How to chroot Ubuntu using Live CD to fix GRUB rescue prompt

Recently I messed up GRUB boot loader in my laptop installed with Ubuntu which resulted in grub rescue prompt. So I had to boot Ubuntu Live CD to get it fixed. Thought of blogging it, may be useful for some one.

This fix involves two steps. First one is to chroot into Ubuntu installation partition. Second one is to install the grub MBR (Master Boot Record). I am using Ubuntu Lucid 10.04 and Live CD also of same.

Step-1: Boot your machine with Ubuntu Live CD and select Trying Ubuntu without installation option when it is prompted (Live CD mode)

Step-2: Be patient till you get complete desktop ready.

Step-3: Ubuntu main menu -> Places -> Home Folder -> Look for other partitions listed on left hand side pane. Mount one by one and identify your Ubuntu root partition. When you are in your root partition, press Ctrl+L to view the complete mount path. Press Ctrl+C to copy this path. This path is normally/media/xx..xx kind of long path, where xx..xx denotes your hard disk partition unique id.

If you know your Ubuntu root partition you can replace the above GUI step-3 with simple mount command like this (Applications -> Accessories -> Terminal):

$ sudo mount /dev/sdax /mnt/myroot (where sdax is your root partition)

Let’s say you have mounted root partition at /media/xx..xx.

Step-4: $ Run the terminal through Applications -> Accessories -> Terminal.

Step-5: Run the following commands to export the pesudo file system of Live CD to your would be root file system soon.

$ sudo mount ‐‐bind /dev /media/xx..xx/dev

$ sudo mount ‐‐bind /proc /media/xx..xx/proc

$ sudo mount ‐‐bind /sys /media/xx..xx/sys

Step-6: Changing the root file system of live system to your hard disk installed root file system.

$ sudo chroot /media/xx..xx

Step-7: Installing GRUB Boot record in Master Boot record of your hard disk. My hard disk is sda. Replace your hard disk device node in the following command.

$ sudo grub-install /dev/sda

Step-8: Reboot the Live Ubuntu. Eject the CD.

Now you should get boot menu for your Ubuntu installation back. Enjoy the Ubuntu!

Reference Link: http://karuppuswamy.com/wordpress/2010/06/02/how-to-chroot-to-ubuntu-using-live-cd-to-fix-grub-rescue-prompt/

 

Setting up https transparent proxy

for several years the squid proxy can be used as transparent proxy for HTTP and also HTTPS. As I was curious how it will work and how hard it is to setup, I’ve just installed and configured it.

First I installed a fresh virtual machine with Debian 7.2. In Debian you could either install Squid 2.7 or Squid 3.1 via apt-get (apt-get install squid or apt-get install squid3). Unfortunately to make a transparent proxy that also supports all HTTPS features, at least version 3.2 is needed. So I downloaded the latest sources (Version 3.3.10) directly from squid-cache.org. Before installing, the following packages should be installed in Debian, otherwise errors will pop-up during configure or make:

# apt-get install build-essential
# apt-get install libssl-dev

After unpacking the squid sources it is important to use the following configure statement, to activate ssl, because it is disabled by default:

#./configure –prefix=/usr/local/squid –enable-icap-client –enable-ssl –enable-ssl-crtd –with-default-user=squid

Afterwards you can compile and install squid:

# make all
# sudo make install

Now squid is installed in /usr/local/squid. As next step the user squid should be created and the log directory should be allocated to that user:

# useradd squid
# chown -R squid:squid /usr/local/squid/var/logs/

The next steps I’ve copied from the squid documentation (2):
Afterwards you must create the swap directories. Do this by running Squid with the -z option:

# /usr/local/squid/sbin/squid -z

Once the creation of the cache directories completes, you can start Squid and try it out. Probably the best thing to do is run it from your terminal and watch the debugging output. Use this command:

# /usr/local/squid/sbin/squid -NCd1

If everything is working okay, you will see the line:

Ready to serve requests.

