- Roundtable - muug.ca

Suggestion For Improvements To Cryptographic Hashing
by Ihor Jakowec 14 Mar '17

14 Mar '17

I hope this is readable, if not please notify me. This article is also readable from google+ Keywords: Ihor Jakowec DEJA VU HASH Revised Or, copy and paste, the below link... https://drive.google.com/open?id=0BxLingfkcfkbQ3JwYUlZVVBGZGc DEJA VU HASH Abstract Described here is a self modifying cryptographic hash, that changes with every login, and/or, after an arbitrary time interval. In addition to a password, the hash uses login statistics. A hacker would would have less time to crack a password, because the hash value could keep changing. Also, hacker would need login statistics.  TIME SENSITIVE CRYPTOGRAPHIC HASH This method is used for remote logins from computers with an operating system containing log files that hold login data and network traffic data. This method is NOT for use by “dumb” terminals, or on guest computers where data is erased upon logout. The input to the hash consists of some or all of the following: 1.) Password. 2.) Time delay, established by use either/or: - the mode and variance of several ping attempts - a truncated value common to most ping trials - or the intersection algorithm. [1] 3.) Login time. 4.) Previous or, current login duration. 5.) CPU serial number. 6.) An array that is a histogram of values of the number of packets sent and received (the interval size is arbitrary) [1] _________________ Wikipedia Contributors “Intersection Algorithm” “Wikipedia, The Free Encyclopedia” Wikipedia, The Free Encyclopedia 5 May 2014. Web. 5 May 2014. NOTE: You could use NTP (Network Time Protocol), with peer-to-peer connectivity for both the login client and the server; to increase the resolution of the above items: 2, 3, and 4. (Referring to item 4.) If the current login is used, the hash is performed at the end of the login. A different hash value can be kept for each login from a different CPU. (This could be a weakness if many different CPU’s have been used, and infrequently at that.) Therefore, using item 5. should only be considered as an option, for those who want to restrict logins to a select few computers. How these values are arranged as input to the hash is arbitrary. You could use sequential concatenation. Or, values can be hashed separately, then xored to the final hash value. Input values can also be bit shuffled. Modification: Item 6 could consist of a single array that is a histogram of differences: (number of data packets sent - number of data packets received) The arbitrary time interval is: login duration / inter login interval Both the server and the client would have records of items 1 to 6 on their respective file systems. However, for concealment, the way they are stored, and used as input to the hash can vary. Since, this method results in a different hash for every login. A hacker’s cracking time would be limited to the time interval between successive logins PSEUDO LOGIN The concept here is to use pseudo logins. This is not a full login. Only the login state tables are synchronized and the password hash value is re-hashed. The login interval can be based on information known to both the client and the server. The average of the last five logins could be used, where a fraction, or multiple, of this average is used as the pseudo login interval. Moreover, the pseudo login interval can be vary. This interval can be made slightly longer or shorter. This variation can be based on the histogram of differences previously mentioned. The histogram can be partitioned into percentiles, or an arbitrary n-tile. Lower than average values can be used to shrink the pseudo login interval, while higher than average values can be used to lengthen the interval. Optimally, the average of these intervals should be slightly shorter than the amount of time needed by the average hacker to crack a hash value. Or, it could be left up to the system adminstrator to set the length of the pseudo login interval. This would depend on the need for security in juxtaposition to system load demands. SALTING THE SALT As an added security feature, each pseudo login hash can be salted with a random number. The same value that is used by the server and the remote login. The random number generator and the seed value used, would be common to the server and the login client. The type of random number generator used would be quasi-propriatary to the system being used. That is, each random value could be cryptographically hashed with a common seed value. The resulting hash value could be used with the hash value of the previous login or previous pseudo login hash value. ================================================== DISCLAIMER Any words not defined, in this collection of documents; use the definition given to them, by the O.E.D. and/or American Webster's dictionary. It is not my intention to use double entendre: either from English or in any other language, or from pop subculture (past or present). Any words redefined by me, or phrases defined by me, are simply technical in nature. They are not intended to refer to any: group, institution, organization, person or persons. — No alternate meaning to any word or phrase is implied or intended. — My intent is NOT to: slight, insult, affront, or offend. Ihor Jakowec Tuesday 14 December 2017 ===================================================

