SSL Spoofing with Surrogate

I've been doing a lot with SSL certificates recently.  Setting up certificate authorities for testing purposes and other things got me thinking about what it would take to spoof SSL certificates for any site.   Taking over the session at HTTP CONNECT time is easy enough, but then the problem becomes generating certificates.

Enter uCA.  uCA is a micro certification authority.  Once uCA has been configured with its initial CA cert it presents an HTTP interface that can be used to request a certificate and key pair for any commonName.  I have configured Surrogate to request a key and certificate pair from uCA based on the requested CONNECT host.  Surrogate then upgrades the connection to SSL then hands the socket back to the main HTTP proxy handler.

After working out a few bugs I am now able to browse SSL sites that are validated by my local certificate authority.
I still need to add some configuration options for surroage and improve the security and user interface of uCA, but my initial proof of concept is working.

Forking ejabberd

This weekend I decided to start playing with a fork of ejabberd.  I have already started refactoring things in preparation for adding dynamic vhost creation and removal.  I'm calling it Fork21 and I already have a new website devoted to it.

All of this comes after building Chatmongers with ejabberd 3 which has resulted in me having a number of misgivings about ejabberd 3.  It looked like it should be coming out soon when we first evaluated it in the summer of 2011.  15 months later I'm not sure if it will ever ship and the current alpha release has some problematic breakage.  In the name of getting a better chat system for chatmongers the dynamic vhost management features need to be implemented in ejabberd 2.1.x.

I may run out of time before I can finish this so I don't want to make too many promises so for now Fork21 is an interesting project for me to fix whatever I don't like about the current ejabberd.  If the problems with ejabberd 3 can't be resolved then chatmongers as a service may not be viable long term.

For the moment I'm working on Fork21 for my own enjoyment.  If I produce something useful that others like or that is useful to fixing Chatmongers then that just means I'm not alone in wanting what I'm trying to turn ejabberd into.  If nobody cares then I had some fun hacking on an interesting piece of software.

Configuring skype connect with FreePBX

Today I have been fighting my way through configuring skype connect with my PBX. Skype connect is a feature that allows skype calls to be terminated to a SIP based phone system. Skype charges a small monthly fee per channel to do this termination.

There were no configuration guides available for setting this up with FreePBX so I just played with the settings until I got something working without having to enable anonymous sip calls in.

Trunk Name: skype-trunk
Peer Details:
host=sip.skype.com
username=
secret=
port=5060

User Context:
User Details:
type=friend
host=sip.skype.com
insecure=very
context=from-trunk

Register string:
:@sip.skype.com:5060

The User Context value isn't terribly critical. I had it set to "anonymous" since the calls coming from skype come from anonymous@sip.skype.com, but I felt like it was easier to identify the channels by using the userID skype provides. Also, the userid and secret are not skype credentials. They are values provided in the skype manager as your sip credentials when you sign up for skype to sip trunks using the skype connect service.

Getting through firewalls with ping

The gauntlet was thrown. The lodgenet network at the riviera was blocking everything unless you pay.

Things we tried:

• DNS tunnels
• Listening outside on externalhost:1111
• PingTunnel FTW!!!!

Once I verified that ICMP pings were making it all the way out and back from the public internet I started looking for a ping tunnel.

Enter PingTunnel (http://www.cs.uit.no/~daniels/PingTunnel/)

I downloaded and installed PingTunnel on my laptop and on my linode.

On the linode:
ptunnel -x [password]

On my laptop:
ptunnel -x [password] -p -lp 8001 -da 127.0.0.1 -dp 22

This tunnels localhost:8001 to my linode:22

I finish by creating a socks proxy using ssh dynamic port forwarding:
ssh [user]@localhost -p 8001 -D 1080

Once I log into my server I configure firefox to use localhost:1080 as a socks proxy.

After these steps I'm using lodgenet internet without getting caught by the gateway.

Huzzah!

