

There is an existing Puppet bug report about the issue at http://projects.puppetlabs.com/issues/2019

Apart from the obvious mistake that I should have just run this in a test environment first, this was totally unexpected behaviour.

A couple of things you could do to prevent this happening to you:

  1. Disable filebucketing either globally, or just for this file resource
  2. Don’t try to remove the NFS mount and directory at the same time

Hope this helps.

Posted in Personal at September 27th, 2012. No Comments.

AFL plugins for XBMC

UPDATE: Plugins now updated and working for the 2013 season!

Whilst being in London, it’s been hard to get my AFL fix. So to keep up with what’s going on, I’ve created two new XBMC plugins: AFL Video and AFL Radio.

AFL Video

You can browse all the latest videos from the AFL web site, including match replays, interviews and highlights.

AFL Video plugin

You have a bunch of channels to choose from, including a team channel. The team channel will list the videos specific to your club.

Cats TV

Match replays are usually available 12-24 hours after the match has been played.

AFL Radio

Unfortunately, you can’t watch the games live without some sort of paid subscription – so the radio streams are the next best thing.

AFL Radio

Just choose the stream you want and away it goes. I’m not sure how stable this will be long term due to how the stream works, but so far so good.

Interestingly, most of the streams work outside of the AFL game calls, but most of the streams are only 64k WMA, so the bit rate is a little low.

 

Installation

You can grab the latest ZIP files from the Github project download pages for AFL Video and AFL Radio. You can then choose the ZIP files from the XBMC Addon install from Zip file menu option.

These will also be included in the AU CatchUp TV XBMC repository too.

 

Issues

For any issues, please file a bug at issue tracker and please include a copy of your XBMC log file.

Posted in Personal at April 8th, 2012. 90 Comments.

AFL streaming radio from Linux

This is a big sarcastic thanks to AFL and Telstra for building the AFL web site in such a way that it only really works properly in Windows.

Being in London, I want to listen to the Geelong games over the streaming radio, but in Linux (and probably Mac), Silverlight just won’t cut it – and the radio fails to load with an error.

I did some digging around, and worked out the URL for the the streaming radio, which you can then plug into MPlayer to obtain the ASX stream:

mplayer -user-agent "NSPlayer/11.08.0005.0000" http://lon-cdn220-is-1.se.bptvlive.ngcdn.telstra.com/online-radio-afl_12

The code on the end is the stream ID. These are the station codes I’ve managed to work out:

  • ABC774: 2
  • 5AA Adelaide: 3
  • 6PR Perth: 4
  • 3AW Melbourne: 5
  • National Indigenous Radio Service: 6
  • Gold FM Gold Coast: 7
  • Triple M Sydney: 11
  • Triple M Melbourne: 12
  • Triple M Brisbane: 13
  • Triple M Adelaide: 14
  • K-Rock Geelong: 15

I hope this proves useful to someone else.

UPDATE: This has now been changed for the 2013 season. If you’re interested in listening to AFL radio on Linux/Mac/Windows, then try my XBMC AFL Radio plugin.

Posted in Personal at April 2nd, 2011. 19 Comments.

New Tram Hunter web site

I’ve been slowly doing some bits and pieces for a new Tram Hunter web site. I would now like to announce the new site at http://tramhunter.andybotting.com/.

Since v0.5 of Tram Hunter, we’ve included an option to send anonymous usage statistics to a server I have running on Google’s App Engine. My main aim was to generate some heat maps, based on the location of tram stop requests.

You can now see the final version of the heap map, which is generated nightly, from the latest 1000 requests. It turns out to be quite interesting to look at.

I’m also using the Google Chart API to generate some nice pie charts showing some other info like handset model, Android version and mobile networks.

In other Tram Hunter news, the latest stats from the Android Market show 5687 total installs, with 4293 active installs (75%). We also have a 4.85 rating out of 5, with 255 comments. The comments are all really positive, so it definitely makes development worthwhile.

I’ve created a new Twitter account for Tram Hunter, so for the latest updates, follow @tram_hunter.

Posted in Personal at October 9th, 2010. 1 Comment.

