Setting Up and Configuring Ubuntu Server 9.04 VMWARE with SSH, VSFTPD (TSL/SSL), OpenVPN, Fail2ban (PART 3)

Ok, now its time for OpenVPN. There is a really good write-up on how to install OpenVPN by niels on http://nielsvz.com. Follow his guide to install it on 9.04 and then you can play with some options below.

To authenticate via PAM, add this line in your server.conf file:

plugin /usr/lib/openvpn/openvpn-auth-pam.so system-auth

To route all traffic through your VPN connection (HTTP, DNS...), uncomment this line in your server.conf file:

push "redirect-gateway def1 bypass-dhcp"

Corresponding with this switch, you will need to enable NAT redirection. This will allow your VPN connected clients to see and access network resources on the subnet your server is on. Enable it with the following:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

To configure OpenVPN to only allow certain users to log in, follow the instructions here.

Here is a copy of my client config to reference:

persist-key
tls-client
remote techaccesstips.servehome.net 1194
proto udp
ca ca.crt
dev tun
persist-tun
cert client1.crt
comp-lzo
nobind
key client.key
pull
auth-user-pass

Here are a list of clients for Windows and Mac:
Tunnelblick - Free OpenVPN client for Mac
Viscosity - Shareware client for Mac
OpenVPN GUI - Free client for Windows

So ends the guide...If you have any questions, comments, or revisions/suggestions please leave a comment and I will get back with you.

Arrow Keys Not Working in Ubuntu VMWare / Backtrack

Found this post from projektd at http://bias9.blogspot.com/2008/10/keys-not-working-in-vmware.html.

Either modify or create the file in your Home directory:

cd ~/.vmware
nano config

Add this line to your config file:

xkeymap.nokeycodeMap = true

Then restart VMware with:

sudo /etc/init.d/vmware restart

Should work after that.

Cracking Cached Passwords with Cachedump and John the Ripper (JTR)

So if you are looking to audit password strength in a Windows Domain environment, there are two tools that will be of help to you. FGDump is a compilation of PWDump and Cachedump. It also has a some useful switches, but documentation for those can be found here. PWdump will pull hashes for local accounts such as Administrator. Cachedump however will pull the cached hashes from network users who have logged into the machine.

Here is how to grab the hashes.

Download FGDump from here and place the executable on a flashdrive (if you have a U3 device, I will soon be posting how to run fgdump without any user interaction).
Plug the flashdrive into the target computer and open up a command prompt.
Navigate to your flashdrive and execute fgdump.exe.
Wait for it to finish and once it is successful, open up the 127.0.0.1.cachedump file in notepad to see the hashes.
Copy the hashes to a file and save in this format: filename.txt.
Next download John:

wget http://openwall.com/john/f/john-1.7.2.tar.gz
tar xzf john-1.7.2.tar.gz

Now we are going to have to patch it to let it recognize the cachedump format:

wget http://openwall.com/john/contrib/john-1.7.2-mscash-alainesp-4.1.diff.gz
cd john-1.7.2
zcat ../john-1.7.2-mscash-alainesp-4.1.diff.gz | patch -p1 -Z

If you do not have the zcat command, then patch it with gzip:

gzip -dc ../john-VERSION-WHAT-REVISION.diff.gz | patch -p1
cd src
make
make clean SYSTEM (which ever system type you have as displayed with make)

Once successful:

cd run
./john --test

Now lets crack the cached file

./john -format:mscash hashes.txt

or

./john -w:passwordlist.txt -format:mscash hashes.txt

Give me some feedback if this helped you.

Change XP Serial Number

So, there are a lot of posts out there on various ways to do this, but I have found this method to be the easiest and most successful.

1. Click Start > Run
2. In the Open box, type regedit and hit enter.
3. Go to the following registry key:
   HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\Cur rent Version\WPAEvents
4. In the right pane, double click OOBETimer, and change the value of any one of the digits (you can change it to whatever you like). You have now just deactivated Windows.
5. Go to Start > Run.
6. In the dialogue box type:
   %systemroot%\system32\oobe\msoobe.exe /a
7. Select "Yes, I want to telephone a customer service representative to activate Windows" and then click next.
8. Click "Change Product key".
9. Type in the new product key and then click "Update".
10. If you return to the previous window, click "Remind me later", then restart the computer.
    

Access your Mac from XP...

This is just a simple way to remote into your Mac from XP. I am sure there are some alternate techniques, but this is fairly simple.
Ok so here are the steps I took:

1. Download OSXvnc (Vine), mount, and then drag into Applications.
2. Open System Preferences > Sharing > then click Remote Management (select the options you want).
3. Now launch OSXvnc Server and enter in the password to connect.
4. Log into your router and find the Port Forwarding tab. For Linksys routers it is under Applications and Gaming.
5. Now forward port 5900 (TCP and UDP) to your computers IP address.
6. Go back to your Mac and open up a browser and find out your external IP.
7. Go to the machine running XP and download and install RealVNC.
8. Open Up RealVNC player and enter in your external IP.
9. Enter in your password to connect.
10. Now that's it!

Now some explanation of what is going on. You have a service on your mac that is listening on port 5900. You are telling your router to forward all activity on port 5900 to your Mac IP. So, by entering your external IP, the packets are hitting your router, then forwarding to your Mac on which the VNC server is listening on port 5900.

Enabling Remote Desktop Connection (RDC) Remotely...

