My Operating System Journey

My current primary desktop: KDE Neon LTS

It's interesting to think back on how my sentiments about what an OS should or shouldn't be have changed over the years. My current opinion is "Every OS sucks, it's a matter of choosing the one that sucks the least for you", which for me is currently KDE Neon LTS, but more on that later.

I'm relatively young, The first computer I ever got was an old hand-me-down Compaq that's probably still collecting dust in my parent's garage. I was around 11 at the time, and it came with Windows 95 on it. My dad had a copy of Windows 98SE available for me to upgrade it, so upgrade it I did! It was cool having a computer in my room, though when I wanted internet, I had to run a 150ft ethernet cable from my computer all the way to the other side of the house to plug it in (After a few months of doing this, I was able to finally convince my dad to properly install ethernet for me). Those first couple of years were pretty uneventful. I just did normal computer stuff that anyone my age would do (pokemon, neopets, etc) but from the comfort of my own room rather than fighting over the family PC. The Operating System didn't matter much.

Computers came and went. I used Windows XP and then for Christmas one year, I got my own brand-new computer running... Windows Vista. Honestly, I should have been much more grateful than I was. The computer was actually pretty decent and properly specc'd to run Windows Vista, which was the biggest problem with the OS at the time. However, being that it was a new computer (meaning it didn't come with much software) and being that I was a poor high school student at the time it did leave me down the wonderful world of open source via OpenOffice.org, and later Linux (Downgrading to XP wasn't an option for me, so that just left Linux). The first Linux distro I tried was Ubuntu 7.04. It worked, and things were good, but I never fully switched. For me, at the time, Windows Vista did what I needed with the least amount of hassle.

Somewhere along the way I was given a hand-me-down laptop that had all sorts of problems with Windows XP on it and no recovery disks. I put Lubuntu on it and I was pretty happy. It served me well for a while there. As I continued in my education I came across a need to use MS Access, so I got a new laptop with Windows 7. I put Kubuntu 10.04 on it and enjoyed a dual-boot. While using this laptop, I was pretty evenly split between Windows 7 and Kubuntu, probably because I made booting into Windows 7 so painful to improve security by using TrueCrypt with the boot image stored on a flash drive, so I could only boot into it with the flash drive plugged in.

Then I built my own desktop... and I felt no need to put any linux distro on it. I continued to play with Linux distros like Lubuntu, Arch, and Fedora (and various Windows Server OSes) in virtual machines for the next few years, but I felt no reason to switch to Linux for my main OS. Windows 7 did what I needed. It was the beginning of the pragmatic approach to my OS choice. I built the PC specifically for gaming, so why would I use Linux? Windows did what I needed at the time better.

Somewehre along the way I decided I needed a NAS, and decided to build my own. I had already used both Linux and Windows server OSes in my professional work at this point, and knew instantly that I wanted it to run Ubuntu

Then came Windows 8. Oh how I hated Windows 8. The start screen and deep integrations with Microsoft's cloud were incredibly off-putting. For those reasons, I never upgraded to Windows 8, nor Windows 8.1. However, I was still into gaming and I thought Microsoft might straighten out by the next release.

Then I saw Windows 10. I instantly knew there was no future for my personal computing in Microsoft's OS. I have no interest in Microsoft's cloud or having my information collected by yet another company. I started a clock; I wouldn't be using Windows as my primary OS after Windows 7's End of Life.

In the end, I beat that timeline easily. I no longer play games all that much, and those I do play work well enough in Wine. I finished finding alternatives for software I need and regularly use earlier this year and switched to Linux full time. In my next PC build I plan on buying components that will allow me to do VGA passthru, but it's more of a "just in case I want to".

