I’ve acquired an odd affinity in the past couple days for country music. So it was no mistake that I didn’t change the station in -0.5 seconds when I got into my rental car today and a country station was on. Spurred on by a recent ‘positive country music experience’, I listened to some of the songs for a while. And then one by Brad Paisely came on that started like this:

Well I love her But I love to fish

I busted out laughing and almost swerved off the road. Once I regained my composure, I listened to the rest of the song (lyrics) which is basically about a dude’s wife who says fishing or her and his response is Oh, lookie there, I’ve got a bite. Hehe…pretty funny stuff.

Anyway - I’ve always been able to respect country, but never paid attention to it for more than one or two songs and those that crossed into the “Pop” genre. Just thought I’d share that one song I heard today, though.

This has been an interesting week, and it looks like I’m not the only one. I’m down in Miami for work and had trouble finding a hotel. I eventually came across a place called the “Fortune House Hotel”, which was cheap and didn’t look too bad - it’s condos that they’ve converted into apartment suites. If I had a wife and two kids, this would be a great place for me to stay. But I don’t. I’m traveling on business. And it wouldn’t have been so bad…it really wouldn’t had it been for a series of incidents that just made it unbearable.

The first strike was the lack of Internet access in the rooms. There was wireless in the lobby, but I enjoy sitting around in my room and hacking. I can live without Internet, though. It was when I pulled into the garage after my first day at the client to find somebody in my assigned parking spot that things really started going downhill. I swung into an employee parking spot, thinking I’d just run downstairs and get it taken care of. I swiped my keyfob at the elevator, but just like the night before…it didn’t work for some reason. So I walked down to the 4th floor of the garage and it worked just fine. I went to the hotel desk, explained the situation and they assigned me a new spot on the third floor. I got back in the elevator, back up to the 5th floor, and moved my car back down to the 3rd. I got out, swiped my keyfob at the elevator…and it didn’t work. Great. It only works on 4 for some reason. Also note that I’ve been carrying my laptop-backpack bag with me all this time with two laptops and many accessories. So I walked back up to 4 and hopped on the elevator to go back down to the lobby and get another parking spot. On the way down…the power went out, and I get stuck in the elevator. After a few seconds it powered back on, but wouldn’t go to any floors…until it went up to the 2nd floor and somebody got on. As I still needed to go back down to the lobby, I hopped off at 6. There was a maintenance guy there that said I probably shouldn’t take the elevator back down…so I walked all the way back down to the lobby. I was pretty tired and not impressed with the hotel at this point, so when I got to the lobby I let off a little steam at the poor person at the reception desk who gave me a new parking spot on the 4th floor. The keyfob worked fine and I took the elevator up to my floor. I was just about to put my key in the door to my room, when I noticed the door wasn’t locked…the cleaning staff had left it open when they left. Wonderful.

This is where it gets good…

When I got back from dinner, the hotel looked a little dark. Yep…power outage. No elevators. No Internet. And only mild illumination in the rooms. I was so done with this hotel. I found a deal on Expedia and checked myself out the next morning and it shall forever remain in my mind as the mis-Fortune House Hotel.

Just to keep count…that’s 1 hotel and 1 day.

I found myself that night at the Mercury Resort on South Miami Beach (hotel and room #2), one or two blocks off the ocean. It was a bit difficult to get the room, between fluctuating rates and the hotel running out of the Junior suite, but since I had found the Expedia rate I actually got the Execute suite for a really good price. Parking was $25 and the Internet was $15…but at least there was Internet and the bed didn’t feel like a piece of cheap plastic. The rooms were actually quite nice…stylish, King beds, and quite the ahem ammenities (remember…south beach…yyyyea).

As I headed to bed, it seemed a little warm in the room, but it was bearable. I woke up the next morning and headed out.

I returned that evening to a 90-degree hotel room. My A/C was busted and it was unbearable. The hotel was very good about it, however, and attempted to fix it. It wouldn’t be so easy, though, and they eventually put me into an even nicer room…a Deluxe Suite, complete with kitchen and seperate seating area.

So that’s 3 rooms, and 2 hotels.

Now, South Beach being what it is…the area around the hotel is a little rowdy…but more than comfortable enough for me…not to mention I’m paying about half what I should be!

There’s a great SANS article today about the Illusions of Security.

It’s a nice read if you need to jettison yourself back to reality. Security is very much about being practical as much as it is making sure you have the right technology to protect yourself.