I have run into many situations where I need to remote into a computer, but can't because RDP is not enabled on that computer. So I want to enable it remotely because either I am too lazy to get up and access a network computer or cant access a network computer because it is behind a locked door. There are a few ways to do this.
The first is to add a network registry and then change a value. To do this:

1. Open regedit | Start > Run > regedit
2. File > Connect Network Registry
3. Then type either the name or the IP of the computer to connect to and press Check Names.
4. Press Ok then you should see the network registry under yours in the left pane.
5. We are going to change the value of fDenyTSConnections and it is under
• HKLM\System\CurrentControlSet\Control\Terminal Server
6. Double click fDenyTSConnections and change the value to 0.
7. Now you should be able to remote it.

NOTE: If you receive and Access Denied error when trying to access HKLM, then check your security settings on the remote computer (this most likely means physically accessing it).

Another process would be to download PSTools (a light-weight telnet-replacement that lets you execute processes on other systems) from Microsoft. Download and extract PSTools into a folder. In command prompt (Start > Run > CMD) CD (change directory) into that folder and then execute the following command:

• psexec \\IP reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0

There are also some programs that can assist you with enabling RDP.
IntelliAdmin has a freeware program that will enable RDP remotely with a GUI, it also has some nice additional features. It can be downloaded here for free.

Outlook reminders not appearing

When Outlook reminders are not appearing on there expected times, try these steps to fix the problem:

Verify the reminders are enabled:
In Outlook go to Tools > Options > Other (tab) > Advanced Options > Reminder Options and verify the Display the reminder box is checked.

If that is checked, then go to Start > Run > type outlook /cleanreminders.

If there is still no solution, then go to Start > Run > type outlook /resetfolders.

Microsoft Support

New commands that I have used frequently the past month...

On my never ending Linux/Unix/Windows knowledge quest, I have learned a few basic commands that have just been really helpful and that I have used very often in the past month while troubleshooting random problems.

Linux
smbmount - mount smb shares
Been in a few tight squeezes with some data I needed off a machine, but my only available storage option is a NAS.

• smbmount //ip/share /mnt/mountpoint -o username=domain\\user,password=pass

For me this would look like:

• smbmount //192.168.1.10/Backup /mnt/nas -o username=user,password=password

df - shows disk info (usage, mount point, free space)
The -a switch displays all filesystems, the -T switch displays the FS type, and the -h switch displys the results in "human readable" formats (such as MB and GB)

• df -a -h -T
  

du - shows size of files and folders
The -c switch gives a total of the size of all files in the directory, the -h switch lists size in a human readable format, and the -s switch outputs only the size of the directory, not the files within (it is pointless to use the -c switch with the -s switch unless you really enjoy doing so. Also without the -s switch, the output will be of every file and folder in a directory, which could be very verbose)

• du -c -h /mnt/Backup
• du -h -s /mnt/Backup

Unix/Mac
Here is how to make a release renew script to make quicken things up a bit:
In a terminal window, type:

• nano /usr/bin/rr

Which will open a blank page called rr. Now add:

• #!/bin/bash
• echo "Now releasing your IP"
  
• sudo ipconfig set int BOOTP
• sleep 5
• echo "Renewing your IP"
• sudo ipconfig set int DHCP
• echo "Done!"

Where int is the specified interface. CTRL+O to write the file then CTRL-X to exit.
Now to make the file executable enter:

• sudo chmod 775 /usr/bin/rr

That is it...now just enter rr to release and renew your ip.

Windows
I have also been using Windows to mount network shares through command prompt.

• net use
  
• net use a-z: \\ip\share /USER:domain\user
• net use /DELETE a-z:
• net use /DELETE *

The first command will display all mapped network shares.
The second command will map a share and use the logon credentials of domain\user, and might prompt you for your password (a-z is the drive letter for the share to be mapped to, you must use a drive letter not currently used).
The third command will delete a specified mapped drive (again, you must specify a drive letter for a-z).
The fourth command will delete all mapped drives.

These are all simple commands, but very useful for me day to day.

Some updates were not installed...

I get this error frequently. Windows Update (WU) will find all available updates for my machine, download them, and attempt to install them, but reports the error: Some updates were not installed. A fix I have stumbled across that has worked every time is to force reinstall WU. The steps are fairly simple.

• Download a WU executable from Microsoft.
• Save the executable to your desktop.
• Open up command prompt (Start > Run > cmd) and cd (change directory) to your desktop.
• cd Desktop (Assuming you are at C:\Documents and Settings\)
• Next type the name of the executable (windowsupdateagent30-x86.exe) followed by the switch /wuforce
• WindowsUpdateAgent30-x86.exe /wuforce
  
• Note: When typing the name of the executable, you can enter a bit of text and then press tab to autocomplete your file name. Example typing windows then pressing tab would give me windowsupdateagent30-x86.exe

That's it. Now just go to Windows Update and it will require you to reinstall WU. After that you should be able to download and install properly. Hope this helps.

Disable the annoying restart prompt after installing Windows Updates

I always get caught working on something and find myself interrupted to install updates. I install and clench my teeth knowing that the notoriously annoying restart prompt will bug me until I finish my work and restart.

Fortunately, there is a fix. Just follow these simple steps to make your update experience a bit less annoying.

• Click Start > Run
• Enter "gpedit.msc"
• Select Computer Configuration > Administrative Templates > Windows Components > Windows Update
• Open "No auto-restart for scheduled Automatic Updates installations"
• Select "Enabled"
• Open "Re-prompt for restart with scheduled installations"
• Select "Disabled"
• Now restart for the changes to take effect.

What you just did: Entered local Group Policy and changed Windows Update configurations.

*For more information on Group Policy see Wiki.
*For more information on Group Policy Editor applied locally see Microsoft.
**Original article from 4sysops.