Michael McNamara

technology, networking, virtualization and IP telephony

Home Desktop Upgrade 2016 – Part 2

by

I recently got the hardware itch again and decided to replace my dual ASUS 27″ LCD monitors with a single Acer Predator X34 34″ Curved LCD monitor. In order to drive that 3440 x 1440 display I replaced my MSI Twin Frozen R6950 with an EVGA GTX 1070.

I’ve had the ASUS displays since back in 2012 so at four years old they have served me well but I thought it was time for a change and I decide to spend a little more money than I usually would for a monitor and graphics card combination.

I’ll need a few weeks to see how I really like the new display but so far it looks beautiful.

2016_office_acer_desktop_monitor

Cheers!

CrashPlan for Home v4.5.2 – not backed up

by

As you can imagine there are a large number of computers in my house and like most households we’ve had more than our fair share of hard drive failures so backing up our files (and pictures) has become an important task. About 18 months ago I setup CrashPlan (now called CrashPlan for Home) to backup my desktop computer and my wife’s to a third hard drive connected to my primary desktop. It’s been working great for the past 18 months or so until this morning when I received two emails from Code42, the makers of CrashPlan, advising that neither computer had been backed up in 3 days. I restarted both computers and found that CrashPlan had lost my user credentials on my primary desktop the destination device. I provided my credentials to the CrashPlan application but then I was left with a “waiting for network connection” error on both the source and destination computers. I launched the CrashPlan application on the source and found two destinations with the same computer name, one marked green (online) and one marked grey (offline). I had to select the computer marked green to get the backups to start running. I then had to deactivate the offline computer to remove it from the list.

There was an upgrade back on January 12, 2016 to v4.5.2 for CrashPlan for Home. I’m guessing that something went wrong in that update. I can’t really complain though since I’m essentially using the service for free since I’m not backing up to the cloud and it’s been working fairly well for the past 18 months.

What are you doing to backup your files on your home desktop/laptop?

Cheers!

cURL and SSL TLS Issues

by

I ran into an interesting problem while recently checking over my blog. I noticed that the RSS feed from the discussion forums was failing to load in the HTML footer of my blog. It was returning the error “RSS Error: WP HTTP ERROR: SSL connect error”. So I started digging into trying to figure out what had broken.

BlogRSSfailstoload

I quickly found that cURL was having issues connecting to https://forums.networkinfrastructure.info without any parameters;

[root@mars certs]# curl -v https://forums.networkinfrastructure.info/.xml/?type=rss
* About to connect() to forums.networkinfrastructure.info port 443 (#0)
*   Trying 162.243.40.10... connected
* Connected to forums.networkinfrastructure.info (162.243.40.10) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -5961
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error

Initially I thought I had a certificate issue, concerned that either the GEO Trust root certificate and/or intermediate RapidSSL SHA256 certificate might be missing from /etc/pki/tls/certs/ca-bundle.crt but I was able to quickly rule that problem out using the -k flag on cURL. I noticed that if I tell cURL to use TLS 1.2 then it can connect without issue;

[root@mars certs]# curl -v --tlsv1.2 https://forums.networkinfrastructure.info/.xml/?type=rss
* About to connect() to forums.networkinfrastructure.info port 443 (#0)
*   Trying 162.243.40.10... connected
* Connected to forums.networkinfrastructure.info (162.243.40.10) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
* Server certificate:
*       subject: CN=forums.networkinfrastructure.info,OU=Domain Control Validated - RapidSSL(R),OU=See www.rapidssl.com/resources/cps (c)14,OU=GT54191003
*       start date: Jul 16 16:20:24 2015 GMT
*       expire date: Nov 26 12:10:44 2016 GMT
*       common name: forums.networkinfrastructure.info
*       issuer: CN=RapidSSL SHA256 CA - G3,O=GeoTrust Inc.,C=US
> GET /.xml/?type=rss HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: forums.networkinfrastructure.info
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx/1.0.15
< Date: Sat, 26 Dec 2015 14:23:13 GMT
< Content-Type: application/rss+xml; charset=ISO-8859-1
< Transfer-Encoding: chunked
< Connection: keep-alive
< X-Powered-By: PHP/5.3.3
< X-Frame-Options: SAMEORIGIN
< X-XSS-Protection: 1
< X-Content-Type-Options: nosniff
< Set-Cookie: PHPSESSID=tfvh4sti8ks08l6n6o61sd46n5; path=/
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Pragma: no-cache
< Cache-Control: private
<

        
                Network Infrastructure Forums
                https://forums.networkinfrastructure.info/index.php
                            
...
...

So there’s some issue with cURL negotiating between SSLv3, TLS 1.0, TLS 1.1 and TLS 1.2. I turned to Google and found way to many bug reports and issues with how cURL tries to negotiate the transport layer security protocol. There’s a lengthy discussion regarding bug 1170339 concerning cURL’s default behavior on a RedHat/CentOS client and covers the exact scenario I’m experiencing.

I decided to turn my attention to the server configuration, perhaps I could find a quick fix in the server configuration, because a client fix might work for this specific client but would still be present for anyone else on the Internet using the same client software.

