Recent content on David Hamann
A few months back I wrote about the first FMProxy release, giving an overview about past research and the idea of the proxy as a product. We used the time since to add features, fix bugs and improve stability of the proxy. Here are a few of the new things worth mentioning: Support for HTTP tunneling A few beta testers reached out asking how the proxy would affect the “HTTP tunneling”…
Claris has extended the FMUpgradeTool in the recent release , providing support for adding/replacing/deleting more object types, and also added the ability to generate completely new fmp12 files. Next to the new features, there have also been some undocumented breaking changes, though. I used the FMUpgradeTool in version 22.0.2 to inject accounts into fmp12 files as part of a deployment process.…
TL;DR Alex Dubov and I just released the first public version of FMProxy, a security proxy for FileMaker Server. We are currently looking for beta testers. Want to try it out? Get your copy for Ubuntu Server x86_64 or arm_64 . Make sure to read the trial docs (pdf) . Introduction and Research background In the last few years, Alex Dubov and I have independently been researching the security of the…
I recently rebuilt my monitoring environment for the servers I manage. In this post I describe what technologies I chose and how they fit together to form a monitoring stack that - once set up – gives you quick access to relevant metrics and logs and doesn’t burden you much with operations. A couple of requirements were important for me: Everything should be self-hosted and I wanted a…
I’m currently writing a cross-platform server application in Rust which should also be able to run as a service on Windows. While this sounds like a relatively straight-forward thing to do, it was a bit more involved than I originally thought (especially compared to running unix services). Below you’ll find my notes and a well-documented code sample for running a small echo server for…
A while ago I stumbled upon rust-script , a tool which lets you write single-file Rust programs and execute them as if they were standalone script files. This comes in very handy when you want to experiment with Rust code, write up executable examples or build small utility programs, but don’t always want to deal with explicitly setting up Cargo projects for every little script. Using…
I’m currently in the process of setting up several cloud servers for a new project. The whole infrastructure will run on Hetzner Cloud and be codified. Since it’s the first time I’m using the Terraform provider for Hetzner Cloud , I want to write down some of the notes I took. I’ll focus on creating a small, simplified, self-contained example to create a server, set up a…
A while back the FileMaker Server (FMS) installer for Ubuntu Linux started checking the currently installed web server versions and giving warnings and an interactive prompt (!) in case of outdated versions. This is rather annoying if you like to install/upgrade your FMS non-interactively. Using ansible, for example, your playbook would just hang and you would start wondering what’s going…
With a few security features added to the FileMaker Server Admin Console in the last few versions, I decided to play around with them to see how they are implemented. In this article I want to highlight three of the issues I found last year (2023) and subsequently reported to Claris/Apple. TL;DR : Until version FileMaker Server version 21.0.1 you can bypass the IP restricions and until version…
I was recently asked if it’s possible to post a message to a Slack channel whenever the state of a monitor on allgood.systems changes (for example, a web server goes down, a job starts failing, etc.). The answer is “yes”, and it’s quite easy to set this up once you have a Slack app configured. All you need to do on allgood’s side is to add a web hook to your…
Introduction I had been planning for a while to dive deeper into the fmp12 file format to explore how data is organized and how accounts and passwords are stored. A few months ago, I finally found the time to do it. The first thing I noticed was just how little information publicly exists about the file format and especially about account and password storage. The only information on the latter…
The problem statement Let’s say you have a (Windows or Linux) EC2 instance in a private subnet and want to access it interactively. There are several ways to do this: You could use a bastion host in your public subnet, harden it and limit access to a certain IP range, and then tunnel your SSH or RDP (or any other TCP) traffic through this host using SSH. Alternatively, you could set up a VPN…
I’m currently in the process of building a computer based on the 6502 microprocesser, following Ben Eater’s instructions . It’s a nice way of learning the lower level parts of a computer by wiring up and eventually coding everything yourself. In this post I want to share my (more or less structured) notes of the steps taken and lessons learned so far (covering part 1 to part 7).…
Since the launch of allgood.systems you were able to monitor if your background jobs, scheduled tasks, cron jobs, etc. were running whenever you expected them to be running. This was accomplished by defining an interval on allgood and then sending a request to a check-in URL at the end of your script. If the request didn’t arrive at the end of the specified interval, you would get a…
Introduction While checking out how the FileMaker Pro to Server upload feature worked , I noticed that credentials were encrypted using a RSA public key before being sent to the server. I looked into FileMaker Server’s installation directory and found that the private key was stored in the CStore/keystore file – at least I assumed it, as the file stores keys and values, where the keys are…
Back in the dark ages the FileMaker Server admin console (then Java Web Start) allowed you to remotely upload new fmp12 files to the server. For some reason this feature did not survive the admin console rewrite a decade (?) ago. Rather, the upload feature was integrated into the Pro client. Later, as the Admin REST API was released, the upload feature was still missing. The only two options to…
Say you want to allow a non-root user on Linux to execute a couple of scripts as root or another user with more privileges. A common way of doing this is to make an entry in the sudoers file. If the scripts are written in Python, it could look something like this: johndoe ALL=(ALL) /usr/bin/python3 /opt/utils/*.py Essentially, this means that the user johndoe can execute /usr/bin/python3…
I got myself an Aranet4 device to monitor CO2 levels in my office. The monitor gives pretty accurate readings and has very low energy demands (due to the e-ink display) (here’s the datasheet ). While the intended way to read the measurements is to use the mobile app , it’s always good to be able to access the raw data yourself; you get to store as many readings as you like (otherwise…
A couple of months ago I built a JavaScript application that allows adding points and labels to locations on a building floorplan. The whole canvas (not HTML <canvas> ) is a SVG document inside an HTML document and points/objects/labels/etc. are added to that canvas as native SVG elements. Users can add/move objects on the floorplan but also zoom and pan the floorplan itself. When performing these…
Let’s say you have a long-running Python script that should run uninterrupted or perform a graceful shutdown should a user decide to terminate it ahead of completion. By default, sending an interrupt (usually by pressing <Control-C> ) to a running Python program will raise a KeyboardInterrupt exception. One way of (gracefully or not) handling interrupts is to catch this specific exception.…