Fon

Anonymous (anonymous@undisclosed.example.com) — 2013-07-10T01:24:07+00:00

1373418237	current
Line 1:	Line 1:
	+	====== Fon ======
	+	{{:user:ruza:fon_logo.svg.png?nolink \|}}
	+	===== Flashing =====
	+
	+	==== Oficial firmware ====
	+
	+	http://wiki.fon.com/wiki/Firmware_Update_Instructions
	+
	+	==== flashing over serial ====
	+
	+	* hw: http://www.webalice.it/fede.tft/fonera/fonera_serial.html
	+	* sw: http://karmetasploit.com/archives/10
	+	* http://www.dd-wrt.com/wiki/index.php/LaFonera_Hardware_Serial-Cable-Port
	+
	+	==== Yasager! ====
	+
	+	http://www.digininja.org/jasager/installation.php
	+	http://www.digininja.org/jasager/download.php
	+
	+	==== Devices ====
	+	=== Fon (2100) ===
	+	{{ :user:ruza:fon2100.jpg?nolink&350}}
	+	* machine 192.168.1.1
	+	* Fon 192.168.1.254
	+
	+	* CPU: Atheros AR531X_COBRA – MIPS 4KEc V6.4 – 183.50 MHz
	+	* RAM: Hynix hy57v281620etp-h – 16 MB
	+	* Flash: ST(84) H – 25P64V6P – MYS 636 – 8 MB
	+	* Ethernet: (1x) Altima AC101 (10/100 Mbit/s) [Auto-MDI(X)]
	+	* Wireless: IEEE 802.11b / 802.11g (up to 54 Mbps)
	+	* Serial Port exposed on PCB J2
	+	* Antenna Connector: RP-SMA Connector (Reverse SMA)
	+	* Antenna Omni-Directional detachable antenna (2dBi)
	+	* Powersupply Input: 100-240V ~ 50-60 Hz 0.3A. Output: 5V DC, 2.0A Output
	+	* Power Consumption: 4 Watt
	+
	+	=== downgrading 7.0.2 r3 to initial firmware ===
	+
	+	http://wavetenna.blogspot.com/2008/02/fonera-702-r3-hack.html also http://www.metacafe.com/watch/1116957/fonera_7_0_2_r3_hack_initial_hack_enable_ssh/
	+	* no internet connectivity
	+	* pres reset button at the bottom of the Fon for 40s (until only 1 light is on)
	+	* wait 3-5 minutes until all lights go on
	+	* config your pc/ntb:
	+	* ip: 169.254.255.2
	+	* mask: 255.255.0.0
	+	* gw: 169.254.255.1
	+	* dns: 169.254.255.1
	+	* http://169.254.255.1 (7.0.1 r2 aka 0.7.1 r2)
	+	* in Fon webiface in "Internet connection" reconfigure to get real Internet connection, with dns: 88.198.165.155 (applies Kolofinum hack for 7.0.1 r2)
	+	* power off, power on
	+	* 5-10min later ssh 169.254.255.1 (root/admin)
	+	* upload new fw
	+
	+	==== Pentesting ====
	+
	+	* http://stefans.datenbruch.de/lafonera/
	+	* http://web.archive.org/web/20081007064711/http://k0k0.k1k2.de/ssh/open-ssh-access-to-fonera_en.htm
	+

