Rubenerd

The #bashbleed #shellshock fix we got yesterday was only a partial. CVE-7169:

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Update bash on your boxes again, or if you can’t, shut down SSH and block it with your firewall rules.

Also, don’t reinstall bash on FreeBSD. Make tcsh your friend, as many on Twitter told me they have yesterday. It really is quite a nice interactive shell, and you’ve always got sh for scripts.

This is serious. Potentially worse than Heartbleed. CVE-2014-6271:

A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.

Red Hat has a command you can use to test if you’re vulnerable, along with some nice details.

Update bash on your boxes, or if you can’t, shut down SSH and block it with your firewall rules.

On FreeBSD, uninstall it and make tcsh your friend again.

Made two quick comments today. I’d be a hypocrite disabling blog comments here, then encouraging people to blog their responses instead…. then not doing so for these. So here they are.

From Debian-Tutorials.net:

Apologies for commenting on an old post, but you’re on the first page of results on Google and just wanted to give everyone a heads up.

This isn’t really an error, just an indication that InnoDB is using the system’s internal memory allocator instead of its own. The default is yes/1, and is acceptable for production.

According to the docs, this command is deprecated, and will be removed in MySQL versions above 5.6 (and I assume MariaDB):

http://dev.mysql.com/doc/refman/5.6/en/innodb-performance-use_sys_malloc.html

Cheers :)

And ECM Architect:

“I have no idea why [skip-networking] is turned on by default”

I’d say its a prudent security measure, especially for a package manager like MacPorts where users are generally creating stacks for personal local development. You don’t want to be exposing network services you weren’t expecting.

That said, if the default for MySQL/MariaDB is to enable it, it may be a cause of confusion, as it was for you here. Any deviations from the default should probably be documented somewhere.

Via @Damncabbage on Twitter, comes this delightful job offer from some sugary application company. Point one describing who they want:

You are ambitious, intense and entrepreneurial, and you dream of doing epic truly shit with your life.

Is that code? Under who they don’t want:

You are a social misfit. You like technology only because you can’t relate to real people. You spend your weekends playing DOTA and in your sleep you dream about your hero reaching Level 38. At school, you were always the last to get picked on any project or sports team.

Oh, but it gets better:

Having a conversation with you is about as interesting as watching paint dry. Advice: go seek help from a mental health professional.

Class. As Marco Arment wrote in 2013:

Their unreasonable, immature expectations are a damaging message to send to their huge audience of young software developers. Yes, there are other employers this bad (and worse) in the industry, but you don’t have to work for them. There are a lot of better options, especially if you satisfy even half of Penny Arcade’s requirements — and a healthy work-life balance is a basic requirement, like your paycheck, that you shouldn’t tolerate losing for any employer.

Today’s featured image is of a Portuguese SATA aircraft, by Luc Verkuringen on Wikimedia Commons. Because SATA. I’m highly-larious.

By default, QEMU emulates an IDE interface for attached storage devices. For example, starting this VM will attach the hda drive as primary master, hdb as primary slave and hdc (or cdrom) as secondary slave.

#!/bin/sh

qemu-system-x86_64 \
    -hda first.img \
    -hdb second.img \
    -cdrom freebsd.iso

I needed a way to test if an OS operated correctly with a SATA AHCI controller. There is a way to emulate a SATA controller, by creating seperate devices and attaching your drive to it:

[..]
-drive file=[YOUR IMAGE],if=none,id=[AN IMAGE ID] \
-device ich9-ahci,id=ahci \
-device ide-drive,drive=[AN IMAGE ID],bus=ahci.0 \
[..]

Sure enough, ich9-ahci is an Intel controller, which supports SATA. Boom. Booting a Linux system with this config:

[    1.518092] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)

Once again, kudos to the QEMU team for their amazing software.

This post originally appeared on the Annexe.

Yes, I’m turning this Tumblr into a dumping ground for stuff that’s not worth putting on my actual blog :)

If you’ve changed your URL in nginx/Apache, and need to modify in the database:

USE wp_database;
BEGIN;
UPDATE wp_options 
SET option_value='http://example.com'
WHERE option_name='siteurl';
UPDATE wp_options 
SET option_value='http://example.com'
WHERE option_name='home';
COMMIT;

DISCLAIMER: I have used reasonable care in preparing the information included in this document, but I do not warrant that such information is error free. I assumes no liability whatsoever for any damages incurred by you resulting from errors in or omissions from the information included herein. Backup all production databases before modification.

If she were alive today, she would be years old fabulous.

Caught up with my lovely sister in town to have dinner and celebrate her life. This year we talked about change, and all the things we’d eagerly tell her about if we could. Would Deb approve? (She hated, hated when people called her Deb, so naturally I always called her that).

