security_class_101 Day_2

security 101:

Day 2: 

LastPass

LastPass is my cloud based Password data-base management application. I personally use KeePassX for local, and LastPass for my Internet passwords alone. I like different features in either app better. The major advantages to LastPass are the full range of Browser compatibility(IE,Opera, chrome/chromium, safari).  The browsers it does not play well with are:Maxthon, Avant, and a bunch of the Linux web-browsers(epiphany{gnome}midori), while a bunch of Linux browsers are based on the source code of firefox.

I will say that I am reviewing this from a free user perspective. If anyone wants to see a review of the pro, and how yubiKey works with LastPass. Although Hak5 has done a bunch of episodes on using yubiKey's, and LastPass.

LastPass advantages:


~ compliant w/ all of the major operating systems:Linux/mac/windows/BSD(sadly no haiku)

~ has a two factor authentication w/ cards, to perform two factor auth. with the free version.

~ has a security check for checking the strength of your passwords.
(there were three fast screens that flew by encrypting passwords, sending passwords, calculating password strength...)

~share the results to brag to your friend's or like in my case be disappoint by a mere 86%...:~{

~ Imports from almost any format, but doesn't export into many formats.

Import

VS.

export

~  Secure notes for keeping "secret" Lists.
(you can also copy/paste anything in one of thise lists you want.)


~ one click filling of form-data
(although I use AutoKey 2 automate strokes portably from inside a encrypted volume)

~Generate secure Passwords...

The LastPass Password generator, to give you an unlimited amount of random passwords.

 ~ It is my opinion that LastPass strength's lay in Cross-platform/browser, security check you can share with your friend's, a strong encryption focus. You can also use your Last Pass from the local Encrypted Vault. The Vault does work off-Line from your web-browser, but will alert you to off-Line being used. So even if Last Pass is doing maintenance, your still golden. I use my KeePassX local Linux password data-base, to fill in the Master-Password for my LastPass every time I log into most any of my browsers(I like Maxthon/Avant, Midori, and Epiphany as well...:/).

Although I think the main advantage from using any kind of password dataBase, is going to be the ease of use it is for (possibly-incompentent non-tech. users)to enter propperly strong passwords, and to easily change them if they find out their NT was attacked. 

security Class101:Day 1 KeePassX && Linux

 Using KeePassX 2 increase your security in Linux

I have been using KeePassX for my passWord data-base manager, for over a year now. That not only means that my pass-words are as long and complicated as possible, and all completely unique. Although I sometimes use web-services like twitter, google, my launchpad Oauth link, or facebook to login to my passwords. I have been switching one of these per week, which makes cracking my passwords, highly unlikely.

I like to make notes during the creation of an account, any information I found out about what types of passwords the data-base supports. I really wish there were simple tags on web-sites when creating passwords so I can know the most complicated I can make the passwords. Which I have found in the past, but it is generally rare.

You can easily install KeePassX on any GNU/Debian/Ubuntu(Linux) by running the command:

$ sudo apt-get install keepassx

<enter>

<PW>

<enter>
(install keepass2 for more M$ compatibility)

I do want to make clear that KeePassX is compatible w/ LastPass, but not many windows/mac based password managers. Since I use only Linux keePassX is perfect for my situation.

I usually keep keePassX on my toolbar dock. In Unity or Gnome-shell just open the application(app), then just right click and select "lock to panel" or similar command in "G-S".

So you may ask why I use keePassX and LastPass. I say that I like having my web-passwords mainly kept in LastPass, while I like the extra options for generating passwords, and there are other passwords that I only keep in my KeePassX data-base. Some of these passwords are: SSHkeys, IceCast Server, LastPass Master-Password(My LastPass Never remembers my Password, so I have 2 copy it in each time), and my public-pvt. OpenGPG keys.

Power-user top:

Ctrl + P generate semi-random password.

You can also check/uncheck options like:

allows you to do custom characters, exclude look-alike characters, make sure the passwords contain char. from different groups.

you compare and tell me. 

