eNik » Featured

Push Synology syslogs to Splunk

admin — Mon, 19 Dec 2011 16:57:25 +0000

This article walks you through the steps that are needed to get the Log messages from your Synology NAS out and into a Splunk instance.

For the sake of simplicity I assume in this example that the IP address of the Synology NAS is 192.168.10.99 and that the IP of the Server running is 192.168.10.200

1) Prepare Splunk

First let’s prepare Splunk to receive syslog messages

Click on Manager

Select “Data Inputs”

Click “Add New” for UDP

Enter the Port number (let’s use the standard 9998)

Select “syslog” as source type

Click “Save”

2) Prepare your Synology NAS

There you should see the model name in the second line – write it down

Click on “Control Panel”

And then on “Terminal”

Make sure “Enable SSH service” is checked

You can now quit the DSM.

3) Get the Bootstrap

Open this page and search for your Synology model

Then go to this page and look for your processor model

Copy the link location of the ssh file

4) On to the Synology NAS

Start a Terminal application and log into the NAS

ssh root@192.168.10.99

Type your admin password and reply with “yes” if needed (only the first time you connect)

You’re in…

5) Installing IPKG

Type wget and paste the link of the xsh file that you copied before and hit enter.

DiskStation> wget http://wizjos.endofinternet.net/synology/archief/syno-mvkw-bootstrap_1.2-7_arm-ds111.xsh

After the download is done, type

DiskStation> sh

(sh with a space) and then the TAB key

this should result in something like

DiskStation> sh syno-mvkw-bootstrap_1.2-7_arm-ds111

Hit enter and IPKH gets installed

Finally you’ll have to update the packages list, type

DiskStation>ipkg update

DiskStation>ipkg upgrade

6) Install the Packages

Install the Nano text editor (if you master vi, you can skip this step, but you probably wouldn’t be here . Type

DiskStation> ipkg install nano

Then install syslog-ng by typing

DiskStation> ipkg install syslog-ng

7) Adapt the configuration

Open the configuration file by typing (you can speed this up this by using the TAB key to autocomplete)

DiskStation> nano /opt/etc/syslog-ng/syslog-ng.conf

Scroll down to the Destination Section and enter a new destination (put here the IP Address and Port of your Splunk server)

destination splunk { udp(“192.168.10.200″ port(9998)); };

Scroll down to the Log Section and enter a new log command (you can also use filters, but I prefer to do this in Splunk)

log { source(src); destination(splunk); };

Click

CTRL-O (to save hit Enter)

CTRL-X (to quit)

Start logging

Start Syslog by typing

syslog-ng

Check that there is a connection to your Splunk server by typing

netstat

You should see an entry for the connection to Splunk

Finally Using Splunk

Select Search

You should see the IP Address of the Synology NAS with a growing number of Events

If you click on the IP Address you apply a filter to see only messages from this host

That’s it, enjoy.

See the Splunk website for more information.

FinFisher beats Carrier IQ

admin — Fri, 02 Dec 2011 12:48:01 +0000

The FinFisher Trojan is government spyware that is installed via a phony iTunes update.

Your iPhone could be spying on you, according to the latest documents from Wikileaks, called the Spyfiles…

(Via CultOfMac: If You Thought Carrier IQ Scandal Was Bad, Wait Till You See Latest Wikileaks)

Automatically sync files across Macs via iCloud

admin — Wed, 02 Nov 2011 15:56:21 +0000

Did you know that you can sync any document between your Macs by using a little trick?

In fact, every document you put in the ~/Library/Mobile Documents folder will get synced through iCloud.

read the whole story here MacOSXHints.com

Pixelmator 2.0 Now Available

admin — Thu, 27 Oct 2011 14:50:14 +0000

Finally the long awaited Pixelmator 2.0 is available.

Check out this review: Pixelmator 2.0 Now Available On The Mac App Store, Our First Impressions

Private Eye – Check who’s phoning home

admin — Thu, 13 Oct 2011 14:44:02 +0000

There are a miryad of possibilities to check what connections are active on your Mac.

Rubbernet, Little Snitch and Dtrace (for the unafraid) are only two of them…

Now there is a new small and free tool called Private Eye that sort of formats the Dtrace output in a nice way,

so you can verify strange outgoing or incoming connections.

You can download it here – everyone should have this on his Mac…

NetworkMiner packet analyzer – Version 1.1 available

admin — Mon, 10 Oct 2011 14:22:45 +0000

NetworkMiner is a free Network Forensic Analysis Tool (NFAT) for Windows that can detect the OS, hostname and open ports of network hosts through packet sniffing or by parsing a PCAP file.