1 0

Re: [RndTbl] GnuCash crash on secret payload in XML file
by Dan Martin 13 Mar '17

13 Mar '17

I have used GnuCash for many years, building up huge XML files, and never had an issue until I tried some auto-entry with a program. If the file is not EXACTLY what it expects, it will fail. No problem getting data out, though it can be processor intensive to rebuild the trees. But I have not had the patience to dig into source code to be able to write to it. It would be nice to have a high level API to allow auto entry, modify reports, etc. -Dan On Mon, Mar 13, 2017 at 3:04 AM, Hartmut W Sager <hwsager(a)marityme.net> wrote: > OK, it's late at night, and I did something that Trevor likes doing. :) > I went looking for trouble. But hey, I had a good reason, and had been > planning this experiment for weeks already. > > My current accounting is still my own FoxPro concoction (started in 1992 > and updated a few hundred times), and for the last few years I knew I would > have to move it. Besides export/import issues, I have several extra fields > of information that I need to preserve (even if not accessible outside of > raw XML editing), so I edited a good GnuCash native XML file by adding a > secret payload in one existing transaction with > <mynewtag>mypayload</mynewtag>, at the same level as the other fields of > that transaction. I was hoping it would be ignored on load, and restored > on save. > > The result: GnuCrash crashed totally while opening the edited XML file! > Yeah, just crashed with a crash message and self-quit after that. Is > GnuCash that unstable??? > > BTW, a simple raw XML edit of an existing text field of a transaction > works fine, and is then shown in GnuCash when the file is opened. > > Hartmut W Sager - Tel +1-204-339-8331 <(204)%20339-8331> > > > _______________________________________________ > Roundtable mailing list > Roundtable(a)muug.ca > https://muug.ca/mailman/listinfo/roundtable > >

1 0

Les.net MUUG member discount slow in coming
by Hartmut W Sager 13 Mar '17

13 Mar '17

Sorry Les, no offense intended, but 4.5 months since the first promise is a bit long, and I did ask your staff about this a while back. The facts: 1. In the Nov 2016 MUUG Newsletter, Les.net offered a 10% discount to MUUG members. 2. My inquiry about this at Les.net a few weeks later led to a pleasant conversation with Sonja, who assured me that it would be implemented "pretty soon", and that discounting would definitely be back-dated to 01 Nov 2016. So, Les, will you kindly carry through with this? It was at your own discretion to offer this in the first place, without any pressure from anywhere (I hope) - I am not your typical Winnipeger who is routinely looking for a discount everywhere. I hasten to add, I too appreciate what you do for MUUG. Hartmut W Sager - Tel +1-204-339-8331

1 1

Looking for Proxmox support
by Gerald Brandt 10 Mar '17

10 Mar '17

Hi, I used to do consulting (about a year ago). When I stopped, I told my clients, and all was well. Well, I have an old client that called me up. He had serious issues and didn't know why. I solved the issues for him, but we are now looking for someone to move forward to continue support. The client is relatively low maintenance, but when he needs help, he needs it immediately. The configuration is 4 Proxmox 4.4 servers and two Synologys in HA configuration serving vm images under NFSv4. Is there anyone in Winnipeg that would be interested in supporting infrastructure like this? Gerald

1 0

MUUG Meeting, Mar 14, 7:30pm -- Pi-hole and Shred
by Gilbert E. Detillieux 07 Mar '17

07 Mar '17

*** Please note the updated meeting location below *** The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting on Tuesday, March 14 (Pi Day). The meeting topic for this month is as follows: Daemon-Dash: Pi-hole Pi-hole turns your Raspberri Pi (or other supported devices) into a network-wide ad blocker, using DNS redirection. It promises to block over 100,000 ad-serving domains, improve overall network performance and reduce cellular data usage, on any device. Gilbert Detillieux will demonstrate the installation process and typical use of Pi-hole on a Raspberry Pi (after all, it is Pi Day!) and describe some pros and cons of the installation method used, as well as some pros and cons of using an ad blocker on your network. RTFM: shred This month's RTFM will be presented by Wyatt Zacharias, who will talk about the shred(1) command, which allows you to overwrite a file to hide its contents, and optionally delete it. The group usually holds its meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. ****************************************************************** Please note our *NEW* meeting location for this month: *Room 1L11* Lockhart Hall, University of Winnipeg, entrance on Ellice Ave. between Spence St. and Balmoral St. Parking is available on the surrounding streets and in the lots on nearby streets. Look for signage once you're at the building, or ask a security guard. ****************************************************************** For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board: https://muug.ca/meetings/MUUGmeeting.pdf -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.ca> c/o Gilbert E. Detillieux Web: http://muug.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0

