Openssl's weak key generation

OpenSSL prior to 1.0.0 may use its own function for random number generating and it's vulnerable.

After 1.0.0, it may use OS's if available, and if not available, it still use its own.

What keys are used for:
http://www.openssl.org/docs/HOWTO/keys.txt

Vulnerabilities:
http://www.openssl.org/news/vulnerabilities.html


This topic seems to start from Debian platform. And this posts method to test on your platform, Debian based or not. Don't work on cygwin, however.
http://www.debianadmin.com/fix-for-weak-opensslopenssh-keys-in-debian.html

Quote some here:

The Debian team has provided a tool that can be used to determine if any such weak keys exist on the system, and it can be run by anyone, regardless of whether they use Debian or not. To begin, download the dowkd.pl perl script and use it to test SSH keys of the host system:

$ cd ~/tmp

$ wget http://security.debian.org/project/extra/dowkd/dowkd.pl.gz

$ wget http://security.debian.org/project/extra/dowkd/dowkd.pl.gz.asc

$ gpg --keyserver subkeys.pgp.net --recv-keys 02D524BE

$ gpg --verify dowkd.pl.gz.asc

$ gunzip dowkd.pl.gz

$ perl dowkd.pl host localhost

This will download the dowkd.pl perl script and also import a Debian security team member’s key from subkeys.pgp.net. If the archive verifies okay with gpg, unarchive it, and then run the script in host-checking mode against the localhost.

If the script detects that the host key is weak, it will indicate such. Next, run the script against user keys on the system:

# perl dowkd.pl user

This check should be run as root in order to obtain access to every user’s keys. The script will check the keys and also the authorized_keys file and will alert you if the fingerprint to a remote host indicates a vulnerable key as well. If you wish to check a specific user, append the user name to the command:

# perl dowkd.pl user ruchi

If the script indicates that any keys are weak, they should be removed and regenerated immediately.

Some more links:
http://www.debian.org/security/2008/dsa-1571
http://www.us-cert.gov/cas/techalerts/TA08-137A.html

Some comments on choices=headaches from More Joel on Software

The example doesn't make too much sense to me until I see:
Each additional choice makes complete sense until you find yourself explaining to your uncle that he has to choose between fifteen different ways to turn off a laptop.

It really hurts my ball when I tried to explain something similar to my father...

Days ago, I need to design a config file per request, and my original opinion is "KISS". To re-use existing config file(a stupid txt) may seem too naive, stupid and not popular at all. However, I did prefer to a little bit better choice-ini file a lot to popular "xml" type. It's only simple request internally, thus, less choices/less effort makes sense to me.

Interesting article on memory leak

From codeproject, I may try it some day since I was stuck with howto find out memory leak in Openoffice.However, the issue in OO mainly comes from share_pointer, much harder to detect.

http://www.codeproject.com/Articles/393957/Cplusplus-Memory-Leak-Finder

Why not stl?

There has been such opinion for a while. However, it's not the time I should know why not stl now, maybe. Put a discussion thread from stackoverflow here for reference.

I hate template, since it makes debug process much more complex. Sometimes, it does help save a lot of coding, to admit it or not .
http://stackoverflow.com/questions/266523/drawbacks-to-templates-and-the-stl-in-c

FAQ

FAQ
Q: cifs_mount failed w return code 22 on Ubuntu 11
A: apt-get install smbfs

Q: mount command on Mac
A: sudo mount_smbfs "//bjcheny:zhao&123@bjcheny-work/301" /Volumes/  # for Mac

Q: gdb on Mac
A: different from what's on linux

1. gdb -arch i386 301/IBM\ Lotus\ Symphony.app/

1. b IniParser::IniParser

1. r

1. (opt) kill # and then build and replace dylib

1. (opt) r    # gdb will re-read dylib

cat /etc/passwd | wc -l

• useradd -d [home directory]

• userdel -r

CentOS release 5.2 (Final)

http://developer.apple.com/library/mac/#technotes/tn2124/_index.html

Q: if [ -s /etc/redhat-release ]
A: size is no zero

http://tldp.org/LDP/abs/html/fto.html

Q: list all users on Linux
A: cat /etc/passwd | cut -d":" -f1
Also, to find out the total number of accounts, enter:

Q: useradd & userdel
A: 
http://linux.die.net/man/8/useradd 

http://linux.die.net/man/8/userdel


Q: Is /etc/redhat-release existing on CentOS
A: Yes, as below:
[root@www ~]# cat /etc/redhat-release


Q: can I throw an exception in constructor?
A: yes, throwing an exception from the failed constructor is the standard way of doing this. See below:
http://stackoverflow.com/questions/810839/throwing-exceptions-from-constructors
http://www.parashift.com/c++-faq-lite/exceptions.html#faq-17.8

Q: switch tabs in terminal on Mac
A: cmd + {

Q: class A {operator int(){}};
A: class obj; obj.operator int(); int n = obj;



Q: Howto man c lib functions on ubuntu?

A: apt-get install manpages-dev

man 3 <function> 
eg: man 3 printf 
man -k <keyword>  - list related function
eg: man -k printf


Q: config blinking cursor on ubuntu
A: alt-f2; gconf-editor; desktop-gnome-interface-cursor_blink

Q: IB Vs UB 
A: 
IB: Implementation-defined behaviour. The standard leaves it up to the particular compiler/platform to define the precise behaviour, but requires that it be defined.

Using implementation-defined behaviour can be useful, but makes your code less portable.

UB: Undefined behaviour. The standard does not specify how a program invoking undefined behaviour should behave. Also known as "nasal demons" because theoretically it could make demons fly out of your nose.

Using undefined behaviour is nearly always a bad idea. Even if it seems to work sometimes, any change to environment, compiler or platform can randomly break your code.

Q: Some unexpected comments
A:

 We should know that in C++ source code, if compiled with GCC, "<:" means "[", ":>" means "]", "<%" means "{", "%>" means "}", "%:" means "#", "%:" means "##". If compiled with MSVC, "??=","??/","??'" means "#", "\", "^".

    Please pay attention that if you write:
int a = 1; // some comments ??/
a++;
printf("%d", a );

    Compiled with MSVC you'll get print result is "1" but not "2" as you expected. This is because the "??/" is replaced as "\", which means the comments will extend to the next line, the same as:
int a = 1; // some comments \
a++;
printf("%d", a );




Avoid re-inventing wheels when parsing config file

Using boost instead of inventing your own wheels. It depends a new object brought in boost 1.42.0, Property Tree.
You can use it to parse below types of config files: Xml/Json/Ini/Info. Refer to below link:
http://www.boost.org/doc/libs/1_42_0/doc/html/boost_propertytree/parsers.html

http://stackoverflow.com/questions/4703134/is-there-a-way-to-print-config-file-for-boost-program-options

Assume the ini config file looks like:

[Section1]
Value1 = 10
Value2 = a_text_string

Then,

#include <boost/property_tree/ptree.hpp>
#include <boost/property_tree/ini_parser.hpp>
...

boost::property_tree::ptree pt;
boost::property_tree::ini_parser::read_ini("config.ini", pt);
std::cout << pt.get<std::string>("Section1.Value1") << std::endl;
std::cout << pt.get<std::string>("Section1.Value2") << std::endl;

http://stackoverflow.com/questions/6175502/how-to-parse-ini-file-with-boost


However, it's necessary to keep in mind on how to write your own iniparser.

Data structure in HXX file:



struct ini_NameValue
{
    string sName;
    string sValue;

    inline ini_NameValue() SAL_THROW( () ) {}
    inline ini_NameValue(string const & name, string const & value )
        : sName( name ),
          sValue( value )
        {}
};
typedef std::list<ini_NameValue> NameValueList;

struct ini_Section
{
    string sName;
    NameValueList lList;
};
typedef std::map<string,ini_Section>IniSectionMap;

class IniParser
{
IniSectionMap mAllSection;
public:
IniSectionMap * getAllSection(){return &mAllSection;};
ini_Section *  getSection(string const & secName);
IniParser(string const & rIniName)
            throw(IOException );
#if DEBUG_LEVEL > 0
void Dump();
#endif

};

Implementation in CXX file.

