From the Canyon Edge -- :-Dustin

Tuesday, January 13, 2009

Daemon Challenge 2: How persisent are you?

As described in previously in my blog, this is is the second of three Daemon Challenges.

The first person to complete this challenge will be named the "winner" of this challenge, and will receive a hardback copy of Daemon by Daniel Suarez. Anyone else who completes the challenge successfully, but is not named the "winner" will earn mention here in my blog.

Check back here for the final, most difficult challenge, which will be released on January 20, 2009.

Daemon Challenge 2: How persistent are you?

  1. Run the Ubuntu Intrepid Ibex (8.10) Linux distribution somewhere.
    You can:
  2. Install ecryptfs-utils
  3. Download:
    • challenge_2.txt - eCryptfs underlying data
      • encrypted using eCryptfs, a passphrase key, the AES cipher, and 16 key bytes
    • wrapped-passphrase - an eCryptfs wrapped passphrase file
      • the mount passphrase inside is 128-bits of random data, symmetrically encrypted using a wrapping passphrase and the standard eCryptfs salt
      • HINT: the wrapping passphrase consists of only alphanumeric characters and you can crack it using a brute-force attack in less than 48 hours
  4. Your goal is to solve the riddle and follow the instructions in the decoded challenge_2.txt file to submit your answer.

Good luck,
:-Dustin

Monday, January 12, 2009

screenbin - like pastebin, but for screen

Just before Christmas, Mark Shuttleworth posed a question to our development team. He asked us think about how we could leverage Ubuntu instances in the Amazon EC2 cloud in the course of our daily development practices.

I had a jump-start on that question, in that I had already been thinking about it for several weeks.

To answer Mark's challenge, I created a script that I call screenbin.

Most of us that use IRC on a daily basis are familiar with 'pastebin', such as http://pastebin.ubuntu.com. For those that are not, a pastebin is a website that allows people to paste large dumps of code or text data, and then share simply by referencing a URL. It's handy in IRC and instant messaging, where people generally abhor large dumps of text being pasted and overrunning their IRC buffer.

Pastebin has become an incredibly valuable tool for collaborative communication and development. It's key that the data shared via pastebin is non-confidential and volatile (able to be discarded at any time).

Thinking about Amazon's EC2, I'm particularly intrigued with the "throw-away" nature of instances. A given instance is useful for some period of time, and then it's trivial to destroy that instance, and pay your ~$0.10 tab for 1 hour's usage.

I also noted the asynchronous limitations of pastebin. For real-time collaborative editing, you can use something like Gobby. But what if you want to do more than simple document editing? What if you and your Agile Development practices dictate that you need to do some extreme programming or paired programming with a buddy halfway across the globe? Or you need to do a demo, some education, instruction, or peer code review? Maybe some collaborative debugging? Or even mentoring?

Of course, you can use a shared GNU screen or VNC session. This necessitates exchanging keys or passwords, though, and allowing that sort of access over the Internet. Most of the time, our personal or corporate firewalls prevent this sort of access for very good reasons. And even when it doesn't (or can be opened), allowing such access can be a bad idea!

But then there's that "throw-away" nature of EC2. In a matter of seconds, you can instantiate a brand new, pristine and clean Ubuntu instance in EC2, add the additional packages you need. You can point your collaboratives to a publicly accessible hostname/ip and get to work. When you're done (or should something go south, such as the machine becoming compromised), you can pull the plug and destroy the instance in a second. You can do all of this without necessitating any changes in your network infrastructure or firewalls.

This is the magic that screenbin provides!

Prerequisites

You must have an active EC2 account and the userspace utilities installed. For instructions, see:

Installing

I have packaged it for Ubuntu, and I hope that it will make into Jaunty Universe soon. For now, it's available in my PPA:
* https://launchpad.net/~kirkland/+archive

Usage

Once you have installed screenbin, you could use it like so:
$ screenbin --guest kirkland --guest mathiaz --packages "ubuntu-desktop" --ec2-keypair ~/.ssh/ec2-keypair.pem

screenbin will use Launchpad to retrieve the guest users' ssh keys, so the value of --guest should be a valid Launchpad id. And it will try to retrieve a public key from $HOME/.ssh/*pub. In this case, you would be sharing a screen session among yourself, as well as kirkland and mathiaz.