GPG modern (2.1) with Elliptic curves

Anonymous (anonymous@undisclosed.example.com) — 2015-01-10T09:36:56+00:00

	current
Line 1:	Line 1:
	+	====== GPG modern (2.1) with Elliptic curves ======

	+	Being an elliptic curves fan for whatever reason (NSA-aware, early adopter, bored geek,...) you are forced to compile GnuPG for yourself or use Debian experimental.
	+
	+	<note important>Before doing anything be sure to read carefully and fully understand this article https://www.gnupg.org/faq/whats-new-in-2.1.html You've been warned!</note>
	+
	+	===== Oficial variant =====
	+	<note>Recommended way described in [[https://wiki.gnupg.org/Build2.1_Unix\|GnuPG wiki]] is much simpler than the following guide which uses debian experimental in schroot.
	+	<code bash>sudo make -f build-aux/speedo.mk native INSTALL_PREFIX="/usr/local"</code>
	+	actually works well.
	+	</note>
	+
	+	===== Debian experimental schroot variant =====
	+
	+	Use if oficial variant is not functional.
	+
	+	==== Create chroot environment (Debian Jessie) ====
	+
	+	start sudo from your regular user (this is important step to have SUDO_USER environment variable set)
	+	<code bash First we create an directory and prepare environment:>
	+	export MY_CHROOT=/data/virtuals/schroot-deb-experimental
	+	sudo -E su
	+	echo -e "My Chroot:\t$MY_CHROOT\nWhoAmI:\t\t$(whoami)\nSUDO_USER:\t$SUDO_USER"
	+	mkdir -p $MY_CHROOT
	+	chown $SUDO_USER $MY_CHROOT
	+	</code>
	+
	+	<code bash Install software needed to create an schroot environment:>aptitude install schroot debootstrap</code>
	+
	+	<code bash Configure chroot:>
	+	cat <<EOF >>/etc/schroot/schroot.conf
	+	[experimental]
	+	description=Debian experimental
	+	directory=$MY_CHROOT
	+	groups=sbuild,root,$SUDO_USER
	+	users=$SUDO_USER
	+	root-groups=root,sbuild
	+	EOF
	+	</code>
	+
	+	<code bash Now we will create and modify the content of the chroot:>
	+	debootstrap jessie $MY_CHROOT
	+	echo "proc $MY_CHROOT/proc proc defaults 0 0" >> /etc/fstab
	+	mount proc $MY_CHROOT/proc -t proc
	+	echo "sysfs $MY_CHROOT/sys sysfs defaults 0 0" >> /etc/fstab
	+	mount sysfs $MY_CHROOT/sys -t sysfs
	+	echo "/home/$SUDO_USER/.gnupg/ $MY_CHROOT/home/$SUDO_USER/.gnupg/ none bind 0 0" >> /etc/fstab
	+	mount "$MY_CHROOT/home/$SUDO_USER/.gnupg/"
	+	cp /etc/hosts $MY_CHROOT/etc/hosts
	+	cp /proc/mounts $MY_CHROOT/etc/mtab
	+	grep $SUDO_USER /etc/passwd >> $MY_CHROOT/etc/passwd
	+	egrep ^$SUDO_USER /etc/group >> $MY_CHROOT/etc/group
	+	mkdir -p $MY_CHROOT/home/$SUDO_USER
	+	chown $SUDO_USER $MY_CHROOT/home/$SUDO_USER
	+	</code>
	+
	+	==== add experimental repository ====
	+	Debian experimental is not an distro variant, its just a bunch of packages in the repo.
	+
	+	<code bash we are entering newly created chroot environment>chroot $MY_CHROOT /bin/bash</code>
	+
	+	<code bash now we will upgrade jessie to experimental branch\\ as a ROOT INSIDE chroot
	+	apt-get update
	+	echo 'deb http://ftp.debian.org/debian experimental main' > /etc/apt/sources.list.d/experimental.list
	+	apt-get update
	+	apt-cache policy gnupg2
	+	apt-get -t experimental install gnupg2
	+	apt-get install bash-completion
	+	</code>
	+
	+
	+	==== Make keyring backup ====
	+	<code bash AS a NORMAL USER>
	+	BACKUP="/home/$SUDO_USER/.gnupg-$(date +%F).backup.tbz"
	+	tar cjvf $BACKUP /home/$SUDO_USER/.gnupg/
	+	chmod 400 $BACKUP
	+	### TRIPLECHECK YOUR HAVE AN BACKUP !!! (there are big changes in gpg 2.1 and might need to reimport some keys or downgrade)
	+	</code>
	+
	+	<code bash verify chrooted env works>
	+	schroot -p -c chroot:experimental -- gpg2 --version
	+	gpg (GnuPG) 2.1.1
	+	libgcrypt 1.6.2
	+	...
	+	</code>
	+
	+	==== sChroot shell access ====
	+	<code bash btw>schroot -p -c chroot:experimental ... gives you an full shell access</code>
	+
	+	==== Make chrooted binaries executable from non-schroot environment ====
	+	<code>sudo -E su</code>
	+
	+	<code bash now we symlink to universal script /usr/local/bin/run-deb-exp.sh that runs symlink basename in chroot:>
	+	root@DebExp@azur:/usr/bin$ for file in $(dpkg -L gnupg2 gnupg-agent dirmngr\|grep bin); do [ -f $file ] && echo "mv $file $file.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh $file";done
	+	mv /usr/sbin/applygnupgdefaults /usr/sbin/applygnupgdefaults.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/sbin/applygnupgdefaults