For the distro, I settled on KDE Neon LTS because I quite like the KDE stack and Qt framework and quite like the Ubuntu base. Is it bug-free? No, but I've yet to use an OS that is bug-free. It does what I want the best, though. Which, what I want is easily getting the software I want, automated patching of just security updates and some specific other core packages like Google Chrome, and good documentation with a decently-sized online community that has some buy-in from the corporate software world (I don't live free of proprietary software). Fedora and Debian, while fine OSes, just don't quite meet all my needs without too many additional hoops. Arch's bleeding edge was initially appealing, but I care more about staying up and staying secure than I do about having the latest version of nmap. Also, while I know some people love AUR, I personally love automated security updates much more than I liked AUR. None of that is meant to bag on your OS, as they are all fine linux distros, just not the right one for me.

Oh, and yes, I've used MacOS too. both as a Hackintosh and on official hardware. I personally was not a fan of the UI, especially the UI of Finder. The way many default system packages were really old (like Bash) and the general philosophy of Apple were also big negatives for me. Whenever I use it, I only feel productive when in a terminal, and even then I just am meh about the experience.

So I guess I could be classified as an Ubuntu fanboy if you want. Until something else checks off all my checkboxes and gives me a good reason to switch, I plan on staying with KDE Neon LTS.

Read More

Proper Computer Infection Triage

It's been a looong time since the last time I've cleaned up an infection. I do my best to keep it from happening on my computers that run Windows as well as those I manage. Of course eventually something gets through. Yesterday (my day off since I work Saturdays), I got a call from the office about a computer acting weird. It turned out it was the System Care Antivirus rogue software. According to file timestamps, infection occured around 1:34 PM. I was notified approximately 10 minutes later.

Like a stroke, I believe that fast action is important, and the mnemonic FAST still applies, albeit a bit differently, as it relates to triage instead of identification:

• F[ull stop]: Once you think you're infected, don't do anything with the computer.
• A[lert (me)]: I need to know ASAP
• S[hutodown]: I'll do it if I'm there. Otherwise Get that computer turned off asap (usually a hard poweroff. I'd rather have a single PC damaged than risk malware spread over the LAN)
• T[ime]: This one stays the same. Time is important. The longer a virus has to act, the more extensive the damage, and the less likely infection removal will be the right course of action. Files may be irreversibly damaged without a reinstall and you just never know.

As hinted  in that last one: I'm a strong believer in disk imaging. Clonzilla is awesome; RedoBackup is great for those who want a GUI. Haven't gotten around to messing with FOG, but it's definitely a project that interests me (and of course Windows 7 and 8 can create an image natively as well as some Server-side ways via Windows Server). I don't usually deal with viruses, because it takes more time to clean up the mess than it does to restore an image. This time was an exception. The EHR software we use at work had been upgraded, along with some other programs on that particular computer. I hadn't imaged it since these upgrades (my bad). It would have taken longer to install those programs (as with some of them, all other clients need to be exited before a new client can be added) than it would have taken to clean it since triage had been followed. Had triage not been followed, I probably wouldn't have tried. Triage really makes that big of a difference in my opinion.

So now to explain FAST.

F -- Full Stop

Many infections start out as a simple file that was able to execute itself in the %AppData% area of your computer. It doesn't have much permissions yet and damage is usually not that bad. It will then try to trick you into giving it more power by clicking on something. By stopping everything and not touching anything, you can in many cases stop the virus in its tracks. This wasn't the case this time. It looks like the virus used an exploit in Adobe Flash Player to infect a bit worse -- more on this later.

A -- Alert (me)

If you aren't computer savvy, now is the time to get help. In the case of my office, I'm the one alerted. The sooner the problem is brought to the attention of others, the more easily it will be resolved. If you are at work, please note this: you will not be able to keep an infection a secret. Eventually it will come out. All you are doing is putting your coworker's computers, and the business at risk. Tell someone and tell them fast. I am quite proud how well it was handled. The person whose computer was infected told the office manager, who promptly instructed her to call me, just like it should have been done. It was beautifully handled.

S -- Shutdown

This one goes along with Full Stop. If the computer has been truly compromised (which the alerted person should be able to tell), then it's time to power that bad boy off. Some malware will try to stop this. Solution: Hit the switch on the power cord. A hard power off is much better than other computers getting infected. I instructed the coworker to turn off the PC and it stayed off until I got there. She was given a laptop to work on in the mean time.

T -- Time

Time is of the essence in an infection. Just like in a real medical emergency, triage is designed to quickly ascertain the severity of the problem. The longer it takes to triage, the more at risk the bad cases are. In the case of a computer infection, the longer it takes to get a PC squared away the worse it is going to be and the less likely cleanup will be at restoring a PC to its former glory.

I have two time counters: The first one is time from infection until the end of triage. I give this 30 minutes. If more than 30 minutes have passed and the PC is still being actively used, most likely that infection is going to be in every nook and cranny of the PC, maybe even jumping across the network. The second time is cleanup time. This one is 60 minutes. If no progress on cleaning up the infection has been made in one hour, it's probably time to wipe and start from scratch. Infection cleaning is a race against the clock in every aspect. The longer you spend cleaning, the more appealing the wipe-and-reinstall method will be. I find one hour to be a good compromise. If I've made good progress and everything seems in order by then, I'll continue cleaning up the infection. If I haven't even come close to getting it under control then it's time t wipe and reinstall.

My Case

As mentioned, this was my first cleanup in a long time. My first cleanup in years in fact. It was quite pleasant. Or at least as pleasant as a cleanup can be. I contribute most of this to the triage method described above. None of the network shares were infected and the PC is back up-and-running.

The infection appears to have been due to an outdated Flash Player install. I don't know how that happened. It should have been updated, but wasn't. The user had visited a website (the website in question seems to have been compromised. It doesn't appear to have been a malware website) and then wham, the popup of System Care started sceaming its alerts at her. She did the best next move by telling the office manager. The office manager than told her to call me. I got the call. I told her to shut down and she got a laptop. I arrived the next day and started cracking.

First, it was taken out and brought back to my office room. It was disconnected from the network and booted up into safe mode. I had done my research beforehand and quickly deleted the files and removed the registry entry related to the malware via the command prompt. Total time? A few minutes (spent more time getting the PC to my room than deleting these files). All was looking good so far, so I booted into Windows normally, expecting the worst. I booted in to windows and it wasn't bad. I was able to launch things and it wasn't a problem. First I launched the antivirus software (Vipre Business). Lookie there! It had caught two files. It may not have been a full success, but it did catch part of the malware and was probably why it was so easy for me to delete it manually with no problem (along with the blitzkrieg tactics in my removal methods). So now it was time to get some better malware scanning software and get the AV up to date.

Before I did that, I noticed that there was an Action Center alert. Apparently the malware had disabled Windows Security Center Service. I went into services to try and re-enable it when I saw it didn't exist. Uh-oh. Looks like the malware did more than I initially thought. Most likely it deleted a few registry values, causing the service to disappear. Knowing that, I decided to gamble on a System Restore. I consider System Restores a gamble because many malware programs will infect them, so when you restore them, you just end up restoring the malware too. I thought "if this doesn't work, I won't have wasted much time and I'll just wipe and reinstall" that way I don't waste much time. I chose a restore point a bit older in hopes that an older restore point would lower the chances since this malware had all of about 20 minutes before I deleted its core files and registry entries.

It was successful! Security Center and firewall and everything were all back after the system restore, and still no traces of the malware! So now I needed Internet access.

Even though I had done some cleanup and everything was looking good, I'm far too paranoid to just plug this computer into the LAN after it's been infected. It won't get LAN access until I've given it a clean bill of health. So what to do? I don't have a secondary Internet connection to use. This is where my Quarantine LAN comes into play. Using a DD-WRT router and some iptables rules, I made it so the desktop could connect to the Internet, but not to any computer on the LAN. Using a different subnet for the quarantine router and blocking the DHCP pool of the servers outside of it, I guaranteed that this computer couldn't infect my LAN even if it was filled with the nastiest of nasty malware (which is wasn't at this point). So then I went on and installed some more antimalware stuff and updated all the cleanup tools to the latest definitions and versions. CCleaner took care of any temporary files, with me cleaning up some it missed manually. the antimalware software was humming along, removing traces in cached and temporary files every now and then. It was the log in Vipre that informed me that it seems Adobe Flash Player related. The computer this entire time hasn't been exhibiting any infected signs: everything was running fine and nothing weird was going on. After a few runs with the various scanners, things were coming up clean. HijackThis logs were clean of anything worrying too. I put the PC back and that was it.

