Graph Resources Using Gnuplot on Linux

My previous post dealt with retrieving some data and then dumping it into a csv file. Here is a script and gnuplot configs that creates an index page. The script finds all the csv files in the specified $DIRECTORY. For every csv file found, a new *_summary directory is created with an index.html files, and the png graph images.

This is the main script file. Make sure to adjust the DIRECTORY and GRAPHDIR variables for your environment.

create_graph.sh

       
#!/bin/bash

#directory that contains the csv files
DIRECTORY=/dashcam/resourcelog_archive
#directory that contains the gnuplot config files
GRAPHDIR=/dashcam/graphs

for f in $( ls "$DIRECTORY"/*.csv ); do
        HTMLDIR=$(echo "$f" | sed 's/.csv//g')
        #echo HTMLDIR is "$HTMLDIR"

        mkdir -vp "$HTMLDIR"_summary

        echo "$f" > "$DIRECTORY"/gnuplot_variable.txt

        /usr/bin/gnuplot -e "filename='$f'" "$GRAPHDIR"/temperature.gp > "$HTMLDIR"_summary/temperature.png
        /usr/bin/gnuplot -e "filename='$f'" "$GRAPHDIR"/memory.gp > "$HTMLDIR"_summary/memory.png
        /usr/bin/gnuplot -e "filename='$f'" "$GRAPHDIR"/cpu.gp > "$HTMLDIR"_summary/cpu.png

        #Create webpage
        echo "<center>"$HTMLDIR"</center><br><br>" > "$HTMLDIR"_summary/index.html
        echo "<center><img src="cpu.png"></center><br><br>" >> "$HTMLDIR"_summary/index.html
        echo "<center><img src="memory.png"></center><br>" >> "$HTMLDIR"_summary/index.html
        echo "<center><img src="temperature.png"></center><br>" >> "$HTMLDIR"_summary/index.html

done

#Create index webpage
echo "<center><b>Index</b></center><br><br>" > "$DIRECTORY"/index.html

for d in $( ls -d "$DIRECTORY"/*_summary | xargs -n 1 basename ); do
        echo  "<a href=$d>$d</a><br>" >> "$DIRECTORY"/index.html
done
       

All the *.gp files should be in $GRAPHDIR. All graphs are sized at 1000x400.

This template graphs 1, 5, and 15 minute CPU load over time.
cpu.gp

       

#!/usr/bin/gnuplot
reset
set terminal pngcairo size 1000,400
set datafile separator ","

set xdata time
set timefmt "%Y-%m-%d,%H:%M:%S"
set format x "%H:%M"

set xlabel "Time (Hour:Minute GMT)"
set ylabel "CPU"

set title "CPU"
set key below
set style data line
set grid

plot filename using 1:4 title "1 min", filename using 1:5 title "5 min", filename using 1:6 title "15 min"

       

This template graphs Free, Cached, and Total Memory.
memory.gp

       

#!/usr/bin/gnuplot
reset
set terminal pngcairo size 1000,400
set datafile separator ","

set xdata time
set timefmt "%Y-%m-%d,%H:%M:%S"
set format x "%H:%M"

set xlabel "Time (Hour:Minute GMT)"
set ylabel "Memory (KB)"

set title "Memory"
set key below
set style data line
set grid

plot filename using 1:8 title "Free", filename using 1:7 title "Total", filename using 1:9 title "Cached"

       

This template graphs degrees celcius over time.
temperature.gp

       

#!/usr/bin/gnuplot
reset
set terminal pngcairo size 1000,400
set datafile separator ","

set xdata time
set timefmt "%Y-%m-%d,%H:%M:%S"
set format x "%H:%M"

set xlabel "Time (Hour:Minute GMT)"
set ylabel "Celcius"

set title "CPU Temperature"
set key below
set style data line
set grid

plot filename using 1:3 title "Degrees Celcius"

       

Raspberry Pi Resource Monitor

There are plenty of resource monitors and graph utilities out there for the Raspberry Pi. RPi-Monitor is a great one. However, I wanted to learn a little more about how to collect data for the various resources, so I made my own simple bash script. Here are some basic commands that can be stringed together to monitor the basic resources of the Raspberry Pi. I output the data to a csv file that can be graphed using gnuplot.

Skip to the bottom for the full script.

First, create a new file using text editor.

nano resourcelog.sh

Start with the basics. Tell the shell to use bash.

#!/bin/bash

Most of the time I am getting time from a GPS dongle. Wait a minute to allow a GPS lock.

sleep 60

Create a date/time variable used to name the log file. I do this so that every time the Pi is powered on, it creates a new file with a name based on the date/time the logging was started.

LABELDATE=$(date +"%Y-%m-%d_%H:%M")

Make a directory to put the log files.

mkdir -vp /home/pi/resourcelog_archive/

Name the columns in the csv file. You can see we will be logging date, time, degrees celcius of the pi CPU, average CPU loads, free memory, cached memory, swap total, and swap free. This gets put into a new file in the resourcelog_archive directory, using the date variable defined above. (The command should be one line)

echo "Date,Time,Degrees Celcius,CPU 1 Min,CPU 5 min,CPU 15 min,Memory,Free Memory,Cached Memory,Swap Total,Swap Free" > /home/pi/resourcelog_archive/resourcelog_"$LABELDATE".csv

Create a while loop that will query for the info specified. I do this by defining a variable ($CYCLE) and the loop runs while the variable equals the original value (1).

CYCLE=1
while  [ $CYCLE -eq 1 ]
do

Create variables for data gathering. These variables are part of the while loop and are updated every 60 seconds.

Define the current date in YY-MM-DD format.

DATESTAMP=$(date +"%Y-%m-%d")

Define the current time in HH:MM format.

TIMESTAMP=$(date +"%H:%M")

Define the temperature of the APU (CPU) in degrees celcius. This command uses vcgencmd measure_temp, shows only data after the = symbol, and then removes the "'C" so we are left with only a decimal number.

TEMP=$(/opt/vc/bin/vcgencmd measure_temp | cut -d '=' -f 2 | sed s/\'C//g)

Define the CPU load average. This runs the loadavg command, only shows the last three fields, and then replaces the spaces with commas, giving an output formatted as 0.0,0.0,0.0

CPU=$(cat /proc/loadavg | cut -d ' ' -f -3 | sed 's/ /,/g')

Define the total amount of memory in kB. This uses /proc/meminfo, finds "MemTotal", displays only column 2, then removes the "kB" so only numbers are output.

 MEMTOTAL=$(cat /proc/meminfo | egrep MemTotal | awk '{print $2}' | sed 's/kB//g')

Define the total amount of free memory. Similar to above, but searches for "MemFree".

