kdmurray.blog

The crossroads of life and tech

XKPasswd – Generate Secure, Memorable Passwords

On the heels of Steve Gibson‘s Password Haystacks website, which demonstrated how long memorable passwords can be far more secure than randomly generated characters simply by virtue of being longer, Bart Busschots has created a new password generation tool called XKPassword.

The idea of the generator is along the same lines of the original generator posted on the GRC website, but has been done as an implementation example of Bart’s perl library xkpasswd — the “xk” being a reference to the xkcd comic which discussed the same subject around the same time as the Security Now episode talking about password haystacks.

The general theory behind haystacks is that you take an easy-to-remember password like monkey (or m0nk3y) and bury it an easy to remember, but very long “haystack” of other characters. The sheer length of the password makes it orders of magnitude harder to guess than the original password.

Example: !@#$1234-Monkey-1234!@#$ and just like that you have created a 24 character password with upper case, lower case, numbers and symbols which (if you look at it for a minute) is going to be really easy to remember — especially if you recycle the “haystack” portion and pair it with other simple words to create a multitude of never-have-to-write-em-down passwords.

So what about xkpasswd? Well the idea is this, the tool will generate for you a list of easy to remember words buried in a haystack of simple padding characters. He has also added a number of presets for things like an Apple ID, WPA2 wi-fi security key and web sites (short and long) in case you do not want to tweak the raft of available options.

It is a great little tool for generating passwords that adds some intelligence that you do not get from the typical random password generators like the ones built into LastPass, 1Password or SuperGenPass. I highly recommend you check out xkpasswd if you are looking to augment your password arsenal. If you are a developer, check out the library available from Bart’s website if you want to include this functionality in an application that you are developing.

One Year Anniversary: Random Image Selector 1.2.0

I can’t believe it’s been one year since the last major release of the random image selector.  Since the plugin’s initial inception last summer it has received a fair amount of attention garnering nearly 11,000 downloads.

Random Image Selector - Downloads Per Day

Random Image Selector - Downloads Per Day

I’m glad that it’s proven useful for people and there will be a major update coming out over the Christmas break to coincide with the WordPress 2.7 release.  This update will include a few bug fixes, a couple of minor feature changes and one significant addition.

Thanks to everyone who has downloaded the plugin, and to those who have left feedback on the blog!

Disable Anonymous Edits in MediaWiki

It didn’t take me forever to find this, but I felt it was simple enough that it bore re-posting.  If you’ve ever wanted to disable anonymous editing of articles in a mediawiki-based wiki (the ones that look & feel like wikipedia…) there’s a simple one-line fix:

In your LocalSettings.php file, add this to the bottom: #Disable Anonymous Editing $wgGroupPermissions['*']['edit'] = false;

It should be noted that this fix is for MediaWiki 1.5 and later. If you want some ideas on additional things that you can do with MediaWiki security, check out the MediaWiki Manual.

How To Slipstream Windows XP SP3

I’ve decided to go with Windows XP for my dual-boot environment on the MacBook.  Partly due to familiarity, but mostly due to the lower resource requirement.

In setting up this new environment, I needed to decide how to cope with my Windows XP disc being an original, pre SP1 disc.  The solution: Slipstream.

Slipstreaming allows you to create a Windows XP CD that has updates like the most current Service Packs.  In this case, I’ll be adding Service Pack 3.

There are lots of guides on how to do the Slipstream process, including these two on HowToHeaven and Invisibill.  These are great step-by-step tutorials that show you everything involved in the process.  But they’re also very manual.

The tool I’ve chosen to go with is nLite.  This slick little application provides the ability to not only Service Pack your XP installation, but apply lots of other custom features as well.  Here are the steps I went through for my Slipstreaming adventure.  (There is also a step-by-step guide on the nLite Website)

Installation Screen ShotStep 1: When running nLite is to show it where the Windows installation is located.  After that, you’ll need to specify a location for nLite to perform it’s magic.  I chose C:slipstream.

Windows Slipstream ScreenshotStep 2: The next phase is to select the options for your installation.  I’m a whole-hog kinda guy, so I elected to go with every option if for no other reason than to browse the options and screens.

Windows Slipstream Screenshot

Step 3: Pick your Service Pack.  Once you’ve selected a service pack and applied it, nLite will perform the Slipstream operation and integrate the service pack.

Windows Slipstream ScreenshotStep 4: Updates & Hotfixes.  The more that you can download and apply here, the fewer there will be to apply once the windows installation is completed.

Windows Slipstream ScreenshotStep 5: Select components to remove.  nLite gives you the opportunity to eliminate components from the final installation.  This can lighten not only the ISO, but also the final installation.  Beware removing too many options.  By eliminating support for hardware or drivers the usage of the installation will become more limited.  However, if you have a specific application in mind it can help to streamline the process.