I ended up spending a few hours due to me being cautious. Rebooting, rescanning, scanning with all sorts of things. It eats a lot of time, but I wanted to be confident in my clean bill of health before I put it back in place. During the time I was also running scans on the network shares and other computers just to be safe.

In the end, it was a pretty successful cleanup story. And for the future? Well, I might implement Click-to-Play for flash content now.

Read More

Expanding C: Partition on Win2k3 and Remote GParted

As I mentioned in my last post, the C: partition on the Windows server at work had become completely full. I immediately did some temporary stopgaps to hold her over until I could properly repartition her. Today was that day.

Repartitioning modern Windows (Server 2008+, Vista+) is no problem, as you can do it with the included disk management utility. XP and Server 2003(R2) are different, as the disk management utility isn't nearly as capable. This server is a Windows Server 2003R2, so I had to use a third-party utility. For home users, the EaseUS Partition Manager family is pretty good. For a corporate server, though, it's $160. I wasn't approved for spending that (For good reason, the server is slated for replacement in a year or so, so the money would have been wasted in the long-run), so had to go with free options.

I ended up going with two different tools: one for shrinking the data partition and one for expanding the system partition. I used GParted to shrink the data partition and ExtPart to expand the C: drive. The reason being that Windows doesn't really like GParted and sometimes it'll require a repair action from the Windows disk when messing with the C: partition. I didn't want to deal with that and ExtPart is a small, simple, free utility for extending a partition (hence the name) from within Windows.

The day started at 8:40 am. I fired up CloneZilla and cloned the hard drive. If there was a power outage or some other freak accident during the repartitioning, I could then simply restore the image in a short time. I always recommend imaging your system before repartitioning for this reason. There are lots of disk cloning tools, I like CloneZilla. I tried doing this the day before, but the version of CloneZilla I had didn't work with my server's RAID card (a SAS 6/iR). I brought a freshly burned copy of the latest CloneZilla release and it recognized my drive just fine. This ran until 12:35 pm.

Next it was partitioning time. I inserted the GParted Live CD and got busy. Unfortunately Dell thought it was a good idea to make the data partition an extended partition. This means I'd have to do an extra action: First shrink the data partition and then shrink the extended partition it resides in. This means it'll take more time. I figured it to be done by 2:30 pm originally, but this would make it take longer. I figured it'd be done by 5:30 pm (it ended up beating my expectations by finishing at just shy of 4:50 pm). I didn't want to stay at work until 5:30 pm, time to get remote access to the GParted Live CD.

This actually proved pretty easy. First I configured the network, which GParted Live includes a nice desktop shortcut to do. Next I opened up a terminal. GParted Live is based on Debian so I did a sudo apt-get update && sudo apt-get x11vnc... This didn't work. Turns out GParted comments out the repos from sources.list. So I did a sudo nano /etc/apt/sources.list and un-commented the repos.

So now to install and run x11vnc:

user@debian:~$ sudo apt-get update && sudo apt-get install x11vnc
user@debian:~$ x11vnc -forever -display :0

The installation pulled a few packages besides x11vnc: libvncserver0, libxssl, openssl, tcl, tcl8.5, tk, tk8.5, and x11vnc-data. It only ended up taking 11.2 MB of more space, so no big deal, my server has plenty of RAM.

The forever flag tells x11vnc server to remain running after a client disconnects. Without that, as soon as you disconnect the first time, x11vnc will stop running. I planned on connecting a few times so I could do periodic check-ins on how GParted is progressing. The display :0 flag tells x11vnc to show the current session instead of creating a new one. It would be useless to VNC in to check on GParted's progress if I was given a new session. I also didn't want to risk x11vnc disconnecting and me being SOL, so I also decided to enable ssh on GParted. This is simple.

