Dissecting a Checkpoint UTM-1

August 26th, 2011

I got into maintenance mode on this a while ago, I don’t have any notes on how I did it, I may have pulled the harddrive and modified it from a different system. Or maybe it was just a factory reset. So At this point I’ve connected via serial to the device and have a shell.

sh-2.05b# cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 9
model name : Genuine Intel(R) processor 600MHz
stepping : 5
cpu MHz : 600.047
cache size : 512 KB
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 2
wp : yes
flags : fpu vme de pse tsc msr mce cx8 apic mtrr pge mca cmov pat clflush dts acpi mmx fxsr sse sse2 tm pbe up
bogomips : 1200.88

sh-2.05b# cat /etc/cp-release
Check Point SecurePlatform R70.1

sh-2.05b# uname -a
Linux gw 2.6.18-92cp #1 SMP Thu Jun 18 15:35:09 IDT 2009 i686 i686 i386 GNU/Linux

sh-2.05b# uname -m
i686

sh-2.05b# free
total used free shared buffers cached
Mem: 1026232 598264 427968 0 7992 575896
-/+ buffers/cache: 14376 1011856
Swap: 2096472 0 2096472

sh-2.05b# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current
7.9G 2.2G 5.4G 29% /
/dev/sda1 145M 20M 118M 15% /boot
/dev/mapper/vg_splat-lv_log
26G 174M 25G 1% /var/log

Backtrack5 On a Vostro 3400

May 27th, 2011

Getting backtrack5 to do anything besides blackscreen and kernel panic on this system has been a challenge.
It appears I have two graphics cards? an Intel 915 and a Nvidia 330M
I think this was confusing it somehow, it would start up looking graphical but then go black shortly after it began booting.

 

I found I could get an emergency shell by adding nosetmode but this did not allow me a gui and backtrack doesn’t appear to have a cli installer option

I made a little more progress by pushing modeset options to the drivers themselves.

 

The ultimate fix was to set

i915.modeset=1 nouveau.modeset=0

 

This allowed me to get an actual X window without crashing so I  could install.

 

After installation I had more problems. A learned a lot of about how the vostro 3400 has a hybrid video card that is “sorta” intel and “sorta” nvidia and VERY unsupported in linux. (i thought we were past these days guys!).

There’s a project to bring support to linux. Or atleast some control:

I tried playing around with this for a while but didn’t have much luck in getting X to work. Its hard to tell how affective it is since when I typed startx I got immediately hit with a black screen and the dreaded blinking capslock and scroll lock (kernel panic)

What ended up finally getting a gui for me, after another 8 hours of fighting with it was this post:

http://www.pskl.us/wp/?p=630

 

Finally, I found this kernel parameter: i915.modeset=1

they should rename that to “setbrokentofixed=1″

So, put that at the end of your GRUB_CMDLINE_LINUX_DEFAULT in your /etc/default/grub and update-grub!

 

I had done this! It hadn’t done anything! Wait, update-grub? what the hell is this?

I am not as familiar with grub2 as grub1 and had no idea we went back the direction of lilo and i had to run a an additional program after making my changes.

ARRRGGG!

So after doing the steps mentioned above, I have a working X. I’m not sure if i’m happy with running just on intel but i don’t think i have it in me to fight with it more. I may do a reinstall to pull out all the nvidia cruft left over from my trials.

Make Kirby Dance on your Bash Prompt

April 9th, 2011

Saw this posted by Tenbits on /r/linux on reddit. Read the rest of this entry »

Removing files in Linux doesn’t restore space to the filesystem.

March 23rd, 2011

Seem a couple people both via email and on IRC have this problem:

< robo> hi: on a vm guest running centos .. it shows that / is filled up to 100%. However, if I do a du on / it only shows about half is used.
Any suggestions?

The problem here is not understanding how Linux handles files and data, In linux, a file doesn’t actually get deleted until the number of links to the file is zero. In other words, if you delete it while it’s opened, then that instance of the file will continue to exist (without a directory entry) until every process that has it open is ended – even if you create a new one in the same place.

This is why you see logrotate restart processes after it removes files, that removes that last link to the data allowing it to be cleared up.

Alternatively you can sometimes just blank out a file to reclaim space without having to restart the processes holding the files. something like

:> filename

Will clear the contents of the file but leave the connection to it. This works as long as the process writing to it doesn’t keep track/seek to where it was when it writes again.