(Via Sourceforge)

Chrome Remote Desktop

admin — Mon, 10 Oct 2011 09:39:50 +0000

Chrome Remote Desktop BETA is the first installment on a

capability allowing users to remotely access another computer

through the Chrome browser or a Chromebook.

The goal of this beta release is to demonstrate the core

Chrome Remoting technology and get feedback from users.

This version enables users to share with or get access to

another computer by providing a one-time authentication code.

Access is given only to the specific person the user identifies

for one time only, and the sharing session is fully secured.

One potential use of this version is the remote IT helpdesk case.

The helpdesk can use the Chrome Remote Desktop BETA to help

another user, while conversely a user can receive help by setting

up a sharing session without leaving their desk.

Additional use cases such as being able to access your own computer

remotely are coming soon.

Chrome Remote Desktop BETA is fully cross-platform, so you can connect

any two computers that have a Chrome browser, including Windows, Linux,

Mac and Chromebooks.

Get it here

Websecurify Website Security Testing Framework

admin — Mon, 10 Oct 2011 09:09:14 +0000

…

Websecurify is an open source framework for testing web application, the platform is designed to perform automated as well as manual vulnerability tests.

The built-in vulnerability scanner and analyzing engine are capable of automatically detecting many types of web application vulnerabilities as you launch a penetration test. List of automatically detected vulnerabilities include:

SQL Injection

Local and Remote File Include

Cross-site Scripting

Cross-site Request Forgery

Information Disclosure Problems

Session Security Problems

many others including all categories in the OWASP TOP 10

The current version is still a beta one but you can run it on all major platforms (Windows, Mac OS and Linux), also it is available for the Google Chrome (Chromium) web browser. This extension provides intuitive web application security testing environment which is easy to use by everyone: from casual users who want to check the security of their web apps to experienced professionals.

(Via SecTechno)

teleport: multiple Macs – one keyboard

admin — Tue, 15 Mar 2011 09:34:44 +0000

teleport lets you use a single mouse and keyboard to control several Macs.
It’s a bit like Synergy that some users might know from the Windows world.

Download here.

OSX 10.6.1 SnowLeopard on the eee 1000HE – Part 1

admin — Sat, 03 Oct 2009 11:41:25 +0000

This video is the first part of a two part video tutorials on how to install OSX Snow Leopard 10.6.1 on the Asus EEE PC 1000HE.

This should work similarly for the other models of the eee family.

Watch part 2

The new install package can be downloaded here.

Update: New installation package

Fixed:

Sleep should work now

Brightness fix

Bluetoth fix

Ethernet fix

Existing users just replace /Extra folder with the new one.

Notes

USB boot problems

AFAIK, if you only get a blinking cursor (no boot0 or boot1 failed) then the boot0 file has not been correctly written.

Otherwise it is probably the boot1h file.

Make sure that you are in the right directory.
Type “ls -l” and make sure that you have a bunch bootXX files in the list
Make sure that you got the right disk ID (you’ll need the one that has the capacity of your USB drive)

(and no, a 4GB stick will NOT work, but it was the only one lying around to illustrate the problem)

Make sure you type : sudo fdisk -f boot0 -u -y /dev/rdiskXXX AND replace the XXX with the ID of your USB stick
Make sure that you type your password at this moment
There is no message after you do that (even if it fails)
Make sure you type: sudo dd if=boot1h of=/dev/rdiskXXXs2 AND replace the XXX with the ID of your USB stick
There you should get a message on several lines saying something about “XXX bytes transferred….”
Make sure you have a file named boot in your root
Check with “ls -l /” –> you must have a file named “boot” in this list

That should do it.

Post Installation problems

Wrong screen resolution, no sleep, … don’t panic:

Open a terminal
Type:

cd /Extra
mv Extensions.mkext Extensions_COPY.mkext
sudo ./eee-mkext-create.sh

then type your password.
Check that a new Extensions.mkext file has been created.
Reboot

Wifi

There are two types of Wifi cards that are used to build the 1000HE:

The NE766 : You’ll have to get the OSX drivers from the Ralink homepage
The NE771 : It seems that this card is working out of the box (tested by Paolo)

I swapped my Wifi card just in the beginning for a compatible Airport device (Broadcom BCM 94321MC 802.11n), so unfortunately I cannot test this.

Graphics

Works

At the moment the brightness adjustment is not working.

I’m looking into this…

WARNING: Even though I don’t experience any problems, there are some reports that the graphics performance under SnowLeopard may be quite slow for some installs (around 30% of Leopard).

You can follow this topic here.

Ethernet

Working

At the moment the ethernet port is not working.

I’m looking into this…

Bluetooth

Working

Not tested