Also if you do like me and generate passwords from KeePassX, then all it takes is clicking that "save site" in the box that drops down from LastPass in your browser. From that point onwards you can just click "auto-fill to fill in your pass-words. Then just click the regular "log-in" button to get logged in.

the lock screen. You must unlock, before your next copy/paste. I set my desktop to be very lenient; while my net-book keePassX locks and deletes the paste buffer. 

you could also use a stupid-complicated password in a text file, called a keyFile.

What I highly recommend in getting started w/ a secure pass-word data-base is to make a list of your most often used/needed passwords: Here would be my list:

~Amazon/Ebay/pay-pal
~Google/twitter/Facebook/OpenAuth(my OpenID Link 2 my LaunchpadID)
~del.ic.ious/digg/reddit/stumbleupon/P2PU/identi.ca/linkedIn
~facebook/mySpace/couchSurfing/
~tumblR/wordPress/ping.fm/seismec/everNote(on-line notebook)/diigo(highlighting)
~mint-forums
~liveMocha/typingWeb/lumosity
~digsby/trillian/aol/icq/yahoo!
~last.fm/pandora

That is a lot, but I share a lot of articles on the Net. Most people will probably only need a dozen or so passwords to be satisfied, especially w/ most web apps having facebook, twitter, google, && OpenID link. Along w/ a few like E-bay, Amazon, and Pay-pal. Although I would suggest getting a second factor authentication token for your on-line banking either from your $ site(paypal for example), or get a yubi-key for $20 tied to your LastPass.

read fields for tips. repeat is red, because it does not match the first PW field.

five things that I wish Ubuntu could Learn from Kubuntu & KDE

KDE Logo

I learned Linux from a gnome/Ubuntu point of view and I will continue to use gnome on my desktop.  With that said I have really been digging on my Kubuntu installation on my netbook for the last week, so I decided to post a list of things I wish Ubuntu could do. I will also list some things that frustrate me about Kubuntu.






What I really wish Ubuntu would Learn from Kubuntu:

~ 1 I wish the nautilus file mgr. would have a pause button for file transfers.

This is one of the greatest strengths of the dolphin file manager. There have been a few times where my laptop was almost out of charge in the middle of a file transfer. If I could have just paused it, then hibernate/suspended  the transfer until I plugged in my charger; I would not have had to franticlfy look for my charger. I used to use the terra copy freeware program to get this functionality in Windows, and it is being bundled into windows 8. I don't understand why a pause button isn't standard on all Operating system file managers. :/

 ~2 I wish  that Nautilus would have a one click way to select/de-select multiple files.

In dolphin when you hover your mouse/tracpad cursor over a selected item, there appears a Plus button which selects the file with one click. If you select a bunch of files, but change your mind about one of them; then just simply click the minus button, and it will be de-selected from the list of files. This feature is extremely handy when sorting files to copy/move, as well as delete. Windows has a similar feature, that shows a check-box that allows you to select/de-select files; but it is buried within the file options...;D~ In all fairness you could still do what I learned to do in Windows XP and Ubuntu, which is just hold the ctrl. key to select/de-select files in Kubuntu as well.

~3 I wish that Ubuntu would learn to integrate desktop customization like KDE has.

What I mean by this is that in Kubuntu KDE user created themes are installed, with ridiculous ease. For example if I dig into the the workspace appearance, under the system settings, you will find the cursor theme tab. Under the cursor theme tab, there is a "Get new theme" button. This button will show a dialouge that will show a ton of cursor themes. After which with one button, you can install the theme of your choice.

This is the  case with the several other options, and one is the login screen. Which I chose to install a "stargate" 9 chevron theme for when my Kubuntu is loading. I still have not figured out how to change the lightDM theme on my Ubuntu side YET.

~4 wish that Ubuntu would have made it as simple to re-install the xScreensaver package.

I guess that Ubuntu was trimming, and that is OK, by me. Especially since in modern computing screen-savers aren't really necessary. Kubuntu did the same thing, but they included a pop-up notification that directed me to a one-click install of a package to extend the functionality of the screen-saver, beyond just a plain boring black screen. I was disappointed that the xscreensaver-gl package in Kubuntu didn't have the matrix-gl screen-saver, until I found the ascii aquarium.