It will install the specified additional packages on the instance, and install the guest users' ssh keys.

Then, you and each of your guests can ssh to the public hostname/ip address and each of you should be logged into a shared screen session.

Upcoming features
Feedback

Please provide feedback and feature requests in Launchpad as bugs at:

:-Dustin

Wednesday, January 7, 2009

Daemon Challenge 1: We have a Winner!

Thanks to everyone who participated in Daemon Challenge 1!

And the winner is...

I'm pleased to announce that Michael Bryant is the winner of the first challenge, clocking in with the correct answer at about 7 minutes past noon!

Congratulations to Michael. I'm shipping a copy of Daemon to the UK for Michael ;-)

I would also like to recognize the following participants who correctly solved the first challenge (in order of correct submission):
  1. Michael Bryant
  2. Greg Auger
  3. Adam Greig
  4. David Futcher
  5. Thomas Thrainer
  6. Vincent Bakker
  7. Kay Bieri
  8. Flávio Martins
  9. Ted Smith
  10. Martijn Cielen
  11. Alexander Gabriel
  12. James Tait
  13. Eric Hammond
  14. Jeremy S
  15. Pedro Silva
  16. Michele (Macno) Azzolari
  17. José Luis "Artir" Ricón
  18. Dave Walker
  19. David Langton
The Solution...

I've said several times that Daemon is a great book, and I'm happy to host this contest to support Daniel's first book. In running the contest, I'm also hoping to make more people aware of Ubuntu, security, and specifically our open source encrypted filesystem, eCryptfs.

This first challenge, "Is there anybody out there...", was mostly about generating some interest in the book and the contest, and hopefully getting a few new people using Ubuntu Intrepid Ibex's Encrypted Private Directory feature, which I've spent quite a bit of time developing.

The solution to the first challenge is quite simple... Once you've followed the Encrypted Private Directory setup instructions, and mounted your private directory by logging out and back in, you can obtain your mount options and remove your signature as I described with:


$ x=`grep "$USER.*Private.*ecryptfs" /proc/mounts | awk '{print $4}' | sed 's/sig=[0-9a-f]*,/sig=xxx,/'`
$ echo $x
rw,ecryptfs_sig=xxx,ecryptfs_cipher=aes,ecryptfs_key_bytes=16
Then, you can obtain the md5 message digest of $x with:
$ echo $x | md5sum
da9ae8f980ec845914220cfe727a8b16 -
The value, da9ae8f980ec845914220cfe727a8b16, is then used as the symmetric key to decrypt the challenge text file:
  • $ gpg challenge_1.txt.gpg
Once this text file is decrypted, you could see a very simple riddle:
Challenge 1:
--------------------------------------
Leinad_Zeraus : Daniel^Suarez
::
Nitsud_Dnalkrik : ???????????????
--------------------------------------
Daniel Suarez originally published Daemon under the pseudonym, Leinad Zeraus, which, of course, is his name spelled backwards.

Unfortunately, my backwards-name isn't nearly so cool ... 'Nitsud Dnalkrik' sounds more like a scrubbing agent used aboard Russian spacecraft ;-)

The Next Contest

I hope there's even more participation in the second challenge, due to be published next Tuesday.

It should be more difficult, will likely involve Ubuntu, eCryptfs, gpg, and actually cracking passwords/passphrases, as well as a more difficult embedded riddle.


Cheers,
:-Dustin

Monday, January 5, 2009

Daemon Challenge 1: Is there anybody out there?

As described in previously in my blog, this is is the first of three Daemon Challenges.

The first person to complete this challenge will be named the "winner" of this challenge, and will receive a hardback copy of Daemon by Daniel Suarez. Anyone else who completes the challenge successfully, but is not named the "winner" will earn mention here in my blog.

