Static in the Ether

Roland Bless, has a rather useful resource of a set of BibTex information for all RFC documents for those working with RFC’s and needing to cite them using BibTex. Available for download is an automatically generated .bib database of all the current RFCs.

The 1.8 meg .bib file is probably a little large for general use but once can easily trim and copy entries required manually or using JabRef. Citations look like the following:

@MISC{rfc1466,
author = {E. Gerich},
title = {{Guidelines for Management of IP Address Space}},
howpublished = {RFC 1466 (Informational)},
month = may,
year = {1993},
note = {Obsoleted by RFC 2050},
number = {1466},
organisation = {Internet Engineering Task Force},
publisher = {IETF},
series = {Request for Comments},
timestamp = {2008.05.18},
url = {http://www.ietf.org/rfc/rfc1466.txt}
}

A resource certain to save typing or multiple c & p operations. The one possible change one may want to make is to include the RFC number in the document tile such as:


title = {{RFC 1466: Guidelines for Management of IP Address Space}}


Another changes may be to use the @TechReport type as opposed to @Misc. An other alternative (although out of date) is the repository at University of Utah Maths Department.

Related to this the W3C have a web page which allows for automated generation of bibTeX citation information for their publications.

With the release of Ubuntu 8.10 (Hardy Heron) and its designation as the new LTS version, I decided to upgrade my one local server from Dapper to Hardy, with the small challenge of I didnt want to do it via a gui. This is partly because I did not have a X client on my laptop this morning, and partly because it will allow me to trial the upgrade of one of my Remote hosted systems.

Some issues specific to the Rhodes environment are noted at the end.

Get up to date:

aptitude update
aptitude upgrade
aptitude dist-upgrade

All fairly painless and out of the ordinary, bar the need to add the dapper-proposed repo to my /etc/apt/sources.list

Installing the requires base packages:

aptitude install update-manager-core

Before doing the upgrade I decided to set up the CDROM ISO as a local repository in order to save bandwidth whales etc.. (Having a system with real internet access, or a working apt-proxy may be a better solution). Once the Hardy DVD is available in a few weeks this may go a lot faster, as libraries such as QT and other components of main will be included in the larger image.

$ mount -t iso9660 -o loop ~bvi/ubuntu-8.04-server-i386.iso /cdrom
$ apt-cdrom add

This should show output similar tot he following as the CDROM is added tot he Repo list.

Using CD-ROM mount point /cdrom/
Unmounting CD-ROM
Waiting for disc...
Please insert a Disc in the drive and press enter
Mounting CD-ROM...
Identifying.. [b36baea778d37bbf48a3c8bd75b5cffb-2]
Scanning disc for index files..
Found 2 package indexes, 0 source indexes and 1 signatures
Found label ‘Ubuntu-Server 8.04 _Hardy Heron_ - Release i386 (20080423.2)’
…


And should add a to the top of your /etc/apt/sources.list similar to the following:

deb cdrom:[Ubuntu-Server 8.04 _Hardy Heron_ - Release i386 (20080423.2)]/ hardy main restricted

Finally the update can be performed

do-release-update -p

The -p parameter is due to the fact that the LTS as defined at http://changelogs.ubuntu.com/meta-release-lts is still showing dapper as the LTS, and should be able to be omitted in the future. with the -p, the meta-release-lts.proposed file is used instead.

the bulk of the base operating system was happily upgraded form CDROM repo in a matter of minutes, and the remaining pile of mostly universe and multiverse packages took around an hour to download

3 hours and a reboot later and the server is happily running Hardy.

All in all its about the same time for doing a ‘buildworld dance’ with FreeBSD, along with a massive level of portupgrade.

Post Reboot

In order to validate the upgrade, we can make use of the Linux Standard Base support for Debian
utilities ( aka lsb_release)

We have gone from:

$ uname -a
Linux spy.ict.ru.ac.za 2.6.15-51-686 #1 SMP PREEMPT Tue Feb 12 16:59:15 UTC 2008 i686 GNU/Linux
$ lsb_release -a (output trimmed)
Distributor ID: Ubuntu
Description: Ubuntu 6.06.2 LTS
Release: 6.06
Codename: dapper

To:

$ uname -a
Linux spy.ict.ru.ac.za 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
$ lsb_release -a
Distributor ID: Ubuntu
Description: Ubuntu 8.04
Release: 8.04
Codename: hardy

In reflection, far less pain than I expected certainly not enough to make me want to employ a depenguinator on this server yet.

