Tarsnap logo

 

For the better part of the last half year I’ve been working on a Graphical User Interface for the popular Tarsnap online backup service. The frontend enables desktop users to benefit from the same advantages that the Tarsnap service offers, admittedly only at the command line interface. These benefits include:

  • cost effectiveness;
  • flexibility and control of your backup process;
  • total openness on the client side;

While the Tarsnap service is of immense efficiency and conveniency for server and scripted backups thanks to its Unix utility design, that same characteristic makes it a good choice for wrapping a desktop application with a graphical interface on top so that more users can benefit from truly secure and well designed backups as well as to easily define and use more complex backup routines from a comfortable and lean interface.

Tarsnap-v0.5-OSX-Yosemite-Wizard

Tarsnap Setup Wizard

 

The application is cross platform, written in C++ with the help of the Qt SDK and is released under the BSD 2 clause license. It has been tested on OS X Yosemite, FreeBSD and most Linux distributions with a wide audience.

In the present state, the application makes it easy to:

  1. Configure Tarsnap on your system via a Setup Wizard;
  2. Make single shot backups from the Backup tab, for quickly putting some important files and directories at rest on Tarsnap;
  3. List, inspect and manage your backup archives from the Archives tab  ;
  4. Define frequent backups you attend to as a job from the Jobs tab; A job has custom backup paths and settings;
  5. Provides useful customizations and help via the Settings and Help tabs;

The current version is 0.5. There’s so much more to be implemented and ground to cover in both usability as well as Tarsnap options breadth and depth coverage. So stay tuned for further releases and announcements to this blog, @shinn0K, @tarsnap or the tarsnap-users mail list.

Project page and source code is available at GitHub: https://github.com/Tarsnap/tarsnap-gui

Head over to this overview Wiki page for extra details regarding the current release. Also read the announcement e-mail on the tarsnap-users mail list.

As explained in the wiki page and the announcement e-mail, there are no binary redistributable packages for now, mainly because there aren’t any for the Tarsnap command line client either. This might change in the future though.

As with any Open Source project, I encourage you to participate via discussion, feedback, code contributions, bug reports, fixes and platform testing. Basically any type of constructive and informative contribution is very much welcomed.

Tagged with:
 

Blocking ads and trackers using HOSTS

If you’ve stumbled across this post, you’re probably familiar with adblocking extensions such as Adblock and uBlock(seriously recommend the latter for a handful of reasons) and most likely you’re in need of a solution to take back your network and system resources as well as a need for less clutter and more privacy in your daily web ventures, however, this method for blocking ads at the browser level only tends to be quite inefficient and fairly limited. Wouldn’t it be cool to also have ads and trackers blocked at the system level, including but not limited to applications like Skype, uTorrent, IE(seriously?) and other browsers or the many shareware/freeware apps that track your usage via mechanisms like Google Analytics(some use exactly that for tracking).

The solution is fairly simple, we’re going to use a simple hostname based block list to map undesirable domain names to either 0.0.0.0 or 127.0.0.1. In my testing on OS X, I found that 0.0.0.0 works best, that might not be the case on different operating systems. The blocking is done via the ages old hosts(5) unix file, but still very useful mechanism for easy static ip-name mappings at the host level.

The current block list that I use is hosted at hosts.neocities.org. I’m not affiliated with that site and don’t know who is providing it, that being said I use git to track and review changes between updates. The list is quite exhaustive, combining lists from several other sources cited in the header. I’d like to see a couple more lists combined like that from several other places(mainly the ones from uBlock would be useful), but you can then add extra lists by modifying the script fairly easily.

Now the script itself, is hosted on Github. Please read the entire script and what I’ve written bellow before running the script on your system.

Before you go on and use the script on your OS X, I really encourage to start using git in your /etc/ directory. The script won’t even work without a git repo in /etc/, unless you know what you’re doing and you’re going to modify it to bypass that. Having a git repo in your etc directory gives you revisioning, rollback, beta-testing, review and scrutiny abilities to whatever you’re doing to your etc. I do this on my workstations, laptops and servers that I manage. The added git overhead on your daily etc routines is insignificant when compared to the benefits you get when you most need them.

The script is smart enough to not break your current system. What it does as part of the first time run initialization is copy your current /etc/hosts to /etc/hosts.d/hosts.1.head. All your existing localhost rules and custom rules will be maintained there. The adblocking rules will go into /etc/hosts.d/hosts.3.adblock. You can add custom mapping rules(for staging servers, local network mappings) to  hosts.2.custom.

Then each time the script updates it will do the following:

  1. Update hosts.3.adblock with the latest rules from upstream;
  2. Concatenate the rules in /etc/hosts.d in the numeric order to your /etc/hosts;
  3. Show you a git diff of the changes and the option to commit those changes or deny to review, undo or commit yourself using git;

The script also has some pfsense blocking rules from www.emergingthreats.net and some custom ip blocking enabled in /etc/pf.rules/ip-block.pf. This is disabled by default, you can enable it by setting the PFSENSE var to “true” or passing -f as argument. If you know of some other worthy and fresh ad/malware ip lists let me know.

