Adding copyright/creator infos to your photos made easy

Posted on 25/01/2013 by grimneko

I was lately wondering how I could add copyright/creator information easy to my pictures. First I thought after some reading I could have my camera do it for me, but sadly it’s only available on the more expensive cameras. So how we can still do it without much pain? The solution is easy, it’s ExifTool. With it you can easily add Exif/IPTC information to your photos.

ExifTool is a commandline tool for Windows, OSX, Linux and more. On the website you find packages for Windows, OSX and on Linux/others use your package manager. Once installed, it’s an easy task. Open a commandline, navigate into your photo folder, and issue the following command:

exiftool -by-line="[your name]" -CopyrightNotice="© [your name] ; Licence: Creative Commons cc-by-nc-sa 3.0 United States (http://creativecommons.org/licenses/by-nc-sa/3.0/us/)" -artist="[your name]" -Copyright="© [your name] ; Licence: Creative Commons cc-by-nc-sa 3.0 United States (http://creativecommons.org/licenses/by-nc-sa/3.0/us/)" -v0 -progress -E -overwrite_original *.JPG

The command overwrite the original files, if you don’t want that remove the “-overwrite_original” parameter. And yea, don’t forget to insert your name and change the licence to one of your liking. And if you want process whole folders recursive, then add the parameter “-r” to the line.

You wonder why all the stress ? Well, this way people can tell who made the picture and for what they can (not) use the picture. This especially interesting if you post them public like on G+, Flicker and so on where they can spread uncontrolled. Also it helps you tracking them (unless someone remove the infos).

How to tame the B.E.A.S.T. in your SSL

Posted on 24/10/2012 by grimneko

Since I was looking the details how to tame the B.E.A.S.T. (Browser Exploit Against SSL/TLS) once again, I thought I write a few lines down about it. The exploit actually was discovered last year by Juliano Rizzo and Thai Duong. More details about the exploit can be found at h-online.com. To hinder the BEAST from attacking you, one way is to enable TLS 1.1 in your browser, but I plan to go another way.

I actually disable the vulnerable CBC modes. To archive this with apache and mod_ssl/mod_gnutls, do the following:

- mod_ssl:

SSLHonorCipherOrder on SSLCipherSuite !aNULL:!eNULL:!EXPORT:!DSS:!DES:RC4-SHA:RC4-MD5:ALL

- mod_gnutls:

GnuTLSPriorities NONE:+VERS-TLS1.0:+ARCFOUR-128:+RSA:+SHA1:+COMP-NULL

I found this information in the German IT-security forum over at XING.

VirtualHost Overlap on Port 443

Posted on 24/10/2012 by grimneko

When I was fiddeling with mod_gnutls to get full power forward with the new Wildcard SSL Cert I got me, I came across the problem that Apache 2 was whining about the VirtualHost Overlap with a message like this:

[warn] _default_ virtualhost overlap on port 443, the first has precedence

Also, he refused to serve the content from the additional ssl vhost. After a little searching, I found on the page webchalk.hubpages.com the hint that let me fix this behavior. I just needed to add another NameVirtualHost directive to the ports.conf. So now it looks like this:

NameVirtualHost *:80 NameVirtualHost *:443 Listen 80 <IfModule mod_gnutls.c> Listen 443 </IfModule>

With that now I can create my <VirtualHost *:443></Virtualhost> and Apache don’t complain anymore. And with mod_gnutls he also shut up about multiple SSL hosts.

Getting subtitles from YouTube made easy

Posted on 03/08/2012 by grimneko

When I wanted to save me some hillarious video from YouTube I encontered a the problem to get the subtitles since they’re part of the fun. But thankfully I found a solution on Sourceforge called “Google2SRT“. With this lil’ program its piece a cake to grab the subtitles you want (except the automatic generated speech2text ones).

Its very simple to use, just select Web, insert the URL of the YouTube video, hit “Read”. Then he present the found subtitles to you and after selecting which you want just hit “Go”. After that he grabs the subtitles and converts them into SRT (SubRip Subtitles) from where you can easily merge them into a MP4/MKV or edit/convert them into another formats. Since the program is written in JAVA it practially runs where JAVA runs, like Windows, Linux, OSX and more. Used it on a Ubuntu 12.04 (64 bit) and worked fine.

How to get into the hidden menus of a Panasonic TV

Posted on 14/05/2012 by grimneko

First of all, a (usual) word of warning: PLEASE BE CAREFUL AND ONLY PLAY WITH THESE MENUS IF YOU KNOW WHAT YOU ARE DOING! If you do not know what you do there, it’s quite possible to get unwanted effects and in worst case you might even destroy the panel/circuit boards or just lock yourself out of the device^^.

