Getting an A+ on SSL Labs Report

October 31st, 2019

blog.stevedoria.net received an A+ overall rating from Qualys SSL Labs.

utmpdump: Dump UTMP and WTMP Files in Raw Format

October 29th, 2019

Login attempts can be tracked in real time with the following command:

/bin/utmpdump -f /var/log/btmp

I received a Logwatch email reporting a “corruption detected in /var/log/btmp : XX time(s)” issue. By performing an Internet search for the reported issue, I found Gabriel Cánepa’s How to Monitor User Login History on CentOS with utmpdump. Cánepa describes utmpdump in depth and the fields in each utmpdump line entry.

The eight fields emitted by utmpdump are:

  1. session identifier
  2. PID
  3. “~~” (runlevel change) | “bw” (bootwait process) | TTY | PTY
  4. empty | username | reboot | runlevel
  5. TTY | PTY
  6. remote hostname | kernel version
  7. remote IP address
  8. timestamp

Making Your Grass the Greenest

October 6th, 2019

Sometime around November 2005, I stumbled upon Scott Berkun’s Essay #41 – Why I Left Microsoft. At the time, I felt inspired by his courage of leaving an environment where he acquired tenure as a program manager for the Internet Explorer web browser project. In his essay, Scott Berkun writes:

So I chose to leave Microsoft less for reasons of escaping a particular place or group of people, but more to seek out a new set of circumstances to live in. Just like I sought out Microsoft to escape my fears of the post-college emptiness, I looked to leave Microsoft to create not a void, but a new space to grow in: one of my own choosing. I ran to Microsoft to escape my fears of failure. I left Microsoft to define my own idea of success.

Like Berkun, there have been times where I was concerned about becoming a “sad, confused bird of prey, circling the same territory over and over again, never understanding why there was nothing new to find.” I am fortunate enough to consistently find or receive opportunities to overcome new and interesting challenges at my current company. Some projects have been tedious and required little innovation beyond skills gained for certifications. Although such projects did not enhance my technical capability, they developed my patience and persistence. I am now working on a project that requires new programming languages, techniques, and paradigms. I am glad to not be circling the same territory. I am finding excitement in helping my current company expand. Maybe the grass is currently arguably greener at other companies, but I feel there is an opportunity for and the possibility of experiencing the achievement of the greenest grass at my current company. Unless a company is disinterested in growth, with sufficient drive and personal motivation this opportunity can be made available at any company.

Personal Password Policies

September 28th, 2019
Posted in Security | No Comments

Need secure passwords that are not completely unintelligible? Devise a personal password policy:

  1. Select three or four words from a dictionary. Consider using adverbial forms, past and present tense of verbs. Consider using singular and plural forms of nouns. Avoid idioms.
  2. Pick a number. Consider inserting leading 0s.
  3. Pick a symbol: !@#$%^&*()-_=+
  4. Assemble the above elements with arbitrary rules, for example:
    1. Capitalize 1st letter of each word and leave others lowercase.
    2. Insert symbol somewhere between words, or before the first or after the last word.
    3. Do the same with the number.

Passwords from the generator featured on this page are magnitudes stronger than those similar to '3l337p@s5w0rD,' and they are easier to type!

Password Generator

Password:
Length:

Securing Dynamically Generated HTML

September 22nd, 2019
Posted in Security | No Comments

Implementing code that simply displays a user’s IP address as part of an HTML page may be considered easy. Without security considerations, it can be implemented in PHP simply with the following:

    echo "IP: " . $_SERVER['REMOTE_ADDR'];

2011 CWE/SANS Top 25: Monster Mitigations recommends establishing and maintaining “control over all your inputs” and “control over all of your outputs.” Since the IP address is output as part of an HTML page, the code is more securely implemented as follows:

    $ipAddrRemote = $_SERVER['REMOTE_ADDR'];
    if(my_is_ipaddr_valid($ipAddrRemote)) {
      $ipAddrEncoded = my_htmlencode($ipAddrRemote);
      "IP: ${ipAddrEncoded}";
    }

The remote IP address is retrieved from the global $_SERVER variable for validation then use. The validated address is encoded before it is used in the output HTML.

The difficulty of selecting appropriate validation and encoding functions is conveniently abstracted away here by user-defined functions: my_is_ipaddr_valid() and my_htmlencode(). The two code samples above demonstrate differences in effort between naive and secure implementations.