MEMFREE=$(cat /proc/meminfo | egrep MemFree | awk '{print $2}' | sed 's/kB//g')

Define the total amount of cached memory. Similar to above, but searches for only matches that start with Cached. (^Cached).

CACHED=$(cat /proc/meminfo | egrep '^Cached' | awk '{print $2}' | sed 's/kB//g')

Define the swap file allocation. Similar to above, but searches for "SwapTotal".

SWAPTOTAL=$(cat /proc/meminfo | egrep SwapTotal | awk '{print $2}' | sed 's/kB//g')

 Define the amount of swap available (unused).

SWAPFREE=$(cat /proc/meminfo | egrep SwapFree | awk '{print $2}' | sed 's/kB//g')

That's all the resources I monitor. Now the variables need to be written to the file created at the beginning of the script. This just writes a new line at the end of the file with the variable specified above seperated by commas.

echo "$DATESTAMP","$TIMESTAMP","$TEMP","$CPU","$MEMTOTAL","$MEMFREE","$CACHED","$SWAPTOTAL","$SWAPFREE" >> /home/pi/resourcelog_archive/resourcelog_"$LABELDATE".csv

 Wait for 60 seconds and then start again.

sleep 60

Close the loop.

done

 Save the file and exit. Make the file executable.

chmod +x resourcelog.sh

Make the file run on every reboot. This assumes you are logged in as the user "pi".

crontab -e
@reboot /home/pi/resourcelog.sh

That's it, the pi will run the resourcelog.sh script every time it's powered on, and record the results in a new file in the resourcelog_archive directory.  Feel free to tell me there's a better way to do this, I'm sure there is something more efficient. The next post will go over creating graphs automatically using gnuplot.

Here is the full code:

       
#!/bin/bash
# Wait for GPS time
sleep 60

LABELDATE=$(date +"%Y-%m-%d_%H:%M")
mkdir -vp /home/pi/resourcelog_archive/
echo "Date,Time,Degrees Celcius,CPU 1 Min,CPU 5 min,CPU 15 min,Memory,Free Memory,Cached Memory,Swap Total,Swap Free" > /home/pi/resourcelog_archive/resourcelog_"$LABELDATE".csv
CYCLE=1
while  [ $CYCLE -eq 1 ]
do

DATESTAMP=$(date +"%Y-%m-%d")
TIMESTAMP=$(date +"%H:%M")
TEMP=$(/opt/vc/bin/vcgencmd measure_temp | cut -d '=' -f 2 | sed s/\'C//g)
CPU=$(cat /proc/loadavg | cut -d ' ' -f -3 | sed 's/ /,/g')
MEMTOTAL=$(cat /proc/meminfo | egrep MemTotal | awk '{print $2}' | sed 's/kB//g')
MEMFREE=$(cat /proc/meminfo | egrep MemFree | awk '{print $2}' | sed 's/kB//g')
CACHED=$(cat /proc/meminfo | egrep '^Cached' | awk '{print $2}' | sed 's/kB//g')
SWAPTOTAL=$(cat /proc/meminfo | egrep SwapTotal | awk '{print $2}' | sed 's/kB//g')
SWAPFREE=$(cat /proc/meminfo | egrep SwapFree | awk '{print $2}' | sed 's/kB//g')


echo "$DATESTAMP","$TIMESTAMP","$TEMP","$CPU","$MEMTOTAL","$MEMFREE","$CACHED","$SWAPTOTAL","$SWAPFREE" >> /home/pi/resourcelog_archive/resourcelog_"$LABELDATE".csv
sleep 60
done

       
 

Quick Reference: Linux ln command

I'm constantly forgetting the correct syntax for the ln -s command. This post is mostly for my reference...

ln -s /path/to/original.file /path/to/target

Upside-Down-Ternet: Raspberry Pi Edition

I did a post on this a few years ago, here is an update for 2013. This walkthrough is based on the technique found here: http://www.ex-parrot.com/pete/upside-down-ternet.html

First the disclaimer: Do not do this to any sort of important computer or network, because it WILL break things. This is meant as a prank for home use only; such as confusing your brother, sister, kids, wife, etc... Doing this to a network you don't own could be considered a serious offense by your local law enforcement, and could result in fines or imprisonment.

What it does

A small device (Raspberry Pi) powered by either a battery or cell phone charger is connected to your network in front of the intended victim's computer, which will wreak havoc on your victim's internet browsing. This method does not require changing any settings on any target computers. 

The instructions assume that the computer you want to prank is using a DHCP assigned IP address. If the computer is using a manually assigned IP address, the only thing that will happen is the internet will be completely cut off - which isn't very funny. If you want to be really evil, you could put it in front of your internet router, causing all the devices that use your internet to be effected. 

How it works

The Raspberry Pi is configured with with a dnsmasq DHCP server which will assign downstream computers a new IP address and gateway. A squid transparent proxy is installed on the Pi where traffic is redirected using iptables. A redirection script uses mogrify to alter images and then re-hosts the images through the a web server. 

Equipment and Software

* Raspberry Pi Model B with Raspbian installed

* USB Ethernet Adapter

* CAT5 Patch Cable

These instructions assume that the Raspberry Pi is accessible through SSH, and also has access to the internet. Installing and configuring Raspbian is out of the scope of this post. If you need help, here is a great place to start: http://www.raspbian.org/RaspbianInstaller

Prepare the Software

For best results, overclock the pi to 800Mhz, and set to memory split to 32 or 16MB. For some reason my raspberry pi wouldn't boot when configured with 16MB. Also make sure that eth1 is configured with static IP 192.168.254.1.

Dnsmasq

Install with:

 sudo apt-get -y install dnsmasq
Add the following config to /etc/dnsmasq.conf to configure the dhcp server on eth1, which should be the USB ethernet adapter.
 domain-needed
 interface=eth1  
 domain=upside-down-ternet

 dhcp-range=192.168.254.100,192.168.254.200,255.255.255.0,12h

Edit /etc/sysctl.conf to allow the Raspberry Pi to act as a gateway router. Add or uncomment:

 net.ipv4.ip_forward=1

Type /etc/init.d/dnsmasq restart and then plug a laptop into the USB ethernet adapter. You should get an IP in the 192.168.254.xxx range. At this point although the gateway should be reachable, there is no NAT configuration so you won't be able to access the internet.