Here’s what my ngnix configuration looks like on the server side;

    #SSL
    ssl_certificate     /etc/ssl/certs/bundle-forums.networkinfrastructure.info.sha256.crt;
    ssl_certificate_key /etc/ssl/certs/private.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_ciphers ALL:!EXPORT:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
    ssl_prefer_server_ciphers on;

I recall recently removing TLS 1.0 support from the Nginx configuration file so I’m guessing I broke it myself (funny how that’s usually the case).

I went back and did some additional research around best practices for SSL protocols and ciphers and modified my Nginx configuration file with the following settings;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-S
HA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-R
SA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256
:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:A
ES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EX
PORT:!DES:!MD5:!PSK:!RC4;

I restarted Nginx and then ran a quick test from Qualys SSL Labs to validate the changes and found that I needed to make an additional config tweak to close a Diffie-Hellman issue. With that complete I the server was now scoring an A from the Qualys SSL Lab testing and it was answering TLS 1.0 requests from cURL.

Another 5 minute problem closed 2+ hours later.

Cheers!

What is Chip-and-PIN for credit cards?

by

A few weeks back I was enjoying a meal at the Barclay Prime Steakhouse in Philadelphia, PA when someone asked me to explain what chip-and-PIN really meant to the everyday American consumer. I paused for a few seconds contemplating how two describe a solution that US banks weren’t really implementing. While EU banks have adopted chip-and-PIN, US banks are only adopting chip-and-sign. While chip based credit cards are more difficult and expensive for counterfeiters to physically copy and clone, chip-and-PIN does little to deter online fraud which is becoming a bigger and bigger problem on both sides of the Atlantic.

Why is it so slow?

If you’ve used a Chip-and-PIN card you’ve probably noticed that it takes about 7-11 seconds for the authorization to occur. A far cry from the 3-4 seconds it generally takes when swiping an older magnetic card. I’m not sure if this is a function of the crypto, the immaturity of payment systems or the actual retail POS systems themselves. I know that in my organization there’s been quite a bit of discussion around what this will do to customer check out times, I’m wondering if there will be a marked increase in ADHD medication sales coinciding with the rollout of chip-and-PIN. I know that Target and Home Depot, both victims of very public data breaches, are now using chip-and-signature in their retail stores.

What’s NFC?

Near field communication is a low power, short range radio signal that can be used between mobile devices or between a smartphone and a credit card payment terminal. Google was the first on the scene with Google Wallet in 2012 but adoption has languished partially because all the vendors want a piece of the pie. Fast forward to present day and you have Apple Pay, Samsung Pay and Android Pay. Android Pay is just a more refined version of Google Wallet although there are quite a few complaints about Android Pay not working well on the net. What’s the allure of these mobile applications? You can store your credit cards and loyalty cards within the mobile app and then just tap and go to make your purchase. No need to carry all those credit cards and loyalty cards in your wallet or purse anymore.

I have a Motorola Moto X which supports NFC but I haven’t really tried it yet with any retailers.

Are you using either Apple Pay, Samsung Pay or Android Pay?

Cheers!

Image Credit: Alex Fiore

References;
http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/

Raspberry Pi 2 Model B – Let the fun begin!

by

I finally broke down and ordered a Raspberry Pi 2 Model B and here are my first thoughts after tinkering with this $35 device for a few hours. The default username is “pi” while the default password is “raspberry”.

In short I’m just flat out impressed, it’s amazing how far technology has come and what you can do with a $35 device. I haven’t touched a breadboard in more than 20 years now but I’m excited to pick one up and start tinkering again. The electrical engineer in me is giddy with excitement and anticipation. While the computer scientist in me is eager to write some code and see how this little device can literally integrate into the real world.

I was impressed by how responsive the GUI was on the Raspberry Pi 2. It felt faster then some of the older Intel Core 3 laptops I have lying around the house. Using the USB 2015-08-21-230509_1632x1018_scrotwireless adapter that was included in the kit I purchased I was quickly able to get the Raspberry Pi to join my WPA2-PSK wireless network. Within 15 minutes I had a X windows desktop (you need to manually start X Windows with ‘startx’ from the command line interface – that reminded me of my early Linux days). I was also able to remotely connect via SSH using PuTTY to the little computer. The Raspberry Pi 2 uses a microSD card as the primary storage filesystem. I was again surprised by the performance of the 8GB Kingston microSD card that was included in the kit.  I’ve run a few live Linux distributions from CD/DVD and/or USB flash drives and the performance is always painfully slow. In this case the performance was transparent as the solution just worked and I didn’t need to bother about the bottlenecks because there were no visible performance issues.

Here are a few commands I used to update the Raspbian Linux distribution to the latest and greatest;

sudo apt-get update
sudo apt-get upgrade
sudo apt-get dist-upgrade

I’m going to document how to setup a Raspberry Pi 2 as a remote PRTG probe. That should be fun.

Are you using a Raspberry Pi or Arduino? What are you doing with it?

Cheers!

Recent Posts

Categories

SUBSCRIBE BY EMAIL