~5 I wish that Ubuntu allowed for more advance control of the Interface.

In Kubuntu I found myself able to easily disable the caps lock key. Kubuntu has mouse/tracpad gestures built right into the distribution. For the record I do really like Unity's gnome shell implementation, except for one major thing. If I zoom out into window switching mode in Unity I can only close the last active window, if I am careful with the global menu. But in the gnome 3 fall-back and Kubuntu when zoomed out in window selection mode, I can choose to select or close any of the windows displayed and the screen. Window switching mode is accessed via the top Left corner in both Kubuntu and Gnome 3 shell.

My only major frustration with Kubuntu as a whole is the plasmoid widgets did not work very well for me. I could not get half of them to work, and the other half looked like crap on my screen.

For the record I will continue to use both desktops. Ubuntu is the only Linux OS on my net-book that I can use, as a modem for my desktop, because my wifi source is in a different room.

If you want to check kubuntu out for yourself, you can download it below:

www.kubuntu.org/getkubuntu

Sore with SUSE...

I decided last night that I wanted to check out OpenSUSE gnome on my desktop computer. The reason for this was that I wanted to play around with the gnome extensions web-site, and create a really custom UI(user-interface). I have the gnome 3 UI on Linux Mint 12 working perfectly, but I cannot install extensions directly from the web-site. The web-site tells me that I need an updated version of gnome.

I honestly did not know what to expect from OpenSUSE. I have read some recent reviews that had pointed to openSUSE in a positive light, and I wanted to give it a try.

The First thing that blew me away was that it had a really cool graphical Holiday boot menu.

I thought this was a good sign, and that I would be able to install , and test the newest version of gnome 3 shell without a hitch. The problem is that I was wrong.
There was also another shocker that came with this install, and that was having to agree to a software agreement. I haven't had to do that since the last time that I installed an OEM version of Microsoft.

There were two main problems with OpenSUSE. For starters I was unable to boot into the gnome 3 shell, and was forced to boot into a gnome 2.3.+ fall back mode. My computer is by no means ready for retirement. I have an Nvidia mobo chipset, 2gb RAM, dual core ATI 64  bit CPU(although I chose to install the 32-bit version, because I only have 2gb RAM), and an Nvidia Geforce 210 1gb DDR3 GFX memory graphics card. I am taking this to mean that gnome 3 is not ready for all the hardware out there. I am doubting there is much I can do about this, except for be patient; and wait for the Linux community to code better gnome 3 hardware support.

Also when the install had finished I was greeted with only one Operating system, and that was the Non-working OpenSUSE. I have a half dozen other Linux distribution's installed on this PC, for various purposes. So what I chose to do was to re-install peppermint OS, because I had decided to try btrfs on it, but was not given the option to boot from it. I had assumed this was because Linux Mint 12 was unable to see the peppermintOS btrfs file-system.

I have not given up on NovellSUSE, but I am going to do more research, before I attempt to do another install. Perhapse I will try a KDE install next time. The only KDE OS I am running currently is Kubuntu on my net-book, which is working out quite well.

Drivers, drivers, Drivers

What I have found in my technology driven life is that Drivers are an on-going issue in any Operating system. A Hardware Driver is a piece of software that is in charge of controlling a piece of Hardware. For example a Wireless network card. Many times this is because the old saying is true that:”People who make good hardware make bad software, and people who make good software make bad hardware”

Windows approach is that for every device there will be a download, that will need to be installed. Usually these drivers come from the Hardware Mfg.(Manufacturer). For example Dell, HP, Asus, Logitech, MS, apple...etc. Windows often over-complicates the process by adding on-line lookup of drivers. Which could slow down the system depending on hardware power. Keeping all of your Hardware up to date to keep your system stable is a holy pain in the rear end. Ever heard of a BSOD? It means Blue Screen Of Death. When Windows has a driver issue is gives a blue screen w/ white writing to say OH efF we have a problem. A while back I was taking the “T”(subway red-line through Cambridge, MA), and I saw a BSOD at the train station.