As I mentioned in my Blind SQL Haxoring post, I use Absinthe from time-to-time to assist me, even if I have whipped up my own perl script. I only recent added Oracle support, so Absinthe still came in handy.

One of the nice features of Absinthe was that it could restart a scan if some sort of exception or error occured, which comes in handy when you get such an exception after spending 4 hours enumerating 200 tables. Even better, it allows you to save the data to an xml file (with quite a nice stylesheet, I might add). It also allows you to load the data back in from the xml file, but this functionality has never worked for me and I was always frustrated by it. I usually got some sort of system.xml.xmlreader: root element missing exception. It seemed like something of an xml formatting error, but I could never track it down.

Well tonight, I finally decided to stop whining and actually do something about it. Seeing as how I don’t have enough HDD space left on my Windows partition for Visual Studio, I jumped over to Linux and downloaded the Absinthe Source. After some battles with figuring out how mono worked (never used it before) and trying to compile the project by hand until remembering it uses nant to build (much easier!), I dug into the source and employed my uber-debugging skills to the world of C#. It took a while, but I finally came across the cause of the problem and now you can see my first-ever patch to the open-source world.

Well Happy New Year, and all that jazz. It’s been quite a while since I last posted, but I’ve been busy as all heck. I had the distinct pleasure of staying at a Ritz-Carlton the first week of 2006 and I was quite impressed. Unfortunately, I left my camera behind at home, so I don’t have any pictures of the swank, but I can relate a story about the “Ritz Magic”, which according to Google, is a term they’ve coined.

I was standing in life for “Yet Another Buffet Luncheon”, when I turned to the person next to me and said something to the effect of geez, where are the buffalo wings? I quickly forgot my comment, and continued down the line of deli meats and shot-glass-tiramisu. No sooner had I sat down and started digging into my meal, when I caught a glimpse of a Ritz waiter out of the corner of my eye. I looked up and as he came walking towards me. Your buffalo wings, Sir he said as he set down a plate of steaming wings, celery and bleu cheese. Speechless, my face turned into one of utter disbelief. He merely smiled, and walked away. My tablemates and I then proceeded to enjoy some buffalo wings, courtesy of the Ritz Magic.

Talk about class. That right there showed me just how attentive the Ritz staff can be. How very impressive.

In any case, I’ll be on the road most of this month so you won’t hear much from me. So much to do, and only so many hours in the day.

Somebody referred me to the excellent Tamper Data extension today. Tamper Data can be used to track and modify http(s) requests ala live headers, but with a better feature-set. It has quickly become a new favorite for quick & dirty HTTP interception. It’s also got a few nifty features like various actions that can be taken on form fields. Go ahead, take a look. You might be pleased. It’s a decent alternative to all those memory-hogging java proxies out there… Thanks for the link, Dave.

In addition, here’s an interesting presentation about Web Development and Testing with Firefox that I just came across while looking up some of the links above.

In an attempt to reduce a certain url from being spammed in my comments, I put that url into my wordpress comment blacklist. I know there’s a warning about being careful what you put there, but I figured the url was safe…well it turns out I was wrong. I didn’t look into it too much, but it seemed the url matched any comments that were put in. That means I lost comments from some of my recent posts like automating subversion, upgrading mysql on Gentoo, and running tentakel in Windows…some posts I really would have liked to see some feedback about.

My apologies to anybody that tried to post in the past two weeks and didn’t see anything show up. What a bummer. :-(

As I believe I mentioned in the past, my favorite little firewall (Kerio) was recently purchased by Sunbelt. Sunbelt has already proven their worth in my opinion with this post about adding Bleeding-Edge Snort rules to protect yourself from the recent wmf issues.

WHAT?! Kerio supports bleeding-edge snort rules?! I really wish I had known this before, but man that is cool!

I’ve been following Sunbelt’s blog since the announcement and have been pretty impressed with both the openess and technical nature of the posts by the company’s president, Alex Eckelberry. Not only has Sunbelt introduced me to features of Kerio I never knew existed, they’re also going to slash the price to $14.95, at least temporarily. $14.95, yes that’s right folks…$14.95. That’s 1/3 of what it used to cost. Mr. Eckelberry - I applaud your “no brainer” pricing. You have convinced me, a long-time free user of the firewall, to pony up and pay for it.

Nothing like a little late-night Python to keep one up until the wee hours of the morning…

I came across a great article tonight about executing commands on multiple nix servers. It will come in extremely handy for me when moon-lighting as a nix admin. I’d used fanterm before, but it wasn’t that good looking and being the freak of nature that I am, I spend most of my time in Windows. Although the program mentioned in the above article, Tentakel appeared to be designed for use on Linux systems, it is written in Python and should be able to run on Windows.