new ECC computer options
by Trevor Cordes 04 Mar '17

04 Mar '17

I'm looking for input from anyone in the club who may be knowledgable, eyeballing, or has purchased a "workstation" system recently with ECC memory. (Note, ECC is imperative!) I don't need dual-socket, crazy speed, just something like a mid-range modern i7 with modern RAM, slots, etc. (i3 speeds won't cut it.) By "workstation" I mean it has to have at least one PCIe x16 (full 16 electrical) slot so it can have a good video card installed (and handle upgrades in the future). So some "servers" will qualify, although most do not have a true x16 slot (they'll say x16 but the small print will say x8 or x4 electrical), especially on the low end. I also need tower form factor, as rackmount will (unless 4U) be a pain to fit cards in, etc. Lastly, I really want a DIY setup where I buy the board, cpu, etc individually, though if a perfect premade system (i.e. Lenovo) exists that fits the bill I might consider it (must use no propreitary form factor parts, including mobo & PS). It's basically impossible since the discontinuation of the Intel D975 chipsets (nearly 10 years ago) to do Intel with ECC without buying a Xeon CPU. So I'm probably stuck buying a Xeon CPU and getting slower than i7 for double the price. Ugh. I'd really love to hear from the AMD nuts out there if there are any good AMD options, especially ones that are more enthusiast/desktop oriented rather than same-price-as-Xeon competitors. If I'm going to spend big bucks, I'll buy Intel: AMD needs to offer a compelling price advantage to pull me over. I still believe AMD could carve a niche for itself by offering desktop enthusiast chips / mobos with ECC at desktop, rather than server, prices. Maybe add $50 each to a mobo and cpu as the price premium. Not the 100% premium Intel wants just to get ECC. (I miss the old days when getting ECC was cheap/easy.) If AMD already has such a thing (I'm hoping!), great! I know I'm not the only one in the club interested in these answers. P.S. being a computer reseller, I don't need prices or store suggestions, I can just buy it all wholesale :-) It's the "this chipset plus that CPU" that I'm really looking for. Thanks!