Filtering and color coding maillogs

January 18th, 2010

We recently made a large change to mail routing at work, I was trying to look at the mail logs but being able to discern useful information from streaming logs at any company of reasonable size can be difficult. Borrowed an Idea from here: http://blog.crythias.com/2008/04/awk-colorizer-for-tail.html

and came up with the following:
* note ^[ is ctrl-v esc not ^ and a [

function colorize(word, color)
{
c["red"] = “^[[1;31;40m"
c["green"] = “^[[1;32;40m"
c["yellow"] = “^[[1;33;40m"
c["blue"] = “^[[1;34;40m"
c["magenta"] = “^[[1;35;40m"
if (line ~ word)
{
line=c["magenta"] $6 c[color] ($7)
print line
}
}
{line = $0
colorize(“to=”,”green”)
colorize(“from=”,”red”)
}

I save this to printcolor.awk and then just pass my maillog through it:

tail -f /var/log/maillog | awk -f ~/printcolor.awk
A5FBD188DB:from=<xxxxxxxxxx@yyyyyyyyyy.com>,
A5FBD188DB:to=<xxxxxxxxxx@yyyyyyyyyy.com>,
BCFE2188EE:from=<xxxxxxxxxx@yyyyyyyyyy.com>,
BCFE2188EE:to=<xxxxxxxxxx@yyyyyyyyyy.com>,

Living inside screen

February 19th, 2009

First of all, what is screen?

According to the website, “Screen is a full-screen window manager that multiplexes a physical terminal between several processes, typically interactive shells.”. Basically screen lets you run multiple shells that aren’t tied to your active connection. You can disconnect and they stay alive, you can then come back later and reconnect and continue to use them. Screen is used for long running processes you care about seeing the output from, such as viewing log output of a daemon or most commonly a command line IRC client.

I have one server that I am constantly in a screen session in, and I found a tip on parsed.org that makes it a no brainer. Basically whenever you start a shell it calls screen. If screen isn’t running, it starts a new one. This is great for remote systems!


You can use this in your shell dotfile (e.g. ~/.bash_profile, ~/.zshrc) to create a screen session when you log in or reattach to an existing screen:


if [[ $TERM != 'screen' ]] ; then
    if [[ `screen -list | grep -v "No" | awk '$2 { print }' | wc -l` == 0 ]] ; then
        screen
    else
        screen -dr
    fi
fi

Migrating a Maildir archive to IMAP

February 19th, 2009

A while ago I migrated my email from local hosting to a remote hosted solution. All of my new mail went fine but the old mail was left sitting in a Maildir on my home server. To solved this dilemma I wrote a python script to move it for me. It was much easier then I expected it to be.


#!/usr/bin/env python

import mailbox, imaplib, email, getpass

SERVER = "mail.server.com"
USER  = "dgibbons"
PASSWORD = "xxxxxx"
MAILDIR_PATH = '/path/to/maildir'
mdir = 'INBOX.oldmail' # change to the imap location you want your mail to end up at 

# connect to server
server = imaplib.IMAP4_SSL(SERVER)

# login
server.login(USER, PASSWORD)
server.select()
server.create(mdir)
server.select(mdir)

src_mdir = mailbox.Maildir('MAILDIR_PATH')
for m in src_mdir:
    server.append(mdir,None, email.Utils.parsedate(m.getheader('Date')), ''.join(m.headers)+'\n'+m.fp.read())

Checking for Boxee updates with ubuntu 64bit

February 18th, 2009

If you’re one of the people using Boxee on Ubuntu 64, you probably went through some archaic steps involving the 32bit deb package and getlibs, as described here.  What this doesn’t give you however, is a easy method to make sure your boxee version is update.

So I wrote a small script to check for you.

Basically if you run this and you get no output, you’re running the latest. If you get a message telling you to upgrade, well you should know what to do.

Paste the following into a file and chmod +x it.

#!/bin/sh
if [ ! $( which curl ) ]; then
sudo apt-get install -yq curl
fi

LATEST=$(curl -s http://apt.boxee.tv/dists/intrepid/m...86/Packages.gz | zgrep Version Packages.gz | awk '{v=0;for (i = 1; i <= NF; i++) if ($2 > v) v = $2};END{print v}')

CURRENT=$(dpkg -s boxee | awk '/Version/ {print $2}')
if [ $LATEST != $CURRENT ] ; then
echo TIME TO UPGRADE
fi