Travel-related tech

I recently took a trip, and here are a few notes about some of my technology-related experiences.

I knew I'd probably want Internet access at the hotel, but I figured it would be wireless, and I was hoping for some kind of VPN. In the past I've used ssh's socks proxy feature, but I've found it to be pretty slow. So I thought I'd give wonderproxy a try. You can get a VPN account for a month for around $5, and I thought it worked really well. It was fast, and it made me feel a little better about using the hotel's wireless.

I bought a Macbook Air not long ago, and I like it. So I took it with me on the trip. I took some pictures, and I used iPhoto to copy the pictures off the camera onto the laptop. Then I tried using iPhoto to upload the photos to flickr, and that didn't work well for me. iPhoto crashed at one point during an upload of a bunch a photos, and there was no obvious way to resume the upload. I was able to figure out where it quit, and then I just told it to upload the photos it missed. But many of the photos on flickr don't have the original size--the largest version of many of them is 1024x768 (there should be three larger sizes). So I have to upload those images again or just be OK with the smaller sizes on flickr. So I'm glad I hadn't told iPhoto to delete them off the camera.

I also told iPhoto to mark several of the photos as private, and they ended up as public on flickr.

So I probably won't be using iPhoto any more.

And although southwestvacations.com did a great job of booking the trip, they totally FAIL in password security. When I created the account, I used a password generator to create a long password with all four character classes, and I saved the password in my password wallet. At one point during the trip, I needed to access something in my account. But when I tried to log in, I got invalid username/password errors. I ended up using the "forgot my password" link, thinking it would send me a login token. Nope, it sent me my password. It wasn't even my original password (which is why I was having trouble logging in). The original was around 20 characters long, but what they sent me was the first 10 characters of the password I'd created. So southwestvacations.com

• restricts password complexity (they truncated my password at 10 characters--the 11th was a percent sign, so I don't know if it was the length or the character)
• they truncated my password without warning me
• they store non-hashed passwords
• and they'll send passwords by email

FAIL.

Otherwise, it was a lovely trip. Have a look, if you like.

shadow passwords with openssl

I once had to break in to a CentOS box, because I'd forgotten root's password and didn't know the passwords to any other users (I think it had been shut down for a while). So I booted with a rescue disc (I think it was a CentOS installation disk, and I typed "linux rescue" at the prompt). The rescue disc mounted the filesystems, and I tried running passwd in a chroot. I got some kind of error message, and it wouldn't reset the password for root in /etc/shadow on the filesystem. I ended up editing /etc/shadow by typing in a password I got out of /etc/shadow on another box.

As I'm writing this, it occurs to me that if I knew the password to some other user (at this point I don't remember if I did or not), I could have just edited /etc/sudoers to give root to that other user, rebooted, logged in as that user, and done "sudo passwd" to reset root's password.

But if you ever need to create /etc/shadow entries by hand for some weird situation, here are a few suggestions involving openssl's passwd utility.

Incidentally, if you have trouble finding the man page for openssl's passwd ("man passwd" is likely to get you the man page for thing that resets your login password), try "man 1ssl passwd" (Ubuntu) or "man sslpasswd" (Red Hat 5).

The hashed passwords in /etc/shadow look something like this:

$1$.oDCRZmb$mYZm6IzfMWVfe38Pr4fHt0

The shadow entry has three parts delimited by dollar signs. The 1 indicates that this shadow entry was computed with the MD5 password algorithm. The next section (".oDCRZmb") is the salt, and the final portion is the hashed password.

