All posts by luke

Enterprise Network In A Cabinet – pfSense

Auto backup of config

wget -qO- --keep-session-cookies --save-cookies cookies.txt \
  --no-check-certificate https://192.168.1.1/diag_backup.php \
  | grep "name='__csrf_magic'" | sed 's/.*value="\(.*\)".*/\1/' > csrf.txt
wget -qO- --keep-session-cookies --load-cookies cookies.txt \ 
  --save-cookies cookies.txt --no-check-certificate \
  --post-data "login=Login&usernamefld=admin&passwordfld=pfsense&__csrf_magic=$(cat csrf.txt)" \
  https://192.168.1.1/diag_backup.php  | grep "name='__csrf_magic'" \
  | sed 's/.*value="\(.*\)".*/\1/' > csrf2.txt
wget --keep-session-cookies --load-cookies cookies.txt --no-check-certificate \
  --post-data "Submit=download&donotbackuprrd=yes&__csrf_magic=$(head -n 1 csrf2.txt)" \
  https://192.168.1.1/diag_backup.php -O config-router-`date +%Y%m%d%H%M%S`.xml
References

https://doc.pfsense.org/index.php/Remote_Config_Backup

Enterprise Network In A Cabinet

Goals

scalable

Designed to grow as you grow with large IP address spacing, and multi-site multi-cabinet ability.

licence free

Built on Linux and BSD systems.

stability

Emphasis on Long Term Support and traditionally stable distributions

standards

Ease of access to documentation and certifications (LFCS)

repairable / replaceable

Export/import of configs, common hardware, rotating backups

secure

isolated by enterprise grade firewall

Addressing

172.s.c.x = dmz
10.s.c.x = lan
.1.x = routers
.2.x = switches
.3.x = WiFi
.4.x = Monitoring
.5.x = storage
.6.x = vms
.7.x = POS

s= site designation, c = category, x = device

s = separate by 30 so subnets can restrict access?

allows for 254 devices, within 254 categories per site, with 254 sites that don’t overlap. Also skipping 10.0.0.0 and 192.168 avoids conflicts with most default router configs.

Hardware

cabinet (18RU)- $600

Net gear Switch 24 port – $209

ups Eaton/apc remote control – $800

pfsense – $1000us

Seagate – external backups – one hourly, two daily, one weekly, one monthly.

Wifi

VM Server

Cables

Network Division

Classic 3 tier network separation – WAN, DMZ, LAN

Hardware OS Services / Notes VM LAN
10.0.0.0/8
DMZ
172.0.0.0/8
WAN
Modem     bridge mode       ⭐️
Router pfSense openVPN, dmz , proxy?, dns, dhcp, traffic shaping / monitoring, network bridge? 10.0.1.1/8 172.0.1.1/8 ⭐️
Switch header-gs724tv4-3-4lft-photo-large 24 port GS724T Netgear Fanless, Bonding 10.0.2.1/8
Wifi Linksys WRT1900ACS AC1900 DD-WRT 10.0.3.1/8
Monitoring Must be fanless, Solid State Slackware Nagios 10.0.4.1/8 172.0.4.1/8 ⭐️
Storage Intel NICs, 8GB ECC FreeNAS smb, backup scripts 10.0.5.1/8 172.0.5.1/8
VM Intel NICs CentOS 10.0.6.1/8
Auth CentOS openldap, radius?, active directory? ⭐️ 10.0.6.2/8
Email CentOS / ubuntu postfix, clamav, spam assassin ⭐️ 172.0.6.3/8
Groupware CentOS calendar, contacts, drupal openatrium (SharePoint) ⭐️ 10.0.6.4/8
Web CentOS / ubuntu Apache, PHP, Python ⭐️ 172.0.6.6/8
DB CentOS / ubuntu Mysql / Postgres ⭐️ 172.0.6.5/8

references

ip addressing – http://www.cisco.com/c/dam/en_us/about/ciscoitatwork/downloads/ciscoitatwork/pdf/Cisco_IT_IP_Addressing_Best_Practices.pdf

http://www.cisco.com/c/en/us/support/docs/availability/high-availability/15111-configmgmt.html#topic4

Menupatch, Free Digital Signage

An evolution of the Student Notices V2 project, completely re-written again to allow for multiple user accounts, media uploads, and an algorithmic digital signage system.  This was released for free to complement the commercial Signchro product.