PS. If you don't think it will work, I'm posting this through the tunnel.

Update:
Connections can be problematic. You must allow all ICMP on input. The following iptables rules work for me:

iptables -F
iptables -P INPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -j DROP

The icmp rule is the one I changed that got it working.

Programming projects

I've started playing with Erlang again. I know what you're thinking... "What? Shaun doing something in erlang? Well, I never." There has been that small matter of some people asking me if I would use Erlang any time I present an interesting problem. My normal answer is No, that's not what it's for.

I've been thinking of picking up my DNS proxy code as well as writing a syslog receiver. Look at me reinvent the wheel, with clustering and supervision trees!

We'll see what I find time to get done. There is still that small matter of my day job and having a life at night.

Finals

The semester is almost over. All I can say is that calculus is awesome. I have my final on Wednesday, I expect it's going to be fun.

In other news I'm having alot of fun with programming. I added CS 1400 Fundamentals of programming to my spring semester schedule. Yesterday I managed to execute an erlang module written and compiled on my linux box on my omniFlash. Pretty soon here I'll have Yaws and ErlyWeb running. Not too bad for a 200MHz arm with 32MB ram.

I'm pretty sure that the CS 1400 class is going to be kind of a walk. I'll be excited to see how it all works out.

More fun with the hobie

Last week I went sailing up at bear lake. Today, I went sailing with my brother. I think the first lesson I learned today is that I need to get up earlier. If I get to the lake and the wind is already blowing pretty well, I've wasted that good sailing time.

Another lesson I learned is to make sure I secure the tiller extension arm before travel. The extension arm that makes it so you don't have to be sitting on the back edge of the boat the whole time in order to steer. The extension arm also costs $80, so if you drive out of the bear lake marina without securing it that's what the replacement is going to cost you.

I'm pretty sure it's a mistake that only has to be made once.

Other than that I've used silicone to cover the cracks in the starboard transom that were leaking so I should be good at least until the end of the season.

I bought some spare parts at my local Hobie dealer. I picked up some shackles lest I lose one while rigging the boat. I also got a new wind indicator. Apparently the flag decided to fall of of my old one between where I stepped the mast and where I put the boat in the water. Go figure.

I'm not sure how much this boat will end up costing me, but I'm pretty sure it will be worth it.

The adventures of Baron Munchausen

I'm watching this film right now. One of my favorite lines is from Baron Munchausen when speaking of the turks:

"They are inviting us to defeat them... We must ablige them!"

DDR Again

Today I played DDR for the first time in months. A friend of mine wanted to get StepMania and was having all kinds of trouble finding songs for it. She came over and I got her setup with the songs and then I proceeded to give myself a beating on the dance pad.

The last time I really played much DDR was last December. I was scoring low and breathing heavy. Too bad, I was getting pretty good before.

Sink and sunburn

Thursday I took my hobie out and I made two mistakes. I discovered the first one about 200 feet out from the dock at deer creek. I noticed the boat was riding a bit low and didn't really know why it was performing so badly. I suddenly realized I had forgotten to put in the drain plugs. I usually give the matter of jumping off of a perfectly good boat in the middle of a lake some thought, but I figured this was a situation where I didn't want to waste too much time thinking about my options. The fact that the boat tilted sharply, submerging the end of the trampoline, when I crawled toward the back also helped me commit to jumping in.

We took on enough water for the boat to ride four inches low once we got off of it. I'm not sure how many pounds of water it was, but it felt like a significant amount. We got back to the dock just in time to catch a few people there. They were kind enough to help me drain my hulls by pulling the boat onto the dock and tilting it such that all the water would run out. The left hull was draining fast for a full 5 minutes.

Another mistake I made was not putting on sunscreen. It was overcast and didn't feel like I would burn all that much. The one thing I forgot is that I could burn with sufficient exposure to a full moon. Strictly speaking I wasn't that badly burned. The only part that was really bad was the tops of my feet. I went for the sandal strap burn pattern. Once I acquired the burn I quickly realized that these sandals were all I was going to be able to wear for a few days.