	+	mv /usr/sbin/addgnupghome /usr/sbin/addgnupghome.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/sbin/addgnupghome
	+	mv /usr/bin/gpg2 /usr/bin/gpg2.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/bin/gpg2
	+	mv /usr/bin/gpgconf /usr/bin/gpgconf.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/bin/gpgconf
	+	mv /usr/bin/gpgparsemail /usr/bin/gpgparsemail.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/bin/gpgparsemail
	+	mv /usr/bin/kbxutil /usr/bin/kbxutil.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/bin/kbxutil
	+	mv /usr/bin/watchgnupg /usr/bin/watchgnupg.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/bin/watchgnupg
	+	mv /usr/bin/gpg-agent /usr/bin/gpg-agent.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/bin/gpg-agent
	+	mv /usr/bin/gpg-connect-agent /usr/bin/gpg-connect-agent.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/bin/gpg-connect-agent
	+	mv /usr/bin/gpgkey2ssh /usr/bin/gpgkey2ssh.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/bin/gpgkey2ssh
	+	mv /usr/bin/symcryptrun /usr/bin/symcryptrun.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/bin/symcryptrun
	+	mv /usr/bin/dirmngr /usr/bin/dirmngr.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/bin/dirmngr
	+	mv /usr/bin/dirmngr-client /usr/bin/dirmngr-client.ORIG ;ln -s /usr/local/bin/run-deb-exp.sh /usr/bin/dirmngr-client
	+	</code>
	+
	+	<code bash /usr/local/bin/run-deb-exp.sh>
	+	cat /usr/local/bin/run-deb-exp.sh
	+	#!/bin/bash
	+	# schroot -p -c chroot:experimental -- gpg2 "$@"
	+
	+	CHROOT_PREFIX="/data/virtuals/schroot-deb-experimental"
	+	export LD_LIBRARY_PATH="${CHROOT_PREFIX}/lib/x86_64-linux-gnu:${CHROOT_PREFIX}/usr/lib/x86_64-linux-gnu:${LD_LIBRARY_PATH}"
	+
	+	${CHROOT_PREFIX}/usr/bin/$(basename $0) "$@"
	+	</code>
	+
	+	in case you went into trouble with your keydb (like "invalid packet"/"key not found" errors) fix it by reimporting your keys from backup:
	+	! notice that export is using gpg1 with homedir where backup is, while import is made by gpg2.1
	+	<code>
	+	gpg --homedir /home/ruza/.gnupg-BACKUP/ --output F7EEAF5998070C1D_pub.gpg --armor --export-secret-key 0xF7EEAF5998FFFC1D
	+	gpg --homedir /home/ruza/.gnupg-BACKUP/ --output F7EEAF5998070C1D_pub.gpg --armor --export 0xF7EEAF5998FFFC1D
	+	gpg-chrooted --import F7EEAF5998FFFC1D_pub.gpg
	+	gpg-chrooted --allow-secret-key-import --import F7EEAF5998FFFC1D_priv.gpg
	+	</code>
	+
	+	==== Other software integrationn ====
	+	finally configure all your software to use /usr/bin/gpg2 (/usr/bin/gpg is default).
	+	no longer need to start gpg-agent. it is started automagically (... did you've read that "What's new in 2.1" article?)
	+
	+	=== Enigmail ===
	+	path to gpg is configurable in enigmail .. verify in enigmail Console
	+	=== Gajim ===
	+	path to gpg in gajim seems to be hardcoded .. do cd /usr/bin/ && mv gpg gpg.ORIG && ln -s /usr/bin/gpg2 gpg
	+
	+	==== Using ECC in GPG2.1+ ====
	+	* ECC are available in expert mode only. Beware, parameter order is important.
	+	<code bash>gpg2 --expert --edit-key 0xKEYID</code>
	+	* it is not possible at this time create Curve 25519 key for encryption purposes ("unknown eliptic curve" error)
	+	<code bash>
	+	gpg> addkey
	+	Please select what kind of key you want:
	+	(3) DSA (sign only)
	+	(4) RSA (sign only)
	+	(5) Elgamal (encrypt only)
	+	(6) RSA (encrypt only)
	+	(7) DSA (set your own capabilities)
	+	(8) RSA (set your own capabilities)
	+	(10) ECC (sign only)
	+	(11) ECC (set your own capabilities)
	+	(12) ECC (encrypt only)
	+	(13) Existing key
	+	Your selection? 12
	+	Please select which elliptic curve you want:
	+	(1) Curve 25519
	+	(2) NIST P-256
	+	(3) NIST P-384
	+	(4) NIST P-521
	+	(5) Brainpool P-256
	+	(6) Brainpool P-384
	+	(7) Brainpool P-512
	+	Your selection? 1
	+	gpg: WARNING: Curve25519 is not yet part of the OpenPGP standard.
	+	Use this curve anyway? (y/N) y
	+	Key is valid for? (0) 3y
	+	Key expires at Tue 09 Jan 2018 08:31:25 AM CET
	+	Is this correct? (y/N) y
	+	Really create? (y/N) y
	+	We need to generate a lot of random bytes. It is a good idea to perform
	+	some other action (type on the keyboard, move the mouse, utilize the
	+	disks) during the prime generation; this gives the random number
	+	generator a better chance to gain enough entropy.
	+	gpg: agent_genkey failed: Unknown elliptic curve
	+	gpg: Key generation failed: Unknown elliptic curve
	+	</code>

