Have I been pwned?

Greetings, weary tech[no] traveler!

Breached databases are a common occurrence in this digital age we live in.  Login credentials are leaked onto the internet all the time.  Adobe, Snapchat, Dominos Pizza, are just a few of the countless companies and institutions who had their costumers account information stolen; including usernames, email addresses, and passwords (more like password hashes).  At the beginning of 2015 many costumers of companies, such as Intuit (known for their Turbo Tax software) and the University of Oregon, became data breach victims.  Most of the time they're rarely notified that their data has been compromised and available to anyone on the internet, for long periods of time.  This is the polar opposite of good!

Despair not!  There is website that will tell you if your email address was found in a leaked user credentials database.  It's called haveibeenpwned.com.  It's a pet project of a heavy weight champion in the world of web security, Troy Hunt.  Just enter in an email address.  The site will check it's database of breached sites and return it's results to you.

You're probably thinking "Wait a sec...I bet whoever is running this site is harvesting email addresses!  Why should I believe the Tech[no] Survival Guide?".  You don't have to believe me.  Check out the details for yourself.

Not only does haveibeenpwned check single email address through it's web interface, it also provides a handy API.  So, you can write your own programs that use this awesome service!  Which is what I did.  I wrote a handy python script, called checkpwnedemails, that is capable of checking a single email address or multiple email addresses right from your command line interface.  Also, it can write the results to a (tab delimited) text file.  Which can be useful for reports, or storing in a database for later analysis.  It's free (as in, free beer) and open source.  You can get a copy of it from here.

To use checkpwnedemails, you need to have a python 2.7 (or greater) installed on your computer.

To check a single email, type the following command:

python checkpwnedemails.py -s <email_address>

To limit the results to breached websites:

python checkpwnedemails.py -b -s <email_address>

To limit the results to login credentials found in paste sites (such as pastebin):

python checkpwnedemails.py -t -s <email_address>

To check multiple email addresses, provide a text file listing the email addresses you wish to check (one address per line):

python checkpwnedemails.py -i <list_of_email_addresses>

If you want the results to only contain email addresses that were pwned, pass the -p option, like this:

python checkpwnedemails.py -p -i <list_of_email_addresses>

Of course, the -b and -t tags can be used as well.

If you want to print the results to a (tab delimited) text file:

python checkpwnedemails.py -i <list_of_email_addresses> -o <name_of_output_file>

If you did not provide the -b or -t option, then two files (one for breaches and one for pastes) will be created by default.

If you find that your email address(es) was in haveibeenpwned's database, it would be in your best interest to immediately change the password of the corresponding account.  As a matter of fact if you (or someone you know) are one of those people who use the same password for everything, then change all your passwords (and use a different password for each account!).

Ubuntu 14 and Apache and MoinMoin! Oh my! (Part 1)

Greetings, weary tech[no] traveler!

Sure has been a while since the last post, hasn't it?   I could go on about why I haven't posted in a while, but why?  You're here to find out how to serve up a wiki, right? 

Recently I had to set up and configure and a wiki site, complete with https and SSL certificates.  For this task, I decided to use what I called the MUA (MoinMoin, Ubuntu, Apache) stack.  We're all familiar with the greatness of Ubuntu and Apache, but out of all the wiki solutions that are available why did I choose MoinMoin?  MoinMoin is a free and open source wiki solution, that is easy to install, configure, and use.  Plus, it's written in python.  As a python fanatic, I have a bias for anything python related.

So, let's get down to it!  Log into your shinny new Ubuntu 14.04 server and install Apache, as well as MoinMoin and the mod_wsgi apache module:

sudo apt-get install apache2 python-moinmoin libapache2-mod-wsgi -y

Once Apache, mod_wsgi, and MoinMoin are finished downloading and installing, enable mod_wsgi by running the following command:

sudo a2enmod wsgi

Next, let's configure MoinMoin.  You can name your wiki site anything you want, but for the sake of example let's call the wiki in this example, humboldt.  In the interest of modularity, let's configure MoinMoin so that we can serve more than one wiki later on down the road.  At the command line, create a directory for our wiki site, and copy our wiki config and wsgi config files:

sudo mkdir /usr/share/moin/humboldt
sudo cp /usr/share/moin/config/wikiconfig.py  /usr/share/moin/humboldt
sudo cp  /usr/share/moin/server/moin.wsgi   /usr/share/moin/humboldt

Next, we'll configure our wsgi file for humboldt.  Open /usr/share/moin/humboldt/moin.wsgi in a text editor of your choice.  Once opened change the following line:

sys.path.insert(0, '/etc/moin')

to:

sys.path.insert(0, '/usr/share/moin/humboldt')

Now, let's configure our wiki config file, wikiconfig.py.  This is the file that you will edit to make configurations that are specific to humboldt only.  For now, let's change the site name and interwiki name for humboldt.