Step 6: Unattended Install. The next screen provides the ability to streamline the installation for a smooth unattended install.  If you want to use this option, you’ll need your Windows XP CD key at this stage.

Step 7: Installer Options. This screen allows you to customize some of the behaviours of the installation process including boot-time messages and BIOS backup retention.  If you don’t understand an option, take the default.

Windows Slipstream ScreenshotStep 8: Tweaks. Wow.  This section has dozens upon dozens of options to tweak and adjust virtually every major setting in Windows.  And a whole bunch that aren’t so major.  Take your time with this and make sure to read the little captions for each option.  There are so many possibilities.

Step 9: Integrate all the changes.  nLite will begin to create the installation image, merging together all the changes you’ve selected.  This process will take quite a while.  On my machine it took about 10 minutes.

Windows Slipstream ScreenshotStep 10: Burn the ISO.  Set any last settings you want for the ISO, and click the Create ISO button to start writing the image.  Once the image is written, it can be installed to a VM (VMWare/VirtualServer) or burned to a disk for installation at a later time.

WordPress 2.6 – Restore the “Add Image” button

During the recent upgrade to WP 2.6 I noticed that the old “Add Image” button was missing.  This is something I use quite a bit because it’s quick and simple.  Call me old fashioned, but I don’t particularly care for the new Media-bar uploader.

After some searching on Google and the WordPress.org forums, I came across a relatively easy fix.  To restore this button, and add a few others, you can install the TinyMCE Advanced plugin.  TinyMCE is the editor that’s built in to WordPress’ visual editor.

Once the plugin is added, all the functionality you had before will be restored, along with a ton of cool new neato features!

Command Line 101 – Windows: Backup, Remote Desktop and More

I’ve been working on some things for work recently which have me deeply buried in the Windows command line again, both writing applications and scripting/automating actions against various systems on our network.

Backup your Files to a Remote Computer

One of the things we all need to do is keep backups of our data.  It’s easy enough to re-install your OS and all your apps, but if your system dies and you lose your data, the results can be heartbreaking to say the least.  So be proactive and schedule yourself a backup using xcopy.

xcopy "c:documents and settings<username>My Documents" "f:<username>" /C /D /E /H /Y

So lets examine what this does.  Normally the copy command can only copy single files, and doesn’t handle large file structures very gracefully. This is where xcopy steps up to fill the void.

  • /C — Continue to perform the backup even if an error is encountered (like a file that’s currently open/locked by another program)
  • /D — Copy only files which are newer than the ones on the destination drive (Don’t copy that 1.2GB movie file that you backed up last week)
  • /E — Copy all files and sub-directories under the one you’ve selected including empty ones (To exclude empty directories, use /S instead)
  • /H — Copy Hidden and System files (use this to make sure you catch those thumbs.db files that hold thumbnail caches for your pictures)
  • /Y — Automatically override destination files without prompting

Get a list of all your MP3 files (or anything else!)

Once in a while you may want to generate a list of files from your system.  This isn’t always an easy thing to do, particularly if those files are buried in a large series of well-organized subfolders.  But there is a way.

dir /B /S "c:documents and settings<username>my music*.mp3" > "c:documents and settings<username>my documentsAllMyMusic.txt"

The dir command is used to get a list of files and typically display it to the screen.  By changing where the output of the command goes using the greater-than (>) symbol you can print the output of the dir command (or any other command for that matter) to a file.

  • /B — Show a bare directory listing, files only no other information or headers
  • /S — Recurse through sub-directories to find all instances that match

In this case we set the search up to look through the My Music folder.  If you had already pointed your command prompt to the location you wanted, you could leave off the folder location, and just use a file string (.mp3, *.doc, DSCN.jpg) to search for the files you want.

Find out who’s logged in

This tip is aimed squarely at administrators that would like to know who (if anyone) is connected to a given computer.  If that computer is running Windows XP, Windows Server 2003 or a later OS this can be discovered by way of a couple of Terminal Services commands.

qwinsta /server:<hostname or IP address>

This will return a list of user IDs and will also indicate which session they’re connected to.  The console session (session 0) is the physical UI of the server.  That means that a person who is using the console session may in fact be in physical contact with the system (they may not too, as this access can be achieved remotely as well).  Session IDs higher than 0 indicate a connection using a MS Terminal Services client (mstsc).

If a user is connected to a computer, but has simply left the session disconnected (consider this an un-tidied session that’s no longer wanted.

If you find that you want to terminate a user’s session, this can be acheived through another command:

rwinsta /server:<hostname or IP address> [0|1|2|...|n]

By entering the name of the server, and the numeric session ID you can forcibly terminate a user’s session.  This can be much easier than trying to attempt a reboot of the server… particularly if the server is providing other services on your network.

So there you go, a few quick command line tips to help you become more productive with the Windows command line.

