Debian Squeeze 6.0.2 update (Security – important)

Debian project has released update on Debian 6.0 (Squeeze) which addressed several security issues and bugfix. Debian Squeeze users are advised to update their installation using “apt-get update” and “apt-get upgrade” command to ensure all of the updates are installed properly.

p/s: Although I currently use Ubuntu, I was actually a Debian user and I continue to use Debian on my VPS to host this website till this very day. Without Debian, I would never has discovered thousands of wonderful open source software in it vast software repositories :)

Ubuntu 11.10 drops Synaptic package manager

The upcoming Ubuntu 11.10 release (Oneiric Ocelot) will drop Synaptic Package Manager from default installation in favor of Ubuntu Software Center.

This has been foreseen since Canonical has spend their effort in developing and improving Ubuntu Software Center as a convenience one-stop center to install free and paid software alike.

Personal Thoughts
Personally, I still prefer to use Synaptic Package Manager over Ubuntu Software Center as it is still doesn’t offer the same number of options that I used to get from Synaptic (ability to search by name, description, ability to test the fastest mirror).

But I believe the changes that Canonical and Ubuntu community made might make it easier to streamline the looks and functionality of package manager into desktop environment (Unity) regardless of the computing platform.

Synaptic

How to make sudo display funny error messages in Ubuntu Linux

sudo is probably the most used command in Ubuntu.

In this post, I will show you how to make ‘sudo’ display funny and humorous error messages in Ubuntu Linux.

To do that, you would only need to edit the /etc/sudoers :

sudo nano /etc/sudoers

Then find the line that starts with Defaults env_reset, add insults at the end of the line so it would look like this:

# See the man page for details on how to write a sudoers file
#
Defaults env_reset, insults

Save the file, and you are done! You can test the results by running the sudo command and entering the wrong password.

Screenshot Demo

sudo insults

How to: Quick and Dirty Web Server Load Balancing with IPTables in Linux

Load balancing is a method to distribute workload across multiple computer over a network. The purpose of load balance in web server is to avoid one web server from being overwhelmed by requests which eventually leads the machine to come down to a crawling halt.

Assuming that you have 3 web server to assign the load to each with this IP Address:
10.20.20.1
10.20.20.2
10.20.20.3

You can drive the traffic to each of this on every third packet with this iptables rules:

iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m nth --counter 0 --every 3 --packet 0 -j DNAT --to-destination 10.20.20.1:80

iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m nth --counter 0 --every 3 --packet 1 -j DNAT --to-destination 10.20.20.2:80

iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m nth --counter 0 --every 3 --packet 2 -j DNAT --to-destination 10.20.20.3:80

This will ensure that every 3rd packet of the request will be properly distributed among the three servers to balance the load. Note that this is only useful in simple website which serves static content or for a download servers that serve large files over the internet (CD or DVD iso downloading)

Crack zip file password with FCrackzip

Fcrackzip is a tool that can be used to crack zip files encrypted with ZipCrypto algorithm through dictionary-based and brute-force attack.

The brute force attack can be configured to use the combination of lower,upper, numerical characters or with other symbols or punctuation marks.

Example usage:

  • fcrackzip -u -v -l 1-6 -c a example.zip
  • fcrackzip -u -v -l 1-6 -c aA1 example.zip
  • fcrackzip -u -v -D -p wordlist-dict.txt example.zip (dictionary attack)

Switch Explanation:

  • -v : verbose output, display the progress of current crack, may slow the progress a little bit
  • -l : length of password to brute-force in this case (1 to 6 characters)
  • -c : character set to try (a – lower-alphabet, A-uppercase alphabet, 1-numeric, ! – include [!:$%&/()=?[]+*~#])
  • -u : verify the zip password in case of multiple possible matches

p/s: It is strongly suggested to use dictionary attack first before going down with brute-force as passwords longer than 6 characters may take (a long) time to crack. A collection of wordlist can be found at PacketStormSecurity website

Debian and Ubuntu users can get fcrackzip from the default apt-get repository.
Windows may download fcrackzip win32 binaries from Schmorp.de website

Recommended Reading