Notable Features:

  • Fully responsive layout using Bootstrap CSS.
  • Paypal API integration to keep track of accounts and payments.
  • Dedicated Digital Signage interface, with complex weighted calculations to use all available display face in the most optimal manner.
  • Media optimisation on upload to multiple sizes, for optimal display and bandwidth usage throughout.
  • UUID based database and file storage.
  • DOM manipulation for Multi-use Modals.
  • MVC framework for ease of maintenance.

Making KDE look a little more like Gnome

There is a dilemma with linux which I think is partially why it has never truly made it to the desktop.  There are two major interfaces – KDE and Gnome.  These two have been battling it out for as long as I can remember – some people prefer the ‘Gnome look’, others prefer KDE.

I’ll admit, I started out enjoying KDE as it had a more finished feel to it and nice icons (outlines were the theme at the time).  Here’s KDE in the year 2000 (The lets-immitate-windows days).

desktop-kde1

Gnome always felt a step behind.  Here’s how Gnome looked.  Notice the window borders are harsher, the ‘unfinished’ look to the icons, and unnecessary buttons behind the icons at the bottom.

desktop-gnome1

Then things got different.  OS X was coming out and had glossy buttons, and Windows was adding extreme colourful window borders everywhere.  KDE didn’t know what to do so it copied both, while adding more options to customise how everything worked.

Kde-3.2.3-es-es

Gnome instead decided to clean up and get a more fuzzy basic look to it.  This is when I switched to Gnome.

arch-linux-default-gnome-desktop

Gnome had the right amount of settings to change it to the windows start bar style, and had a warm fuzzy look to it that made you want to use it.  This to me is the golden age of Gnome.

Then everyone became fascinated with the OS X Dock, Tablets were the future, Ubuntu grew to the top of the Linux ladder overtaking Fedora, and ‘flat’ design happened.   So now we have huge fragmentation and 4 interface players.   KDE decided to do a complete rewrite called Plasma, and added every option possible.  Here’s what it looks like now:

KDE_Leap42.1_dolphin

Gnome decided to go to a mix of OS X and Tablet, removing many settings, giving a really nice warm and fuzzy clean appearance at the extreme expense of usability.

GNOME_files_42.1

Ubuntu came along and introduced ‘Unity’, which has the Gnome ‘feel’ and is admittedly slightly more usable than Gnome – but not much better – and the theme just doesn’t look clean after a while.

Access-Windows-Partitions-from-Ubuntu-16.04

Edit: They have apparently added the ability to move the dock to the bottom of the screen so this should make it MUCH better – hopefully they can eventually change it back to a proper taskbar looking arrangement.  To do this, install dconf-editor and navigate to com > canonical > unity > launcher > launcher-position.

ubuntu_16_04_beta_desktop_unity_menu_mover

Then there’s Linux Mint with Cinnamon.  This has the old Gnome / Windows taskbar style which is extremely useable – however it’s almost exclusively on Linux Mint (which is Ubuntu based anyway so all good), and has a horrible grey theme.

Linux-Mint-17-1-RC-Rebecca-Cinnamon-Officially-Released-Screenshot-Tour-465052-11

So at the moment – until Cinnamon gets a new theme and becomes one of the big players, I feel the best option is to use KDE but give it a Gnome ‘feel’.  This can be achieved by changing the font to Cantarell:

Screenshot_20160604_102226

Changing the font smoothing to make it a little friendlier:

Screenshot_20160604_102236

Changing the icon theme to Adwaita:

Screenshot_20160604_100308

Fixing up the GTK Icon themes:

Screenshot_20160604_100759

And adjusting openoffice’s icon settings:

Screenshot_20160604_101831

This gives KDE a more friendly feel.  It’s like Gnome and KDE had a baby.  Hopefully we can get away from this overly simplified tablet theme and make something more like where we were before Tablets and Docks but still useable, like Windows 10 has.

