THIS IS BSD

Why BSD is dying ?

See the answer (quite old, but still good)

Preshared key exchange

I have to exchange many sensible data with some partners. They are international phone companies.
But, no one knows about public/private key pairs, nor PGP/GPG.
All VPNs I set up are using PSK, no X.509 certificates.
Event gpg data are encrypted using symetric keys.
If someone knows why ?

Video, Video and Video

New projects are quite exciting. I am building full Video solutions for customers. Now, I am diving into DRM, Flash movies, H.264 and so on.

It is very interesting. If you are interested in, check Wowza Media server (www.wowzamedia.com) as a Flash Server (well, for openSource gurus, check Red5 :-) )

More to come ....

That is really fun (and scary)

Hacking a keyboard ? Yes it is possible:
http://www.dailymotion.com/video/x74iq0_compromising-electromagnetic-emanat_tech

New job, new life

I started a new job last week.
I spent more than three years driving security projects. I am now using things I developped.
Things are sometimes funny ....

About phones

Hi all.

Using SJPhone, I have found a serious drawback. It is not capable of using my SIP freephonie.net account through a nat'ed router. Too bad.

Last week, my SIP hard phone failed to get a carrier. I used my soft phone to make calls. X-Lite works like a charm using my freebox in router mode. SJPhone not.

I am not sure it is only a SJPhone problem, because it works with voxalot, pulver.com. So ?

In fact, the only thing I am sure, it is that you always must test any VoIP equipment (phone, router, SBC, firewall, ...) deeply before adopting it.

The VoIP protocols are so complex that between two architecture, there is probably something that is not supported :-)

VoIP is so exciting

Back to VoIP testing.

I (re)tested SJPhone 1.65 at home. It is a very good softphone.

But it has a annoying drawback: it can only register to one account at a time. I currently have freephonie.net, VoXaLot (eu), and FreeWorldDialup account. I only can register one !

So, I cannot use my enum number if I am always (almost always) registered through FWD. Too bad.

I tried gtalk, but it cannot send Video (works fine with audio, but my friends tell audio quality is worst than skype).

The solution is a Linux one (but I have not tested it yet): Ekiga. Multiple account registration, video, audio, SIP+H323 ! wonderful. But I do not use Linux at home (FreeBSD or Windows ...)

So, the ultimate solution is an Asterisk SOHO box dedicated to VoIP management.

I received an email (through sip-implementors ML) which announce pingtel opens a new SIP testing PBX gateway. Good thing. Not only for SIP implementors, but also for Security developer who needs to check that their control are not too rigorous. Good initiative.

Centralized private music server

I was looking for a personal music server.

I have my own MP3 (ripped from MY CD). I wanted to listen from my work computer, or at home.

I searched for a simple solution... and I found it:

sockso. This little server has a web interface, with a flash embedded (or not) music player, and support for M3U playlists access.

I tried it for a week, and it works fine (unless some minor problems with UTF-8 and ISO8859-1 accent character in song filename).

http://sockso.pu-gh.com/

Web Review : 15/05/2008

25 years to fix a bug ?

yes it is possible: http://www.osnews.com/story/19731

A (french ?) postfix manager: http://www.artica.fr/index.php

It looks good ! especially if you do not want to spend hours to configure manually postifx, fetchmail and so on.

I prefer my own configuration, but I admit that sometimes, 10 minutes setup is good ;-)

FreeBSD vs Linux

Good troll ...



then ...

FreeBSD tip

Because I spent more than 5 minutes wondering why portsnap does not work correctly, I prefer to write the tip for anyone.

If you want to launch 'portsnap fetch' through an authenticated proxy, do not use:

HTTP_PROXY=http://user:passwd@ip:port/

but use

HTTP_PROXY=http://ip:port/

and

HTTP_PROXY_AUTH=basic:*:user:passwd

in your environment.

Stop global warming

I didn't know that link. One of my friend added it to its blog:
http://www.blueman.com/land/archive/earth/

Great !!


(while reading my mailbox, i read that: Quarterly VoIP vulnerability summary
You may discover that:
- old Cisco 7940/7960 phones still have security issues
- recent phones (snom ...) still have big security issues ..

I am afraid by the situation ;-)
)

Web Review : 14/04/2008

Almost one month from my last web review. I was very busy building my house :-)

So, what are the coolest project I have found:

- MathGL : something nice. It allows to generate nice graph, in 2D, 3D. The most interesting feature (well, not the most, but an interesting feature, sure) is the MGL scripting language, which allow a shell script to generate a JPG/EPS/SVG/PNG/anyOtherFormat graphic. [http://mathgl.sourceforge.net/index.html]

- GreenSQL : it may be very interesting for security. It is a MySQL application level gateway. It does for MySQL what a web filtering proxy do for HTTP. I took a look at the demo. If it work as presented, It is a very interesting project ! [http://www.greensql.net/]

- Because security is only a protection, you have to make backups. And if possible, automatic backup. This project seems to do the right job, local or network (through ssh).. zbackup-mysql [http://www.zmanda.com/backup-mysql.html]

- On a previous post, I talk about insecurity of VoIP clear voice stream. Give someone Dtmf2num, and dial your bank count access code with your prefered VoIP phone. You may be surprised ;-) dtmf2num

- Two of my friends will be very interested by the following: SMART [http://smart.conformix.com/]. This is a tool to manager security policy and its associated workflow. It looks cute ... (as long as security is cute ...)

- For those who are developing cross application (by cross, I mean Linux/Window*), check that: I'm a cross .... You should enjoy this one !

That's all folks !!

Remote access

Well... I crashed a second hard disk (yes, the second in about 15 days ...).
I reinstalled completely my system.

I used to access my system through several vpns and DMZ: an IPsec to a DMZ server, from which I connect to my system through an SSH tunnel (encapsulated into the IPSec one).
I tried X11 forwarding through SSH, works fine ...
But I tried today NX server (from NoMachine). Incredible. Almost local speed screen...
Yeah !
Through SSH ...

This is not very simple to install (DO NOT INSTALL IT THROUGH SUDO !), but once installed, it works fine, and quick !

For teleworkers on Unix station, this is definitely a MUST HAVE...

Web Review : 13/03/2008

I have tested a "small" discovery application last week: It is called "Scenari". Fabulous ! It is used to build a publishing chain and to deliver multi format document. I tried the CV module, which deliver OpenOffice documents, PDF and HTML documents.
Very simple, a real ease of use. Next step for me is to try the creation of a new template... Not easy ? not sure ... I will keep you informed. The link => http://scenari-platform.org/projects/scenari/en/pres/co/.
Try the Scenari Discovery application.

Web Review : 28/02/2008

For those who knows VOMIT (Voice Over Misconfigured Internet Telephones), take a read at RTP Break. I have not enough time to test it by myself, but if it does all that is written, It should be ... hum .. .quite interesting ! => http://xenion.antifork.org/rtpbreak/


But (for me) the most important new today is "FreeBSD 7.0 RELEASED" !! http://www.freebsd.org/releases/7.0R/announce.html

Web Review : 21/02/2008

I spent some time reading publikations located at http://www.snocer.org/. It is very interesting. It is about VoIP security.

Web Review : 18/02/2008

I got a link to a pretty good Firefox extension: gridfox, which enables "grid display".
The link : http://www.puidokas.com/portfolio/gridfox/

Another good thing to try: MysqlFS, a FUSE Mysql filesystem backend. Take a look at: http://www.linux.com/feature/127055. For those how installed apache webservers, It worth reading that.

Yes, it is a kind of security

Just take a look at: Five fun ways to use a Linux webcam, especially to ZoneMinder.

Web Review : 13/02/2008

One of my friend sent me a good article on "Who Invented the Firewall ?"
For me, I consider that M.J. Ranum is the father of firewalling as we know it today.
I have worked for 7 years on *-gw proxies, then on *-pdk (for those who know). I rewrote smap/smapd, improved http-pdk and so on.
Until now, I am still working on a firewall software editor, and MJ Ranum concepts are still up to date. I do not say that other were not doing security, but who could say "packet filtering module is a firewall module" ?
Using authentication daemon of TIS you can add a usefull value to security: "who is doing what ?"
Today, firewalling, as I can see, is not as good as it could be.
The ultimate firewall solution should be a description not of host using ports, but users using services.
It is easier to tell: "allow Alice to contact Bob over XMPP" than "allow from 10.0.0.1 to bob.domain.tld port 5222 keep-state"
NuFW/EdenWall seems great for this. It is not a finished project yet, compared with some great closed products, but the right idea is here.

During my web review, I have seen the following announce: SignServer project 4.0 is released. http://www.signserver.org/. It looks very interesting. And it shows me that apache project as its own mail server ?! James ... googlize it !

(Last week was very rich !!)
This is a interesting post about FreeBSD 4->5->6->7 releases, and why some of Linux gurus are telling "FreeBSD sucks". Well, I do not want to say that "FreeBSD is better than Linux" or "Linux is a *BSD killer" (but it is not :-). Take a look at Truth on FreeBSD 5.x releases". I am very proud of FreeBSD developers, because I love FreeBSD, much more than the hundreds of Linux distros. And Explanations given here are the real world on project management. I encountered almost every day at my own job !


Some fun: http://icanhascheezburger.com/

VoIP security news:
Sipera 5 threats in 2008: VoIP Security Threat Predictions
Let's see....