Squid

Install squid, iptables, and imagemagick:

 sudo apt-get -y install squid3 iptables imagemagick

Edit /etc/squid3/squid.conf and copy the text below. This configures squid to act as a transparent proxy with no caching. It also specifies a redirect script at /etc/squid3/upsidedown.sh.
 cache_mgr dustin
 cachemgr_passwd dustin all
 cache deny all
 redirect_program /etc/squid3/upsidedown.sh
 acl manager proto cache_object
 acl localhost src 127.0.0.1/32 ::1
 acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
 acl localnet src 192.168.254.0/24 # RFC1918 possible internal network
 acl SSL_ports port 443
 acl Safe_ports port 80  # http
 acl Safe_ports port 21  # ftp
 acl Safe_ports port 443  # https
 acl Safe_ports port 70  # gopher
 acl Safe_ports port 210  # wais
 acl Safe_ports port 1025-65535 # unregistered ports
 acl Safe_ports port 280  # http-mgmt
 acl Safe_ports port 488  # gss-http
 acl Safe_ports port 591  # filemaker
 acl Safe_ports port 777  # multiling http
 acl CONNECT method CONNECT
 http_access allow manager localhost
 http_access deny manager
 http_access deny !Safe_ports
 http_access deny CONNECT !SSL_ports
 http_access allow localnet
 http_access allow localhost
 http_access deny all
 http_port 3128 transparent
  cache_mem 64 MB
 #cache_dir ufs /var/spool/squid3 150 16 256
 coredump_dir /var/spool/squid3
 refresh_pattern ^ftp:  1440 20% 10080
 refresh_pattern ^gopher: 1440 0% 1440
 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
 refresh_pattern .  0 20% 4320

Iptables

Create a file iptables.sh and copy the text below:

#nat
iptables -t nat -A POSTROUTING -j MASQUERADE
#squid transparent proxy
iptables -t nat -A PREROUTING -i wlan0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.254.1:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

Hit ctrl-o to save the file, then ctrl-x to exit. Now the file needs to be made executable and copied to an appropriate location.

chmod +x iptables.sh
sudo cp iptables.sh /etc/init.d/

Apply the configuration at boot:

sudo update-rc.d iptables.sh start 99

Upside Down Redirection Script

First make sure Apache and perl are installed:

 sudo apt-get install apache2 perl

Create a directory for the modified images and assign permissions:

 sudo mkdir /var/www/images

 sudo chmod 777 /var/www/images

Create the redirection script:

 sudo nano /etc/squid3/upsidedown.pl

Paste this code:

#!/usr/bin/perl

$|=1;

$count = 0;

$pid = $$;

while (<>) {

        chomp $_;

        if ($_ =~ /(.*\.jpg)/i) {

                $url = $1;

                system("/usr/bin/wget", "-q", "-O","/var/www/images/$pid-$count.jpg", "$url");

                system("/usr/bin/mogrify", "-flip","/var/www/images/$pid-$count.jpg");

                print "http://127.0.0.1/images/$pid-$count.jpg\n";

        }

        elsif ($_ =~ /(.*\.gif)/i) {

                $url = $1;

                system("/usr/bin/wget", "-q", "-O","/var/www/images/$pid-$count.gif", "$url");

                system("/usr/bin/mogrify", "-flip","/var/www/images/$pid-$count.gif");

                print "http://127.0.0.1/images/$pid-$count.gif\n";

        }

        elsif ($_ =~ /(.*\.png)/i) {

                $url = $1;

                system("/usr/bin/wget", "-q", "-O","/var/www/images/$pid-$count.png", "$url");

                system("/usr/bin/mogrify", "-flip","/var/www/images/$pid-$count.png");

                print "http://127.0.0.1/images/$pid-$count.png\n";

        }

        elsif ($_ =~ /(.*\.jpeg)/i) {

                $url = $1;

                system("/usr/bin/wget", "-q", "-O","/var/www/images/$pid-$count.jpeg", "$url");

                system("/usr/bin/mogrify", "-flip","/var/www/images/$pid-$count.jpeg");

                print "http://127.0.0.1/images/$pid-$count.jpeg\n";

        }

        else {

                print "$_\n";;

        }

        $count++;

}

Press ctrl-o to save, then ctrl-x to exit. Make the script executable:

 sudo chmod +x /etc/squid3/upsidedown.pl

Reboot the raspberry pi and make sure everything starts up automatically. Most images should now be shown upside down!

Raspberry Pi Personal Hotspot - Squid with Adzapper Config (part 2)

-- Link to Part 1 --

Here are the steps I used to finish my personal wifi hotspot. I was able to find lots of tutorials that show how to make a simple wifi to ethernet bridge, but I wanted to save the max bandwidth possible. I'll be using adzapper and a squid3 cache for bandwidth saving. I don't usually block ads, but since this is a metered internet connection I don't like the thought of paying for ads. Squid can be configured for very aggressive caching, but I have left it on the default configuration. 

Inside view of the "PiSpot". The video and audio port have been removed to save space.

Battery, 4 port USB hub, 4G dongle, and a shortened USB Cable.

Here we see the fully operational battle station -- err, PiSpot.

You can see the various components in the pictures above. I removed the plastic casings to save space. I haven't done any testing on the battery life, but it should last at least a few hours with light traffic. Here are the parts I used:

• Raspberry Pi Model B 1st generation (256MB RAM) --Model A would work as well
• 4 port USB 2.0 Hub - Iogear Model GUH285 -- I chose this because of its size and it was <$10 at Fry's.
• EasyACC BP8400 Power Bank 5600mAh Battery - Amazon Link
• Belkin F9L1005 Wifi Adapter (rtl8192cu)
• FreedomPop 4G Adapter - Amazon Link

TODO:
Charge battery without opening case.
Power button so the the unit can be turned on or off without opening the case.

This post will assume that you are already able to connect to the Raspberry Pi WiFi network that was created in part 1.

Install Software

Make sure squid and adzapper are installed

apt-get install squid3 adzapper

Configure Squid

First make sure that the pi is configured for ip forwarding at /etc/systcl.conf. Uncomment or add:

net.ipv4.ip_forward=1

Edit /etc/squid3/squid.conf and to something similar to the config below. This config includes lines to enable adzapper and transparent proxy. Max storage size is 1.5GB. Make sure to change the IP address to your network.  **I'm sure this can be fine tuned for better bandwidth savings, let me know if you have any suggestions!

cache_mgr dustin
cachemgr_passwd dustin all
redirect_program /usr/bin/adzapper.wrapper
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 192.168.254.0/24 # RFC1918 possible internal network
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access allow localhost
http_access deny all
http_port 3128 transparent
 cache_mem 128 MB
cache_dir ufs /var/spool/squid3 1500 16 256
coredump_dir /var/spool/squid3
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320

Configure Adzapper

/etc/adzapper.conf should look something like this:

ZAP_MODE=""

ZAP_BASE=http://adzapper.sourceforge.net/zaps

ZAP_BASE_SSL=https://adzapper.sourceforge.net/zaps # this can probably be ignored

ZAP_PREMATCH=

ZAP_POSTMATCH=

STUBURL_AD=$ZAP_BASE/ad.gif

STUBURL_ADSSL=$ZAP_BASE_SSL/ad.gif

STUBURL_ADBG=$ZAP_BASE/adbg.gif

STUBURL_ADJS=$ZAP_BASE/no-op.js

STUBURL_ADHTML=$ZAP_BASE/no-op.html

STUBURL_ADMP3=$ZAP_BASE/ad.mp3

STUBURL_ADPOPUP=$ZAP_BASE/closepopup.html

STUBURL_ADSWF=$ZAP_BASE/ad.swf

STUBURL_COUNTER=$ZAP_BASE/counter.gif

STUBURL_COUNTERJS=$ZAP_BASE/no-op-counter.js

STUBURL_WEBBUG=$ZAP_BASE/webbug.gif

STUBURL_WEBBUGJS=$ZAP_BASE/webbug.js

Now iptables needs to be configured to route traffic through squid. Create a new file:

nano iptables.sh

Add the the rules below. Careful with line breaks when cut/pasting, there should only be 5 lines total.

#nat for wifi
iptables -t nat -A POSTROUTING -j MASQUERADE
#squid transparent cache
iptables -t nat -A PREROUTING -i wlan0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.254.1:3128
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128

Hit ctrl+o to save the file, then ctrl-x to exit. Now the file needs to be made executable and copied to an appropriate location.

chmod +x iptables.sh
sudo cp iptables.sh /etc/init.d/

Apply the configuration at boot.

sudo update-rc.d iptables.sh start 99

That should wrap it up. At this point I suggest doing a power cycle on the Pi to make sure everything comes up automatically. 

ntop via svn on Ubuntu Server 12.04

Install ntop svn on Ubuntu Server 12.04

Quick post on installing the most up to date development version of ntop on Ubuntu server. The version of ntop in the official repositories is 4.x, which will show as being out of date in the web gui.The development version will show as unstable.

1. Install prerequisites:

sudo apt-get install libpcap-dev libgdbm-dev zlib1g-dev librrd-dev python-dev libgeoip-dev subversion

2. Download software:

cd ~
svn co https://svn.ntop.org/svn/ntop/trunk/ntop/

3. Configure source:

cd ntop
./autogen.sh

4. Compile source:

make

5. Install:

sudo make install

6. Configure ntop. Without ldconfig you will get an error "ntop: error while loading shared libraries: libntopreport-5.0.2.so: cannot open shared object file: No such file or directory"

sudo ldconfig
sudo ntop --set-admin-password

7. Configure permissions:

sudo chown -R nobody:nogroup /usr/local/var/ntop/

8. Start ntop:

sudo ntop -d

9.  Access ntop:

http://localhost:3000

Done!!

Quick and Dirty: Set up a Zimbra Email Server

This guide focuses on setting up an email server ideal for home or small business use. Setup is extremely quick and very low cost.

What I mean by "Quick and Dirty" is that in most cases the default settings will be used. Completing each step in this guide should get you a fully function server in a few hours (depending on hardware and download speeds. Sometimes defaults maybe not optimal or most secure, but the system will be running in the end.

Zimbra offers a full featured email solution that does not require a super-powered server. (if a low amount of users are accessing it) I have been successfully using the latest version on my home server (only 2 users) configured on a VM with 768MB RAM and 1 AMD Athlon64 3000+ processor. Although it takes a while for all the services to start at boot, I  haven't had any performance issues while using the system. I chose the Zimbra system because of its ease of setup and powerful features.

Here are the materials I used for this setup:

• 768MB RAM (1GB or higher recommended)
• Athlon64 3000+ (32 bit can be used, but is being phased out)
• Comcast internet connection with DHCP IP address
• Postini Anti-Spam service used as smarthost and general spam protection, This is necessary for a server with a non-static WAN IP address.
• CentOS 5.5 x64

** This guide will not be covering configuring Postini or MX records.**

Install and Configure CentOS 5.5

CentOS 5.5 can be downloaded at www.centos.org. Burn the ISO or point your virtual machine to it. Only CD 1 will be needed.

Follow the installer directions. When the Network devices screen appears, make sure to change the network device to static IP.

- Disable IPv6 if not being used on your network.

- Set "Hostname" to manually and configure the FQDN that your server will be using. (e.g. mail.somename.com) The hostname is checked when setting up Zimbra, and it's easiest to configure it at this screen, so make sure it's correct if possible.

- Configure the Gateway and DNS as apporpriate for your network.

Click next, and assign the timezone and root password as needed on the next screens.

When the software selection screen is reached, make sure that all desktop options are unchecked, and the "Customize now" button is selected.

Remove Gnome and choose customize so that only Disc 1 is needed.

At the next screen, go through all the categories on the left, and uncheck everything EXCEPT "Base" in the "Base System" category.

The only box that should be checked is "Base"

Once configured, click "Next" and proceed with installing the system.

All additional needed software will be installed via yum and wget once the installation completes.

When the install finishes and the server finishes booting the first time, the setup wizard will appear. Since this server will be behind a physical firewall on a trusted network, I will be disabling the software firewall and SELinux options. 

Disable firewall and SELinux

Use the above settings while installing. SELinux is not advised. Firewall settings can be tested and configured after the installation if desired.

Once configured, select OK.

"Sendmail" should be disabled, as Zimbra uses it's own integrated MTA.

- Select "System Services"

- Scroll down the list until "sendmail" is displayed and uncheck it with the spacebar.

Disable sendmail

After configuring, press "OK" and then "QUIT", and then reboot the computer. 

# reboot

After rebooting, make sure the date and time is correct.

# date

If not correct, use:

# date MMDDhhmmYYYY

Example: "date 102015302010" will change the date and time to Oct. 20th, 3:30pm, 2010. It is recommended to sync time with an NTP server, covered elsewhere.

When the date is correct, update the system:

# yum update -y

This will install all security updates and update the kernel, which will require a reboot when finished.
After the reboot, Zimbra its prerequisites can be downloaded and installed.

Installing Zimbra

 Zimbra requires a few packages (sysstat and gmp) that aren't included with the basic CentOS install.

# yum install sysstat gmp -y

Now the hosts file needs to be changed because we are using a static IP with a smart host.
Edit /etc/hosts and change the IP address on the last line to the LAN IP of the server. It should look something like this:

Reconfigure /etc/hosts

The IP address above was initially the public WAN IP of the router.