You can generate these yourself. If you type the following (the "-1" requests the MD5 algorithm)

echo password | openssl passwd -1 -stdin

you should get something resembling

$1$DcuakEM4$c4WDkEXKd6YXNYjAfN2Sh/

You can reproduce this by providing the salt:

carl@stilgar:~$ echo password | openssl passwd -1 -stdin -salt DcuakEM4
$1$DcuakEM4$c4WDkEXKd6YXNYjAfN2Sh/

And it looks like openssl is smart enough to strip the newline:

carl@stilgar:~$ echo -n password | openssl passwd -1 -stdin -salt DcuakEM4
$1$DcuakEM4$c4WDkEXKd6YXNYjAfN2Sh/

Without the "-1" argument, openssl uses the standard crypt algorithm. The first two characters from crypt output are the salt, and this is what the Apache webserver's htpasswd uses for making passwords (at least, crypt seems to be the default algorithm for the Ubuntu and Red Hat 5 packages):

carl@stilgar:~$ echo password | openssl passwd -stdin
BxZPctq22eZ4M
carl@stilgar:~$ echo password | openssl passwd -stdin -salt Bx
BxZPctq22eZ4M

passwd also knows the Apache variant of the MD5 algorithm:

carl@stilgar:~$ echo password | openssl passwd -apr1 -stdin
$apr1$z4cUIQjr$fXbDk6ypzyZIIIb/OIp0I.
carl@stilgar:~$ echo password | openssl passwd -apr1 -stdin -salt z4cUIQjr
$apr1$z4cUIQjr$fXbDk6ypzyZIIIb/OIp0I.

Looks like Ubuntu uses the sha-512 algorithm for hashing passwords, and openssl's passwd doesn't support this. If you want to try making /etc/shadow entries w/ sha-512, try saving the following file as passwd.c:

#define XOPEN_SOURCE
#include 
#include 

int main(int argc, char *argv[]) {
    if ( argc < 2 ) {
        printf("usage: %s password salt\n", argv[0]);
        return;
    }
    printf("%s\n", (char *)crypt(argv[1], argv[2]));
    return;
}

And then try this:

gcc -lcrypt -o passwd passwd.c
./passwd password '$6$salt$'

setting the session.cookie_path in PHP (redirection loop)

This is a quick note about a bug in some PHP code I was working on the other day. It took me a while to figure it out. I was developing and initially testing in google chrome, which is evidently forgiving of this kind of error. Maybe writing this will help someone (and maybe it'll help me not to make the same mistake again).

This was for an application which requires authentication. The controller sends the browser a redirect (to the login URL) if the user is not authenticated. I had set the cookie path with something like the following:

$baseUrl = 'https://www.example.com/gakkk/';

// several lines later...

ini_set('session.cookie_path', $baseUrl);

This worked OK in chrome, but Firefox and MSIE both got locked up in redirection loops. After scratching my head for a while, I finally figured out that I should be doing this:

ini_set('session.cookie_path', '/gakkk/');

The cookie_path (it has that name for a reason) should exclude the protocol, hostname, and port. Information security auditors like to complain about web applications that don't set the cookie path.

Testing an SSL-enabled service for cipher strength

Vulnerability scans sometimes find that an SSL-enabled service allows clients to connect using ciphers which have key lengths shorter than 128 bits. Most services have configuration directives to disable these connections. Here's how to test a service for key length (without doing a new nessus scan, or whatever).

openssl ciphers -v

This gives a list of ciphers that the openssl client can use, and the output indicates the key length. openssl's s_client command can take an argument which specifies the cipher(s) to use. So after reconfiguring the server, run the following two commands (the first should fail, and the second should succeed):

openssl s_client -ign_eof -connect target:port -cipher RC4-MD5

openssl s_client -ign_eof -connect target:port -cipher DHE-RSA-AES256-SHA

(You should replace target:port with something like www.example.com:443)

Safari Issues

I learned a couple of things about Safari yesterday. When using the @import syntax for CSS, make sure you remember the semi-colon after the URL (outside the quotes):

<style type="text/css" media="screen">@import "styles.css";</style>

Firefox and Internet Explorer are forgiving about a missing semi-colon, but Safari won't load the stylesheet without it.