Using the Yubikey for two-factor authentication on Linux

The Yubikey is a nice little device. It’s quite simple in design and operation. Yubikey

The key actually emulating a USB keyboard, which makes it instantly usable on any modern OS. You just press the button on the key to generate a one-time-password (OTP) to validate you. The method works by typing in your password, but before hitting the return key, you press the Yubikey button to finish it off. At the end of the OTP generation, it sends a carriage return itself.

The OTP is then sent to a validation server, either hosted by Yubico themselves, or you can host your own.

I’m going to walk through how you can set the infrastructre for doing two-factor authentication on Debian. In my specific case, the requirement was two-factor with an Active Directory username/password combination and the Yubikey as the second factor.

Unfortunately, the documentation from Yubico is quite average. To top it off, they insist on using multiple Google Code project sites for hosting their software.

This would normally be fine, but in this case, they have a Google Code project for every single little piece of code. Much of the documentation I found relates to older projects which are not supported by Yubico. This makes working out exactly what you need difficult. Within the Google Code project sites, documentation often runs in circles between projects.

In this document, I’ll look at using PAM to auth again the Yubico auth servers first. Once that’s working, I’ll move onto flashing the Yubikey with a new key and using our own Validation System.

NOTE: This is just some rough notes I put together. You should definitely read the Yubico documentation for this to really make sense.

Authenticating with the Yubikey with PAM

Get some dependencies

apt-get install libpam-dev libcurl4-openssl-dev libpam-radius-auth

Make ourselves a source directory

mkdir ~/yubikey; cd ~/yubikey

Get the current tarball of libyubikey, and install it

wget http://yubico-c.googlecode.com/files/libyubikey-1.5.tar.gz
tar xf libyubikey-1.5.tar.gz
cd libyubikey-1.5
./configure
make check install

Get the current tarball of the Yubico C client, and install it

wget http://yubico-c-client.googlecode.com/files/ykclient-2.3.tar.gz
tar -xf ykclient-2.3.tar.gz
cd ykclient-2.3
./configure
make
make install

Get the current tarball of the Yubico PAM module, and install it

wget http://yubico-pam.googlecode.com/files/pam_yubico-2.3.tar.gz
tar -xf pam_yubico-2.3.tar.gz
cd pam_yubico-2.3
./configure
make
make install

You should end up with your Yubico PAM module ‘/usr/local/lib/security/pam_yubico.so’

We’ll refer to this in our PAM config /etc/pam.d/openvpn

#
# /etc/pam.d/openvpn - OpenVPN pam configuiration
#
# We fall back to the system default in /etc/pam.d/common-*
#
auth required /usr/local/lib/security/pam_yubico.so id=1 debug authfile=/etc/yubikeyid
auth required pam_radius_auth.so no_warn try_first_pass
@include common-account
@include common-password
@include common-session

This configuration will tell PAM to hit the Yubico module first. This splits apart your password field into your password and OTP. The OTP is validated against the Validation Servers, and the password is then passed onto the next module. This configuration will use the Yubico auth servers to check your token.

Once you have a working config, we’ll move to setting up our own Validation Servers. We’ll need to specify the URL for that in this config later on.

In that case, we’re also using RADIUS. This could be LDAP if you had an LDAP server available. You should be able to use the standard UNIX credentials (/etc/password, /etc/shadow) also.

The other important piece to note here is the authfile, /etc/yubikeyid

This file lists the mapping between username and the fixed part of your Yubikey. This is the first 12 chars of the Yubikey OTP (e.g. when you press the button)

abotting:vvcnrdkvevtj

FreeRADIUS authenticating against Active Directory 2008.

I banged my head against a wall for a while on this one. The trick is that you need at least FreeRADIUS 2.1.6 for AD authentication to work properly.