3 11

sawfish on wayland
by Trevor Cordes 23 Feb '17

23 Feb '17

I thought this might interest some MUUGers. This is mostly about Wayland in general, though my query was regarding "porting" sawfish (my favorite wm for 10+ years) to wayland (the replacement for X we're all soon going to have foisted upon us). The pasted posts below come from the sawfish mailing list, mostly from actual sawfish devs, and other interested parties. I wouldn't mind hearing a MUUG discussion about wayland, if people want to chime in. With wayland, it definitely won't be "business as usual". I have a question: is wayland just a linux thing, and if so, that means the BSDs will stick with X? I sure hope so, as that would mean X will stick around, even on Linux. Also, I now welcome mir (wayland competitor from Ubuntu), as keeping things fragmented on the replacement side will also keep people (who don't want wayland for any particular reason) in X. Weird... I can't seem to find any Linus comment on wayland anywhere. He wasn't silent about systemd, why wayland? ============ From: Trevor Cordes <sawfish(a)tecnopolis.ca> To: sawfish(a)lists.tuxfamily.org Subject: wayland support? Maybe this has been asked already, but I can't find it on google anywhere... Is work being done on making a "sawfish for wayland"? Since wayland doesn't access wm's like X does, it looks like "wm-like" things have to be rewritten and merged somehow into wayland. It sounds like enlightenment is already working in wayland, so I suppose it is possible. Please tell me we'll have sawfish for wayland? With the amount of customization I've done in sawfish during the last decade my productivity will go into the dumps if I have to throw it all away, especially if the replacements (enlightenment) can reproduce the same customizations. It looks like with Fedora 25 defaulting to wayland that in about 7-8 months when F24 goes EOL I'll be forced into wayland whether I like it or not. Even if (?) F25 allows you to switch to X (not X in wayland, but pure X-only), all the desktop apps will start to be developed and maintained with wayland in mind. That means even if I can stick with X for a couple of Fedora revs, the X versions of things will get buggier and no one on bz will care. Kind of like the 32-bit kernel today. If anyone has some insights into these things, I'd love to hear them! Anything to keep my hopes up. -- Signed: a happy X user that sees absolutely no value-add for wayland in his happy 2D-only sawfish life. ================== From: Jan Kasprzak <kas(a)fi.muni.cz> To: sawfish(a)lists.tuxfamily.org Subject: Re: [Sawfish] wayland support? Hello, Trevor Cordes wrote: : Is work being done on making a "sawfish for wayland"? Since wayland : doesn't access wm's like X does, it looks like "wm-like" things have to : be rewritten and merged somehow into wayland. : : It sounds like enlightenment is already working in wayland, so I : suppose it is possible. This is a question I wanted to ask for some time as well. GTK supports Wayland, but I am not sure about how WMs are supposed to work in Wayland. : It looks like with Fedora 25 defaulting to wayland that in about 7-8 : months when F24 goes EOL I'll be forced into wayland whether I like it : or not. Speaking as a Fedora 25 user: there is no problem with Sawfish (+XFCE, in my case) on Fedora 25. It apparently uses Wayland only for GNOME-only setups. My lightdm starts the X server and XFCE session just fine, as it did in previous releases. My F25 systems run Xorg just fine (including a dual-seat workstation at home). : Even if (?) F25 allows you to switch to X (not X in wayland, : but pure X-only), all the desktop apps will start to be developed and : maintained with wayland in mind. That means even if I can stick with : X for a couple of Fedora revs, the X versions of things will get : buggier and no one on bz will care. Kind of like the 32-bit kernel : today. I guess the biggest push would not be from desktops being developed for Wayland, but from drivers for newer hardware being developed for Wayland. It is not a problem yet, but I think it will be. : If anyone has some insights into these things, I'd love to hear them! : Anything to keep my hopes up. -- Signed: a happy X user that sees : absolutely no value-add for wayland in his happy 2D-only sawfish life. +1. -Yenya ============= From: "Robert 'Bobby' Zenz" <Robert.Zenz(a)bonsaimind.org> To: sawfish(a)lists.tuxfamily.org Subject: Re: [Sawfish] wayland support? The "problem" with Wayland is that it is just a protocol. So there is no such thing anymore as a window manager on Wayland, there are just different compositors which do *everything*, from providing drawing capabilities to handling input, configuration and windows. There are efforts to extract most of these into libraries, though, but with other downsides, for example libinput has a lot of hardcoded assumptions. I don't know if something like the Wayland-X bridge can be used, getting Sawfish "natively" on Wayland would require to write a complete compositor for Wayland, which for sure is neither trivial nor easy. Also I'd like to take the opportunity to remind everyone that X is going *nowhere* within the next two to three decades at least. I mean, it could happen that some people like Gnome drop support for it within the next years, but I hope that's not going to happen because that would be pretty fatal to the Linux application ecosystem as a whole (a friendly reminder that Mir *is* a thing, and currently there is only a Mir-X bridge). So I hope nobody is that stupid. My personal opinion on Wayland is quite bleak, actually. It feels like it is tailored towards a mobile environment in which no application is trustable, similar to the sandbox and all-in-one package movements which seem to endorse a "download some completely random application from the interwebs and don't worry when running it" mentality. Which is in extreme contrast to what has been pushed in the last decades, "you can trust any application you run as long as it is coming from the official repository". That means that a Wayland compositor must bring all the functionality which are currently provided by different tools, because nothing is allowed to temper with the compositor or other windows. Having a nice compositor would be cool, but Wayland comes, in my opinion, with a pretty hefty price tag. =========== From: Christopher Roy Bratusek <nano(a)jpberlin.de> To: sawfish(a)lists.tuxfamily.org Subject: Re: [Sawfish] wayland support? Hi folks, to put it plainly: there are no such plans. As Robby Zenz already said X isn't going anywhere, soon. Also we do not have enough man power or free time. ============ Lastly, from "Major Linux Problems on the Desktop, 2017 edition": Wayland: !! Wayland works through rasterization of pixels which brings about two very bad critical problems which will never be solved: Firstly, forget about performance/bandwidth efficient RDP protocol (it's already implemented but it works by sending the updates of large chunks of the screen, i.e. a lot like old highly inefficient VNC), forget about OpenGL pass through, forget about raw compressed video passthrough. In case you're interested all these features work in Microsoft's RDP. Secondly, forget about proper output rotation/scaling/ratio change. !! Applications (GUI toolkits) must implement their own fonts antialiasing - there's no API for setting system wide fonts rendering. What??! Most sane and advanced windowing systems work exactly this way - Windows, Android, Mac OS X. In Wayland all clients (read applications) are totally independent. !! Applications (GUI toolkits) must implement their own DPI scaling. The above issues are actually the result of not having one unified graphical toolkit/API (and Wayland developers will not implement it). Alas, no one is currently working towards making existing toolkits share one common configuration for setting fonts antialiasing, DPI scaling and windows shadowing. At least in theory these issues can be easily solved, in practice we already have three independent toolkits for Wayland (GTK3/Qt5/Enlightenment).