But after that, there are 2 menu’s which you can use. Let’s begin with the more interesting of them, the so-called “hotel menu”. Why more interesting? Well, most settings I can imagine that are useful to you are to be found in this one. To access it press and hold the button “-/V” and while holding it press in a fast sequence the “AV” button or “TV/AV” button (depending on your remote).

Then a new menu opens, and there you find the settings. Here are some hints on what settings save and which put your device in the danger of becoming unusable unless a service tech undo those:

Save ones

“Initial INPUT”: Let you select which input gets selected on startup (like HDMI1/2/3,TV,etc)
“Inital VOL level”: The sound volume at startup
“Maximum VOL level”: how loud can you make them at most, nice to keep the kids from overdoing it^^
“Inital POS”: let you select the TV channel that he selects at startup

Dangerous ones

“Remote lock”: deactivates the remote control
“button lock”: deactivates the buttons on the TV itself

Found those info in the German Hifi Forum here. The picture I found on PC Creator’s blog.

And for those who know what they’re doing and who really want into the so-called “service menu”, you can use it via pressing and holding “-/V” on the tv and at the same time repeated pressing “0″ on the remote. Navigation gets done by the colored buttons on the remote. But I can’t really give any information on that menu, since I don’t have the knowledge, just came along those information at some page.

And a last warning, I don’t take any responsiblity for those information to be correct and/or flawless since those are inofficial and so can be wrong. It is up to you if you want to make use of them or not, and the later results are also your responsibility.

How to fix the blue colorization of videos in Flash 11 on Linux

Posted on 14/04/2012 by grimneko

I had this annoying color bug that showed everything with a blue dust over it, like on YouTube. To fix call a page with Flash and then do a right-click, go to settings. There select the first tab and deactivate the hardware accerlaction. Then load a page with a flash video player, and enjoy watching flash video again. This works only for the Flash from Adobe.

Transfer mail encrypted between the servers with postfix

Posted on 14/03/2012 by grimneko

When I was looking at mailheaders again (it became kind of a hobby, and this proves you learn from it^^) I was noticing one of my incoming mails was transfered via ESMTPS. So far I knew SMTP and ESMTP but ESMTPS was appearently a new. Turned out it was ESMTP via secure transportlayer, or like RFC 3848 defines it: “The new keyword ‘ESMTPS’ indicates the use of ESMTP when STARTTLS is also successfully negotiated to provide a strong transport”. So I became curious, how can I do that too? After a bit searching I came across the setting smtp_tls_security_level in postfix and yes, after setting it to ‘may’ it did the trick. So now if the server supports STARTTLS he opens a encrypted connection with the remote server for the transfer. You need to set a bit more to make it working without any errors, here is what you need to do on a Ubuntu 10.04 (Debian and others should work similar):

sudo postconf -e 'smtp_tls_security_level = may'
sudo postconf -e 'smtp_tls_loglevel = 1'
sudo postconf -e 'smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt'
sudo service postfix restart

We set only smtp_tls_security_level to ‘may’ cause otherwise with ‘encrypt’ the remote server is forced to support STARTTLS, if he does not the transfer fails. So with may encryption gets used when supported. Loglevel 1 gives you a short notice when a safe connection was established and what cipher got used. Like this:

Mar 14 00:22:08 utgard postfix/smtp[11397]: setting up TLS connection to gmail-smtp-in.l.google.com[173.194.70.26]:25
Mar 14 00:22:08 utgard postfix/smtp[11397]: Trusted TLS connection established to gmail-smtp-in.l.google.com[173.194.70.26]:25: TLSv1 with cipher RC4-SHA (128/128 bits)
Mar 14 00:22:09 utgard postfix/smtp[11397]: 6A591E6C2C3: to=, relay=gmail-smtp-in.l.google.com[173.194.70.26]:25, delay=0.9, delays=0.01/0.03/0.13/0.73, dsn=2.0.0, status=sent (250 2.0.0 OK 1331680929 s26si2913819weq.13)

And last but not least, we need to set the path to where he can find the ca-certificates to validate the remote servers certificate. Otherwise we get a entry saying a untrusted connection gets used, means he encrypts but can’t verify the remote identity. In Ubuntu (Debian) inside the chroot path of postfix lies a file containing all ca-certificates, we just need to point postfix to it. The normal path is not accessable from inside the chroot. Thanks to Alain Kelder to point this out. With all that done, our server is good and enabled to send out his outgoing mail to other smtp servers using a secure transport layer. You can go even further and for example force encryption for specific servers on a per-site basis. But since thats not the scope of this article, please refer to the postfix TLS documentation for that. There you find also information how to optimise the encryption by disabling/enabling ciphers and similar.