Add Debian backports to your /etc/apt/sources.list

deb http://www.backports.org/debian lenny-backports main contrib non-free

Import the backports key

wget -O - http://backports.org/debian/archive.key | apt-key add -

Update and install the new freeradius

apt-get update
apt-get -t lenny-backports install freeradius freeradius-ldap

In your radiusd.conf

ldap {
    # Define the LDAP server and the base domain name
    server = "ad.yourcompany.com"
    basedn = "dc=ad, dc=yourcompany, dc=com"

    # Active Directory doesn't allow for Anonymous Binding
    identity = "ldap_bind_user@ad.yourcompany.com"
    password = password

    password_attribute = "userPassword"
    filter = "(&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(memberOf=CN=Users,DC=ad,DC=yourcompany,DC=com))"

    # This fixes Active Directory 2008 access
    chase_referrals = yes
    rebind = yes

    # The following are RADIUS defaults
    start_tls = no
    dictionary_mapping = ${raddbdir}/ldap.attrmap
    ldap_connections_number = 5
    timeout = 4
    timelimit = 3
    net_timeout = 1
}

In our FreeRADIUS client file /etc/freeradius/clients.conf:

client localhost {
    ipaddr = 127.0.0.1
    secret = testing123
    nastype = other
}

Use radtest to test our RADIUS is authenticating properly

radtest <username> <password> localhost 1 testing123

Should return Accept.

Set the address and shared secret of the radius server in /etc/pam_radius_auth.conf. The password of testing123 was defined in our RADIUS client config.

# server[:port] shared_secret   timeout (s)
127.0.0.1       testing123      1

OpenVPN has an issue with PAM loading the Yubikey module, so we have to LD_PRELOAD the pam module before starting OpenVPN.

export LD_PRELOAD=/lib/libpam.so.0.81.12; openvpn --config openvpn.conf

For a permanent fix, at the end of the start_vpn function in /etc/init.d/openvpn, just before the $DAEMON line:

    export LD_PRELOAD=/lib/libpam.so.0.81.12
    $DAEMON $OPTARGS --writepid /var/run/openvpn.$NAME.pid \
        $DAEMONARG $STATUSARG --cd $CONFIG_DIR \
        --config $CONFIG_DIR/$NAME.conf || STATUS=1

Change the path of /lib/libpam.so.0.81.12 to suit your own system.

I won’t go into the OpenVPN configuration, except that for PAM authentication you need these options in your server config:

plugin /usr/lib/openvpn/openvpn-auth-pam.so openvpn
username-as-common-name
ns-cert-type server
client-cert-not-required

Personalising your Yubikey

To host your own Yubikey validation system, you require the secret AES key of your Yubikey. In the past, Yubico could provide this to you. Now, you’re required to flash your Yubikey yourself which will generate a new AES key.

Yubico provide a personalisation tool for Linux, Mac and Windows. If you’re on Windows, you get a nice little GUI. For Linux and Mac, you have a CLI based tool. It’s worth having a look at the ‘Personalization Tool’ page at: http://www.yubico.com/developers/personalization/

Installing the Personalisation Tool

Install some dependencies:

apt-get install libusb-1.0.0-dev

Grab the latest Pesonalisation Tool tarball from: http://code.google.com/p/yubikey-personalization/

cd ~/yubikey
wget http://yubico-c.googlecode.com/files/libyubikey-1.5.tar.gz

Extract, build and install libyubikey

tar xf libyubikey-1.5.tar.gz
cd libyubikey-1.5
./configure
make
make install

You’ll need to provide a UID value for flashing your Yubikey. It needs to be 6 characters, and in hexadecimal. You can use this command to generate one for you.

dd if=/dev/urandom of=/dev/stdout count=100 2>/dev/null | xargs -0 modhex | cut -c 1-10 | awk '{print "vv" $1}'
74657374696e

You must provide the public name (fixed) parameter in modhex format. The modhex format is a special encoding used to ensure characters sent by the key are always correctly interpreted whatever keyboard layout you use.

You also need to generate yourself a public name for your key. This is known as the ‘fixed’ part, and it’ll be the first 16 chars when you generate your OTP. This will identify your key from anybody else’s.

dd if=/dev/urandom of=/dev/stdout count=100 2>/dev/null | xargs -0 modhex | cut -c 1-10 | awk '{print "vv" $1}'
vvcnrdkvevtj

This comamnd generate some random text, does a modhex operation, grabs the first 10 chars, then adds ‘vv’ to the front to make it up to 12.

You’ll be prompted for a passphrase on your AES key. I leave mine blank, but if you do set one, don’t ever lose it. I believe it’ll stop you from re-personalising your Yubikey.

ykpersonalize -ouid=74657374696e -ofixed=vvcnrdkvevtj
Firmware version 2.1.2 Touch level 1793 Program sequence 1
Passphrase to create AES key:
Configuration data to be written to key configuration 1:
fixed: m:vvcnrdkvevtj
uid: h:74657374696e
key: h:fcaad309a20ne1809c2db2f7f0e8d6ea
acc_code: h:000000000000
ticket_flags: APPEND_CR
config_flags:

Commit? (y/n) [n]: y

Save this information, as we’ll need it later.

Setting up yor own YubiKey OTP Validation Server

You need to install two things: The Key Storage Module and the Yubico Validation Server. The Key Storage Module (KSM) holds the secret AES key of your Yubikey token, while the Validation Server does the OTP check against the KSM.

In their 2.0 architecture, you can have multiple KSM’s and Validation servers with work together for reduncancy.

KSM Installation

Make a working directory, and get the KSM package

mkdir ~/yubikey && cd ~/yubikey
wget http://yubikey-ksm.googlecode.com/files/yubikey-ksm-1.3.tgz
tar xfz yubikey-ksm-1.3.tgz

Install the KSM files

cd yubikey-ksm-1.3
make install

Install Apache2 and PHP

Install Apache2, PHP and MySQL

apt-get install apache2 php5 php5-mcrypt php5-curl mysql-server php5-mysql libdbd-mysql-perl

Create the ykksm table

echo "CREATE DATABASE ykksm;" | mysql -u root -p

Import the DB schema

mysql -u root -p ykksm < /usr/share/doc/ykksm/ykksm-db.sql

Set up some MySQL permissions

CREATE USER 'ykksmreader';
GRANT SELECT ON ykksm.yubikeys TO 'ykksmreader'@'localhost';
SET PASSWORD FOR 'ykksmreader'@'localhost' = PASSWORD('hYea3Inb');

CREATE USER 'ykksmimporter';
GRANT INSERT ON ykksm.yubikeys TO 'ykksmimporter'@'localhost';
SET PASSWORD FOR 'ykksmimporter'@'localhost' = PASSWORD('ikSab29');

FLUSH PRIVILEGES;

Include path configuration

Set the include path by creating a file /etc/php5/conf.d/ykksm.ini

cat > /etc/php5/conf.d/ykksm.ini << EOF
include_path = "/etc/ykksm:/usr/share/ykksm"
EOF

Make a web server symlink

make -f /usr/share/doc/ykksm/ykksm.mk symlink

Set your configuration settings in /etc/ykksm/ykksm-config.php

<?php
  $db_dsn      = "mysql:dbname=ykksm;host=127.0.0.1";
  $db_username = "ykksmreader";
  $db_password = "hYe63Inb";
  $db_options  = array();
  $logfacility = LOG_LOCAL0;
?>

Restart Apache2

/etc/init.d/apache2 restart

Test the KSM Server

Try this URL:

curl 'http://localhost/wsapi/decrypt?otp=dteffujehknhfjbrjnlnldnhcujvddbikngjrtgh'
ERR Unknown yubikey

It should return ‘Unknown Key’ until we have imported our Yubikey into the database.

Install the Yubico Validation Server

The latest version, and documentation can be found at: http://code.google.com/p/yubikey-val-server-php/

Installation

Go to our working source directory, and grab the package

cd ~/yubikey
wget http://yubikey-val-server-php.googlecode.com/files/yubikey-val-2.4.tgz

Extract, build and install the server

tar -zxf yubikey-val-2.4.tgz
cd yubikey-val-2.4
make install

Create the ykval database and import the schema

echo 'create database ykval' | mysql -u root -p
mysql -u root -p ykval < /usr/share/doc/ykval/ykval-db.sql

Install the symlink

make symlink

Include path configuration

cat > /etc/default/ykval-queue << EOF
DAEMON_ARGS="/etc/ykval:/usr/share/ykval
EOF

Create a htaccess file: /var/www/wsapi/2.0/.htaccess

RewriteEngine on
RewriteRule ^([^/\.\?]+)(\?.*)?$ $1.php$2 [L]
php_value include_path ".:/etc/ykval:/usr/share/ykval"

Symlink the htaccess file

cd /var/www/wsapi; ln -s 2.0/.htaccess /var/www/wsapi/.htaccess

Copy the template config file for the Validation Server

cp /etc/ykval/ykval-config.php-template /etc/ykval/ykval-config.php

Edit the file and configure settings in /etc/ykval/ykval-config.php

<?php

  # For the validation interface.
  $baseParams = array ();
  $baseParams['__YKVAL_DB_DSN__'] = "mysql:dbname=ykval;host=127.0.0.1";
  $baseParams['__YKVAL_DB_USER__'] = 'ykvalverifier';
  $baseParams['__YKVAL_DB_PW__'] = 'password';
  $baseParams['__YKVAL_DB_OPTIONS__'] = array();

  # For the validation server sync
  $baseParams['__YKVAL_SYNC_POOL__'] = array("http://localhost/wsapi/2.0/sync");

  # An array of IP addresses allowed to issue sync requests
  # NOTE: You must use IP addresses here.
  $baseParams['__YKVAL_ALLOWED_SYNC_POOL__'] = array("127.0.0.1");

  # Specify how often the sync daemon awakens
  $baseParams['__YKVAL_SYNC_INTERVAL__'] = 10;

  # Specify how long the sync daemon will wait for response
  $baseParams['__YKVAL_SYNC_RESYNC_TIMEOUT__'] = 30;

  # Specify how old entries in the database should be considered aborted attempts
  $baseParams['__YKVAL_SYNC_OLD_LIMIT__'] = 10;

  # These are settings for the validation server.
  $baseParams['__YKVAL_SYNC_FAST_LEVEL__'] = 1;
  $baseParams['__YKVAL_SYNC_SECURE_LEVEL__'] = 40;
  $baseParams['__YKVAL_SYNC_DEFAULT_LEVEL__'] = 60;
  $baseParams['__YKVAL_SYNC_DEFAULT_TIMEOUT__'] = 1;

  // otp2ksmurls: Return array of YK-KSM URLs for decrypting OTP for
  // CLIENT.  The URLs must be fully qualified, i.e., contain the OTP
  // itself.
  function otp2ksmurls ($otp, $client) {
    return array("http://localhost/wsapi/decrypt?otp=$otp",);
  }
?>

In the above configuration, we’re only expecting to use one Validation Server and one KSM. If you’re planning on having multiple Validation servers and KSM’s, then you’ll be including the other Validation Servers in the SYNC_POOL, and your KSM’s in the URLs at the bottom, returned by the otp2ksmurls function.

Enable the mod_rewrite

a2enmod rewrite

Create the ykval database user

CREATE USER 'ykvalverifier'@'localhost' IDENTIFIED BY  'password';
GRANT ALL PRIVILEGES ON `ykval`. * TO  'ykvalverifier'@'localhost';

Fix some privileges on our config file

chgrp www-data /etc/ykval/ykval-config.php

The Sync Daemon uses the PEAR module System_Daemon so you need to install it:

apt-get install php-pear
pear install System_Daemon-0.9.2

Install the init.d script

ykval-queue install
update-rc.d -f ykval-queue defaults

Start the daemon

/etc/init.d/ykval-queue start

Testing

Use CURL to test our server is working

curl 'http://localhost/wsapi/verify?id=1&otp=vvcnrdkvevtefjbrjnlnldnhcujvddbikngjrtgh'

It should return something like this:

h=aPCQ4kWJilDgriyEii3j8J8lfuY=
t=2009-04-27T19:08:51Z0100
status=NO_SUCH_CLIENT

Once we import our Yubikey into the database, we should get a nice ‘status=OK’ message.

Importing your keys into the KSM server

Refer back to the output from personalising your Yubikey. You’ll need the fixed part (referred to as publicname in the DB), internal name (UID) and our AES key.

This is an entry for our newly personalised Yubikey.

USE ykksm;
INSERT INTO `yubikeys` (`serialnr`, `publicname`, `created`, `internalname`, `aeskey`, `lockcode`, `creator`, `active`, `hardware`)
VALUES (101209, 'vvcnrdkvevtj', '2010-05-07 15:18:40', '74657374696e', 'fcaad309a20ne1809c2db2f7f0e8d6ea', '000000000000', '', 1, 1);

This entry is required for our systems to authenticate against the Validation server. I’m not exactly sure about this, as the documentation is somewhat bare. I think you need an administrator-type person’s key details in here. The imporant part is the ID. This values corresponds the the ‘id=’ value in our CURL requests and in our PAM config.

