Category Archives: en

deny access to .git directory with Apache 2 on Debian

When you use GIT in order to deploy your website on an Apache web server, in everybody can access to the .git subfolder. Which means that it’s possible to get your source code (even passwords…).

Create a file name /etc/apache2/conf.d/denyGIT

# do not allow .git version control files to be issued
<Directorymatch "^/.*/\.git+/">
  Order deny,allow
  Deny from all
</Directorymatch>
<Files ~ "^\.git">
    Order allow,deny
    Deny from all 
</Files>

retart apache

/etc/init.d/apache restart

suPHP

On a web server, suPHP allows PHP to run as the user and group that owns the file.

In WordPress, for example it allows to upload files, update wordpress itself or its plugins.

But obvious security issues can make this Apache module really dangerous for your other websites. Here is how I installed it only for WordPress.

http://wiki.gonzofamily.com/a/SuPHP

Git Server on Debian

After testing GIT, and without hesitation, I decided to abandon SVN/Subversion. I won’t write here one more article comparing them but I wrote (and update regularly) a wiki page explaining how to install it on Debian and give access via HTTP, SSH and HTML.

http://wiki.gonzofamily.com/a/Install_GIT_as_public_repository_on_Debian

I also noted how I transfered my existing local XCode repositories to this server, but I will improve this doc soon:

http://wiki.gonzofamily.com/a/GIT_and_XCode

Retrieve local IPv4/IPv6 on Wifi/Cellular on iPhone

On iOS, you want to know your local IP (for example, when an application opens a webpage on the wifi interface) but the iOS SDK provides no simple way to get the IP Address for the wifi connection.

I found an interesting Method in Objective-C which retrieve the IPv4 address of the wifi connexion as a NSString on Zach Waugh’s blog.

Sadly it doesn’t work with IPv6. So I modified it and here is the code:

http://wiki.gonzofamily.com/a/Retrieve_local_IPv4/IPv6_on_Wifi/Cellular

PID on Mac OS X without Netstat

On Linux we use to see the Processes associated to a listening network port with the following command
netstat -p

On Windows it’s
netstat -o

Sadly on Mac OS X this option doesn’t exist. The equivalent will be
sudo lsof -P

So we can imagine that we need to know which program dare listening on port 123
sudo lsof -Pn | grep 123

You will see something like that:

ntpd 21 root 20u IPv4 0x0899ace4 0t0 UDP *:123
ntpd 21 root 21u IPv6 0x0899ac08 0t0 UDP *:123
ntpd 21 root 22u IPv6 0x0899baa4 0t0 UDP [::1]:123
ntpd 21 root 23u IPv6 0x0899b8ec 0t0 UDP [fe80:1::1]:123
ntpd 21 root 24u IPv4 0x0899b810 0t0 UDP 127.0.0.1:123
ntpd 21 root 25u IPv6 0x098b5658 0t0 UDP [fe80:4::cabc:c8ff:fe90:6472]:123
ntpd 21 root 27u IPv6 0x098b5b80 0t0 UDP [2002:3ba7:d4b1::cabc:c8ff:fe90:6472]:123
ntpd 21 root 28u IPv4 0x15463370 0t0 UDP 10.0.130.101:123
ntpd 21 root 30u IPv6 0x15464b80 0t0 UDP [2002:3ba7:d4b1::c3e:e29a:8de6:68cc]:123

So it was the NTP Daemon with the process ID 21…. petit coquin !

(Cf this page of my Wiki: http://wiki.gonzofamily.com/a/Port_listening_on_Mac,_Windows_or_Linux)

Wiki

As most of my IT articles were about guides, I decided to open a Wiki. It will be more convenient to keep them updated and organised.

Little by little this wiki will become my main website.

Here it is : http://wiki.gonzofamily.com

What is a wiki?
It’s a collaborative website that allows the creation and editing of any number of webpages. It’s easy to modify its pages without programming knowledge, and then to keep them up-to-date

You can correct yourself anything on this wiki. You just need to login with a real email address.

IPv6 and Privacy

IPv6 makes it easy to track you. Let me explain.

IPv6 is composed of a Prefix and a suffix:
IPv6 address: 2001:0DB8:1fc3:481:b357:83ff:fecb:4c30
Prefix: 2001:0DB8:1fc3:481:
Suffix: b357:83ff:fecb:4c30

The prefix changes according to your internet access (at home, work, friend’s…) but the Suffix is deduced from your MAC address and will be always the same for one computer.
So even if your IPv6 Adresse changes, the end of it is unique and identifies your device for sure.

The counter mesure is called IPv6 Privacy Address.
When you enable this policy on your computer, a second IPv6 is randomly affected during autoconfiguration, called Temporary IPv6 address. Even if you cannot change the Prefix, the Suffix changes each time.
It means: you can still contact your computer with the previous IPv6 address, but in the other way (when the computer connect to the internet) it will have a different random address. It has got 2 addresses.
Windows Vista/Seven: it’s enabled by default, you certainly saw “Temporary IPv6 Address” in your ipconfig
Mac OS X 10.6: you have to enable it

How to enable IPv6 Privacy Address on Mac?

you must create the file /etc/sysctl.conf with the following content:

net.inet6.ip6.use_tempaddr=1
net.inet6.ip6.prefer_tempaddr=1

Next restart you’ll get a second IPv6 address and it will be prefered for every internet access.

But I use to protect my servers via the IP address!

Many SSH/FTP/HTTPS servers use IP Addresses to filter access. You would like to keep always the same IP.

I think that every client software should be able to choose which IPv6 address it want to use (since we have 2 IPv6 in Privacy Mode), I guess it will become common very soon. For example in ssh you can add the following line in .ssh/config :

BindAddress 2001:0DB8:1fc3:481:b357:83ff:fecb:4c30

But I think, most of the time, a limited access can be based on the prefix of your IPv6 address. Allowing all your local network to access.

IPv6 Certification

I just got my Free IPv6 certification from Hurrican ( tunnelbroker.net ).

It’s a very interesting process. I think this certification is worth the time spent on it, and means you really mastered IPv6 network and servers configuration.

Before continuing I must wait for my Glue Register…
IPv6 Certification Badge for chriscatfr

Anyway, here in Australia this free tunner broker is very efficient. It allowed me to connect my all home network on IPv6 (the Apple Time Capsule has everything necessary for ipv6 tunnels, even a selective Firewall).

It also allowed me to connect my experimental Linux server (whose provider doesn’t provide IPv6 connexion). This website (on a Dedibox v3) will at last receive an IPv6 next week, Online.net promised… thanks to Hurricane Electric, I did all the necessary tests before the big jump (that I already had done 4 years ago on an OVH server… Online.net is very late…)