IniParser::IniParser(string const & rIniName)
{
    oslFileHandle handle=NULL;
    if (!iniUrl.empty())
fileError = osl_openFile(iniUrl, &handle, osl_File_OpenFlag_Read);

    while (getLine(handle, line))
    {
        // TODO: skip some comments line that starts with "/*" or "#" or "//"
        sal_Int32 nIndex = line.indexOf('=');
        if (nIndex >= 1)
        {
            ini_Section *aSection = &mAllSection[sectionName];
   struct ini_NameValue nameValue;
            nameValue.sName = line.copy(0,nIndex).trim();
            nameValue.sValue = line.copy(nIndex+1).trim();
            aSection->lList.push_back(nameValue);
        }
else
{
   sal_Int32 nIndexStart = line.indexOf('[');
   sal_Int32 nIndexEnd = line.indexOf(']');
   if ( nIndexEnd > nIndexStart && nIndexStart >=0)
   {
       sectionName =  (line.copy(nIndexStart + 1,nIndexEnd - nIndexStart -1).trim();
       if (sectionName.empty())
           sectionName = string("no name section");
       ini_Section *aSection = &mAllSection[sectionName];
       aSection->sName = sectionName;
   }
}
    }
 
    osl_closeFile(handle);
}

ini_Section *  IniParser::getSection(OUString const & secName)
{
if (mAllSection.find(secName) != mAllSection.end())
return &mAllSection[secName];
return NULL;
}

Above code only gives a basic model on iniparser.

Make own hello's rpm

It sucks when I tried to post my first tech notes on hi.baidu.com. It's lost by no reason.
Thus, I may need to recall my issues and solutions, and re-post it here.


Follow below's url to make hello's rpm.
http://fedoraproject.org/wiki/How_to_create_a_GNU_Hello_RPM_package
http://fedoraproject.org/wiki/How_to_create_an_RPM_package
https://fedoraproject.org/wiki/Common_Rpmlint_issues


Don't copy all the spec from above url, edit the local generated spec instead.


However, there are several issues during this process and all are resolved
1. installed but unpackaged files found: /usr/local/info/dir
Append "rm -f %{buildroot}/%{_datadir}/info/dir" in %install section.
Some more macro for directories fyi:
/usr/bin/xxx => %{_bindir}/xxx
/usr/lib/xxx => %{_libdir}/xxx
/usr/include/xxx => %{_includedir}/xxx
/usr/share/xxx => %{_datadir}/xxx
/usr/man/xxx => %{_mandir}/xxx


For more, refer below:
http://fedoraproject.org/wiki/Packaging/RPMMacros


2. rpmlint  hello.spec ../SRPMS/hello* ../RPMS/*/hello* |tee rpmlint.log
1)files-attr-not-set
Add "%defattr(-,root,root,-)" in %files section, and then get:


%files -f %{name}.lang
%defattr(-,root,root,-)
%doc AUTHORS ChangeLog COPYING NEWS README THANKS TODO


2)file-not-utf8
Indicates that the text encoding of the specified file, usually a documentation file, is not in UTF8.
iconv -f iso8859-1 -t utf-8 ChangeLog > ChangeLog.conv && mv -f ChangeLog.conv ChangeLog


Some basic commands for tar used:
ls -l hello/ChangeLog
1. tar -tvf hello-2.8.tar|grep ChangeLog
2. tar -f   hello-2.8.tar --delete hello/ChangeLog
3. tar -uvf hello.tar hello/ChangeLog


Done:
[bjcheny@bjcheny-rh6 SPECS]$ rpmlint  hello.spec ../SRPMS/hello* ../RPMS/*/hello* |tee rpmlint.log


3 packages and 1 specfiles checked; 0 errors, 0 warnings.

3. useful macros to make platform specific code

%if (0%{?fedora} >= 9|| 0%{?rhel} > 5)

#do stuff
%endif

%if 0%{rhel_version}%{centos_version} == 0
# do stuff
%endif




http://www.rpm.org/max-rpm/s1-rpm-multi-platform-dependent-conditional.html


http://www.linux-archive.org/rpm-package-manager/70241-canonical-way-detect-platform-distribution.html


4. packaging python
http://en.opensuse.org/openSUSE:Packaging_Python