USE ykval;
INSERT INTO `clients`
(`id`, `active`, `created`, `secret`, `email`, `notes`, `otp`)
VALUES
(1, 1, 1, 'fcaad309a20ne1809c2db2f7f0e8d6ea', 'your@email.addr', 'Any text your want', 'vvcnrdkvevterfbtelvnvkkueenecrlfnlhdjetrhgnk');

We’ll hit our new Validation Server to make sure it’s working

curl "http://localhost/wsapi/2.0/verify?id=1&nonce=askjdnvajsndjkasndvjsnad&otp=vvcnrdkvevtjkreuvvlhtubjecbrticjneckgrigkck"
h=KLEb3gOJ4KqQaCVbh8cEvXjH50U=

It should return something like this:

t=2010-05-20T11:24:53Z0051
otp=vvvcnrdkvevtjkreuvvlhtubjecbrticjneckgrigkck
nonce=askjdnvajsndjkasndvjsnad
sl=100
status=OK

In this URL, we’ve added the ‘nonce’ parameter. This just a test to make sure the v2.0 API is working. ‘status=OK’ means it’s all good! If you get ‘NOT_ENOUGH_ANSWERS’, it means it has trouble trying to sync with other Validation Servers.

We’ll get PAM using our new Validation Servers for auth

/etc/pam.d/openvpn

auth required /usr/local/lib/security/pam_yubico.so id=1 authfile=/etc/yubikeyid url=http://10.68.130.198/wsapi/verify?id=%d&otp=%s debug

If you watch /var/log/auth.log, you should see the PAM module spitting out some debugging information which may be useful. It also spits out your plain text password too, while you have the debug option on. Make sure you remove this later.

Problems

If you see an error like this:

PAM unable to dlopen(/lib/security/pam_yubico.so): /lib/security/pam_yubico.so: undefined symbol: pam_set_data

you’ll need the LD_PRELOAD trick from above. Something to do with dlopening the PAM module I believe.

Posted in Personal at May 20th, 2010. 11 Comments.

Adobe has issued a DMCA removal request for rtmpdump

It seems that Adobe, after issuing a press release claiming they would be opening up the RTMP protocol in the ‘first half of 2009′, have issued a DMCA take down request for an open source implementation of the protocol, RTMPdump. The SourceForge project site for RTMPdump now shows ‘Invalid Project’.

This is going to mean it’s going to become much harder to get RTMPdump for downloading copies of ABC’s iView files, which I previously posted about. This might also have interesting consequences for XBMC and Boxee which both include this code for supporting streaming media from BBC’s iPlayer.

This is pretty disappointing from Adobe, especially after claiming they would be in the process of opening up the protocol.

Posted in Personal at May 23rd, 2009. 10 Comments.

Using libvirt with Xen on Debian Lenny

So it seems that my CentOS 5 Dom0 wasn’t stable. When building new virtual machines, the machine would hang and I’ve have to go back into the machine room to reboot it.

I have suspicions that it was due to the 3ware 8006 RAID controller, but instead of messing around with that, I’ve installed Debian Lenny as the Dom0 (using kernel 2.6.26 as opposed to kernel 2.6.18 with CentOS).

With this machine, I wanted to find the best way to support both Debian and CentOS machine, using a common method of installation. There seem to be two main ways to accomplish this.

You could use the (older) Debian route and use xen-create-image from xen-tools, which does a bootstrap of the OS on the filesystem, or use the newer virt-install from libvirt, to do an actual OS install. Libvirt seems like it’s the preferred method these days, which many of the distro’s now using for managing virtual machines using Xen, KVM or QEMU.

Using xen-create-image for Debian virtual machines has worked for me for a long time, but trying to use it for CentOS failed. The machine built, but I believe there were some packages missing from the install. I really didn’t want to have to mess around with the package lists, so I tried to use both xen-create-image for Debian and virt-install for CentOS. One problem with this is that virt-install doesn’t install the Xen config files into /etc/xen like the other tools do. Instead, it manages its own list, and contacts Xen directly using a Unix socket.