Microsoft in recent years has made strides to make sure that only Microsoft signed drivers get used on Windows operating systems. The testing process for a driver to pass WHQL(Windows Hardware Quality Labs)certification is quite a slow process.

Linux on the other hand, has backwards engineered most of the drivers needed to run a system right into the tiny little kernel. I would say in the last two years of my running Linux 98% of my drivers worked right out of the box. No need to click anything. No need to search the Internet. No need to pay for driver update programs. No BSOD. USB drives just work. My Clear-wire hot-Spot which took an hour for vista to find the drivers for on-line, instantly works even before chrome web browser finished loading. When I say hardware works within seconds, I mean literally within a few seconds(3-5.)

The only exception to this for me have been: Nvidia, ATI, and broadcom wireless. Usually with Nvidia & ATI graphics drivers(and some bcml) all you have to do is click activate driver in “restricted drivers” , then reboot and all is right in the world. Once have I had to use NDISwrapper to install windows drivers in Linux. That was recently, and I will explain that another time. That was on my friend's Dell laptop.

Increase your update speed using Linux Mint: apt-fast script

I just wanted to write today about how you can use a simple script to increase your update times. Speeds, up to four times as fast have been reported using this script. It is ridiculously easy to install this script, that any script kiddie can use it.

First of all you will need to install the axel download framework. So your first step to installing this script is to install the axel framework, from the terminal.

$ sudo apt-get install axel

After which you will enter your user password, press "enter", and also press "y" when prompted. After which you will just wait for the "$" prompt to appear, that signals your software is installed.

The rest is really easy. Start by downloading the script from this link, here. Make sure to download this to a place, that is easy to remember.

Next go to that location. I often right click on the Firefox download manager, and select "go to location".

Next you will need to place the script into the /usr/sbin folder.

If you still have your terminal open you can use the following commands:

$ cd Downloads

 ~cd is much like it is in the DOS command line shell from MS, because it stands for change "Change Directory", and performs the same function. 

$ sudo mv apt-fast.sh /usr/sbin/apt-fast

~sudo is needed to add, remove, or modify files within system file directories.

~mv is the command for moving a file for one place to another. This is the same as cp(copy), except that after the copy from place A, to place B the file is deleted from the original location.

~when using a mv, or cp command the first file name is the original name/location of the file. The location of the file was not used in this command because it is assumed, that you are already located in the directory(folder); that contains the script file.

~Notice that the second file has not ".sh" extension @ the end of it. This is how files are renamed within the Linux terminal, by the destination being different from the original file.

The main benefit from this command is that you can move the script to the correct location, and rename it at the same time.

You will also need to add permissions for the script to be executable with the following command.

$ sudo chmod +x apt-fast

 Now for the GUI(graphical User interface) way of doing things.

(this assumes that you downloaded the script to your Downloads directory(folder), within your User home folder.)

Step 1)Change the file name to just apt-fast.

*Downloads is the default location for your Firefox downloads.*

First rename the scrip to just apt-fast.
 

After the following screen, just move your cursor to the end of the line with the "end" key, or three presses of the arrow key. Once your cursor is at the end of the file name, then just simply press the backspace key three times. This will get rid of the .sh file extension. After you have done this press the "enter" key to finish renaming the file. By the way this is the same way you rename files in Windows.

Step 2)Change the permission of the file to allow for the execution of the code.

This involves a few simple clicks. First you will need to right click the menu, and select properties, at the bottom of the context menu.

PRO USER TIP: context menu
                          keyboard- shortcut.

"shift" + "F10"

*This will only help if the file is selected(highlighted)*

Then the following menu will appear.

Now you will need to click on the "Permissions" tab. The "permissions" tab is located in between the selected "Basic" tab & the "Open with" tabs.

Now all you need to do is to click the check box "Allow executing file as program", and click close the window.



To open up Nautilus with root privileges, you will first need to open the run dialogue, and then type in the following command:

"alt" + "F2"

gksu nautilus

Make sure to substitute <your_user_name> with the user account you are logged in under. If not you will not find the folder when you open Nautilus with root permission. 

This will open up a nautilus file manager with root power.