Well I can confirm that it does, but it needs a few changes in order to do so. What follows is a brief overview of the changes needed and then some more detailed descriptions about what was done. To get Tentakel working on Windows, follow these steps (current as of Tentakel 2.2):

1. Comment out

   1	import pwd

   in lekatnet\config.py
2. Modify the

   1

   user

   parameters on lines 62 and 349 to be the user you’re going to connect as, ie: ‘user’: “bob”, user1 = “bob”
3. Set a HOME environment variable: set HOME=”C:\Documents and Settings\bob\My Documents”
4. Finally add

   1

   import os

   at the end of the imports list in lekatnet\plugins\ssh.py and
5. Either comment out or delete the status, output = commands.getstatusoutput(s) (line 43) in the same ssh.py and add the following where it was:

   1 2 3

   pipe = os.popen(s + '2>&1') output = pipe.read() status = pipe.close()

   and then change the return statement to not perform the shift:

   1	return (status, output)

Follow those instructions, create your tentakel.conf and you should be good to go. By the way, I used the wonderful plink for my ssh client:

1

set ssh_path="C:\Download\Net\plink.exe"

Now for the gory details.

After unpacking the source, I just attempted to run the program to see what would happen.

C:\tentakel-2.2\py>python tentakel Traceback (most recent call last): File “tentakel”, line 43, in ? import lekatnet.config as config File “C:\tentakel-2.2\py\lekatnet\config.py”, line 53, in ? import pwd ImportError: No module named pwd

Hrm, looks like it’s using a module that my Python install doesn’t have. Looking a little bit deeper, this module is actually used to retrieve passwd information from /etc/passwd. In this case, it’s retrieving the current users effective user id. Well…no need for that, really. Just comment out the

1

import pwd

and change the two areas on config.py where the pwd.getpwuid is referenced to be a static string of my username.

Try to run it again:

C:\tentakel-2.2\py>python tentakel Traceback (most recent call last): File “tentakel”, line 43, in ? import lekatnet.config as config File “C:\tentakel-2.2\py\lekatnet\config.py”, line 68, in ? __user_dir = os.path.join(os.environ[‘HOME’], ‘.tentakel’) File “C:\Python24\lib\os.py”, line 422, in __getitem__ return self.data[key.upper()] KeyError: ‘HOME’

Ah…Windows doesn’t generally set a HOME environment variable. No problem there, just do it myself. set HOME=”C:\Documents and Settings\bob\My Documents”

Tentakel ran ok after that with the provided -h flag to get a usage display. Next I made a config file and tried to run it:

C:\tentakel-2.2\py>python tentakel -c tentakel.conf -g linuxservers uptime ### t.u.x.y(stat: 0, dur(s): 2.0): ’{’ is not recognized as an internal or external command, operable program or batch file. ### t.u.x.z(stat: 0, dur(s): 2.42): ’{’ is not recognized as an internal or external command, operable program or batch file.

That certainly doesn’t look good. My first guess was that it was executing the command in those braces, which is compatible on *nix, but not Windows. The only problem was…I didn’t know where this was getting executed. An hour of debugging and familiarizing myself with both python and the tentakel program, and some googling led me to line 43 in lekatnet\plugins\ssh.py:

1

status, output = commands.getstatusoutput(s)

. It appears that the getstatusoutput function uses unix-specific command syntax. That google groups link gives a couple suggestions and I ended up using the last one. I added

1

import os

at the end of the imports list at the beginning of ssh.py and replaced the line above with the following:

1 2 3

pipe = os.popen(s + '2>&1') output = pipe.read() status = pipe.close()

and then finally modify the return statement to not perform the shift:

1	return (status, output)

Save all the files and Tentakel works beautifully in Windows. From a second look, it’s not quite as nice as fanterm in that it is not truly interactive…but I think it’ll do just fine. My only gripe now is that output is based on the duration of the command…something to keep in mind when glancing quickly at the output.

Just wanted to say a quick Merry Christmas. I hope everybody is with loved ones and enjoying the holiday.

Now I better get to bed before it’s too late!

He was chubby and plump - a right jolly old elf, And I laughed when I saw him, in spite of myself. A wink of his eye, and a twist of his head, Soon gave me to know I had nothing to dread. … “Happy Christmas to all, and to all a good night!”