Rhodes Specific notes:

• Preferably use ubuntu.rucus.ru.ac.za as your repo unless you would like your quota flattened. Hopefully it will be up.
• ftp://ftp.rucus.ru.ac.za/pub/linux/ubuntu/hardy has the ISO files
• You will need appropriate proxy settings in order for the do-release-upgrade to be able to access the changelogs.ubuntu.com site.

The Hilbert Curve Rework project is progressing well with version 2.05 having been released, by Nick earlier this week. Ive now taken the opportunity to port the current Windows code across to unix and particularly FreeBSD. Around 10 lines worth of changes later the app built and ran on my FreeBSD 7.0 system. For once the mantra of the C/C++ work actually proved try - write once, run anywhere. I really wish Java was that simple.

A couple of issues still need to be addressed:

• Rework the source to we can maintain a single source three for Windows and Unix targets- this is mostly slog rather than thinking work.
• There is a bug in that some images are coming out a little wrong, but I think this may have to do with line termination issues the good old \r\n vs. \n issue again.
• Write some decent docs!

With a bit of luck Nick should be returning to Grahamstown for a month or so thanks to some funding from the Center of Excellence in the department. Working on the Hilbert project will be one of his main priorities.

Taking some data gathered form various filters I’m investigating for the local schools network,a nd combining with some custom scraping tools which Blake has been assisting with Ive drawn a map of the location of some 15 000 IP addresses representing the seedy side of the Internet.

The image is rendered using the Hilbert Curve Program developed in conjunction with Nick Pilkington, as a project for VizSec 2007 last year.

After what seems like an eternity, I can blog again. The delay was caused by a combination of flaky Hard disk on lair (resulting in a read-only mount), and a lack of time between InfoSec Africa, the National Arts Festival and the Departmental Honours Industry visit, and starting my major stretch of teaching for the year to actually get the problem solved.

After rummaging around in one of my boxes at home I found a suitable replacement drive, and have taken the opportunity to do the OS upgrade — re-install — from 5.0 to 5.4. Other than the usual fun of making sure the same packages are installed, and minor tweeks in configuration files due to version upgrades, things went very smoothly, with the only real hiccups, being wet ware problems as I mounted partitions in the wrong place and had finger trouble copying things to the right directories.

In other news, progress is being made on a number of fronts

• Thanks to Jacot, Guy, David and Jock, Ive now got a proper Darknet running and collecting some very interesting backscatter data. The next coupe of weeks will focus on actually working out what exactly to do with the data, but for now everything is being logged to good old pcap files. As an aside, anyone seeing massive numbers of probes to 1434/udp (MS-sql-M) ??. What this means is that I am actually making some kind of progress on what up until now has been a rather elusive PhD
• My first batch of Masters Students Russell, Dominic and Yusuf have also started on the final slog to actually get their research and ideas down onto paper. Somewhat nervous times for me since they are my first batch, but I have full confidence in you all!
• Two weeks to go untill my op to remove the broken bits of bone in my foot. I cant wait. Weather is starting to improve ,and its getting light earlier, and I’d love to be out and about on my bike, o hopefully three weeks and I can start getting back into action.

I’ve also been working on some other bits and pieces I’ll post in due course, fornow its good to be back

PS - For those of you that were following Planet Rhodes or Planet Security, they are now updating correctly, and regularly. I notice a couple of dead links on both, and I’ll weed them out in due course.

Eweek is carying a story about the launche of the ISEAGE project (Internet-Scale Event and Attack Generation Environment) by the Information Assurance Center at Iowa State University.

This USD 500K environment aims to be able to perform a complete simulation of Internet Activity, by its 64 processor nodes.the stated outcomes are:

“Dedicated to creating a virtual Internet for the purpose of researching, designing, and testing cyber defense mechanisms, the proposed one-of-a-kind facility will be the catalyst for bringing together top researchers from several disciplines for a common goal of making computing safer. Unlike computer-based simulations, real attacks will be played out against real equipment. ”

I really really want one :-) or at the least I think somethign like this could prove valuable for the model evaluation that I’m looking at for my PhD Research. What I am looking forward to on a more practical level is when they start releasing some more detailed design documents and software. We have massive computing facilities in terms of the various large undergrad and general access labs on campus — the majority of which lie completely unused over the long December break. Depending on the complexity of the setup, I would hope it would be possible to construct at least a scale replica , although temporary.

This is definatley a project I will be watching with interest as it grows. The ISEAGE Overview document (pdf) currently provides some of the motivation for such a facility.