Enter your password, and select "OK".

Next you will need to navigate to your users Downloads folder.

 

From this screen there are two ways to navigate to the "/" of the file system. You could either use the keyboard shortcut "alt" +   <up arrow>, or you could click on the little Less than sign, and the small hard drive that appears.

select the highlighted home folder.

 You will find a folder within this "home" folder, that is named <your_user_name>; that contains your "Downloads" folder.

I have two user folders within my "home" folder, because I have separate user accounts for me and my roommate. 

PRO USER TIP: In order to use the split view for easy drag/drop of your files within nautilus you can use the "F3" key to toggle split pane view, or navigate the view drop-down menu and select "extra pane". When you are in split pane view the window that has a white background, is the one that is active.

Now you will need to double-click the "Downloads" folder. 

Now that you are within the "Downloads" folder as root, you will need to right-click & select the copy option. 

 

Now you will need to navigate to the / of the file-system, before navigating to the /usr/sbin folder. You can do this by selecting the small Hard drive icon, just to the Left of the home button. From here you will need to double-click on the "usr", and "sbin" folders in turn; until you end up at the following location.

Click through the highlighted /usr folder, and also double click the /usr/sbin folder within the /usr folder. Make sure not to put it in the /sbin directory on the base of the file-system.

congratulations you finally found the /usr/sbin folder.

Now you will need to right click anywhere that is not a file, until you find the following menu; and select "paste".

 

Now your apt-fast script is installed, and here is how you use it. When you would normally use a command like apt-get update, now you will use apt-fast update. It is that simple. 

Let's open a terminal to check it out:

"Ctrl." + "alt" + "t" :opens a terminal window, without having to search for your distribution's terminal program within a burred menu.

PRO_User_TIP: Notice how I added the apt-fast upgrade, and the apt-fast upgrade commands together with the double ampersand symbols; so that I don't have to wait for one command to complete before starting another.

Enter your password when prompted, and don't panic if you don't see anything when you type your password; just do it and press "Enter".

notice the three connection's, all collecting bits of the file; all at the same time.

type "y", and "enter" when prompted by the [y/n] prompts. All activity will stop until you choose "y" or "n".

Done already? verify that all packages are installed properly. If errors are found, run apt-get clean as root and try again using apt-get directly.

Humble bundle 4: Get it b4 it's gone

I am happy to announce that the humble indie bundle 4, was just released yesterday. Now if you have not heard of the Humble indie bundle, then you have probably been hiding under some sort of digital rock for the last year or so.

These games are now fully cross platform on all modern operating systems. What that means is that you can purchase the games, and play them on either your windows, Apple, or Linux operating system. This is super exciting to me because it is a fantastic way to usher in a host of games into the Linux gaming arena. I still run into the myth on a regular basis, that Linux has no good games for it. This couldn't be further from the truth. Actually Linux users in previous indie bundle, have consistently been the most charitable givers.

Did I mention that the proceeds of these games are going to incredible charities. The two main charities are Child play, and the American red-cross.

First off is the child's play charity, which has been around since 2003. Child's play charity works with hospitals worldwide to find what kinds of games and gaming systems can be used in various hospitals to help make the recovery process an enjoyable experience. Let's help bring children in need of hope a light in their dark, and scary times.

The American red cross is a disaster relief organization. These days it seems like every where you turn there is a natural disaster getting ready to strike. When the disastrous Earthquake in Hatti struck, the American Red-cross was there to do everything in it's power to end the suffering of the local Haitian people.

Now for a sneak peak @ the games:

Super Meat Boy

The game I am most wanting to play.

 

Jamestown:

Shank:

 Bit.Trip Runner:

NightSky HD:

Now if you pay above the average price, you also get the following two games. The avg. price was only five dollars and some change when I was there, which was amazing considering the retail value of the games all together is $100 and the proceeds go to charity.

Gratuitous Space Battles:

 Cave Story+:

 

How 2: take screen-shots with Linux.

Many of you have probably noticed how many screen-shots I use within my Blogs, so I have decided to demonstrate just how easy it is to capture screen-shots on a Linux Operating system. 

