Let’s Encrypt Apache With Multiple Virtual Host Files

Over the holidays I converted this site over to use SSL using a free SSL certificate from Let’s Encrypt since the folks at Digital Ocean had written a nice tutorial, How To Secure Apache with Let’s Encrypt on Ubuntu 14.04. The problem was that the installation script partially worked. It created a SSL certificate for multiple hosts but it did not update any of the virtual hosts files. So I had to update the files manually using the template in the /etc/letsencrypt folder. To get an “A” rating from Qualys SSL Server Test I had to download the intermediate certificate https://letsencrypt.org/certificates/. Finally I redirected all of my encrypted traffic to the SSL site. Here is what my Apache host configuration file looks like.

<virtualhost *:80>
ServerName mysite.com 
Redirect / https://mysite.com/ 
</virtualhost>
<virtualhost *:80>
ServerName www.mysite.com 
Redirect permanent / http://mysite.com/ 
</virtualhost>
<virtualhost *:443>
ServerName mysite.com 
DocumentRoot /var/www/html 
ErrorLog ${APACHE_LOG_DIR}/error.log 
CustomLog ${APACHE_LOG_DIR}/access.log combined 
SSLEngine on 
# Intermediate configuration, tweak to your needs 
SSLProtocol all -SSLv2 -SSLv3 
SSLHonorCipherOrder on 
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA 
SSLCompression off 
SSLOptions +StrictRequire 
SSLCertificateFile /etc/letsencrypt/live/mysite.com/fullchain.pem 
SSLCertificateKeyFile /etc/letsencrypt/live/mysite.com/privkey.pem 
SSLCertificateChainFile /etc/letsencrypt/lets-encrypt-x1-cross-signed.pem 
</virtualhost>

R Portable Version 3.2.0 has been Released! Download R Portable for free! http://bit.ly/1OuYdJM via @sourceforge

R Portable Version 3.2.0 has been released and is available at the R Portable project page, http://sf.net/projects/rportable/. Please update RStudio to the latest version to avoid the “Error in tools:::httpdPort < = 0L" error when using RStudio with R 3.2.0.

How To Quickly Install Packages With A New R Installation

Okay, Joel, here it is. I got these instruction off of the Internet but I do not remember who was the original source.

  1. I keep this file in a RStudio project I call installed_packages.
  2. Before I upgrade I run the first two line to update the package_list.
  3. After I upgrade I go back to project, un-comment the install.packages line and run it.
  4. I also have a line in there if you want a csv copy of the installed packages.
#Get currently installed packages

#work
package_df < - as.data.frame(installed.packages())
package_list <- as.character(package_df$Package)
#write.csv(package_df, file = "package_df.csv")
#Re-install Install packages
#install.packages(package_list)

A Better Windows Command Prompt

This month I have been fooling around with ConsoleZ. ConsoleZ by Christophe Bucher is the open sourced Windows Command Prompt replacement and is a fork of the more popular replacement application, Console2 by Marko Bozikovic. Since I was already using Console2 I already had customized tabs for Windows Command prompt, Ipython, Powershell, MinGW shell, and some custom DOS/Powershell applications. One of the tabs I wish I had was a DOS prompt with Administrator access. So I searched the web and found that Ben Garrett had solved that problem and few others I did not know I had in his post, Create A Better Windows Command-line Prompt. So I added an Administrator console tab, ANSI color, a DOSKEY macro to start Notepad++, GOW, and a colorized version of ls. It is almost as functional and colorful as a Linux prompt now. 😉 Here is what it looks like.

ConsoleZ

Over 90 percent of data breaches in first half of 2014 were preventable

This ZDNET article, “Over 90 percent of data breaches in first half of 2014 were preventable”, had me intrigued but it was their summary that really caught my attention. Since the latest explanation of how the North Koreans hacked Sony was that they stole a system administrator’s password by some method that is not discussed but vaguely confirmed by the NSA, we would have to conclude that the Sony breach was probably a staff mistake.