Mac Lab Rat – GGP #083 :: Be Verwi Verwi Quiet

It seems like forever since I’ve been behind the mic recording my very own segment for the podcast.  But sure enough, here I am.

fseventer First off this week is a tool from FernLightning called fseventer.  This app gives you new visibility into just what files on your hard drive are modified by the tools you use every day.  It was quite remarkable to me to start fseventer and just allow it to run while I wasn’t using the computer.  In a matter of seconds my “idle” computer had performed dozens of operations and written to lots of files.

The tool presents the information in a variety of ways not the least of which is the uber-cool tree view.  This app seems to do a pretty good job of finding all of the changed files, but I haven’t tried doing ay specific research with the tool.

Warp Warp is an application that uses mouse gestures to control switching between your OS X Spaces.  I realize that I’ve been on the anti-mouse bandwagon for some time now, but some things are so slow and unproductive that you can fix them with mouse gestures.

The application installs an OS X preference pane to control Warp which is tied to the existing Spaces panel.  When you activate warp it also verifies to ensure that Spaces is active.

Warp is a great shortcut for those who use the mouse alot and don’t want to memorize keyboard shortcut; or for those who simply prefer shudder to use the mouse.

Download Warp by Kent Sutherland.

Teleport If you’ve ever wanted a great way to control multiple macs in your house from one keyboard & mouse the AbysSoft‘s Teleport just might be the solution you’ve been looking for.  This gives you much of the same functionality that you’d get from using a KVM switch, but without the unnecessary hardware.

Teleport provides a single interface for controlling other Macs that have teleport installed.  In some ways it behaves like Spaces, but with each space being a separate physical machine.  I really wish I’d had a chance to try this one, but with only the one Mac in the house, that makes things a bit difficult.

Teleport a great way to make use of existing network infrastructure to reduce your cable load and make your digital life that much easier.

Licensed This next application is one that should be in everyone’s utility toolbox.  Licensed by Amar Sagoo is designed to one things, and one thing only: keep track of your software licesnses.  Licensed has a quick to learn and easy to use UI and takes no time to learn

Licensed falls into the category of tools that most good freeware and open-source applcations are famous for: simple applications that do what they say they will.

One thing I would suggest is a prompt on the delete button.  Not a big deal, but usually a good practise to avoid accidental loss of data.

Front Row “Remote Control” Last up this week is Bert Ramakers’ software-based Front-Row remote.  This app allows you to control Front-Row over the network on other machines that are Front-Row enabled (Tiger and later).

It’s not clear whether this application will work with other applicances like the Apple TV, but its a creative remoting solution nonetheless.

Thats it for me this week.  Due to the trouble with the TPN servers there will be no show again this weekend, but we’ll have another one out as soon as life and fate permits.

http://bertramakers.com/?page_id=19

Virus Hunting — Avast + Unlocker

After a somewhat brief Aikido class tonight I was enlisted by Crow to help rid a Vista machine of the Vundo trojan which found it’s way onto the machine (prior to Avast being installed).

Avast did a great job of finding most things and cleaning them up.  What it had trouble with was a few DLLs that were in use by the executing trojan.  I was pointed toward Unlocker to free the DLL’s of their executing process and remove the lock that windows places on these files.  Once the file was unlocked, it was able to be deleted by Avast and all was well.

(Photo Credit: bigux on Flickr)

Endless Options: The Redesign Begins

I’ve been contemplating an update to the look of the blog for several months now.  I know it’s only had the current incarnation since the summer, but I’ve always liked things to feel new and fresh.

The trouble had been finding the right WP theme.  Many of the ones I like visually didn’t have enough support for gadgetry & widgetry.  Being the geek that I am, this is something I prize.  Secondly, and more importantly to some, I wanted a theme that would actually pass XHTML validation and be a bit less of an SEO roadblock (that, and I’m a bit of a perfectionist geek).

I found, though a fortuitous series of bounces the Options theme by JustinTadlock. XHTML compliant, full of widgetable sections and completely customizable through CSS.  Perfect.  Now I just have to get some help with the design work… ’cause I suck.

Admin Links Widget for WordPress 1.1.0 Released

Well after a far more successful 2007 than I could have imagined, I’ve released the first significant feature update to the Admin Links Widget.

First, THANK YOU to everyone who has downloaded the widget.  It has been downloaded an astonishing 2300 times since the inaugural release on August 14th of last year.

The most significant changes for this version are the addition of two new links that you can add to your site:

  1. Edit This Post
  2. Edit This Page

These links provide you the opportunity to edit a specific page or post from a link in the sidebar whenever you’re viewing a single page or post (ie not the front-page, or a search result).  This is particularly useful for blogs which don’t have an edit link built into their current theme.

Please take a moment and download the latest version of the plugin from the WordPress plugin repository.  And as always, if you have any feedback, please don’t hesitate to leave a comment on the blog.