pam_geoip – Restrict accounts to certain Cities/Countrys only

Posted on 01/03/2012 by grimneko

A friend did ask me, if its possible to block access to his SSH server by blocking via GeoIP which he is already successful using on his webserver to lower the amount of spam he gets (at the cost of potential visitors, but thats his choice after all, right ?). So I dugg a bit in the net, and came across the module pam_geoip.so which allows me based on Maxmind’s GeoIP City Database to block access to services using PAM for authentification. What I show here is a example how to install it and block certain countries using GeoIP City DB lite (aka Maxmind’s free database) from accessing our SSH accounts. This works on a Ubuntu/Debian Linux, for other Distributions/OSes please check if the libary packages named similar. I expect you to have the basic development tools installed already. So let’s start:

sudo apt-get install libgeoip-dev libpam0g-dev
wget http://ankh-morp.org/code/pam_geoip/pam_geoip-0.9.tar.gz
tar xzvf pam_geoip-0.9.tar.gz
cd pam_geoip-0.9
make
sudo -i
cp pam_geoip.so /lib/security/
chown root:root /lib/security/pam_geoip.so && chmod 644 /lib/security/pam_geoip.so
cp geoip.conf /etc/security
chown root:root /etc/security/geoip.conf && chmod 644 /etc/security/geoip.conf
cd /etc/security
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
gunzip GeoLiteCity.dat.gz
chmod 644 /etc/security/GeoLiteCity.dat

When that is done, fire up nano and set the geoip.conf to something similar as this:

#
# /etc/security/geoip.conf - config for pam_geoip.so
#

#<domain>   <service>  <action>  <location>  
*           sshd       deny      CN
*           *          ignore    UNKNOWN

When you’ve done this, fire up nano again to edit this time /etc/pam.d/sshd and add this:

account required pam_geoip.so geoip_db=/etc/security/GeoLiteCity.dat system_file=/etc/security/geoip.conf action=allow

With all this we set the pam_geoip module to default allow, and block all access attempts from Chinese IP’s. Don’t forget to restart the sshd and logout, as we don’t wanna be root longer then needed. You can use way more complex configurations like allowing access to a certain account only in a specific place or within a radius around this place. But for that I would really suggest to buy the premium version of the GeoIP City Database for the higher accuracy. For country-blocking the free should be fine for most of us through. For more complex usage check out the modules website at http://ankh-morp.org/code/pam_geoip/geoip.conf.html. And also checkout the included manpages/config samples. Thanks for help with the installation and the sample to block Chinese IP’s goes to guruway’s blog.

500 OOPS: vsftpd: refusing to run with writable root inside chroot() with vsftpd 2.3.5+

Posted on 05/02/2012 by grimneko

If you encounter this errormessage after a recent update or fresh install with vsftpd 2.3.5 or newer, here is whats happend:

As of vsftpd 2.3.5, the chroot directory that users are locked to must not be writable. This is in order to prevent a security vulnerabilty.

Depending on the configuration you utilize this can be a problem. If so I suggest for the moment to downgrade to 2.3.4 (I’m aware not the best solution!), or change your setup. People with ArchLinux have another solution to this, they can install vsftpd-ext via AUR and then set in the config allow_writable_root=YES. If someone has the patch agains the source for this, I would love to get a copy.

Downloadlinks for 2.3.4

https://security.appspot.com/downloads/vsftpd-2.3.4.tar.gz

https://security.appspot.com/downloads/vsftpd-2.3.4.tar.gz.asc

As soon I find a better solution to this problem, I will write again.

Mounting an iOS 5.0.1 device on Ubuntu – how to fix it

Posted on 08/01/2012 by grimneko

After you upgraded your iOS device to 5.0.1 you probably get an error like “Unhandled Lockdown Error (-15)”. The problem is the shipped libimobiledevice which don’t like iOS 5 devices. To fix it do the following:

In a terminal type: “sudo apt-get install ifuse libimobiledevice-utils” (without the ”
Unlock iDevice from device’s lock screen (only needed the first time), plug it in
In the terminal type: “idevicepair unpair && idevicepair pair”
Unplug the iDevice
Make sure the lock screen is still unlocked
Plug it back in

After that it works fine, even with a locked iDevice (iPhone in my case). Most information for this article came from an article over at askubuntu.com.

Grimneko's blogging space

Another place where some blog about findings, thoughts and more…

Category Archives: Tips