Yet another technically oriented blog, more or less
Strelka failed to sync on Security Onion 3.1.0. On the manager node: SOC (webui on the manager node) → Detections → Gear button (on the top right) → Strelka → Full update → Close. See also https://github.com/Security-Onion-Solutions/securityonion/discussions/15938.
TL;DR, port-channels on the Dells needs portmode hybrid in addition to switchport to enable VLAN 1, and it helps to ignore “invalid” PVST-BPDUs by adding no spanning-tree pvst err-disable cause invalid-pvst-bpdu to the port-channels. AT ${WORK} we have a couple of stacked Dell PowerSwitch S4048-ON running PVST STP connected to a Cisco switch running rapid-PVST […]
If your switch ports are part of a link aggregation group, and those interfaces are listed as suspended, check the LAG configuration on the other end. Indicator: TwentyFiveGigE2/0/3 is up, line protocol is down (suspended) FreeBSD doesn’t honour any create_args_laggX variables in /etc/rc.conf if the laggX interface already exists. Either adjust laggX manually or destroy […]
I only saw this strange behaviour on my own laptop running a week old 16.0-CURRENT, but here’s one way of coping. Simply add -lmd after $(STATIC_LDFLAGS) of ports-mgmt/pkg/files/patch-src_Makefile.autosetup, like this:
I migrated our 14.4-STABLE syslog server to a XCP-ng VM, and noticed local-unbound made loud complaints. I ended up creating /var/unbound/conf.d/server-so-sndbuf.conf and gave it this content.
The user manual for Eaton 9PX3000iRT2U is missing one piece of information. Luckily, I found the missing piece in the user manual for the latest generation of 9PX UPSs. After having replaced the battery you must reset the counter for battery life. I can only wonder why the manual omits this crucial information. Assuming the […]
At ${WORK} we have a number of UPSs. Two of them are Eaton 9PX3000iRT2U, each with a NETWORK-M2 NMC (744-A3983). I noticed the NMCs didn’t run the latest firmware, 3.1.15. Let’s upgrade them, or so I thought. The NMCs in UPS 1 and 2 ran 2.0.5, so I uploaded the 3.1.15 tar file on the […]
My internet provider told me a while ago that my old 4G router would be left in the dark after New Year. Enter the ZTE MC888 Pro. While the IEEE 802.11 standard allows up to 32 US-ASCII characters in SSIDs, this router supports only up to 29 characters. Fortunately, the router does allow PSKs up to […]
Synth has frozen on more than one occasion while it was running commands like umount /var/synth/builders/synth-live/SL04/ccache and building more than one package at a time. Manually running commands such as df -ah appeared deadlocked since they never finished, and Ctrl+C never aborted the processes. A reboot was needed, well, I always ended up giving the […]
Windows Update in one of our Windows member servers running Windows Server 2022 threw error 0x8024401c after ingesting KB5070884. Googling for “windows server 2022 windows update error 0x8024401c” suggested the first three steps: Run net stop wuauserv. Delete the contents of C:\Windows\SoftwareDistribution. Run net start wuauserv. Make the Windows Update client connect to the WSUS […]
The ZFS pool feature dynamic_gang_header must be enabled manually.
Two configuration files named Files.config must be edited if your Revit Server 2026 uses a separate NTFS volume for the user data.
At ${WORK}, we’ve been running Greenbone Vulnerability Management for some years. After a recent upgrade, Mosquitto wouldn’t shut up about certificate and keyfile until I told it where to find a server certificate and the associated private key. I simply reused what GVM uses in general.
Today, I had a go at the ETOPEN Suricata rules in Security Onion 2.4.150. I disabled long ago the rule numbered “2060252” and named “ET INFO Go-http-client User-Agent Observed Inbound.” This one popped up when I hunted for the reason the Suricata rules showed “Rule mismatch.” I figured I might as well re-enable this rule […]
Kibana appeared dead after upgrading Security Onion from 2.4.120 to 2.4.130. Running sudo so-kibana-restart on the manager solved this issue.
At ${WORK} we have a so-called “monster server” as our resident FreeBSD builder. Unpatched Synth 3.09 handles up to 64 hyperthreads, i.e. 64 scanners and 128 builders. Our builder has 88 hyperthreads, necessitating an expansion to 88 scanners and 176 builders. Below is a “Git diff” ready for git apply.
After surfing for a while I came across source 1 and source 2. This approach worked for me. Here’s the .cmd file I used:
Git is at 2.47.1 and this happened as part of a routinegit -C /usr/src pull -j `nproc` --no-edit --no-ff -p andgit -C /usr/src rebase stable/14 stable/14+local: Maybe I should add a sleep command between git pull and git rebase. Would five seconds be sufficient?