There’s still a part of me that expects to come home, walk into her bedroom and see her there with her espresso machine, vintage powder compact collection, mountains of artwork and a warm, cheeky smile behind a delightfully silly PG Wodehouse tome. She was really one of a kind, and, without any remorse for the cheesiness of the line I’m about to type, I feel so lucky to have known her not “just” as my mum, but as my best friend.

I love you. ❤

(For some reason, every time I discuss file archiving and compression, I’ve included images of Asahina Mikuru from The Melancholy of Haruhi Suzumiya (© Kyoto Animation). Presumably because her moebeam can similarly compress files).

All good sysadmins maintain logs. In simpler setups, they’re located in your /var/log folder. Slowly accumulating, until you run out of space. That’s okay though, because your /var is mounted on its own partition or BSD slice.

Yours isn’t? Huh. What’s your IP address? ;)

Another way logfies are maintained are regular rotations. For most of my life, I’d taken it for granted that *log files appearing in /var/log seemed to archive themselves after a condition had been met, either time or space. Debian and RHEL archive to gz, FreeBSD archives to bzip2 by default. Proving once again FreeBSD is more efficient. I’ll see myself out.

For example, lets look at a testing machine I run:

auth.log
auth.log.0.xz
auth.log.1.xz

This log tracks authentication attempts. Judging from the number, its been rotated twice.

On FreeBSD, newsyslog is run by cron to archive log files before they become unwieldly. It’s enabled by default, and takes its configuration from /etc/newsyslog.conf. Let’s take a look:

# logfilename     [owner:group] mode count size when  flags [/pid_file] [sig_num]
/var/log/all.log                600  7     *    @T00  X
/var/log/amd.log                644  7     100  *     X
/var/log/auth.log               600  7     100  @0101T XC

There’s a lot here, but basically we have the logs to archive, how many rotations should be done (count), the condition for archiving (size and time), and a series of flags. As usual, the FreeBSD manpage on the topic is excellent; take that GNU info.

This is where things get more interesting. C tells it to create a logfile if it doesn’t exist, and X uses xz to compress the archives.

Wait, what? That’s right, instead of bzip2 or gzip, you can get even crazier compression by default for logfiles now. Makes me want to shed a tear, and bring back the steam roller from 2007.

This is probably [very] old news, but there’s a person born every minute who hasn’t seen *The Melancholy of Suzimiya Haruhi*.

I got an email proporting to be a University Experience Survey, then a letter in the mail. To my old address, that UTS still haven’t updated despite repeated attempts to correct it.

They congratulated me on finishing my UTS studies, and said I’d been “selected” to engage in their experience survey, for the chance to win some token anchor store vouchers.

How did the UES know my personal details, address, my degree, and that I’d finished it? Did UTS provide a third party this information without my consent, or were they compelled to?

Update

It seems UTS signed us up for it. From an email in August:

UTS is participating in the national 2014 University Experience Survey (UES), as it did in 2012 and 2013. Around 120,000 students completed the 2013 UES, making it the largest ever survey of current university students in Australia. The UES is being conducted to help universities and government improve your student experience. Results will play a key role in the ongoing evolution of Australian higher education.

Fortunately, they did (sort of) offer us an opt-out:

If you have any questions regarding the administration of the UES, or would prefer not to be invited to participate, please contact the UTS Planning and Quality Unit’s Survey Coordinator [..]

Prefer seems a little too soft a term. We should explicitly have an opt-out. Whatveer the case its a moot point, this should really be opt-in given personal information is involved.

I’ll be raising this with the Vice Chancellor.

Letter

Dear… [darn, now I need to look up his name],

I hope your new position has found you well.

Many of your students were recently sent invitations to participate in the University Experience Survey. With it, personal information including our addresses, degrees and estimated completion times were sent to this organisation.

UTS sent us email saying we could opt-out if we preferred. Given this involves personal information however, I would prefer this to be opt-in. I’ll admit it was a little disconcerting receiving a letter containing these details from an organisaion I’d had no dealings with before.

Peace, health and happiness,
Ruben

So I needed to convert a VMware vmdk image to a raw disk image. Knowing qemu-img could do the task, I did as per normal:

# qemu-img convert -f vmdk -O raw image.vmdk export.img

Only to find:

qemu-img: 'image' uses a vmdk feature which is not supported 
    by this qemu version: VMDK version 3
qemu-img: Could not open 'image.vmdk': 
    Could not open 'image.vmdk': Wrong medium type
qemu-img: Could not open 'image.vmdk'

It then proceeded to tell me:

Ruben, you're devilishly handsome.

My computer may be a lousy liar, but at least she’s nice. As for the earlier problem, the solution was to upgrade QEMU to 2.1.0. Running the command after this resulted in an image I could use.

As an aside, you you can even use this shorthand:

# qemu-img convert -O raw import.vmdk export.img