Although my script is OS X only, it’s fairly easy to port it to any other UNIX system(I welcome patches to the main script via Github), having such a solution for the Windows platform would be cool too. Maybe someone reading this can weigh in with their solution or insight? Would it work fair enough, is cygwin the only way for automating this? Nonetheless, stay tuned, since I have a similar router solution(AsusWRT, DD-WRT) coming up soon, that steps up the game a notch and provides blocking for your entire network, though it surely doesn’t deprecate this host level solution (on a laptop for e.g. that is frequently switching networks).

Pros for this setup:

  1. Easy setup and update (when compared to a firewall or a custom dns);
  2. Cross-platform and cross-application solution;
  3. Faster and less intrusive(also no https mitm) than proxy solutions(such as Privoxy);
  4. Easy to temporarily disable: just cp /etc/hosts.d/hosts.1.head /etc/hosts and to restore git checkout /etc/hosts;

Caveats:

  1. On some operating systems hosts files with tens of thousands of rules might slow name resolution up to a certain degree. In my usage with over 50000 rules, OS X and Linux is quite fine in that regard. If you find that such is your case, maybe using a dns server or firewall rules is better for you;
  2. Some blank spaces, containers, divs or unresolved error messages will take the place of the ads themselves in sites and apps that don’t handle failure very well. You can get rid of the browser related blanks at least by using uBlock extension with just the cosmetic rules enabled(in the extension Settings);
  3. Related to the previous one, you might experience some failures in certain web related functionality(fairly limited though). Most of them will be social related or news sites that use ad nag pages before they redirect you to the article content itself. Personally I don’t care about them and as soon as I hit such a road block I close it and move on. The benefit of more resources and network bandwidth for my system as well as the increased privacy and less clutter in general, totally trumps any minor drawback like this;
  4. The script relies on the links(1)(or elinks) tool to parse the html page at hosts.neocities.org and extract only the text. On OS X I use homebrew to install additional tools that I need. If you have a better solid solution that relies only on coreutils or other commonly installed shell utilities let me know;

 

 

Tagged with:
 

How motherboards are assembled

Just a couple videos showing a sneak peak into the steps involved in assembling a motherboard that I find interesting:

 

Alternative to the finger Unix command

Every once in a while I stumble on this question on yet too many forums and Q&A sites:

Is there an alternative to the finger command?

The simple answer is yes! There is an official replacement for the original finger command and it’s part of the gnu coreutils package, it is called pinky(1) and it’s available on all systems that use the gnu coreutils.

The long answer is, no, there isn’t really a real replacement to the original remote enabled finger protocol along with the fingerd daemon and finger client. While it did make sense and has seen its fair share of usage in the early days of the Internet,  it has been considered obsolete and a security issue for way over a decade now, thus all of the modern Linux distributions and Unix flavors don’t install the service nor the client by default anymore, some don’t even include them in their repositories at all.

So now, most of the replacement tools and commands that one can use instead of finger are going to act on the local machine only and provide logged in user info only for the current host. One such tool is pinky of course and it’s output similar to:

$ pinky
Login Name TTY Idle When Where
shinnok Shinnok pts/0 2013-09-18 07:32 127.0.0.1
andy        Andy pts/1 2013-09-18 07:32 127.0.0.2

As you can see the output is pretty similar to the who(1) command(it was actually ported from who.c), nothing special about it. The other traditional alternatives to the finger command include w(1) and users(1).

Tagged with:
 

InfoSec fun

InfoSec can be fun, with the right attitude:

Infosec Reactions

 

It’s about time to call the end on the current poll with 412 votes, Which OS do you currently use the most? , and draw the results:

The best pentesting distribution is?

  • Backtrack (61%, 252 Votes)
  • Other (18%, 74 Votes)
  • nUbuntu (9%, 36 Votes)
  • Network Security Toolkit (2%, 9 Votes)
  • General Knoppix (2%, 8 Votes)
  • Pentoo (2%, 7 Votes)
  • Samurai (2%, 7 Votes)
  • Helix (1%, 4 Votes)
  • STD (1%, 4 Votes)
  • INSERT (1%, 3 Votes)
  • Operator (1%, 3 Votes)

Total Voters: 412

Loading ... Loading ...

The new poll is:

The most useful skills in a pentester's arsenal?

View Results

Loading ... Loading ...

This new poll is multi-choice, with a maximum of 3 selections allowed. So go ahead, and pick the three most useful skills you think a pentester should posses.

No carding, no skimming and no phishing, just plain old physical robbery, done properly.

Tagged with: