Homeless Man Saves Police Officer

this is awesome. i think the most awesome part is the hobo who rushes to the cop’s aid is a crip gangster who obviously by looking at him and his mannerisms/vocab spent more of his life in prison than on the streets heh.

i had this dude try to stab me this summer for not letting him use my cell phone (not because i refused, but because it was broken and wouldn’t dial out) and this homeless dude (well, i was/am homeless too lolol) curly smashed him out with a metal water bottle and got him to chase him up the block to the satellite where he threw him through the window.

the cops said all the street kids were heroes that night. curly had gotten a sit/stand/lie citation two hours before he saved my life lol. these are the stories not told by the mainstream media because being afraid of your neighbor makes so much better copy and grabs so many more eyeballs than the truth. :p

#streetstories #homeless

Bypassing the Sim Lock Setup Wizard Failure on Verizon Samsung S SCH-1405

I fucking hate so very very much how the carriers keep trying as hard as they possibly can to lock consumers out of hardware that they have rightfully purchased. Had a friend who got a broken Verizon Samsung S without a SIM or SDcard.

Select English as your language, or Espanol if you prefer lol.
You will be presented with a notice that Setup Wizard cannot continue without a SIM card – select Emergency Dialer

Dial this and it should bring you to the main screen – bypassing the requirement to

*#83786633

which happens to be *#TESTMODE if that makes it easier to remember!

Setting up Win2k8R2 Enterprise Cloud Instance Standalone

When we first log into the local administrator account, we are presented with a wizard that I believe is more than half useless. The only thing that I use it for is to enable automatic updates, and then I click ‘Do Not Show This on Login’ and kill it forever with fire. Then we are presented with this:

Unpin the bullshit from the start menu (Like anyone seriously will use PowerShell or Server Manager ever let alone on a regular enough basis to have it on my quicklaunch lolol) and we will be even more clean/minimalistic:

At this point in time, Windows already wants us to restart to install critical updates which means it will not allow for us to dcpromo at this point, so now is a good time to reset our Local Administrator password to something not assigned by the vendor:

The Remote Desktop session will drop, and then go make a cup of coffee or something because it takes a minute to come back up.

Now once you kill Server Manager one more time (even though we said last time for it to die forever) and acknowledge that Windows has installed updates – look how clean our interface is!

Use Win + R to run dcpromo:

After a bit of the most fun part of Windows systems administration (waiting for progress bars) you are thrown into the Active Directory Domain Services Installation Wizard:

The scope of this howto is to create a standalone minimal domain controller/terminal services box that (in the ideal/corporate/best-practice/you have more than $20 world – you never would mix. Domain Controllers are supposed to only be Domain Controllers. Assuming we don’t have retarded administrators it shouldn’t be too big of a deal even if we do have to scale up later on. So we are going to create a new forest/domain:

It is very important if you actually plan on having shit work right that we use a real FQDN:

Considering we do not have to worry about any DCs pre-2k8R2 – select 2k8R2 functional equivalency:

Ensure you don’t do something retarded like disable DNS on a domain controller lol, click next:

Unless you are super pro and have already set up a delegation for this DC, you probably will get a popup saying that you cannot delegate DNS. Continue:

You probably would be dumb if you changed these defaults. Continue:

Now we are prompted for a Directory Services Restore password which I always set to be the same as the Domain Administrator password:

Here we are prompted with a summary. Continue:

Check the box that says “Reboot upon Completion” and go make another cup of coffee or grab a beer.

Now we want to login with domain credentials forever and ever and ever unless shit gets really broken and it is all our fault… so the way with which you do this is typing the domain name\username

in my instance it is wecansolve.org\Administrator

We are again greeted by the stupid fucking Server Manager thing, so make it go away. Now here we are again with a clean interface:

Invoke Active Directory Users and Computers:

We are greeted with the particulars for the Domain we have just created. The first step is to add folders to contain Domain Objects. Why do we use folders? If we install unique domain info into the system default locations – there is no way to differentiate between objects we have added/modified versus those that are default at this point/known good state.

So expand the domain and create a new OU to contain users with Domain Administrator credentials. Trust me, this becomes very *very* important later on when scaling and ensuring account policies are consistent throughout the organization. Never just grant admin privileges to a user without changing them to an administrative OU. It would really suck to have someone go around breaking shit they shouldn’t later on because you were lazy and lacked foresight:

Name the new OU appropriately so anyone will know at a glance that this is the OU that users with Domain Administrator credentials are located within:

Duplicate this step to create a container for Domain Users:

Now it is time to create ourselves a Domain Administrator account, as logging in as a Domain Administrator on Windows is a lot like running as root – not only do you not *need* to do it pretty much ever, it pretty much never is a good idea unless your credentials are somehow broken to the point where that is the least of your concerns. The only exception to this rule is when we do not have any other Domain Administrators as we are fresh out of the box, ergo, vis a vis – right now. The quickest way to create a new user is to right click inside the OU we just created:

You always want to be as precise as possible with user information in Windows domains as you never know if your entity will become the next Facebook or some shit. You might have a dozen John Smiths at some point and really want to punch yourself in the balls for not adding initials to user accounts until duplicates crop up:

Uncheck all this crap as you are adding the user for yourself. When setting temporary passwords for users that you want to expire upon first login – it is best to ensure these single use passwords are still very secure instead of something dumb like LogMeIn! You also should not use the same initial credentials for separate users because even if it was a short period of time, it is easy for rogue employees (the worst possible ‘hacker’ scenario) to hijack accounts simply by knowing the names of new hires:

Now we need to change the properties of the user we have just created to add fields not present in the wizard we just completed, and to add ourselves to the appropriate administrative groups. Right click for properties:

Add the relevant contact information for yourself. Make sure that every time you make changes on any pane in Active Directory Users and Computers that you click Apply:

Now we need to add this user to two groups – the Domain Administrators and Remote Desktop Users groups. Click Add:

Use a semicolon between Usernames or Groups and what Windows calls Builtin Security Principals:

Click ‘Check Names’ and they should be underlined:

Then ensure that you click OK and Apply:

Now you should be able to log in as the Domain Administrator account you have just created. Stay tuned for more in this series on configuring Windows Server in Cloud environments.

Setting up BIND 9 on FreeBSD 9.1 as Master with Dynamic Updates

Now we need to configure BIND9 for the master nameserver of our domain. The first step is to start the service so a rndc key is generated:

[phocking@qryr ~]$ sudo service named onestart
wrote key file “/var/named/etc/namedb/rndc.key”
Starting named.

Now let’s cd to the /etc/namedb directory as we have a few things to edit here, and I like typing as little as possible (believe it or not!)

[phocking@qryr ~]$ cd /etc/namedb

Generate public/private keypair for our zone:

[phocking@qryr /etc/namedb]$ sudo mkdir keys
[phocking@qryr /etc/namedb]$ cd keys

[phocking@qryr /etc/namedb/keys]$ sudo dnssec-keygen -b 512 -a HMAC-MD5 -v 2 -n HOST ns1.wecansolve.org
Kns1.wecansolve.org.+157+28408

Now copy the key itself to the clipboard – the part you should highlight is italicized:

[phocking@qryr /etc/namedb/keys]$ sudo cat Kns1.wecansolve.org.+…+….private
Private-key-format: v1.3
Algorithm: 157 (HMAC_MD5)
Key: k8caOu.-.-.-.-.-awvgie+A1agaEWmuc.-.-.-.-.-rodJSGrZ+uAmxmeqrk-.-.-.-.-.XXAcWX8x2pc5g==

Setting up FreeBSD 9.1 Cloud Server Instance – Initial Configuration Tasks

After having our Cloud Server instance provisioned, it is time to perform the initial configuration tasks. Now remember FreeBSD by default will not accept SSH sessions from the root user, so the username that RootBSD assigns to you and that is visible in your control panel is necessary to su to the root user. In this particular instance – they picked my first name as a username which is not the one I would have selected. This is how I nip that issue in the bud right quick:

phocking@bt:~$ ssh phillip@199.48.128.154

The authenticity of host ‘199.48.128.154 (199.48.128.154)’ can’t be established.

RSA key fingerprint is 50:45:19:66:61:46:40:1f:4f:1e:41:5a:3d:98:d2:90.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘199.48.128.154’ (RSA) to the list of known hosts.
Password:
FreeBSD 9.1-RELEASE (GENERIC) #0 r243826: Tue Dec 4 06:55:39 UTC 2012

Welcome to FreeBSD!

Before seeking technical support, please use the following resources:

o Security advisories and updated errata information for all releases are
at http://www.FreeBSD.org/releases/ – always consult the ERRATA section
for your release first as it’s updated frequently.

o The Handbook and FAQ documents are at http://www.FreeBSD.org/ and,
along with the mailing lists, can be searched by going to
http://www.FreeBSD.org/search/. If the doc package has been installed
(or fetched via pkg_add -r lang-freebsd-doc, where lang is the
2-letter language code, e.g. en), they are also available formatted
in /usr/local/share/doc/freebsd.

If you still have a question or problem, please take the output of
`uname -a’, along with any relevant error messages, and email it
as a question to the questions@FreeBSD.org mailing list. If you are
unfamiliar with FreeBSD’s directory layout, please refer to the hier(7)
manual page. If you are not familiar with manual pages, type `man man’.

Edit /etc/motd to change this login announcement.

$ su
Password:
You have mail.

Our first task is to ensure that we set the root password to a known value:
root@qryr:/usr/home/phillip # passwd
Changing local password for root
New Password:
Retype New Password:
root@qryr:/usr/home/phillip # adduser
Username: phocking
Full name: Phillip Hocking
Uid (Leave empty for default):
Login group [phocking]:

Considering this is a Cloud instance/howto – this is doubly important – but remember that FreeBSD does not accept root logins by default over SSH. So if we fail to add ourselves to the ‘wheel’ group – we will be unable to su when privilege escalation is needed. So, spare yourself an embarassing n00b helpdesk incident and *always* remember to add yourself to the wheel group:

 

Login group is phocking. Invite phocking into other groups? []: wheel
Login class [default]:
Shell (sh csh tcsh nologin) [sh]:
Home directory [/home/phocking]:
Home directory permissions (Leave empty for default):
Use password-based authentication? [yes]:
Use an empty password? (yes/no) [no]:
Use a random password? (yes/no) [no]:
Enter password:
Enter password again:
Lock out the account after creation? [no]:
Username : phocking
Password : *****
Full Name : Phillip Hocking
Uid : 1002
Class :
Groups : phocking wheel
Home : /home/phocking
Home Mode :
Shell : /bin/sh
Locked : no
OK? (yes/no): y
adduser: INFO: Successfully added (phocking) to the user database.
Add another user? (yes/no): n
Goodbye!

Now let’s remove the extraneous user. This will kick us out of the SSH session, so aren’t you glad you added yourself to the wheel group? ^_^
root@qryr:/usr/home/phillip #  rmuser phillip
Matching password entry:

phillip:*:1001:0::0:0:User &:/home/phillip:/bin/sh

Is this the entry you wish to remove? y
Remove user’s home directory (/home/phillip)? y
Removing user (phillip):Connection to 199.48.128.154 closed by remote host.
Connection to 199.48.128.154 closed.

Log back in with your new credentials:

 
FreeBSD 9.1-RELEASE (GENERIC) #0 r243826: Tue Dec 4 06:55:39 UTC 2012

Welcome to FreeBSD!

Before seeking technical support, please use the following resources:

o Security advisories and updated errata information for all releases are
at http://www.FreeBSD.org/releases/ – always consult the ERRATA section
for your release first as it’s updated frequently.

o The Handbook and FAQ documents are at http://www.FreeBSD.org/ and,
along with the mailing lists, can be searched by going to
http://www.FreeBSD.org/search/. If the doc package has been installed
(or fetched via pkg_add -r lang-freebsd-doc, where lang is the
2-letter language code, e.g. en), they are also available formatted
in /usr/local/share/doc/freebsd.

If you still have a question or problem, please take the output of
`uname -a’, along with any relevant error messages, and email it
as a question to the questions@FreeBSD.org mailing list. If you are
unfamiliar with FreeBSD’s directory layout, please refer to the hier(7)
manual page. If you are not familiar with manual pages, type `man man’.

Edit /etc/motd to change this login announcement.

Now we have a lot of things to do in order to make our userland a little more of an enjoyable experience. The default Bourne shell (/bin/sh) is a fantastic login shell, but a pretty shitty interactive one. Our first task now that we have credentials straightened out is to fetch the ports repository so we can begin installing applications:

$ su
Password:
You have mail.
root@qryr:/usr/home/phocking # portsnap fetch update
Looking up portsnap.rootbsd.net mirrors… none found.
Fetching snapshot tag from portsnap.rootbsd.net… done.
Fetching snapshot metadata… done.
Updating from Mon Apr 1 17:25:36 EDT 2013 to Mon Apr 1 22:40:29 EDT 2013.
Fetching 3 metadata patches.. done.
Applying metadata patches… done.
Fetching 0 metadata files… done.
Fetching 1 patches. done.
Applying patches… done.
Fetching 0 new ports or files… done.
Removing old files and directories… done.
Extracting new files:
/usr/ports/comms/fldigi/
Building new INDEX files… done.

The only thing Linux has by default that I envy FreeBSD is having bash as the default shell. The default bash prompt is far more useful – and while we could dick around with .profile for cosmetic reasons if we were not *real* systems engineers… I wholeheartedly believe it makes a lot more sense just to install bash. Also, portmaster is a robust tool for managing installations and upgrades of ports. It’s advanced features are really cool, but most importantly it allows for less typing when installing ports – so of course we need it. Portmaster can install bash with completions as part of it’s installation – so let’s do that.

root@qryr:/usr/home/phocking # cd /usr/ports/ports-mgmt/portmaster/ && make WITH_BASH=”YES” WITH_PKGNGPATCH=”YES” install clean

Then we need to install the new pkgng system described here – http://www5.us.freebsd.org/doc/en_US.ISO8859-1/books/handbook/pkgng-intro.html – for easier updates and installation of packages in the future.

root@qryr:/usr/home/phocking # portmaster ports-mgmt/pkg

===>>> Currently installed version: The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]:
===>>> Port directory: /usr/ports/ports-mgmt/pkg

Now that we have installed pkgng we need to convert to the new package database:

root@qryr:/usr/home/phocking # pkg2ng
Creating backup pkg_info(1) database directory in /var/db/pkg.bak.
Installing bash-4.2.42… done
Installing bash-completion-2.0,1… done
Installing bison-2.7,1… done
Installing dialog4ports-0.1.3… done
Installing gettext-0.18.1.1_1… done
Installing gmake-3.82_1… done
Installing libiconv-1.14_1… done
Installing libtool-2.4.2… done
Installing m4-1.4.16_1,1… done
Installing perl-5.14.2_3… done
Installing portmaster-3.16… done
Conversion has been successfully finished
Your old packages database has been moved to: /var/db/pkg.bak.

cd /usr/ports/shells/bash && make install
<snip>
Compressing manual pages for bash-4.2.42
===> Registering installation for bash-4.2.42

Now that we have our fancy (some unixbeards would say sissy) interactive shell installed, let’s install and enable the bash-completion port so we can have more economy of motion while on the command line tabbing through stuff. If you never have installed this, well… you have wasted a lot of time on the CLI typing shit out when you could have been cruise control for cool tabbing through it like a boss!
root@qryr:/usr/ports/shells/bash # cd /usr/ports/shells/bash-completion && make install
<snip>
=====================================================================

To enable the bash completion library, add the following to your .bashrc file:

[[ $PS1 && -f /usr/local/share/bash-completion/bash_completion.sh ]] && \
source /usr/local/share/bash-completion/bash_completion.sh

See /usr/local/share/doc/bash-completion/README for more information.

===> Registering installation for bash-completion-2.0,1

^^^^^^^^^^———-I suggest you do this

=====================================================================

Next up, our first task is to install sudo. Why? Some old unixbeards might be saying ‘eeeeeewwwwwwwwww I don’t want my BSD box to even use utilities derived from linux!’ without understanding all of the implications and benefits of sudo.

1: *AUDIT TRAIL, AUDIT TRAIL, AUDIT TRAIL!!!!! * Every time sudo is attempted let alone successfully invoked, you get a log entry which includes the user performing the action requiring (or at least they think they require) root privileges. My own personal set of best practices always includes setting up a remote ‘tank’ to contain syslog entries in case of some catastrophic event. This also allows our network to be NMS/IDS friendly from the get.

2: Whether you are just banging away at the command line carelessly, or flailing upon your keyboard in rage and curses that would be stronger than any DDoS if they could travel over TCP/IP, the extra half second one has to evaluate what they are about to do as it takes to type sudo can be absolutely priceless.

3: Security best practices along with unixbeard/network ninjitsu proficiency tell us always to work with the lowest amount of privileges necessary to accomplish a given task. Assuming that you haven’t done anything weird, you shouldn’t be able to do shit outside of ~ on FreeBSD by default in the sense of write actions. A lot of Linux admins disregard this as distros do not make the distinct separation between the operating system itself and userland programs.

4: Sudo makes it possible to provide other administrators (particularly junior ones) with the ability to perform root tasks and never know the root password. So whenever you are having a BOFH day and decide to rid yourself of a troublesome PFY – you don’t need to go around and change all the credentials for machines they had access to – simply rmuser.

5: If you do something stupid and run into a site down ‘format and reinstall, you’re fucked’ scenario – at least you know it is your own fucking fault because you put sudo in front of your fail instead of blaming fat fingers or a typo.

This aforementioned distinction is worth going into in greater detail and ultimately is one of the most powerful tools FreeBSD offers as a UNIX platform. All of the system-specific configurations are in /etc with installed software in /usr/local/etc. My biggest beef with linuces that pollute the fuck out of /etc is that it becomes necessary to install and configure softwares individually when it becomes necessary to retire or add to a pool of servers.

The repercussions are far reaching for predictability, scaling, and administration in your enterprise solutions; assuming the same major/minor revision and ARCH match from a source to target – you can drop a simple tarball (or in the days of GigE – scp) of /usr/local from source machine to target to effectively ‘clone’ a server. To do this same sort of thing in Linux Cloud environments requires dicking around with creating images and stages to accomplish the same task because the filesystem is not segregated.
root@qryr:/usr/ports/shells/bash-completion # portmaster security/sudo
<snip>
===> SECURITY REPORT:
This port has installed the following binaries which execute with
increased privileges.
/usr/local/bin/sudo

If there are vulnerabilities in these programs there may be a security
risk to the system. FreeBSD makes no guarantee about the security of
ports included in the Ports Collection. Please type ‘make deinstall’
to deinstall the port if this is a concern.

For more information, and contact details about the security
status of this software, see the following webpage:
http://www.courtesan.com/sudo/

Add yourself to sudoers. I prefer using the wheel group with the NOPASSWD option. I also like trying to make stages like this that folks (even if it is only me) can reproduce in as little time as possible. I also like coming up with ways to do things super quick in vi, so try this one on for size:
root@qryr:/usr/ports/security/sudo # vi /usr/local/etc/sudoers

86G
x
wq!

root@qryr:/usr/ports/security/sudo #
^d
$ vi ~/.bashrc
[[ $PS1 && -f /usr/local/share/bash-completion/bash_completion.sh ]] && \
source /usr/local/share/bash-completion/bash_completion.sh
ZZ
^d

$ ^DConnection to qryr.x.rootbsd.net closed.
phocking@bt:~$ ssh qryr.x.rootbsd.net
Password:
Last login: Tue Apr 2 10:06:14 2013 from c-67-165-123-62.hsd1.wa.comcast.net
FreeBSD 9.1-RELEASE (GENERIC) #0 r243826: Tue Dec 4 06:55:39 UTC 2012

Welcome to FreeBSD!

Before seeking technical support, please use the following resources:

o Security advisories and updated errata information for all releases are
at http://www.FreeBSD.org/releases/ – always consult the ERRATA section
for your release first as it’s updated frequently.

o The Handbook and FAQ documents are at http://www.FreeBSD.org/ and,
along with the mailing lists, can be searched by going to
http://www.FreeBSD.org/search/. If the doc package has been installed
(or fetched via pkg_add -r lang-freebsd-doc, where lang is the
2-letter language code, e.g. en), they are also available formatted
in /usr/local/share/doc/freebsd.

If you still have a question or problem, please take the output of
`uname -a’, along with any relevant error messages, and email it
as a question to the questions@FreeBSD.org mailing list. If you are
unfamiliar with FreeBSD’s directory layout, please refer to the hier(7)
manual page. If you are not familiar with manual pages, type `man man’.

Edit /etc/motd to change this login announcement.

[phocking@qryr /usr/home/phocking]$

And now we are working with a very friendly and consistent but still barebones FreeBSD install.  This post is part one of a series on FreeBSD systems engineering management.