Student Notices v2

A complete rewrite of Student Notices v1 using more modern practices and toolkits.  There were a few key requirements:

  • It must be as compatible as possible across hosting providers
  • Make it easy for another programmer to come along and adjust it
  • Must be responsive – work across desktop & mobile solutions
  • Must be written quickly

I decided to write it using Bootstrap as a frontend for the responsiveness and familiarity across programmers, and Codeigniter as a backend to utilise MVC methods and ease of information on the net for another programmer to find out how to modify.  Data was stored in a flatfile JSON format to remove the need for a database.

The project ended up having a digital signage component added, to display notices across tv screens within an existing digital signage hardware solution.

I am now a Linux Foundation Certified System Administrator (LFCS)

logo_lftcert_sysadminI have been using Linux since Slackware arrived on a bunch of floppy disks, and while Linux changes constantly many of those techniques are the same.  So I figured it would be nice to get some sort of recognition to show what I know.  This certification seemed to fit that need nicely.

I highly recommend taking this exam to everyone who wants to validate their Linux skills.

Update:  I am now working on the Linux Foundation Certified Engineer (LFCE) which is a little more towards the technical side rather than BAU tasks.

Cheap Bluetooth car headunit JSD-20158

I have recently purchased a JSD-20158 and installed it in to my car.  I had trouble finding any reviews to answer the questions / reservations I had in buying this so I will endeavour to provide all the answers I can here.

Why did I buy a cheap car stereo headunit?

My goal was to add bluetooth handsfree to my car due to the odd call I get on my daily commute which resulted in me dangerously fumbling for my phone often at the worst time.  The choices were to buy a dedicated hands-free which I would only use once in a blue moon, or spend the same amount and bring the whole stereo up to scratch.

WP_20151121_09_13_42_Pro

My (ageing) car had its original stereo, which was a tapedeck and am/fm radio, with two 4 inch front speakers.

How did I end up choosing the JSD-20158?

I couldn’t justify the $100+ pricetag for a namebrand unit, so off to ebay I went.  When searching for bluetooth car stereo you get a vast amount of results however they all have a very similar look – like they were made in the same factory but little details have been changed to rebrand them.

ebay

As they were all around the same $45 mark it seemed like these were the standard radios for this price.  This was confirmed on a visit to Aldi, who had their own version of the same radio under their brand for a very similar price.  With the large number of ‘sold’ numbers next to each listing, and Aldi’s own take on the same product, how bad could it be?  So off to youtube I went to find out the quality of these.

That is where my plan to purchase the common models fell through – the knob seemed very flimsy, the silver buttons seemed a little wobbly – all to be expected from such a low price.  So I ended up finding alibaba, and a different model radio – the JSD-20158 – which could possibly be a more recent refresh of the same innards.  Not the most flashy (in car stereo terms) but the one youtube video I managed to find confirmed the knobs were far more solid, and had what looked to be a much more quality feel to it.

Decision made.  One of the main things that grabbed me was that the left knob had a notched-type movement to it which showed they put in the effort rather than having it freely rotate.  I found an Australian seller on ebay, bought it, and waited by the letterbox.

First impressions?

Not packed very well for shipping however it arrived in one piece.  Very light, and initial playing with buttons and knobs confirmed I had made the right decision by purchasing this model over the others – has a fairly solid feel to it.

How was the installation?

Wiring was fairly straight forward with the use of a Wiring Harness ($20 – purchased separately) which mimics the sockets on the back of the original radio.  This is plugged in to the original wiring in the vehicle, and soldered colour-for-colour to the (included) Wiring Harness for the new stereo, and plugged in to the original plugs in the vehicles wiring.  This could be installed using common terminal strips where a screwdriver would be all that is needed.

