Edwin van Nuil

WPA2 Enterprise with 802.1x / EAP-TTLS

Recently I decided to upgrade my wireless network at home. My current setup is a pfsense firewall and a airport extreme accesspoint.

For my new Wireless LAN I decided to implement WPA2 Enterprise with EAP-TTLS and a radius backend.

From the wiki entry of EAP-TTLS:

"EAP-TTLS offers very good security. The client does not need be authenticated via a CA-signed PKI certificate to the server, but only the server to the client. This greatly simplifies the setup procedure as a certificate does not need to be installed on every client."

First I describe the installation of the freeRADIUS server and the configuration of the Airport Extreme. Next the client configuration on OS/X Leopard and finally the installation of a EAP client for windows that supports TTLS on Windows XP/Vista.

Using VMWare Server 2.0 Remote Console Add-on on OS/X

VMWare released the 2.0 server edition last month; so I installed it this week on my test server. This server is a Ubuntu 8.04.1 machine. I already had a VMWare server 1.x running and the upgrade went well.

Using Firefox 3.0.1 to admin the server also works very nice and in the same way as our ESX server. If I click on the Console tab under Firefox on Ubuntu it installs a Firefox add-on the first time. After that I have a standalone Remote Console.

But when I connect to the VMWare server from my Mac using Firefox I can use all the functions except the Remote Console Add-on. Firefox tries to install it but fails because the package isn't compatible with OS/X.

In the VMWare forums I read that there are rumors that VMWare is developing a native OS/X client, but in the mean time this is how I connect to the VMWare server from my Macbook Pro:

ssh -X -f -q $SERVERIP /home/nuil/.mozilla/firefox/xxxxxxxx.default/extensions/VMwareVMRC@vmware.com/plugins/vmware-vmrc -h "127.0.0.1:443"

where $SERVERIP is the IP address of the VMWare server and the xxxxxxxx is the profile id of your local Firefox on the Ubuntu server. On my configuration I use port 443, but on a default installation it is port 8333.

For this to work you must have X11 installed on your Mac.

Bandwidth Throttling on OS/X

The following code is a easy way to do Traffic shaping or Bandwidth throttling on OS/X. These are functions of the build-in firewall ipfw in OS/X. With this rule you create a 24 KByte/s pipe:

sudo ipfw pipe 1 config bw 24KByte/s

then attach the pipe to a rule, ie all http (80) traffic:

sudo ipfw add 1 pipe 1 src-port 80

After you are done delete the pipe to gain normal speed:

sudo ipfw delete 1

A way to find the current DHCP server on OS/X

I was network debugging and was looking for the ip address of the DHCP server and then found this handy command:

ipconfig getpacket en0

This only works on OS/X.

Ubuntu 8.04 LTS and JDK / Netbeans 6.1

When trying to install Netbeans 6.1 on my Ubuntu workstation the installation window would freeze. After some searching I first tried this:

export LIBXCB_ALLOW_SLOPPY_LOCK=true

But that didn't solve my problem; then I decided to turn off the Visual Effects (System > Preferences > Appearance > Visual Effects => none) and it installed just fine.

Also note that you're using the right java version, the official from sun:

nuil@Solaris:~$ java -version
java version "1.6.0_06"
Java(TM) SE Runtime Environment (build 1.6.0_06-b02)
Java HotSpot(TM) 64-Bit Server VM (build 10.0-b22, mixed mode)

otherwise install the sun version:

sudo apt-get install sun-java6-jdk
sudo update-java-alternatives -s java-6-sun

Compiling Openvpn on OS/X Leopard

We use OpenVPN a lot. In the Tiger days I used Tunnelblick and everything was fine. But now in the Leopard days things are less than optimal. Tunnelblick crashes a lot, isn't updated in a while and gave al sorts of routing problems.

So I decided to compile the latest and greatest from source and start the VPN connection from the Terminal. Although I miss the visual indicator this works very well at the moment. Maybe I make a GUI frontend in the future but for now I can connect steady to our servers.

Yubico's Yubikey

Received my Yubikeys from Yubico last week. I was listening to the Security Now podcast and heard Steve Gibson telling about this product. I went direct to the website and ordered two. I downloaded the C library and received the AES key from Simon Josefsson. Now I'm making my own verification server. This way it's very easy to add strong authentication to our applications.

Getting Nessus running on Mac OS/X Leopard

Today I wanted to install nessus on my Macbook Pro using MacPorts on Leopard. But I got the following error:

libtool: warning: cannot infer operation mode from `/usr/bin/gcc-4.0'
libtool: you must specify a MODE
Try `libtool --help' for more information.
make[1]: *** [plugutils.o] Error 1
make: *** [all] Error 2

I'm running OS/X 10.5.2 with MacPorts 1.600. After some Googling I found the following bug report: http://trac.macports.org/ticket/14429 titled "nessus-libraries build failed (libtool error)". And in the comments there was the fix: I had to edit the Portfile and add the following line:

"configure.cc    gcc"

I made changes to the following files in the directory "/opt/local/var/macports/sources/rsync.macports.org/release/ports/net/":
libnasl/Portfile
nessus-libraries/Portfile
nessus-core/Portfile


After these changes it compiled and installed fine:

polaris:bin nuil$ sudo port install nessus-core

[...]

polaris:bin nuil$ nessus --version
nessus (Nessus) 2.2.6 for Darwin

(C) 1998 - 2003 Renaud Deraison 
	SSL used for client - server communication

Adding a LVM volume

Our fileserver needed some room for VMWare images. So I needed to add an LVM volume. Martijn came to the rescue and because there was a lot of free space on the server we only needed to add a volume and didn't need to resize another volume.

Scripting with RubyOSA

Scripting with RubyOSA:
MacZealots: “RubyOSA is a bridge from the Ruby language to the Apple Event Manager. The Apple Event Manger allows applications to send and receive messages, or Apple events as they are called, to and from applications that support scripting.”

In other words, you can use Ruby instead of AppleScript. Cool.

Side note: I haven’t looked to see if it’s an actual OSA component or not. It probably doesn’t have to be—because who cares if it compiles and runs in Script Editor or not. But, for anyone interested in OSA components, years ago I posted OSAShell, a basic OSA component demo.