Using vim, I made the following changes to wikiconfig.py:

sitename = u'Humboldt Wiki'
interwikiname = u'HumboldtWiki'

There are lots of ways to configure MoinMoin.  However, the details of wikiconfig.py is not within the scope of this post since I'm only going to cover how to install MoinMoin as well as serve it with Apache, using mod_wsgi.  I'll talk more about that in a future post.

We need to add our configuration of humboldt to MoinMoin.  First, we must create a config file specifically for humboldt.  To do that:

cd /etc/moin
sudo cp mywiki.py humboldtwiki.py

Then edit humboldtwiki.py.  Change it so that the class Config looks something like this:

class Config(FarmConfig):

    # basic options (you normally need to change these)
    sitename = u'HumboldtWiki'
    interwikiname = u'HumboldtWiki'

    # name of entry page / front page [Unicode], choose one of those:

    # a) if most wiki content is in a single language
    #page_front_page = u"MyStartingPage"

    # b) if wiki content is maintained in many languages
    page_front_page = u"FrontPage"

    data_dir = '/usr/share/moin/humboldt/data'

    data_underlay_dir = '/usr/share/moin/humboldt/underlay'

Save and close the humboldtwiki.py.  Then within the same directory, open and edit the wikis variable, in file the farmconfig.py, to look like this:

wikis = [
    ("humboldtwiki", r"^http://humboldtwiki\.example\.com/.*$"),
]

Adding our wiki to the wikis variable in this fashion will allow us to add another wiki instance in the future (if we so choose), with little effort.  It never hurts to plan ahead!

Save and close the farmconfig.py file.

Now that we've done the initial setup and configuration of our MoinMoin wiki site, let's move onto creating and configuring our apache config file for it.  At the command line:

cd /etc/apache2/sites-available
sudo vim humboldtwiki.conf

Again, you don't have to use vim.  Just use whatever text editor you like.

In your new, blank, apache config file add the following:

# create some wsgi daemons - use these parameters for a simple setup
WSGIDaemonProcess moin user=www-data group=www-data processes=5 threads=10 maximum-requests=1000 umask=0007 display-name=wsgi-moin

# use the daemons we defined above to process requests!
WSGIProcessGroup moin

<VirtualHost humboldtwiki.example.com:80>
  ServerName humboldtwiki.example.com
  ServerAdmin webmaster@example.com

  WSGIPassAuthorization On

  DocumentRoot  /usr/share/moin/humboldtwiki

  WSGIScriptAlias / /usr/share/moin/humboldtwiki/moin.wsgi

  <Directory />
    Options FollowSymLinks
    AllowOverride all
    Allow from All
    Require all denied
  </Directory>

  <Directory /usr/share/moin/humboldtwiki>
    AllowOverride All
    Allow From All
    Require all granted
  </Directory>

  ErrorLog /var/log/apache2/humboldtwiki-error.log

  LogLevel warn

  CustomLog /var/log/apache2/humboldtwiki-access.log combined
</VirtualHost>

We're almost done.  Now we need to create a symlink in Apache's "sites-enabled" directory, to the config file we just created.  After that, we'll need to restart Apache.  At the shell prompt, enter the following commands:

cd /etc/apache2/sites-enabled
sudo ln -s ../sites-available/humboldtwiki.conf .
sudo service apache2 restart

Voilà!  Now you're serving up a MoinMoin wiki site, using Apache and mod_wsgi!

However, if you plan on keeping data sensitive wiki pages, you'll want to force https on the users.  If you're interested in using https with MoinMoin, check out Part 2 of Ubuntu 14 and Apache and MoinMoin! Oh my!

Update the locate database in OS X Mavericks (10.9)

Greetings, weary tech[no] traveler!

A great command to help find files via the Unix command line is "locate".  Not only is it simple to use:

locate <name of file>   (without the '<' and '>' characters)

but it is quick to return results too.

To do this, the "locate" command relies on a local database to index and, furthermore, return results to you quickly.  Therefore, this local database needs to be updated periodically.

Unlike most other Unix based operating systems, simply running "updatedb" in the OS X (10.9 mavericks) terminal won't work.  So how do we update the locate database for OS X Mavericks (OS 10.9)?  Like this:

1.  Launch terminal

2.  Change your user session to root:
     sudo su -  (then type your password)

3.  Go to the directory /usr/libexec/
     cd /usr/libexec/

4.  Run the following command to update the locate database:
     ./locate.updatedb

After a minute (or 5) your locate database will be updated, and you can continue to use your command line.

It should be noted that this will only work for those who have sudo privileges to their machine.  For good practice, remember to log out of root when you're done (by typing 'exit' at the command line).