The Online Trust Alliance says that a high percentage of data breaches were the result of staff mistakes — rather than external hacking.

dpd_graphic_2015_final_150px_1According to a recent Online Trust Alliance press release about 47% of data breaches was the result of staff mistakes and 40% were the result of external intrusions. Here is what they said.

OTA also announced that it has analyzed over a thousand breaches involving the loss of personally identifiable information (PII) in 2014, as reported by the Open Security Foundation (OSF) and the Privacy Rights Clearinghouse. OTA found that only 40 percent were the result of external intrusions, while 29 percent were caused by employees—accidentally or maliciously—due to a lack of internal controls. The balance of incidents were primarily attributed to lost or stolen devices or documents (18 percent) and social engineering/fraud (11 percent).

If The Sony Hack Was An Inside Job, When, Why, And How Did North Korea Decide To Plant A Spy At Sony?

There are a lot of loose ends with the Sony hack that bother old IT guys like me. Kim Zetter in the article, The Evidence That North Korea Hacked Sony Is Flimsy, makes the point that nation-state attacks are not normally this noisy. This attack was public and filled with revenge-filled rhetoric that sounded distinctly non-North Korean.

Marc Rogers in the article, Why the Sony hack is unlikely to be the work of North Korea, goes a step farther and says an insider is the likely culprit.

3. It’s clear from the hard-coded paths and passwords in the malware that whoever wrote it had extensive knowledge of Sony’s internal architecture and access to key passwords. While it’s plausible that an attacker could have built up this knowledge over time and then used it to make the malware, Occam’s razor suggests the simpler explanation of an insider. It also fits with the pure revenge tact that this started out as.

So if we are to assume that the attack is from North Korea, we have to ask when, why, and how did they plant a spy at Sony? The mainstream news media seems to be proceeding under the premise that the North Koreans could walk into Sony either literally or electronically and collect extensive knowledge of Sony’s architecture including key passwords in a relatively short period of time. I think this supports main stream media’s agenda that this is technology problem all we need to do is install the latest and greatest firewall. The reality is that this type of hack is typically an inside job so it is a primarily a personnel rather than a technology problem. In most major corporations this type of broad access requires lots of time since security is compartmentalized and transferring passwords to new people is dependent on developing trust. Password management in a large corporation like Sony can be further enhanced by delegating password control to different people. In this case the passwords for administering email, human resources and accounting systems are probably controlled and periodically changed by the people who have operational control of those systems. So if the insider working for the North Koreans is a new hire or contractor then they must have been inserted into Sony months ago. This begs the question of why did the North Koreans target Sony months ago, develop such a sophisticated operation, and then release detailed information about this operation to the world. All of this work for a movie! The North Koreans may be crazy but I do not think they are stupid!

If this hack is not North Koreans consumed by revenge over a movie, we have to conclude the insider was a long time employee or contractor who got the data directly off the servers or via malware installed on certain key computers. We are looking for a person with a Edward Snowden profile. Although some people who are skeptical of the North Korea explanation see a government conspiracy, my guess is our law enforcement agents are temporarily feeding the public misinformation to buy more time to complete the investigation and arrest the suspect while still in the United States.

For a detailed list of the Sony hack events check out the Riskbased Security article, A Breakdown and Analysis of the December, 2014 Sony Hack.

Strengthening 2-Step Verification with Security Key – Part II

A couple of days I ago I wrote the post, Strengthening 2-Step Verification with Security Key, and yesterday I got the security key. I guess parcel post from France is pretty quick! I had to reboot the computer before I could get the hardware drivers to install. It took about two minutes to register the key with both of my gmail accounts after it finished booting. Pretty cool!

Today I tested it at work. The first step was to insert the security key and let Windows 7 install the drivers. Once again my luck installing the drivers was better after I rebooted. Then I cranked up Chrome and went to gmail. Google asked me to login. After I entered the password, it asked me to install the security key. In a couple of seconds it had validated and I was redirected to my inbox. I took the key out and put it back in my storage bag. Although I have entered my password several times as I browsed my security settings, it did not require access to the security key.

The last task was to create an app specific password for gmail for those applications that will not use the security key.

Strengthening 2-Step Verification with Security Key

I was reading the Google article, Strengthening 2-Step Verification with Security Key, and decided to see how much strengthening my security would cost. Everyone says they want better security until they see the price tag. Surprisingly a security key does not cost much. The cheapest key on Amazon comes from Plug-up International, costs $5.99 with $2.00 postage, and my estimated delivery date is November 10. I can do that!

An Interesting Wrinkle On Credit Card Fraud

Yesterday we ran into an interesting new wrinkle on credit card fraud. A customer called us because they did not recognize a credit card charge on their bill. We had an order in our system with the correct billing address but they did not know the person the order was being shipped to. This is the typical way we find out about credit card fraud but this time when we called the person who it was being shipped to and she answered the phone. This was a first! She said that her husband probably ordered it and told us to call him. So we called him and he said he had ordered not one but two pumps from an auction site. Sure enough our order system said we had shipped a second pump to his wife using a completely different credit card and billing address. This is the first incident we have seen in which an auction site was used to launder money for stolen credit cards! Fortunately FedEx had not delivered either pump so we asked FedEx to return the pumps to us. Today we called the second customer and confirmed that they were unaware that their credit card had been stolen. We told them that a credit card refund had been processed and recommended that they notify their credit card company of the fraud. In this case the people whose credit card data was stolen did not lose any money. Typically we lose both the product and the shipping costs so we are pretty happy to get the products back. The biggest loser is the guy who thought he had won a legitimate auction for two pumps. I do not know how he paid for it but if he is fast enough he may be able to process a charge back.

In case you did not already know Home Depot had a data breach that is pretty similar to the Target breach. Since I am one of those Home Depot customers who are at risk, I took them up and signed up for their free identity protection from AllClearID. Like the first customer I plan to check my card activity several times a week.

Fixing WordPress SEO Sitemap Problems

I decided to switch over to WordPress SEO(Yoast) yesterday and ran into a slew of problems with their sitemap generator, a 404 error, a blank screen, and a sitemap.xml not being properly re-directed to the new sitemap_index.xml. The first problem led me to this Yoast knowledge base article, My sitemap is giving a 404 error, what should I do? I fixed the first problem by adding the code to my .htaccess file. To fix the last two problems I added the RewriteRules for the xsl statement(Line 8) and the sitemap.xml(Line 5). Now both sitemap.xml and sitemap_index.xml are being properly redirected and formatted. My Google Webmaster Tools is happy!

Note: The code below is for a WordPress blog in a sub-directory called wordpress.

# WordPress SEO - XML Sitemap Rewrite Fix
RewriteEngine On
RewriteBase /wordpress/
RewriteRule ^sitemap_index.xml$ /wordpress/index.php?sitemap=1 [L]
RewriteRule ^sitemap.xml$ /wordpress/index.php?sitemap=1 [L]
RewriteRule ^([^/]+?)-sitemap([0-9]+)?.xml$ /wordpress/index.php?sitemap=$1&sitemap_n=$2 [L]
# This rewrite ensures that the styles are available for styling the generated sitemap.
RewriteRule ^/([a-z]+)?-?sitemap\.xsl$ /wordpress/index.php?xsl=$1 last;
# END WordPress SEO - XML Sitemap Rewrite Fix

R Portable Version 3.1.1 and RStudioPortable Version 0.98.977 Are Released!

R Portable Version 3.1.1 and RStudioPortable Version 0.98.977 have been released and is available at the R Portable project page, http://sf.net/projects/rportable/.

  • R Portable Version 3.1.1 incorporates the 3.1.1 version of R in a portableapps format.
  • RStudioPortable Version 0.98.977 incorporates the 0.98.977 version of R Studio in a portableapps format.