First, we need to set a password and configure hosts.allow so I can ssh in. This is done with sudo passwd user to create a password for the user 'user'. Without this you'd have to allow for passwordless login for ssh, which would require more configuration. Easier to create a simple password. Next you need to edit hosts.allow by doing nano /etc/hosts.allow. Add sshd subnetblock. (don't for get the period!) to the end. In my case it was sshd 192.168.1. that I needed to add. Now I just restarted networking and started ssh

sudo /etc/init.d/networking restart && /etc/init.d/ssh start

End result? I drove home at 3:00 pm and started checking on it. I use LogMeIn to remote into the office and then fired up TightVNC to check on GParted

 And then a bit later I saw:

Success! Done! Well, with the GParted part. I drove to the office to finish it up, since GParted will hang after ejecting the CD, and the server itself hangs on a setup in the preboot environment due to an alert I cannot disable.

Upon Reboot, Windows did a consistency check on the data partition, no biggie. I then rebooted again and was almost done. Now I need to expand the C:\ drive with ExtPart

C:\Documents and Settings\Administrator>cd C:\Dell\ExtPart
C:\Dell\ExtPart>extpart c: 15325

That's the default directory ExtPart creates when "installed" (it's a self-extracting archive when you download it). As far as the extpart syntax: it's simple. You specify the drive letter and then the amount you want to expand it in megabytes. In my case, that's c: and 15325. The end result? 26.9 GiB C: partition and 16.4 GiB of free space. I call that a rousing success for an honest day's work.

Read More

Locking Down wifi on Windows without Active Directory

This is a cool trick I've learned recently, and it doesn't seem easily found through Google (but if you know of netsh, you may be able to discover it).

Windows management is best done through group policy, or at least most easily done through it. In fact, you can blacklist/whitelist wifi networks via group policy for Windows Vista+. The problem is that it's only available via AD group policy, not local group policy. At work I don't have Active Directory (but am hoping to by the end of the year), so I can't use this. Still, I'd like to block wifi networks on our wifi-enabled Windows computers. My desire for this came from the fact that someone in the office thought it'd be all right to take a laptop without permission for the purpose of working on public wifi during lunch. As a rule,  laptops shouldn't be just taken without properly being checked out, but sometimes people just think something not-ok is OK. Luckily the person didn't end up using the laptop on who-knows-what public wifi network, but it was a close call and made me look into this.

I found out it was possible with a couple of ye olde netsh commands. I'll show them off on my crappy laptop with a dead battery that I never use because I hate laptops (maybe I'll go into that another time). Before firing them off on my laptop, Windows saw these wireless networks:

Donnerschlag is my wireless network, so let's make it so that's the only option for this laptop to connect to. Open up the command prompt as administrator:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\windows\system32>netsh wlan add filter permission=denyall networktype=adhoc

Followed by:

C:\windows\system32>netsh wlan add filter permission=denyall networktype=infrastructure

That will block all wireless connections, let's see what Windows says:

Looking good, but now I need to add my whitelisted connections:

C:\windows\system32>netsh wlan add filter permission=allow ssid=Donnerschlag networktype=infrastructure

Aaaaand now:

Success! Here's some other useful netsh commands for wireless networks:

Show current filters:

netsh wlan show filters

Which returns something like:

Allow list on the system (group policy)
---------------------------------------
    

Allow list on the system (user)
-------------------------------
    SSID: "Donnerschlag", Type: Infrastructure

Block list on the system (group policy)
---------------------------------------
    

Block list on the system (user)
-------------------------------
    SSID: "", Type: Adhoc
    SSID: "", Type: Infrastructure

You may want to blacklist just certain wireless networks, this is done by setting the ssid as appropriate and permission to block

netsh wlan add filter permission=block ssid=somewifinetwork networktype=infrastructure

There's also the ever-important delete filter command. syntax after netsh wlan delete filter needs to match the same syntax you used to add that filter.

TechNet Library for Netsh wlan

Read More