The Zimbra software package can be downloaded here: http://www.zimbra.com/downloads/os-downloads.html 

Locate the latest release for Red Hat Enterprise Linux 5. Right click the link for the appropriate architecture and copy the link location.

The easiest way is usually to SSH to the server and then use wget to download the package. Example:

wget http://files2.zimbra.com/downloads/6.0.10_GA/zcs-6.0.10_GA_2692.RHEL5_64.20101215170845.tgz

When the download is complete, unpack it:

# tar xvzf zcs-* (tab)

Change to the newly created directory and run the install script:

# ./install.sh --platform-override

The first portion of the install is self explanatory. Accept the license agreement and install all the default components.
Be sure to read the output, some of the defaults will exit the installer if not changed. (License agreement, Platform override, and modifying the system)

At one point during the install the following error will appear:

DNS ERROR resolving MX for mail.somename.com
It is suggested that the domain name have an MX record configured in DNS
Change domain name? [Yes]

If you are using a smarthost with a dynamic IP, than type "No".

The following configuration screen will appear when the files are finished copying:

Zimbra installer config screen

For this guide, everything will be left at default, however the admin password needs to be changed.
- Press "3" and then enter
- Press "4" and then enter
- Enter the desired admin password and press enter
- Press "r" and then enter
- Press "a" and then enter
Accept the default entries and then type "y" when asked to modify the system.
After the applying the settings and starting services, the installer will exit and the system should be ready for login.

Configuring Zimbra

Log into the admin page at https://YourIPAddress:7071

The username will be "admin" and the password will be what was specified earlier. 

First, create a new account.

- In the categories on the left panel, click "Accounts," directly under "Addresses."

- Click "New" and then enter the desired info. 

Smarthost and open relay now needs to be configured.
- Click the "Servers" category on the left panel.
- Select your server under the "host name" category in the middle and then click the "edit" button towards the top.
- Click the "MTA" tab

Zimbra web config screen

- Verify the host name is correct in the first field
- Enter your smarthost address in the second port. This will be something like outbounds#.obsmtp.com for Postini spam filtering.
- Enter the trusted smarthost network in the "MTA Trusted Networks" field. For Postini, this will be: 74.125.148.0/22
- Save changes and exit the admin console
- Uncheck the "DNS Lookups" box

That should be it. The system should now be able to send and receive mail to the smarthost/spam filter, providing the MX records and smarthost are configured correctly.

Quick, Easy, Cheap PBX Setup using Skype

Looking to implement a phone and collaboration system for a small to medium sized organization? Open source software provides a proven, reliable solution for a fraction of the price of a standard enterprise level system. (Cisco...). You will need a working knowledge of Linux (or Google) for best results, as I won't be covering standard tasks such as changing an IP on Linux, etc.This post is meant as a proof-of-concept or for quick reference. The following instructions will provide an operational system able to make outgoing calls to standard landlines, however it is not a complete solution. Average user needs will call for something quite a bit more complex.

If you have an old box that can be used as a dedicated system, you can have a working voip (outgoing calls) and an IM communication system for less than $10 a month in fees. A very basic system (a few extensions and one SIP channel) can be set up in about 2-3 hours.
There are many good uses for such a system, not least of which is using SIP software on a mobile phone with 3G data access. The SIP client connects to your server over the internet, which then forwards the call though Skype.

In this walkthrough I will be focusing on creating a system very quickly with minimal configuration.

Materials

Hardware:
I used a virtual machine with 512MB Ram, 10GB HDD, and 3Ghz CPU for my setup. For a production system a physical machine would be preferable so that FXO or other interfaces can be easily added. Generally you need:
512MB RAM
Pentium III 1.2Ghz or higher
20GB+ Hard Drive

Software:
trixbox CE - trixbox CE is the free, fully open source version of the commercial version of trixbox. It utilizes Asterisk for PBX functionality and FreePBX for the web manager. After downloading and installing the ISO, (based on CentOS 5.5) the system is basically ready to go.

Openfire - Openfire is a comprehensive, scalable collaboration system. It has excellent integration features with Asterisk. I'm using Spark and it's SIP Phone plugin for a centralized IM and VoIP application.

Spark - The Java client for Openfire, developed by the same company (ignite realtime). Any XMPP client will work for the IM portion, however Spark has a SIP phone plugin allowing calls to be make directly from the app.

X-Lite - A nice softphone that is free and simple to configure and use. A drawback is it shows an ad everytime it's opened. Useful for testing extensions. Check sourceforge.net for free open source softphones.

Skype  for SIP - Very cheap service allowing incoming and outgoing calls to the outside world. Each channel (equivalent to a phone line) costs 6.95/month. An online number (phone number regular phones can call) costs an additional $6.30 a month per number.

Got it? Ok, lets start!

Install trixbox

Installing trixbox is about as straight forward as a Linux installation gets. Simply burn the ISO to a cd, boot, and let the installer do the rest of the work. Keep things simple and don't try to add it on to an existing installation. The default install will wipe your hard drive! The only input required is the root password. Reboot the system and it should be ready to go. The network will be configured with a DHCP address, so you will need to log in and check it with "ifconfig" or configure a static address as necessary.

Configure an Extension

Once installed, log into the web interface (http://ipaddress). The default admin login is:
User: maint 
Password: password
Check the top right corner to make sure the system is in admin mode. If not, click "switch." 
After successfully logging in, create a new extension. Click on the "PBX" menu and select "PBX Settings".

Click on "Extensions"

Keep the pull down menu on "Generic SIP Device" and click "Submit". The only required fields for the scope of this walkthrough are "User Extension", "Display Name", and "Secret".
Use a 3 digit number for the extension (200), and a name and password for the other fields.
After entering the proper information, click "Submit" on the bottom of the page.
You would think after clicking submit the process would be finished, but Asterisk still needs to be reloaded. Click the "Apply Configuration Changes" button on the top of the page:

Click "Continue with reload" and the extension should be ready to go.

Repeat the process with a second extension so a test call can be made.

Install a Softphone

On a Windows computer (XP, Vista, 7), install X-Lite. Right-click anywhere on the phone and select "SIP Account Settings" from the menu. If there is already an account in the list that comes up, click properties.

"Display Name" can be anything.
"User name" and "Authorization user name" should be the extension.
"Domain" should be the IP address of the trixbox machine.
The defaults for the rest of the fields will work for now.
When two extensions are configured on separate computers, dial an extension and verify everything is working.

Configure Skype for SIP

Configuring the Skype SIP connection is the most complicated part of the installation, mostly because it is still in "beta" and there is currently no documentation (that I could find).