After upgrading Brave to version 1.73.89 (Chromium 131.0.6778.69) and Google Chrome to version 131.0.6778.70, the web GUI of our Fortinet FortiGate is inaccessible. Both browsers display the following error when attempting to access the GUI: This site can’t provide a secure connection [REDACTED] sent an invalid response. ERR_SSL_PROTOCOL_ERROR The same goes for Microsoft Edge version […]
mosh’s IPv6 support has been broken in Cygwin for a while. Network exception: setsockopt: Invalid argument [mosh is exiting.] If only the error message had reported source file and line number. Listen up, boys and girls, hackers and hookers, do error messages properly. If not, I’ll magically materialize next to you, ensuring you do this […]
If you have insufficient space for Security Onion’s /nsm filesystems, then consider adjusting these parameters in the SOC (Administration > Configuration): pcap > config > maxdirectoryfiles Setting this value to roughly 144000 files yields roughly 100 days of packet capture, although you mileage may vary. Be prepared to lower or raise this value as needed. […]
Up until quite recently, I’ve been using YTD Video Downloader in Windows for downloading YouTube videos, but even the paid version has issues. This weekend I rediscovered the steps I took using youtube-dl (yt-dlp) during last Xmas, and made a shell script to automate everything.
Running the command sudo soup on your manager node gives you this warning: WARNING: If you run soup via an SSH session and that SSH session terminates, then any processes running in that session would terminate. You should avoid leaving soup unattended especially if the machine you are SSHing from is configured to sleep after […]
0 [main] mosh-client (21652) child_copy: cygheap read copy failed, 0x0..0x800029F60, done 0, windows pid 21652, Win32 error 299 Died at /usr/bin/mosh line 320.
I wish I did this change ages ago. 50 minutes of waiting on estimates turned into less than 20 seconds of waiting.
It is quite difficult getting “Windows 11, version 24H2 x64 2024-05D” installed in a virtual Windows 11 client. So far I’ve tried the usual LabConfig settings. Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\Setup\LabConfig] "BypassCPUCheck"=dword:00000001 "BypassRAMCheck"=dword:00000001 "BypassSecureBootCheck"=dword:00000001 "BypassStorageCheck"=dword:00000001…
At ${WORK}, we ordered one Lenovo ThinkPad P1 G6 (P/N 21FV000MMX) which came with 32 GiB of RAM. This laptop has two slots for memory modules, so we ordered and waited on one additional 32 GiB memory module. The memory module finally arrived, and I installed the module in the free slot. When I turned on the […]
NetBSD 9.4 is out. I was eager to see if the installer makes the same mistake when sizing the partitions as I had experienced while installing NetBSD 10.0 some days ago. It turns out I had the right hunch. Notice the swap partition got the majority of the available space, despite the text at the […]
For some reason a rebooted Security Onion manager node is perceived as a combined manager-search node (this is my hypothesis), filling up the /nsm filesystem with unnecessary, large amounts of data. Here are four shell scripts I find useful. See discussion #11062 over at GitHub. As soon as I can login on the rebooted manager, […]
When the harddrives in the oldest virtualization server at $WORK died, I was virtually left without any test systems running the other BSDs and some select Linux distros. We have another virtualization server with plenty of resources, and I decided to try NetBSD/amd64 10.0-RELEASE, build a few packages, and upgrade the VM to 10.0-STABLE. Sadly, […]
Autodesk recently published the 2025 editions of their products. Most notably this time, with the exception of 3ds Max 2025, is that the file numbered 001_002 is a short .exe file, while the file numbered 002_002 is a complete 7-Zip archive. This is both a blessing and a curse. A blessing in the sense that […]
While following the suggestions of https://github.com/jtesta/ssh-audit/wiki/FreeBSD and security/py-ssh-audit 3.2.0, I figured it’s better to make adjustments to the startup script in libexec/rc/rc.d/sshd. The patch is available for download. In addition to the changes above, I added these lines not to only to /etc/ssh/sshd_config, but also to /etc/ssh/ssh_config, except for the HostKey lines. As…
I decided to play with FreeBSD 13.3-RC1 in VirtualBox. My display is capable of 1920×1200, and we must specify this both in the VirtualBox XML file for the guest and in the guest’s /boot/loader.conf. The font specification goes in the latter file. You better do the changes to the XML file while the guest is […]
We upgraded our Security Onion nodes today. We really had no choice. I was surprised to see the so-elastalert container normally running on the manager being unable to start. I happened to glance at the release notes, and tried the commands suggested there. Suffice it to say, I got nowhere. Update 2024-02-05 The problem solved […]
In the aftermath of KB5034441, I experimented with creating a 1 GiB large Windows Recovery Partition on a new Microsoft Windows 10 VM, ensuring enough free space for KB5034441 and hopefully any later versions of the “Windows Recovery Environment.” Systems under the control of WSUS or MECM won’t see this update. If your existing recovery partition […]
If Zeek on your forward node (sensor) keeps restarting and its detailed status never changes from “health: starting,” to simply “healthy,” have a look at zeek.config.networks.HOME_NET in the Grid Configuration. In my case I had specified a single IPv4 address among six other larger address blocks. Changing this address to a /31 address block made […]
If you connect your Cisco Catalyst 9600 to equipment using fixed wire speeds, you may need to issue the speed nonegotiate command on affected switchports.