My roommate suggested aloe vera lotion instead of gel. I've used about half of a bottle and I think its helping my burns quite nicely. I base this observation on previous experience with the many sunburns I have had in my life. The only thing I don't understand is why it is that sunburns take so long to develop. I was feeling fine when I got out of the sun. It was just over the next 3 hours that my burns developed into the painful things that they are. Go figure...

The biggest loss from all of this was that I wasn't able to go sailing today as I expected my burns were going hurt too much. It also doesn't help that I'm still sore from stepping the mast on thursday. It took four tries to raise it. I never supposed that rigging a hobie would be so non-trivial.

Political Impact

A strange thing happened a few weeks ago when I declared my departure from political parties. Right after I finished writing that I went to give blood. I was denied because my blood pressure was 160/110.

Funny thing that. I guess I get a little worked up about these things.

Hobie Cats are fast

Last week I bought a used Hobie 16. Yesterday I was able to take it out for the first time. I always heard they were fun, but I had no idea just how fun it would be.

My friend kentos and I got one hull out of the water. The only shame was that we weren't ready for it so it started coming out too far. As the other hull started dipping below the water I had to quickly let out the main sheet to keep us from tipping. It was awesome.

I think I'll be sailing as much as possible until the end of the season. As long as I can find a friend to handle the jib I'll be in good shape.

My political resignation

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This morning I left the Democratic state convention at 10:12. I have decided to discontinue my official affiliation with the democratic party; something I already had to do a few years ago with the republican party.

There are many reasons for this. The first of which is that I believe that no group of politically driven people will accomplish anything if others in their group do not care enough about the rule of law to try to enforce it. It seems the only people concerned with impeachment are the citizens who are farthest from it.

Secondly, I believe that both parties are anti competitive in nature. In the state of Utah, for most elections, a candidate either has to have a long list of signatures or the nomination of one of the established parties in order to be listed on the ballot. It is my opinion that any person wishing to be considered by the public should be allowed to run. This would include multiple people from each party. At which point conventions would be where a candidate runs for the endorsement not nomination of a party. Conceivably, a candidate could receive the endorsement of two or more parties (yes, there could be more than two).

I love freedom, I wish to always be free. When I participate in any political organization it makes me feel sad. It's almost as if people are sacrificing their personal initiative for the will of the group. We all join groups and subgroups. Why? Is it because we don't want to be alone in what we believe? In what we value? Perhaps there's some benefit to being alone. If you are alone you may be better able to act independently of what others think of you.

I do not support government welfare, a big issue in the democratic party. By making that statement some would assume that I do not believe in christian charity. On the contrary I do not support it because of my belief in christian charity. Charity is only charity when an individual decides to give. It is because it was that individual's choice. The choice is taken away, and thus the charity destroyed, when a government taxes from one and gives to another against the will of the taxed. This also destroys the benefit of the relationships that can be formed when individuals help each other through acts of charity.

Our political process is highly broken. Candidates seem to win more by advertising budget than by what they plan on doing once they get into office.

There are many problems. So many that I'm not prepared to discuss a tenth of the ones I have ever noted. Suffice it to say that there is sufficient group-think in both of our parties that until there is a change in the minds and attitudes of the people in our country we will continue to get farther from the freedom we could enjoy. Our country does not suffer so much from oppression of government, though it is rising, as it does from blindness of mind.

And thus I resign from my active involvement in political parties.

Shaun Kruger
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: http://firegpg.tuxfamily.org

iD8DBQFGmP/O/zJrlJgPNdURAmV6AJ437CSZm9zY4MPGbg5RduKTuoDQZwCgq5pc
mnc3yFk1EUPOuoD+5tLlBP8=
=psbP
-----END PGP SIGNATURE-----

Debian gets feisty

A couple of weeks ago I upgraded my Debian box to Ubuntu feisty. The upgrade went ok, though today I found that my machine was having some issues and needed to be restarted. This is all fine and good except that I learned that the root filesystem is selected differently in feisty than it is in Debian.

