Configure more secure SSH algorithms on Cisco IOS

Security checkers, like Nessus, often report issues like these on Cisco IOS devices:

• SSH CBC Mode Ciphers Enabled 
• SSH Insecure HMAC Algorithms Enabled 

There have been a feature request to add the functionality to IOS, that seems to have been resolved in January 2016.

In the versions where it has been resolved, you should be able to:
> enable
# configure terminal
(config)# ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
(config)# ip ssh server algorithm mac hmac-sha1
You might want to check with "?" if better options have since become available, especially from the MACs (SHA-1 is not ideal, SHA-2/SHA-3 based algorithms might be added in the future) before using my list as-is...

Source of config syntax: Cisco IOS SSH configuration guide

Working around Corrupted MAC on input. with Cygwin SSH

When connecting to some servers from Cygwin using ssh, the connection fails and I get this error:
Received disconnect from 1.2.3.4: 2: Corrupted MAC on input.

Looking at debug output, it seems like it is using "umac-64@openssh.com" as MAC algorithm. Forcing it to use something else works around the problem.

When using ssh directly, you can use this: (Other options should work as well, this one worked for me)
ssh -o 'MACs hmac-sha1-96' user@host
or
ssh -m hmac-sha1-96 user@host

When using rsync, you need to put one of the strings above in the --rsh parameter:
rsync --rsh="ssh -m hmac-sha1-96 user@host" :/remote-source /local-dest

A more permanent option is to add the setting to the ssh_config file. This is either /etc/ssh_config (affecting all users) or ~/.ssh/config.

A line using a modified set based on the defaults for my SSH version is:
MACs umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96

You can find the problematic MAC by running 

ssh -v user@host-that-disconnects-you 2>&1 | grep mac

Adding that as a line to ~/.ssh/config seems to be the easiest solution.

A set of wideband antennas for the FunCube Dongle Pro(+), hackRF, bladeRF and RTL-SDR

When I got my Funcube Dongle Pro, I was looking for a suitable set of antennas.

Since it covers such a wide bandwidth, finding a single antenna that covers the entire bandwidth is hard.

Log-periodic antennas seem to be the most suitable wideband antennas. (They are however directional, which can be good or bad, depending on the application) However, they get impractically large, and as a result unobtainable for frequencies below about 400MHz. For these frequencies, the only practical options seem to be telescopic antennas (which can be tuned for a frequency by differing the length that is expanded) or scanner antennas.

I ended up ordering this set:

• Ramsey Telescopic with BNC / Alternative: Scanner antenna with SMA
• Ramsey 400 MHz - 1 GHz log-periodic 
• Ramsey 900 MHz - 2.6 GHz log-periodic

I have since acquired a RTL-SDR dongle. The dongle that I have has a TV-style 75-ohm input connector, as opposed to the 50-ohm SMA connector on the Funcube dongle. Ideally, a balun would be used to match the impedance, but as a minimum, some cables can be made up with the relevant connectors at the ends. I found this video with information on building your own, if you need the increased sensitivity that a properly matched antenna provides. Some other dongles, like the one from hakshop, a random one from Amazon and the NooElec one has MCX connectors, which seem to mostly be 50-ohm.

I have also ordered a hackRF, which has a higher maximum frequency, which requires another antenna. I'm planning to acquire this one. (The ANT500 antenna that is available for it seems like a suitable replacement for the telescopic antenna). My planned antenna set for it:

• ANT500 (buy from wherever you buy your hackRF, I used NooElec (they ship to where I live for $5...)) / Alternative: Scanner antenna with SMA / Alternative: Ramsey Telescopic with BNC
• Ramsey 400 MHz - 1 GHz log-periodic 
• Ramsey 900 MHz - 2.6 GHz log-periodic
• Ramsey 2.1 Ghz - 11GHz log-periodic

Another transceiver that is available is the bladeRF. It covers 300MHz - 3.8GHz, but it has a higher sampling rate than the hackRF (and a FPGA). An upconverter that allows for lower frequencies are also available. A nice antenna set for it is:

• Ramsey Telescopic with BNC (If you want to go below 400MHz) / Alternative: Scanner antenna with SMA
• Ramsey 400 MHz - 1 GHz log-periodic 
• Ramsey 900 MHz - 2.6 GHz log-periodic
• Ramsey 2.1 Ghz - 11GHz log-periodic

For the low end of the range, if you have the space, also look at the scantenna. It covers 30MHz - 1.3GHz (with several gaps). (It might not be safe for transmitting (bladeRF and hackRF)). (Full specs)

This discone also seems like a great antenna if you can install an outdoor antenna. It can handle transmitting up to 200W on the 6m, 2m, 70cm, ~1.3GHz ham bands. Reception is listed as 25MHz - 1.3GHz


I would also recommend a full set of converters, covering different types of antennas. Some examples:

• SMA > MCX (For MCX RTL-DR dongles to most antennas listed above)
• BNC > MCX (For BNC telescopic on MCX RTL-SDR dongles)
• RP-SMA > MCX (for WiFi antennas on MCX RTL-SDR dongle) (Cable that would terminate on the router, now terminates on this)
• RP-SMA > SMA (for WiFi antennas on Funcube / hackRF / bladeRF) (Use on dongle to give it a RP-SMA interface)
• SMA > SMA (right-angle version) (Longer version) (SMA antenna to SMA dongle)
• BNC > SMA cable (direct version) (For BNC antennas, like the Ramsey Telescopic)
• TNC > SMA (A relatively common antenna connector) (Use with SMA-SMA cable)
• N-type > SMA (A relatively common antenna connector) (Linked product allows use with SMA > SMA cable)
• RP-TNC > SMA (different gender version) (For some WiFi antennas (Linksys) to SMA radios)
• TV antenna > SMA (For RTL-SDR dongles with TV-antenna connector)
• TV antenna > BNC (For RTL-SDR dongles with TV-antenna connector)

KiCAD schematic for the Arduino Leonardo

I wanted to design a compatible board in KiCAD. The orgiinal design is in EAGLE format.

I redrew it in KiCAD.

Uses symbols from http://smisioto.no-ip.org/elettronica/kicad/kicad-en.htm

Completely fails ERC. Blame my rough ATMEGA32U4 component.

Original design by Arduino. Errors are probably mostly mine....

Download (Use "Save" from the file menu)

Alternative link

Sourcing RepRap extruder springs in South Africa

Several RepRap extruders use compression coil springs to provide tension on the idler. While some companies exist that manufacture springs locally, they are not really conveniently located and might charge a lot if you are only interested in small quantities.

After search the internet and fastener / hardware stores unsuccessfully, I happened to notice that certain clothes-pegs have springs that seem perfect for the job.

Sourcing the clothes-pegs turned out to be relatively easy....

The ones that I found are:

Barcode: 6009695720525

Branded as: "You Save"

Pack size: 48 pegs (with one spring each) (Can't find it on their online shopping page)

Sources: Pick 'n Pay (~R26 per pack of 48)

Free length: 16mm

Wire thickness: 0.9mm

Turns: 9 (first and last one flattened)

Outside diameter: ~6.4mm (Fits M4 / M3 screws)

Turn "pitch" (relaxed): ~ 1.9mm (including 1 wire thickness)

Spring coefficient: Unknown

Material: Unknown ("rust free", looks like it might be zinc coated steel)

Image:

The pegs themselves seem to be made from PE and might be recyclable into filament with a filament extruder.

This thread on the RepRap forums seem to mention the same springs.

BitBurner - Download HTTP links using BitTorrent

BurnBit has a handy service that allows you to generate torrents for any directly accessible HTTP link.

They have some nice instructions to integrate it into your site. However, almost no big sites use these.

In order to easily use it for downloading Linux distributions (which are well mirrored, making BurnBit useful, even if just easily download from multiple mirrors simultaneously and to check that the file is not corrupted) I wrote a small GreaseMonkey script that injects their download buttons in some of the more obvious mirror sites / HTTP accessible FTP sites.

It is somewhat crude currently, but works well on sites that just contain directory listing.

Compiling CMake 2.8.7 on Solaris 10

Building CMake might fail due to incorrect environment variables.

If you already attempted to compile CMake, delete the directory and start again. It caches its variables for its own build all over the place.

A full Solaris 10 install has everything you need to compile CMake.

I bootstrapped it using as much system libraries as possible and assumed 4 CPUs / cores and set it to install to /usr.

Set up envirnment:
$ PATH=/usr/sfw/bin:/usr/ccs/bin:/usr/bin; export PATH
$ CC=gcc;export CC

Bootstrap:
$ ./bootstrap --parallel=4 --system-libs --no-system-curl --no-system-libarchive --no-system-expat --prefix=/usr

Compile according to Readme.txt:
$ gmake -j4
To install:
Change to root
# gmake install

To package:
$ bin/cpack
The generated package can the be installed as per the instructions on the download page.
The package will only work on other Solaris 10 (and possible newer) system running the same CPU architecture. Solaris 9 misses some of the libraries that it expects to find.

These instructions do not work on Solaris 9, due to the lack of a compiler in the default install. Installing Solaris Studio might work, but was not tested.

Update: I have a prebuilt version available here.