• Log onto skype.com and create an account if you don't already have one. 
• Click on the "Business" link on the far right of the skype homepage and create a business account. You can associate it with an existing regular account if desired. 
• Once in the "Skype Manager Dashboard" purchase some credit. $10 will be enough for our purposes. 
• Click on the "Features" button near the top left of the page, and then click "Skype for SIP". Click "Create new profile" and give it a name. Take note of the username, password, and address that is generated.
• Click on "Profile Settings" on the left, and then click on "Setup outgoing calls". The system will not let outgoing calls through unless there is credit on the line (even free local calls). Add the amount of credit desired. I allocated the remaining credit from the original $10 ($3.04).

An online number for incoming calls can be setup for additional $$$.

Configure the SIP Trunk in trixbox

Now that Skype is configured, the trunk on the trixbox machine can be configured. This is another part that has very little documentation available.

In the trixbox web interface, click on "Trunks" on the left, and then click "Add SIP trunk".

Under "General Settings" type the assigned skype username in the Outbound Caller ID field.

In "Outgoing Dialing Rules", input "NXXNXXXXXX". (area code plus 7 digit number)

Under "Outgoing Settings", give the trunk a name.
Use the following under "PEER Settings":

username=xxxxxx ; This is the Skype SIP User found in the authentication  area
secret=xxxxxxxx ; Skype SIP password
type=peer
qualify=yes
insecure=invite
host=sip.skype.com
fromdomain=sip.skype.com
disallow=all
allow=ulaw&gsm&alaw
context=from-trunk
fromuser=xxxxxx ; Skype SIP Username

Under "Registration" use:

username:password@sip.skype.com/username

Leave the "User Context" and "User Details" blank.

Configure an Outbound Route

This is the last step needed to place outgoing calls.

• Click "Outbound Routes" on the left panel.
• Give the route a name (skypeout or similar)
• Enter "99|." in the "Dial Patterns" box. (Users will dial "99" to reach an outside line.)
• Select the Skype SIP trunk that was created earlier in the "Trunk Sequence" area.
• Submit the changes and then apply the configuration changes.

After the configuration has been applied to Asterisk, the system should be working. Try reaching an outside line from a softphone by dialing "99 1 xxx xxxx"
If it dosen't go through, make sure credit is applied in skype.
Check the output by running "asterisk -r -vvvv" on the server
At this point the phone system should be working correctly. Continue reading for Openfire setup.

Set up the Openfire Collaboration Server (Instant Messaging)

Now that the PBX is working with outgoing calls, the IM server can be configured.

• Download Openfire to the server and start the installation (rpm -ivh openfire_*.rpm).
• When the install is finished, log onto the admin console. (http://ipaddress:9090)
• Complete the setup wizard. When asked for a database use the internal database.

After the setup wizard is up and running, create some new users.

• Click the "Users/Groups" button on the menubar and then "Create New User" on the left.
• Install Spark on a client computer. For the server enter the IP address of the trixbox/Openfire machine. Click connect the client should log on normally.

Install the SIP Phone Plugin for Openfire and Spark.

• Open the Openfire web admin page and click the "Plugins" button on the top menubar.
• Click "Available Plugins" on the Plugins page.
• Locate "SIP Phone Plugin" and click the green install button on the right.
• After the plugin is installed successfully, click the "Server" button on the menubar, and then click the "Phone" button on the sub-menubar.
• Click "Add new phone mapping"

Enter the following:

XMPP username: openfire username
SIP username: asterisk extension
Authorization username: asterisk extension
Display Phone Number: Desired number
Password: password setup on trixbox
Server: IP address of trixbox machine

 Once all the data is in, hit create. The extension will be registered when the client installs the plugin and logs on. (next step)

Install the SIP Phone Plugin in Spark.

• Open Spark, login with the user that has the mapped extension.
• Click the "Spark" menu on the top left and select "Plugins"
• Click the "Available Plugins" tab. Select the SIP Phone Plugin and click the green install button on the right. After it is finished installing, restart Spark.

When Spark starts back up, a new toolbar will be displayed with phone dialing tools. Assuming the extension mapping was configured correctly, the Spark client can now place calls in the same way the X-Lite client can.

That concludes the setup. Please post any problems or suggestions. Thanks!

Resuming an Interrupted SSH Session

If you ssh into remote *nix boxes with any sort of regularity, it's almost inevitble that at some point your connection is going to drop. If it happens while you are editing a file it can be a real pain to start from where you left off. In my case, I had an account on my school's Unix server but it would kick me off after about 5-10 minutes of inactivity. Talk about frustrating. 

Fortunately, the "screen" command let's you easily restart your session. 

Get Screen

Your distro probably already has screen built in. If you're using ubuntu and it's not there just type:

sudo apt-get install screen

For gentoo the command would be:

emerge -av app-misc/screen

Using Screen

Once it's installed usage is trivial. If you're only going to be using a single session, connect via ssh and type:

screen

If you get dissconnected, reconnect your ssh session and type:

screen -R

You will then enter the session where you left off.
You can check if there is an existing screen session by typing:

screen -ls

 If you want to use multiple sessions, you will need to name the sessions with a unique name.

screen -S session1

Then connect in the same way, but including the session name:

screen -R session1

 Those are the basics! Screen has more advanced features you can check out in the man page.

Installing Gentoo on an Apple G5

I was lucky enough to recently acquire an old dual 2.5Ghz G5 from my brother because he was no longer using it. Sweet! This is the first Mac I've used since the late 90's, and I have to say I'm really impressed with the quality of the case, components, and construction. The only drawback is that it's the last Apple to use the PowerPC processor architecture, meaning consumer software isn't really being developed for it anymore. :(

Since updated software for OS X on PPC is getting hard to find, I decided that a source based Linux distro could extend the life of the machine a little longer (debateable, some feel an OS like Debian has more support). Although to be honest, a more practical option would be to keep OS X and compile any Linux software I wanted for OS X. But what's the fun in that? I haven't really used OS X but I would definitely like to experiment with it, so my goal is to have a dual boot system with OS X and Gentoo Linux.

I don't have any experience with Linux on PPC (especially the bootloader), so I decided to take no chances and removed the hard drive with OS X on it and put in a spare 160GB sata drive I had, just to make sure I didn't ruin some data. (fdisk /dev/sda instead of /dev/sdb has been known to happen...)

This walkthrough is heavily inspired from the PPC Gentoo Handbook. I had to make a few modifications since I didn't want a fully 64 bit system and the regular PPC handbook won't work for a G5 if you follow it exactly.

Getting Gentoo

The Gentoo minimal install CD can be downloaded here: http://distfiles.gentoo.org/releases/ppc/current-iso/
This walkthrough was made using "install-powerpc-minimal-20091018.iso"
Burn the iso to a CD-R with a program like Iso Recorder, Nero, or K3B.

Booting from the Install CD

Insert the CD (you may have to boot into OS X to eject the drive without forcing it manually). Reboot and hold down the "c" key after the startup tone sounds.
If you did it right, some information and boot options will be displayed by yaboot. Type "G5" and hit enter to boot from the livecd. If the display is corrupted (I had some problems with the pcie Radeon) try rebooting and typing "G5 video=ofonly" at the prompt.
The livecd should detect the network interface and start dhcp automatically.
When it's finished booting, start ssh so we can install from a different computer.

passwd password (use your desired password)

/etc/init.d/sshd start

ifconfig

Take note of the ipaddress and open an ssh connection from another computer. From Linux:

ssh root@$IP_ADDRESS

Prepare the Hard Drive

This part can get a little tricky. The drive needs a minimum of 4 partitions (counting swap), 2 of which are not used by linux. We will use mac-fdisk to partition the drive. Since, I am installing to a separate drive I'm not going to worry about mac partitions.

mac-fdisk /dev/sda

Press "i" to wipe the drive and initialize it. Warning: All data will be lost!
After the drive has been initialized, press "b" and enter "2p" when asked for the start block. This installs the Apple_Bootstrap partition.
Now we need a swap. Press "c" and enter "3p" for the block. Enter "512M" or greater when asked for the size. Most people generally use twice the installed memory. Type "swap" when the name prompt appears.
Finally, the root partition. Press "c" and enter "4p" to select the starting root block. When the size prompt comes up, type "4p" again to use up all the remaining space. When asked for a name, enter "root."
Hit "w" to save the changes, and then "q" to exit.

Set the Time

Maybe it's already correct? Type "date" and verify. If not set the correct time and date:

date 051018002010 (mmddhhmmyyyy - Month Day Hour Minute Year)

Create the Filesystems

I used ext3, a nice solid file system with plenty of support. Yaboot will not boot from ext4, so if you want to use it you will need a separate boot partition.

mke2fs -j /dev/sda4

Create and activate the swap partition:

mkswap /dev/sda3

swapon /dev/sda3

Mount the root partition so we can install Gentoo on it:

mount /dev/sda4 /mnt/gentoo

Download and Install the Latest System Files

Move to /mnt/gentoo to make things easier.

cd /mnt/gentoo

Now navigate to the Gentoo mirrors to download the latest stage 3 file:

links distfiles.gentoo.org

Navigate to releases/ppc/current-stage3 and download:

stage3-ppc64-32ul-*.tar.bz2

Unpack it:

tar xvpjf stage3-ppc64-32ul*.tar.bz2

Now portage needs to be downloaded and installed/updated.

links distfiles.gentoo.org

Navigate to releases/snapshots/current and download:

portage-latest.tar.bz2

Now install it:

tar xvjf portage-latest.tar.bz2 -C /mnt/gentoo/usr

It might take a while to finish decompressing.

Compile Options

We need to optimize compiling for the G5 processor.

nano /mnt/gentoo/etc/make.conf

Here's what I have in my make.conf:

CHOST="powerpc-unknown-linux-gnu"
CFLAGS="-O2 -pipe -mcpu=970"
MAKEOPTS="-j3"
VIDEO_CARDS="radeon"

Note since the 32bit User Land is being used, there is no 64 after the powerpc above.

Chroot to the New Installation

Copy over the DNS info so that the internet is accessible:

cp -L /etc/resolv.conf /mnt/gentoo/etc

Now /proc and /dev needs to be mounted:

mount -t proc none /mnt/gentoo/proc

mount -o bind /dev/ /mnt/gentoo/dev/

chroot /mnt/gentoo /bin/bash

env-update

source /etc/profile

You should now be inside the new Gentoo installation. Portage should already be up to date, but you can run "emerge --sync" to make sure.
List a profile:

eselect profile list

Select your desired profile:

eselect profile set 9 (9 is the 64/32 gnome desktop that I used)

Set the Timezone

Find your timezone with "ls /usr/share/zoneinfo"
Select it by "cp /usr/share/zoneinfo/America/Los_Angeles /etc/localtime"
You can see that I'm using PST time. Adjust to your needs.
While we are messing the time, might as well configure the clock.

nano /etc/conf.d/clock

Uncomment the line with "Factory" in it and replace "Factory with your zone/city. For me, that's "America/Los_Angeles"

Install and Compile the Kernel

For simplicity, I'm sticking with gentoo-sources.

emerge gentoo-sources

Now change directories:

cd /usr/src/linux

Configure the default settings for the G5:

make g5_defconfig

I've found the above command is all you need for a bootable system. Of course you should probably configure to your liking with "make menuconfig"
Now the tricky part! The G5 needs a 64bit kernel to boot, but we are using a 32bit User Land! This means we have to cross-compile the kernel. Just typing "make" will not work! Use the following:

CROSS_COMPILE="powerpc64-unknown-linux-gnu-" make && make modules_install

Wait until it's finished compiling (probably about 30 minutes) and then copy the kernel to /boot:

cp vmlinux /boot/kernel-2.6.32

Getting close! Bet you thought I forgot about fstab. Think again!
Edit fstab:

nano /etc/fstab

Make sure to comment out the line for the /boot partition
Change "ROOT" to "sda4"
Change "SWAP" to "sda3"
The default settings are configured for an ext3 /root and swap on sda3.

Set Hostname and Network

nano /etc/conf.d/hostname

HOSTNAME="yourcomputer"
Now emerge dhcp:

emerge dhcpcd

If you are using DHCP on your network, you most likely don't need to configure anything else. Gentoo will automatically get an address on boot.

Set the Root Password

This one is kinda important ;)

passwd

System Tools

To speed things up, I'm only installing a System Logger.

emerge syslog-ng

Now make sure it starts on boot:

rc-update add syslog-ng default

Bootloader!

The bootloader was one of the most confusing steps to me as I was used to grub.
Since we are using 32bit UL, we need regular yaboot (NOT yaboot-static)

emerge yaboot

Now, either exit out of the chroot, or just start a seperate ssh session to the live cd and run:

yabootconfig --chroot /mnt/gentoo

It's important you run the above command out of the chroot environment or it will error out.
If the fstab is configured correctly there should be no problems.The bootstrap should be /dev/sda2.
When it asks for a kernel type: "/boot/kernel-2.6.32" (or whatever you named your kernel)
Leave initfs blank.

When it's done, we are ready to reboot! Unmount /mnt/gentoo/proc /mnt/gentoo/dev/ and /mnt/gentoo
then reboot.
If all goes well, gentoo will boot to the command prompt!
From here on out, software can be instaled using standard emerge commands. After emerging gnome, a few other apps, and fiddeling with the appearence (thanks gnome-look.org), I ended up with this:

Conclusion

I actually had some fun working through this project, but I have to say I probably won't be using it as my main desktop. The system is noticeably snappier than OS X, but that may be because I have no 3D effects turned on. The main drawback is closed source software that isn't precompiled for PPC (Adobe Flash, Skype) won't work, which greatly reduces the usability of the system. (Maybe HTML5 will change that?)The OS X drive will be going back in soon and I'll experiment with compiling linux software in OS X. Oh well, it was a fun, project.

Upside Down Images Prank

The other day my fiancee covered up my mouse sensor with a sticky note and then lurked around my computer to see how long it would take me to figure it out when I got home from work. Once I noticed what she had done, the first thing I thought was "well of course, this means war!" Time to break out the ole bag o' computer pranks!

First, I pulled the old take-a-screenshot-of-the-desktop-and-set-it-as-the-background, but that just didn't seem good enough. (Plus she figured it out in about 15 seconds.) So I knew I had to break out the big guns. I remembered seeing a prank a while back ago about setting up a proxy server to mess with images on websites, and that seemed like the perfect weapon for this scenario.

I got the idea from here: http://www.ex-parrot.com/pete/upside-down-ternet.html
There are a couple of other pranks on there that are pretty cool. Anyway, the site gives the script nessecary to flip the images, but it dosen't give a novice squid user (not the tasty calamari type) intructions on how to apply it! Being a squid noob, I had to do a few more searches to familiarize myself with the process. I found this site: https://help.ubuntu.com/community/UpUbside-Down-TernetHowTo but it didn't give me a working system, so I figured I would write up a sure-fire way for this to work quickly.

For my project, I used a Ubuntu 9.10 server, mostly because I already had a virtual machine installed with almost nothing on it. Also, adding software tends to be quick and easy on ubuntu. Any linux distro will work, but the steps for adding and configuring software will vary. Windows will work as well, but I don't have a windows machine I want to fool around with (i.e. break).

I should mention that I am not using a transparent proxy since I'm assuming you have access to your victim's computer, meaning that the proxy must be set in the web browser. Also, it's probably a good idea to disable the firewall on the server computer. With Ubuntu server, the command is "service ufw stop"

Ok, so once Ubuntu is up and running, bust open the terminal and type:

sudo apt-get install squid

While we are installing things, might as well make sure Apache 2 and imagemagick are installed:

sudo apt-get install  apache2 imagemagick

Make sure apache is working by opening Firefox and going to http://localhost and you should get a "It Works!" page. Run "/etc/init.d/apache2 start" if it doesn't work.

Now that we have all the software installed and apache is running, we need to configure squid. The squid configuration file is in /etc/squid/squid.conf. Open that up with root access:

sudo gedit /etc/squid/squid.conf 

The squid conf file is HUGE! It's a really powerful program, and we are just going to scratch the surface. Search for "TAG: acl" and scroll down to the uncommented lines. You need to add in something like:

acl two_ten src 192.168.210.0/24

My network uses 210.0, you need to adjust to whatever fits your requirements. http://www.subnet-calculator.com/ is a nice site to figure out what network options to use.

Once the acl line has been added scroll down to the "TAG: http_access" section and add:

http_access allow twoten_network

Save the file, but don't close it yet and restart squid:

sudo /etc/init.d/squid restart

Hopefully an "[OK]" shows up. Open up Firefox and the proxy needs to be configured.

 Edit->Preferences->Advanced->Network tab->Settings

3128 is the default port for squid. After applying the settings, try to browse to a website. If the site comes up normally, hooray! Almost done!

So now that squid is working normally, it's time to setup the image flipping trickery. First, apache needs a directory to store the images in with the correct permissions:

sudo mkdir /var/www/images
sudo chown www-data:www-data /var/www/images
sudo chmod 755 /var/www/images

Now add Apache to the proxy group:

sudo usermod -aG proxy www-data

Restart Apache:

sudo /etc/init.d/apache2 restart

 Time to use the script provided at http://www.ex-parrot.com/pete/upside-down-ternet.html. Fire up gedit and paste the following:
Edit: just noticed that the sides of the below code are not viewable, however you can copy and paste them into a word processor.

#!/usr/bin/perl
$|=1;
$count = 0;
$pid = $$;
while (<>) {
        chomp $_;
        if ($_ =~ /(.*\.jpg)/i) {
                $url = $1;
                system("/usr/bin/wget", "-q", "-O","/var/www/images/$pid-$count.jpg", "$url");
                system("/usr/bin/mogrify", "-flip","/var/www/images/$pid-$count.jpg");
                print "http://127.0.0.1/images/$pid-$count.jpg\n";
        }
        elsif ($_ =~ /(.*\.gif)/i) {
                $url = $1;
                system("/usr/bin/wget", "-q", "-O","/var/www/images/$pid-$count.gif", "$url");
                system("/usr/bin/mogrify", "-flip","/var/www/images/$pid-$count.gif");
                print "http://127.0.0.1/images/$pid-$count.gif\n";

        }
        else {
                print "$_\n";;
        }
        $count++;
}

If you compare this script to the one on the original page you'll notice I changed the path to the image directory on the lines that start with "system." The script will work with no editing if you used the quoted commands above to create the images directory.  
Save the script as flip.pl in /usr/local/bin. Add permissions:

sudo chmod 755 /usr/local/bin/flip.pl

Add the following to squid.conf

url_rewrite_program /usr/local/bin/flip.pl

Now save and close squid.conf
Change the permissions on the script:

sudo chmod 755 /usr/local/bin/flip.pl

Restart squid and apache:

sudo /etc/init.d/apache2 restart
sudo /etc/init.d/squid restart

Done! Open up a webpage and you should see something like this:

Notice that only .gif and .jpg images are flipped

Since this walkthrough is not using transparent mode, now the victim's computer must be configured. The proxy is configured the same way, but in windows the path may be a little different. For example using Firefox 3.6 in Windows XP, the path is:

Tools->Options->Advanced->Network>Settings

Now all you have to do is be close by to see your victim's reaction!

Let me know if any of the above doesn't work or if you have any other awesome tricks. Also, I'm probably going to write up some instructions on how to do this in transparent mode for confusion on a larger scale.


As always, feedback is welcome.