iwevent.service

Anonymous (anonymous@undisclosed.example.com) — 2016-01-04T22:43:13+00:00

	current
Line 1:	Line 1:
	+	===== iwevent.service =====

	+	Sytemd unit for wireless events logging.
	+
	+	<code bash /etc/systemd/system/iwevent.service>
	+	[Unit]
	+	Description=iwevent-logger
	+
	+	[Service]
	+	Type=notify
	+	NotifyAccess=all
	+	RemainAfterExit=yes
	+	ExecStart=/bin/sh -c "/sbin/iwevent \| /usr/bin/logger &"
	+	ExecStop=/usr/bin/killall iwevent
	+
	+	[Install]
	+	WantedBy=default.target
	+	</code>

user:ruza:unbound.conf

Anonymous (anonymous@undisclosed.example.com) — 2014-03-19T22:42:26+00:00

	current
Line 1:	Line 1:
	+	<file /etc/unbound/unbound.conf>
	+	# Unbound configuration file for Debian.
	+	#
	+	# See the unbound.conf(5) man page.
	+	#
	+	# See /usr/share/doc/unbound/examples/unbound.conf for a commented
	+	# reference config file.

	+	server:
	+	# The following line will configure unbound to perform cryptographic
	+	# DNSSEC validation using the root trust anchor.
	+	auto-trust-anchor-file: "/var/lib/unbound/root.key"
	+	num-threads: 9
	+	use-syslog: yes
	+	log-queries: no
	+	prefetch: yes
	+	prefetch-key: yes
	+	val-log-level: 2
	+	#val-permissive-mode: yes
	+	local-zone: sunsec.lan. transparent
	+	local-zone: lan. transparent
	+	local-zone: brm. transparent
	+	local-data: "test.sunsec.cz. IN A 77.78.111.15"
	+	domain-insecure: "brm"
	+	logfile: "/etc/unbound/unbound.log"
	+	access-control: 127.0.0.0/8 allow_snoop
	+	forward-zone:
	+	name: "brm"
	+	forward-addr: 192.168.77.20
	+	forward-zone:
	+	name: "hack"
	+	forward-addr: 192.168.77.20
	+	</file>

UPC modemy

Anonymous (anonymous@undisclosed.example.com) — 2017-12-29T09:27:38+00:00

1513680701		current

brmlab user:ruza

Fon

GPG modern (2.1) with Elliptic curves

iwevent.service

user:ruza:unbound.conf

UPC modemy