1 0

enterprise antivirus that supports a Linux *manager*
by Trevor Cordes 22 Feb '17

22 Feb '17

Followup to meeting discussion topic last night: Does anyone know of (or better yet, use) an enterprise-grade (i.e. for pay) (think Symantec Endpoint Protection - SEP) antivirus solution that allows the manager/server component to run on Linux? To be clear, many AV's (like SEP) support Linux as a *client*, managed by the central Windows-run manager. I need one that supports Linux as the *server* (with Windows clients). Oh ya, and no cloud-anything, not interested! Thanks! (If not, why not? Sounds like a good idea to me.)

1 0

cheap Windows Servers?
by Trevor Cordes 22 Feb '17

22 Feb '17

Bit off topic, but if anyone knows, it's MUUGers... Does anyone know a source for cheap, older, *legit* Windows Server servers? I'm looking for something that includes the hardware and the O/S. Obviously to be legit the license would have to be OEM (with COA) or FPP (full retail box), and not corporate bulk/blanket licensing. The minimum O/S version level acceptable Windows Server 2008 64-bit or R2. I need the dirt cheapest solution, like dirt dirt cheapest. They can be beat up, low ram, junk cpu, etc; just has to work and be cheap. By cheap I mean like under $250. Surely Server 2008 is old enough now that the 2007-2010 level of hardware is basically only good for recycling now? Alternatively I could also use cheap used FPP copies of Server alone (no hw), which I think would be legit to buy used(?). Obviously OEM wouldn't be. <crosses fingers> Thanks!

2 2

Reminder: MUUG Meeting, TONIGHT, 7:30pm -- Room 1L11, Lockhart Hall
by Gilbert E. Detillieux 21 Feb '17

21 Feb '17

*** Please note the updated meeting date and location below *** The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting on Tuesday, February 21 (i.e TONIGHT). The meeting topic for this month is as follows: Daemon-Dash: vsftpd Wyatt Zacharias will present VSFTPD - the very secure FTP daemon. VSFTPD supports FTP and FTPS protocols, and boasts being one of the fastest and most secure FTP daemons available. Wyatt will demo running the daemon with both anonymous and authenticated modes, chroots, whitelists, and more. RTFM: Fixing drive sector SMART errors Ruh roh! Device: /dev/sdb [SAT], 5 Offline uncorrectable sectors. 7 Currently unreadable (pending) sectors. Those just flashed across your console. Is your hard drive dying? Panic time? Not so fast: Trevor Cordes will show you how to gracefully repair such errors, allowing you to delay or obviate RMAs or replacement drive purchases. The group usually holds its meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. ****************************************************************** Please note our *NEW* meeting location for this month: *Room 1L11* Lockhart Hall, University of Winnipeg, entrance on Ellice Ave. between Spence St. and Balmoral St. Parking is available on the surrounding streets and in the lots on nearby streets. Look for signage once you're at the building, or ask a security guard. ****************************************************************** For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board: https://muug.ca/meetings/MUUGmeeting.pdf -- Gilbert E. Detillieux E-mail: <gedetil(a)cs.umanitoba.ca> Dept. of Computer Science Web: http://www.cs.umanitoba.ca/~gedetil/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0