If you want to run squid in the background, as a daemon process, just leave off all options:

# /usr/local/squid/sbin/squid

Now you should have a running squid on port 3128. But we still do not support HTTPS requests and the proxy is still not transparent. The next steps will be modifing squid.conf and put in some iptables rules. But at first we need to create our your own CA (Certificate Authority):

# cd /usr/local/squid
# mkdir ssl_cert
# cd ssl_cert
# openssl req -new -newkey rsa:1024 -days 365 -nodes -x509 -keyout myCA.pem -out myCA.pem

This pem file can now be imported in your certificate store in your browser. Then you will not get any certificate errors when surfing HTTPS sites later via our transparent squid.
Next we need to replace the line “http_port 3128” with the following lines in /usr/local/squid/etc/squid.conf:

http_port 3128 intercept
https_port 3127 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/usr/local/squid/ssl_cert/myCA.pem
acl broken_sites dstdomain .example.com
ssl_bump none localhost
ssl_bump none broken_sites
ssl_bump server-first all
sslcrtd_program /usr/local/squid/libexec/ssl_crtd -s /usr/local/squid/var/lib/ssl_db -M 4MB
sslcrtd_children 5

Also ip-forwarding needs to be activated:

# echo “1” > /proc/sys/net/ipv4/ip_forward

Finaly we need to insert our iptables rules to redirect the traffic to squid:

# iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp –dport 80 -j REDIRECT –to-ports 3128
# iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp –dport 443 -j REDIRECT –to-ports 3127
# iptables -I INPUT -p tcp -m tcp –dport 3127 -j ACCEPT

Another folder needs to be created, for the dynamically generated certificates:

# mkdir /usr/local/squid/var/lib
# /usr/local/squid/libexec/ssl_crtd -c -s /usr/local/squid/var/lib/ssl_db -M 4MB
# chown -R squid:squid /usr/local/squid/var/lib/ssl_db/

Now you should start squid in debugging mode:

# /usr/local/squid/sbin/squid -NCd9

If the process is running and you get something similar to this, you work was successfull:

2013/11/04 22:39:16| Accepting NAT intercepted HTTP Socket connections at local=0.0.0.0:3128 remote=[::] FD 19 flags=41
2013/11/04 22:39:16| Accepting NAT intercepted SSL bumped HTTPS Socket connections at local=0.0.0.0:3127 remote=[::] FD 20 flags=41

To fully work as transparent HTTPS proxy, your clients in the network needs now the IP of this proxy as gateway address and the pem certificate needs to be imported in the browser of the clients.
Now you can start squid by exeuting:

# /usr/local/squid/sbin/squid

Debugging:
If you have any problems you should check if squid and their ports are running. You can do this by using netstat:

# netstat -tulpen

You should then see port 3128 and 3127. If not execute “killall squid” several times and restart squid in debugging mode with

# /usr/local/squid/sbin/squid -NCd9

You can also have a look at the access.log during browsing or via tcpdump to see if the packets are really arriving at your proxy.
Hint:
This was just a quick’n’dirty how-to on how a transparent proxy supporting HTTPS can be created. This setup is for lab environments to get to know squid and it’s capabilites and not for productive use. For example your private key is in the pem certificate which should be seperated from the certificate your deploying to your browser.

Links
(1) Download Squid Source
(2) Installing Squid
(3) Dynamics SSL Certificate Generation
(4) SSL Bump

http://pen-testing-lab.blogspot.hk/2013/11/squid-3310-transparent-proxy-for-http.html

Setting up Email Server using Postfix, Extman & Extmail

apt-get install postfix
apt-get install postfix-mysql
apt-get install apache-suexec
apt-get install courier-maildrop
apt-get install courier-pop
apt-get install courier-imap
apt-get install courier-authlib-mysql
apt-get install courier-authlib
apt-get install sasl2-bin

a2enmod suexec

Important paths:

/etc/courier

/etc/apache2/sites-available/

/etc/postfix

/var/www/extsuite/

/var/mailbox/

SMTP AUTH

/etc/postfix/sasl

saslpasswd2 -c -u mail.159group.hk -a smtpauth 159group

Update Ubuntu 10 to 12

1. Update the sources.list in /etc/apt/ with following source lists

deb http://old-releases.ubuntu.com/ubuntu/ maverick main restricted
deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates main restricted
deb http://old-releases.ubuntu.com/ubuntu/ maverick universe
deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates universe
deb http://old-releases.ubuntu.com/ubuntu/ maverick multiverse
deb http://old-releases.ubuntu.com/ubuntu/ maverick-updates multiverse
deb http://old-releases.ubuntu.com/ubuntu/ maverick-security main restricted
deb http://old-releases.ubuntu.com/ubuntu/ maverick-security universe
deb http://old-releases.ubuntu.com/ubuntu/ maverick-security multiverse