Most of the time when you want to take a screen-shot of your desktop, you want to either take a picture of either your whole desktop or an individual window. In order to do this you will need to Learn two hot-key keyboard combinations.

hitting the print screen button by itself will take a simple screen-shot of the entire desktop. This is usually abbreviated as "prt scr".

If you are on a smaller computer, the "prt scr" might be a dark blue colo, which is the case on my LGx120 netbook. So when I want to press the "prt scr" key on my netbook I have to hit the "fn" + "prt scr" keyboard combination to trigger a screen-shot of my desktop. On my net-book the "prt scr" button is inegrated with the "pg up"(page up) key.

The next key combination you will need to Learn is the what triggers a screen-shot of the active window on a Linux computer. The key combination is "Alt." + "prt scr". Which also means that if I want to take a screen-shot of an active window, while using my net-book; I have to hit "fn" + "alt" + "prt scr".

What happens next, is what makes taking screen-shots in Linux so much easier than windows. In windows the key combinations are the same, but what happens after a correct key combo press is very different. Watch what happens in Linux:

a screen-shot save preview window, of me starting to write this Blog within Blogger.

Now you may think that I have an incredibly expensive wide-screen at home. This is actually a dual-screen desktop PC, thanks in part to my friend Robert who gave me a second monitor.

If you want to know how to configure you Linux PC, with a dual-screen setup then please check out a previous post here.

If the save in folder is where you want to save your picture, then just click save. You could also just hit enter, or hit "alt." + "S". If you want to save to a different folder, like the a folder that you create just for a series of screen-shots; then select other from this drop down menu.

Windows in contrast does not give you a preview window, of the image you just captured. This confused me when I first learned the windows way. Windows assumes that you already have a window open that you want to place the image in. Once a program is open like an office document, or the GIMP on windows then you paste it in. You can do that with the "ctrl" + "V " keyboard shortcut, or right click and select paste from the context menu options. For a better explanation than I can give please click here.

Wilber the GIMP mascot.

I sometimes choose to use the (GNU Image manipulation Program) to crop, and re-save my pictures.

Here is a short, and simple video that describes how to crop, and re-save an image that you have captured using the GIMP.

 

 Now that will cover your needs 98% of the time. But what if you want to capture a menu in action. You may want to show your viewers what the menu looks like, that you are trying to describe. In Linux you cannot take a screen-shot while there is a window menu active. You also cannot take screens of tool-tips.

That is where the screen-shot tool shutter comes into play. There are many things that you can do with shutter that really help you speed up the screen-shot process, if you are like me and take tons of screen-shots.

main shutter application of shutter.

Shutter features:

• Screen-shot session management.
• Blur sensative data from pictures.
• Highlight important data in multiple ways. 
• Crop your selected picture.
• Set a timer for when to snap the screen-shot.
• Select an active menu, or series of menus for a screen-shot.
• Select an active tool-tip for your screen-shot. 
• Upload to an FTP file server.
• Upload directly to your Ubuntu one account.
• Choose whether or not to include the cursor in your  screen-shot.
• Choose to let shutter handle your key-board combinations, for screen-shot. (aka..."prt scr" && "alt" + "prt scr")

Shutter is included in both the Ubuntu/Linux, and Linux Mint repositories.

Although the preferred way to do this is through the Linux terminal. That way when a new version is available you will have access to it right away. There is generally a lag in time between when a new version is posted to a repository, and when it is available for your distribution's software manager.

If you wish to earn geek credit, and get the newest application updates as soon as they are released; then do the following:

"ctrl" + "alt" + "T" ~ Launches a terminal window

 copy and paste the following commands into your terminal:

 $ sudo apt-add-repository ppa:shutter/ppa

press [enter] when you reach this screen to add the PPA.

{enter password when prompted, and hit return}

gpg keys are encryption keys that verify your software is malware free, and was not corrupted during download.

$ sudo apt-get update && sudo apt-get install shutter

**you may need to type a [y] if prompted.**

 I truly hope everyone who has read this post, has learned as much as I did writing it. It is highly likely that I will write a follow up post on the screen-shot tool "shutter".