Check back here for the next two increasingly more difficult challenges, which will be released on January 13, 2009 and January 20, 2009.

Daemon Challenge 1: Is there anybody out there?

  1. Run the Ubuntu Intrepid Ibex (8.10) Linux distribution somewhere.
    You can:
  2. Set up an Encrypted Private Directory.
  3. With your Encrypted Private Directory mounted, obtain your mount options as established by ecryptfs-setup-private in Intrepid. See column 4 of /proc/mounts. Store that value in a shell variable, $x.
  4. Within $x, replace your unique eCryptfs key signature (16 hexadecimal digits) with 'xxx'.
  5. Obtain the MD5 message digest of $x
  6. Use the resulting string of 32 hexadecimal digits to decode challenge_1.txt.gpg (link broken, challenge over).
    • Learn more about gpg
  7. Solve the riddle and follow the instructions in the decoded challenge_1.txt file to submit your answer.

Good luck,
:-Dustin

Sunday, December 28, 2008

Win a Hardback Copy of Daemon, by Daniel Suarez!

In September, I blogged a review about the best crypto-cyber-punk-thriller I have read in some time, Daemon by Daniel Suarez. At the time, the first-run paperback was already out of print, and a new re-print in hardback had not yet hit bookstore shelves. This book is a must-read by anyone interested in modern science fiction and techno-writing.

Courtesy of Dutton Press, I now have in my possession 3 copies of the hardback, hot off the press...

And I'm giving them away!!!

The Contest

If you haven't read the book yet, you're really in for a treat! I'm presenting 3 challenges, something like of a crypto-scavenger hunt, reminiscent of the Daemon itself.

The Prizes
  • A total of 3 hardback copies of Daemon will be awarded as Grand Prizes to the winner of each challenge. No more than one book will be awarded per person.
  • The first person to successfully complete a particular challenge will be named the winner of that challenge.
  • Any additional successful submissions before March 1, 2009 will earn fame and notoriety by being mentioned here in my blog, with your name and a timestamp of your completion date ;-)
  • And hopefully everyone who competes will learn at least something about Daemon, Ubuntu, eCryptfs, free and open source software, and cryptography.
  • Kees Cook has independently solved each of these challenges and has graciously volunteered to serve as an independent judge in the event of any tie or controversy. His decision is final.
The Schedule

The challenges (increasing in difficulty) will be published here in my blog as follows:
In the meantime, you might want to brush up on:
  • Ubuntu, livecd's, virtual machines, encryption, encrypted private directories, eCryptfs, gnupg, md5, sha, john, shell scripting
Cheers!
:-Dustin

Saturday, December 20, 2008

Jaunty Manpages


A new version of the Ubuntu Manpage Repository has just rolled out to production! Thanks Lamont ;-)
This version includes a number of bug-fixes, a few new features, and the complete collection of manpages in Jaunty.

:-Dustin

Thursday, December 18, 2008

Linux Inflight Entertainment Boot Sequence Video

On my last flight between Paris and Houston on Continent, I had the privilege of seeing one of the Linux Inflight Entertainment systems in action.

At first, I didn't get to see it boot up, but I did have fun playing with the music and movies on demand. It's something roughly akin to the MythTV I've grown to know and love at home.

A couple of hours into the flight, the lady in front of me rang the flight attendant and complained that her system wasn't functioning properly. The flight attendant said that she'd just "reboot" the system.

I jumped up and yelled, "Oh, mine's not working either...can you reboot mine too?!?" My wife knew what was going on, and she rolled her eyes :-)

I grabbed my camera and videoed the whole boot process. I uploaded all 450MB to YouTube in high quality (while I was onsite at Google for UDS last week):
* http://www.youtube.com/watch?v=F1-rfMBp6vw



Your impressions?

Seeing that this is a 4 minute long boot process, I'd say they have some room for improvement! On the other hand, my sarcastic side sees this befitting of all things related to the airline industry and flying...hurry up and wait for arbitrary and no good reasons...

Sorry for the bumps...


:-Dustin

Printfriendly