netdata was recently updated to 1.42.2 in the FreeBSD ports collection. The sample configuration file needs some adjustment. Remember to add run as user = netdata to the [global] section. Otherwise, netdata will run as the user nobody, which hasn’t been given the necessary permissions. If you want to monitor ipfw(4), you must run netdata […]
The Dell PERC H730 Adapter, a 12 Gbit/s SAS controller, in a Dell PowerEdge R330 server, complained about “L2/L3 Cache error was detected on the RAID controller.” This server was using BIOS 2.16.0 in UEFI mode and the SAS controller ran firmware version 25.5.0.0018. Entering X to accept the current predicament went nowhere and nothing else […]
Det er ikke ofte jeg skriver på norsk. I dag fikk jeg ånden over meg og det ble en liten besettelse å få oppdatert oversettelsen av RHIDE 1.5. Det er tross alt 20 år siden sist jeg brukte DJGPP og RHIDE i MS-DOS til noe produktivt. Mon tro om dette er noe som kan brukes […]
I updated my laptop running FreeBSD current yesterday. For the first time I saw kernel messages about redzone violations. Here’s a sample. Luckily, I always recompile my kernel modules originating from the ports collection when I do my other ports. This time I simply had to forcefully reinstall graphics/drm-510-kmod, i.e. pkg install -fy drm-510-kmod, and […]
pkg audit has flagged Curl 7.87.0_1 as vulnerable for a week or so. There is a PR for the latest version, 7.88.1. See PR269967. Combining the available patches from the PR yields: I ran the make makesum command myself, hence the difference in timestamps from the original patch. Size and hash are identical. Save the […]
Upgrading MySQL from 5.7 to 8.0 was mostly uneventful. Here are the steps I did. Stop the running 5.7 instance. Make ZFS snapshots of these three filesystems: zfs snap enterprise_zdata/var/db/mysql@pre-8.0 zfs snap enterprise_zdata/var/db/mysql_secure@pre-8.0 zfs snap enterprise_zdata/var/db/mysql_tmpdir@pre-8.0 Upgrade to 8.0. Review the new my.cnf.sample in /usr/local/etc/mysql. In my case, my…
You can’t configure nor download a newer version of the MySQL client using the FreeBSD ports collection while an older version is installed. It’s outrageous. Anyway, here’s an unpolished patch disabling the check when configuring or fetching the port.
Sometimes old equipment fails in mysterious ways. This time a whole fleet of Cisco Aironet 3700 Series Access Points disappeared from their controller. The access points have “Manufacturing Installed Certificates” and these certificates will expire sooner or later. In this case, the certificates expired sometime during the weekend. One workaround is to tell the controller […]
Caused by xen-guest-tools-4.16.1. Solved by running these commands: cd /usr/local/lib ln -s libxenstore.so.4.0 libxenstore.so.4 ln -s libxenstore.so.4.0 libxenstore.so ln -s libxentoolcore.so.1.0 libxentoolcore.so.1 ln -s libxentoolcore.so.1.0 libxentoolcore.so
One thing has annoyed me for years, and that is the ports tree refusing me to configure and download newer versions of PHP and PostgreSQL while an older one is installed. Here’s a couple of unpolished patches that allows me to configure and download the next version of PHP and PostgreSQL.
I reviewed some used Dell PowerEdge R720. Yes, they’re EoL, a long time ago, but they are some really good workhorses. Component Part CPU 2x Intel Xeon E5-2670 2.60GHz, 20M Cache, 8.0GT/s QPI, Turbo, 8C, 115W RAM 384 GiB (24x 16 GiB) RDIMM, 1600 MHz, Standard Volt, Dual Rank, x4 Internal NIC Broadcom 5720 QP 1Gb Network […]
Based on all the ruckus caused by KB5012170, if you are able, determine if BitLocker is active, and if so and if undesired, disable it on all drives before rebooting your computer running Microsoft Windows 10/11. It looks like my computer is in the clear. If it hadn’t been, then I would run these two […]
Commit 94af43935c4e2709577cb4e4723daf9d7cb91494 removed PORTEPOCH for math/py-kiwisolver. The previous version number, 1.3.2,1, is considered higher than the current one, 1.4.3. py38-kiwisolver-1.3.2,1 > succeeds index (index has 1.4.3) Installation by force is the only way forward. # pkg install -f py38-kiwisolver Updating Synth repository catalogue... Synth repository is up to date. All…