And by default Safari has only limited support for tabbing through Web pages (something that's probably pretty important to keyboard users). The default setting will allow you to tab from form field to form field, but you can't focus on links by tabbing. You can enable this behavior (which is behavior I've come to expect from using Firefox and Internet Explorer) by going to the Advanced tab of the Preferences menu and clicking the checkbox that says something like "Press Tab to highlight..."

added READONLY option to password wallet

Made an update to my password wallet. You can now have the READONLY attribute in your .walletrc file: this disables updates to the wallet (w/ the -e option). I keep my wallet in two places (work and home), and a cron job copies from work to home daily. So I need to make sure that I only update the wallet at work. I once updated it at home, and the next run of that cron job overwrote the update (a new password).

panopticlick

I've seen several posts about the panopticlick project in the last few days. If you go to the panopticlick Web page and click the "test me" button, it'll tell you how identifiable your Web browser is. The idea is that it might be possible for someone to track your Web browsing based solely on certain characteristics of your Web browser (without using cookies or even IP addresses).

So I hit the "test me" page with several different kinds of browsers to see what kind of results I would get. The results are given below (all Firefox browsers below have the NoScript extension). In terms of security, these are like golf scores: you want low numbers in the second (BII="bits of identifying information") and third (NIF="number of identical fingerprints") columns. And in terms of security, being unique is bad (it makes it easy to identify you).

browser/platform	BII	NIF
MSIE7 on XP	17.64	unique in 204,788
Firefox 3.6 on XP	8.62	one in 392
Firefox 3.6 on Ubuntu	12.64	one in 6,364
MSIE6 via wine on Ubuntu	17.66	unique in 207,713
lynx on Ubuntu	14.67	one in 26,001
elinks on Ubuntu	17.67	unique in 208,111
wget on Ubuntu	9.57	one in 761
curl on CEntOS	17.67	unique in 208,688

Firefox 3.6 on XP did pretty well, so I captured the HTTP request headers from that browser:

GET / HTTP/1.1
Host: vmware:8000
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

Then I installed the Modify Headers extension to Firefox on Ubuntu and set the User-Agent header to the value from the request headers above. After doing that, Firefox 3.6 on Ubuntu got panopticlick scores like Firefox 3.6 on XP.

An interesting side effect of this is that the Firefox Add-Ons site uses the User-Agent header. So if you do this and want to add extensions later, you will probably need to disable the header. And I've just done this today, so I don't yet know what effect this will have on updating extensions.

pager in wallet program

I recently got an email from someone who has been using the password wallet program. The reader asked about the possibility of using a different pager when viewing the password file (the "less" pager is hard-coded into the program).

I thought this was a good idea, so I've changed the wallet program to allow the user to specify the pager using the WALLET_PAGER environment variable (which defaults to "less"). You can also put this in the .walletrc file. The reader wants to use w3m, so this should now work in .walletrc:

WALLET_PAGER="w3m -o bg_color=blue"

I've updated the program in the google code repository.

Zendcon 2009

Got home last night from Zendcon 2009. Good conference.

Here are a few of the main things I'm taking away from it:

• I'm a fool not to be using APC (and maybe memcache)
• Zendconners really like twitter (I got sucked in: @carl_welch)
• I need to learn more about dependency injection and better OOP methods
• I need to give git a try (had a good visit with the guy at the github booth)

Update (Monday 26 October): I took some pictures, and I've posted them to flickr.

Barnswallows' return

The barnswallows are back. Considering the placement of the nest, I assume that it has to be the same ones as last year. I've been taking a few pictures.

belated Earth Day

Here are a few interesting articles I found this past week:

• The Next Generation of Biofuels (Scientific American) and California Takes on King Corn (The Daily Climate) talk about alternatives to corn-based ethanol
• How to Fix a Climate Emergency (Newsweek) is a pretty interesting look at some radical ideas about slowing down global climate change (and it makes a good point about how this shouldn't be a replacement for cutting emissions)
• and Wil Wheaton found a cool video of Earth rising over the moon's horizon (must have been taken near new moon)
  

bad news for iron fertilization

I follow a few environmental blogs, and for a while I was occasionally seeing posts about the possibility of using iron fertilization for carbon sequestration. The idea (as I understand it) is that scientists would dissolve a bunch of iron near the ocean surface, phytoplankton would consume the iron (causing the phytoplankton to flourish), the phytoplankton would inhale a bunch of carbon dioxide, and the phytoplankton would sink to the bottom of the ocean, taking the CO2 with it, forever.

So they tried it.

They dumped a bunch of iron in the ocean, and the phytoplankton dutifully multiplied (and presumably inhaled a lot of CO2). But before the phytoplankton could sink, it ended up at the bottom of the food chain of a series of increasingly large sea creatures that live near the surface.

Nice try.

Batman logos

There's a post on /Film highlighting a youtube video showing various incarnations of the Batman logo. The video includes logos from various comic book titles, TV series, and films. It's not exhaustive, but it's a cool presentation of a good sampling.

saving space in firefox

I found a cool Firefox extension a day or two ago. It's called Menu Mod, and it's good for saving some space on the Firefox window (particularly if you have a small screen, like on a netbook). It can collapse all the standard menu items into a single menu item (after installing/restarting, do Tools->Add-ons, click Menu Mod, click Preferences, select "Place all menus inside another"). This isn't all that helpful on its own, but try also doing the following:

1. do Menus->View->Toolbars->Customize
2. drag all the stuff from the navigation bar (Back/Forward/Refresh/Stop/Home buttons, address bar, etc.) up next to the newly-collapsed menu
3. get rid of the search field by dragging it to the "Customize Toolbar" window
4. do Menus->View->Toolbars and uncheck the Navigation toolbar

If you do this and start to miss the search toolbar, try this:

1. go to www.google.com (or whatever your favorite search engine is)
2. right-click in the search field and select "Add a keyword for this search..."
3. add something descriptive for the Name field (like "search" or "google")
4. add something short for the Keyword field (I used "g")
5. next time you want to do a search, open a new tab (Ctrl-T is as easy as Ctrl-K), then type the keyword ("g" for me) followed by a space and your search term(s)

If you use the Web Developer extension, do Menus->View->Toolbars->Customize and drag the "Web Developer" item so that it's to the left of the URL bar. Clicking this new item is a quick way to hide/display the Web Developer Toolbar.

xampp

At times I've wanted to try doing some development work on my eeepc, but the default distribution doesn't come with a LAMP stack (and so far I've been too chicken to try installing something else).

Today I tried installing xampp, and that seems to work pretty well. So far my only complaint is that it doesn't seem to come with any version control tools (like svn), and I don't see an easy way to add/compile them (the eeepc doesn't have gcc).

ESC key alternative in vim

I've been using vim for a couple of years now, and I really like it. But one thing that's always been a nuisance to me is reaching for the escape key. I often hit the wrong key (like the tilde or F1), and/or I have to glance at the keyboard to find it.

A recent post by Matthew Weier O'Phinney suggested binding the 'jj' sequence to <ESC>. I've been trying that for the last day or so, and I'm finding that to be a pretty good trick. Here's what I added to ~/.vimrc to make it work:

:map! jj <ESC>

Star Trek Old School

Funny stuff.

Uhuru is my favorite.

Belize: Day Off, Return

(This is part 6 of a 6-part description of a trip I took to Belize with friends just after Thanksgiving 2008. I put my pictures a flickr.)

We didn't plan anything for Thursday, so we slept in. After a leisurely breakfast, we headed north into the shopping areas of San Pedro. We visited several shops looking for souvenirs and gifts. I found that most of the offerings seemed to be overpriced tourist junk, but I did splurge on a couple of Belikin Beer T-shirts. This shopping trip was also a pub crawl: we hit four or five bars, having lunch in one of them. There are lots of dogs in San Pedro. One would adopt us for a while as we walked along, and another would pick us up as we left a shop or bar. We finished out our last full day of the trip with a delicious dinner at the restaurant of a nearby coastal resort.

We took it easy again Friday morning. I partook of some wireless Internet by the Xanadu pool (my friends were impressed that I'd held out for nearly a week), L and KL swam a bit, and H and K did a little more shopping. Then we packed up and took a cab back to the San Pedro airport. Another Tropic Air flight with more breathtaking views of the Caribbean took us directly to the Belize City International Airport. Other than K having a bit of trouble with immigration/customs in Houston, we had an uneventful trip home. The temperature change was pretty startling: from somewhere around 85F to 33F. Ouch. Back to reality. *shrug*



It was a fabulous trip. I'd do it again.

Belize: Caye Caulker and Snorkling

(This is part 5 of a 6-part description of a trip I took to Belize with friends just after Thanksgiving 2008. I put my pictures a flickr.)

Wednesday morning started with another speedboat pickup from Searious Tours. They took us and several other tourists back to the Searious pier where we piled onto a catamaran. There were ten of us on the tour with two crewmembers. We headed out toward a popular snorkling spot just inside the barrier reef. I'd never been snorkling before, so I didn't know what to expect, but this turned out to be my favorite part of the whole trip. The water was only twenty or thirty feet deep, and it was teeming with fish. We even saw a few stingrays and a couple of moray eels. The fish would swim almost right up to me: I guess they get lots of practice sharing the water with snorklers. We probably got to spend the better part of an hour in the water at this spot.

After another short run on the catamaran, we found ourselves at what the crew called "Shark Ray Alley." As the name suggests, it's an area frequented by predators. One of the crew (Daniel) jumped in and caught a nurse shark. Daniel said that the animals are used to him, and they just swim right up to him. The shark was about four feet long, and it just sat patiently in Daniel's arms while we touched it. Its skin was courser than I would have guessed. After we'd all checked out the shark, Daniel released it and grabbed a stingray, which had a much smoother skin. Anyway, the underwater petting zoo was pretty cool.

Back on the catamaran, we sailed south to the island of Caye Caulker, with plenty of Bob Marley, Belikin, and rum punch along the way. The crewmembers jokingly described Caye Caulker as a drinking village with a fishing problem. We had a delicious lunch of ceviche and fish burritos, followed by a little shopping.

The return trip was straight into the wind (and seemed to narrowly avoid some bad weather), so the crew had to rely on the two outboard motors. Back at Xanadu, we made sandwiches for dinner and again fell into bed pretty early, most of us nursing sunburns.

Belize: Altun Ha

(This is part 4 of a 6-part description of a trip I took to Belize with friends just after Thanksgiving 2008. I put my pictures a flickr.)

We got up early Tuesday morning and were picked up from the Xanadu pier by a speedboat from Searious Tours. There were already several other tourists on board (along with the three crewmembers), and we picked up a few more at other resorts along the coast. Then we headed out over the open waters toward the mainland.

The fellow from Searious who drove the boat (a two-engine job, about 40 feet long) and served as our tour guide as we left San Pedro was named Willie. He was very knowledgeable about the local flora and fauna, and he was fun to listen to: his speech was sort of a toned-down version of the frequently-overblown Caribbean stereotype (I'm thinking Predator 2 here). On the way to the mainland, we got to see a couple of bottle-nosed dolphins break the surface pretty close to the boat.

Once we reached the coast, we went up the Belize River a bit. We saw an iguana lounging about in one of the trees. We stopped at a dock and transferred to a van which took us to Altun Ha. The ruins there are pretty spectacular--I'll let the photos speak for themselves. We stayed for an hour or so. We got to climb to the top of one of the structures, and that was a real kick. There were no guardrails or anything to prevent a careless tourist from falling over the side--one of the many differences with tourist attractions in the litigation-happy US.







After Altun Ha we spent a couple of hours at the Maruba Spa. They apparently offer massages, mud treatments, and several other odd things. We enjoyed a nice lunch and some time by the pool. Then we rode back to the dock (with one of the tour guides acting as bartender in the back of the van: Belikin and rum punch) and took the boat back to Ambergris Caye (the ride back offered a pretty spectacular sunset). That evening we walked up the beach to the Blue Water grill for some fantastic seafood (I had some snapper), and then we headed back to Xanadu and fell into bed.