WP_20151121_09_17_00_Pro

WP_20151121_16_24_14_Pro

Installing the physical stereo was a little tricky due to my car (Toyota Starlet) not having a standard DIN mount.  The sizing seemed correct, but there’s a cover over the top which got in the way.  A lot of wrestling with the frame, some guesswork, and Roofing Screws and I finally got it mounted and in-place.

WP_20151121_09_13_29_Pro

WP_20151121_09_14_35_Pro

WP_20151121_17_58_46_Pro

Did it work?

Yes!  Peeled all the protective plastic off and powered up first go on ACC.  Tuned a few radio stations, played with the EQ presets, tested receiving a phone call – works just as intended and looks great lit up!

WP_20151121_18_07_50_Pro

 

The good bits:

  • Cheap – $65 total when including the wiring harness.
  • Looks great even during the day.
  • Good sound quality.
  • Bluetooth hands-free.  When a call comes in the music mutes and the callers phone number scrolls across the display.  Inbuilt microphone works well.
  • Fairly easy to navigate.
  • Supports USB keys, Memory Cards, Audio in via headphone cable, Bluetooth streaming.
  • Knobs have a smooth solid feel to them.
  • Comes with a Remote Control!

The bad bits:

  • Date is stored in backwards format (Year-Month-Day), common to programmers.
  • Very limited selection of EQs.
  • Buttons aren’t as solid as they could be, but still pretty good.
  • Storing a radio station preset doesn’t give the common reassuring beep after holding a number down.
  • Radio receiver appears a little weaker than the original unit – great with most stations but will get the odd static on others.
  • The flat front reflects a lot of glare – mainly an issue in the morning when the passenger seat is in the sun.
  • I find the volume knob works backwards to how I would expect.  It’s clearly marked, but I find I operate it wrong sometimes without looking.

Definitely worth the money!

 

pfSense Firewall on an intel NUC

An Intel NUC is a perfect device to use as a pfSense firewall.  Here’s why.

Pros:

  • Low power
  • Quiet
  • Reliable
  • Very small – smaller than most modems / routers!
  • Upgradeable
  • Fast!

Cons:

  • Can be expensive
  • Cheaper models come with Realtek ethernet chipsets, the i3 model comes with Intel chipsets which will work.
  • Only one Ethernet port

To work around the single ethernet port you can use a USB to ethernet adapter.  Apple’s official adapter does work but these are expensive.  However I purchased one off ebay for $9.89 delivered containing the AX88772A (ax88179_178A) chipset – said to be the same that is used in the Apple adapter (and admittedly the adapter does look very similar) which does work.

Update: It might also be possible to purchase the cheapest Intel NUC (currently $195) with DDR3L Ram (~$30) and 2 of the USB ethernet adapters ($20) which will give you a fully featured powerful router for $250.  The only downside being the potentially limited rate of the USB ethernet adapters, but for ADSL connections this should be fine.

Update 2: pfSense have now released a tiny firewall appliance with dual NICs which is a much better solution than any of the above, if you are just a small office.  https://netgate.com/products/sg-1000.html

 

Removing Suggested Apps from your Windows 10 Start Menu

The Windows 10 November update has come with a new setting that (by default) shows suggested apps within your start menu, to encourage you to visit the Microsoft Store.  If this is not to your liking it is possible to disable this feature by following these steps.

  1. Go to your settings app by selecting settings in your start menu, or by typing settings in your search bar.

    snip_20151114131102

  2. Select “Personalisation”

    snip_20151114131133

  3. Select “Start” to find the start menu settings

    snip_20151114131148

  4. Here you will find a toggle for “Occasionally show suggestions in Start”.  Turn this off.

    snip_20151114131214

 

Congratulations!  Your start menu should now be free of suggested apps.