This would make management a pain, because you would have to use xm create <domain>to start a Debian VM, but then use virsh start <domain> for CentOS. I needed something simpler.

Then I discovered that Debian Lenny now has para-virtualisation support built into the Debian Installer.

This means that I could use virt-install to build Debian Lenny virtual machines, using the actual Debian installer.

With a quick install of the libvirt packages in the Debian Lenny’s repository:

apt-get install libvirt-bin virtinst

You’ve got all the libvirt stuff you need. Then, to create a Debian virtual machine using virt-install:

virt-install \
--name=debian-test \
--ram=512 \
--file-size=8 \
--nographics \
--paravirt \
--file=/var/lib/xen/images/debian-test.img \
--location=http://mirrors.uwa.edu.au/debian/dists/lenny/main/installer-i386

The important part is that last line. You can actually just throw a path to the install images of a Debian mirror, and virt-install is smart enough to boot a new VM from that. This then begins a Debian install, identical to what you would use on a standard machine. This also gives you full access to use the nice virt-manager. You can install virt-manager by doing:

apt-get install virt-manager

virt-manager

virt-manager running on a Debian Lenny Dom0

So I just need to remember now that if I want to start a VM, I need to use virsh start <domain>

Although, once started, you can use the standard xm tools.

So finally, I have reached open-source para-virtualisation nirvana. Now if only Debian did Kickstart…

Posted in Personal at April 2nd, 2009. 4 Comments.

Thailand Trip (part 4)

Once we realised how much Stable lodge was really costing us, we upgraded our accommodation for the four nights we had in Bangkok. We booked a serviced apartment at Citiadines in Sukhumvit 8, just down the road from Stable Lodge.


Messy bed at Citadines

We booked it on Wotif and it cost us a little bit more than what Stable Lodge was. It was totally worth it for the comfortable bed alone, especially after sleeping on really hard and really soft beds at the other places.


Nice TV at Citadines

Somehow we ended up wth four nights in Bangkok with was way too much. If you’re going to Thailand, only spend a few days in Bangers at a maximum. It’s just not that exciting. It’s too similar to Melbourne really. Trains, shopping centers, etc.

We checked out the massive MBK shopping center and the King Power duty free place too. If you see King Power anywhere.. avoid it. Don’t waste your time, it’s fancy stuff that is way overpriced.

The last night in Bangkok, we found out about the semi-permanent beer gardens that get set up outside the CentralWorld shopping center. The beer garden for the Thai beer Singha, must have had some association with the Japanese beer Asahi, which just happens to be my favourite beer. So, you can imagine my excitement to find out they were serving it there.


The Asahi tower

Bek and I polished off a tower of Asahi. The tower is a 3 litre tube full of beer with a column of ice down the middle to keep it cold and a tap on the bottom to pour. It was awesome. I thought about how good it would be to do a similar thing in Melbourne, but I realised that it just wouldn’t work because it would get abused. People would be getting smashed and then smashing each other (like going to any pub in the city these days). The Thai people don’t drink that much and are very passive. It’s nice to walk around at any time and feel totally safe.


All gone

We had trouble getting a taxi to the airport when it was time to leave. The guy at the hotel mentioned something about a bomb, but we didn’t know anything else. Finally a taxi arrived who was willing to take us. This guy was crazy. He had this strange twitch in his seat while he was driving. He was doing 130 km/h down the freeway, which had 80 signs. Weaving through traffic and flashing his lights at anyone slowing him down. We also didn’t have any seat belts.

Closer to the airport, we started seeing lots of people in yellow shirts with plastic hand clappers. I had no idea who they were until later. They were protesters heading towards the airport to shut it down.


Protester convoy

We managed to get most of the way to the airport before traffic stopped moving. Bek and I had to put our backpacks on and walk the last km to the terminal. It was pretty exciting actually. We were so lucky to get our fight, because not long after, the protesters stormed the terminal and all flights got shut down. It must have been only an hour or two after we left.

Their aim was to stop their prime minister from getting into the country, from Peru where the APEC summit was held. It seems they don’t like him very much… and it’s a long story.

A nine hour flight and we touched down in Melbourne. First stop, the Classic Curry Company :)

All the photos have been uploaded to my Google Picasa account.

Posted in Personal at November 29th, 2008. 3 Comments.