Feisty wants to mount by UUID and my old upgraded Debian system wanted none of it. It had a kernel panic.

The fix?

I changed /etc/grub/grub.conf from root=UUID={...} to root=/dev/sda5.

I can't say I'm surprised. I've been a Debian user for coming up on 9 years. If I wasn't so comfortable with it I probably wouldn't have attempted the upgrade just because I know something is likely to go wrong when converting between distributions that just happen to use the same package manager.

Lets remember that this upgraded from a kernel I compiled myself with lilo as my boot loader. Ubuntu installed its own kernel and it uses grub unless you really have an opinion on the matter.

All told it was only a 15 minute fix and that's how I learned a valuable lesson.

Shaun

Funny thing I just heard

"Dude, it worked. I just drew the internet with it!"

Programming Erlang

Last night I pre-ordered my copy of Programming Erlang: Software for a concurrent world.

After having read the example chapters I think this is going to be a really good book on the subject. Granted, by the time it gets here I may not really need it, but it will still be nice to have.

One of my favorite things about buying books like this is that I can get a better view of what the author thinks is really important about the language. Instead of a language reference where everything is given equal time. (because that's what you need in a reference) You get a view of some of the best practices around using certain parts of the language.

Languages have syntax, libraries, and idioms. You don't get the idioms from the library reference. You also don't get them from the language reference, it's too busy describing the syntax.

I like what I've seen, and I'm excited to get my copy when it ships later this summer.

More erlang awesomenes

This weekend I started playing with erlang again, and erlang started impressing me again.

I just declared a lexically scoped anonymous function and sent it to a different node. I then executed it on that node and it worked as expected.

For those who are not familiar, an anonymous function is a function that exists, but that is not associated with a function name in a global table of functions. It only exists by a variable reference that can and will go away at some point.

Lexical scoping is when you use a variable in an anonymous function that exists in the current scope where the function is created. That is the only copy of the variable that will be used in the execution of the anonymous function, even in the case that another variable of the same name is seen near the anonymous function later.

Creating the lexically scoped anonymous function and sending it to the other host:

(nomad@nomad)43> Var = 4.
4
(nomad@nomad)44> Fn = fun(X) -> Var * X end.
#Fun
(nomad@nomad)45> global:send(slim_proc,Fn).
<4792.72.0>


Receiving the anonymous function into the variable Fn and executing it using map and executing it directly:

(slim@slim)28> receive Fn -> Fn end.
#Fun
(slim@slim)29> L = [1,3,4].
[1,3,4]
(slim@slim)30> lists:map(Fn,L).
[4,12,16]
(slim@slim)31> Fn(3).
12


Remember: these are on two different machines executing in a clustered erlang environment.

Is this not awesome?

If you die in Canada you die in real life!

In the event you haven't noticed. I would have to say that xkcd.com is my favorite web comic.

That said, it looks like I'm going to PGCon at the University of Ottawa in a couple of weeks. This will be my first conference of this variety. I'm highly excited.

New website

Ever since I got my new job at backcountry.com I've been a little busy.

OK... Very busy.

There is however one thing I thought was really cool. This video was put up on whiskeymilita.com for a few weeks before it was to launch.

It's nice to work for people who can have some fun.

Income sources

Sunday night I was over at my parents house. My brother and his wife were trying to do their taxes and having trouble classifying things. Our Dad printed a copy of Publication 525 and found this great little bit on page 32.

Stolen property.
If you steal property, you must reports its fier market value in your income in the year you steal it unless in the same year, you return it to its rightful owner.

I already owe enough taxes. It's a good thing I didn't steal anything last year.