Updated: Download the newest version (2.5.urmom) here.

After adding yet another user to my ignore list in irssi I realized that the channels started getting a little too quiet. Instead of silently ignoring public messages from ignored users I decided to redact their messages instead. The code for redacted_ignore.pl is:

#!/usr/bin/perl

use strict;
use Irssi;

use vars qw($VERSION %IRSSI);

$VERSION = "0.000000001";
%IRSSI = (
authors => 'Blaine Fleming',
contact => 'blaine@selfishman.net',
name => 'redacted_ignore',
description => 'script to redact public messages from ignored users',
license => 'GPL',
url => 'http://selfishman.net',
changed => '2009-11-03',
changes => 'FIRST POST!'
);

Irssi::theme_register(['redact', "{msgnick \$0}" . ""]);

sub do_urmom_in_public {
my ($srv, $msg, $nick, $addr, $tgt) = @_;
$srv->printformat($tgt, MSGLEVEL_PUBLIC, "redact", $nick)
if $srv->ignore_check($nick, $addr, $tgt, $msg, MSGLEVEL_PUBLIC);
}

Irssi::print("redact public messages from ignored users") ;

Irssi::signal_add_first("message public", "do_urmom_in_public") ;

This script is also available for download from here.

To use it just ignore users normally using '/ignore user'.

I've noticed several other people showing their most frequently used shell commands so here it is from a few of my systems.

One of my spamtraps that publishes all the data to a webpage at http://www.spameatingmonkey.net :

selfishman@spamtrap:~$ history|awk '{a[$2]++} END{for(i in a){printf "%5d\t%s \n",a[i],i}}'|sort -rn|head
137   vi
46   ls
39   exit
29   /etc/init.d/qpsmtpd
27   cd
25   dig
23   tail
23   sudo
16   mysql
13   ps


The system that creates the SEM fresh domains list:

selfishman@spammonkey2:~$ history|awk '{a[$2]++} END{for(i in a){printf "%5d\t%s \n",a[i],i}}'|sort -rn|head
109   vi
85   ls
35   dig
23   screen
23   rm
20   ./prep-name-zone.pl
17   cd
14   exit
13   cp
10   ./test.sh


Finally, my primary testing and development system:

selfishman@rabidmonkey1:~$ history|awk '{a[$2]++} END{for(i in a){printf "%5d\t%s \n",a[i],i}}'|sort -rn|head
72   ls
60   vi
49   time
40   cd
34   exit
29   sudo
24   cat
17   ./john
13   gcc
12   crontab


I don't remember running JTR that often!

Update: Pull the power cord and battery and let it sit for a while.  You may need to remove the BIOS battery (located under the keyboard) as well. It turns out this was the fix that I accidentally used when ripping apart the laptop trying to figure out the problem.

My primary laptop is a Dell Inspiron 1501 (cheap, I know) and a couple months back it started registering a key being pressed every second. Exactly every second. This made simple things like alt-tabbing through a list of programs difficult as it would cause the alt-tab windows to close. Copying and pasting from a command prompt was almost impossible with less than a second to do it. Programs and dialogs were opening behind other windows, sometimes behind their own parent. Various flavors of linux would even show the '=' key being pressed. The final problem that got me to look into it was when I was doing remote access using VNC to an old Windows 2000 Pro system at the Livingston-Park County Public Library. I clicked on a file and instantly I started getting harassed by Windows to delete the file as the 'delete' key was registering. After a few quick clicks and keystrokes I got out of that and opened up the log I wanted to view. To my surprise the log was being eaten one character every second.

When this problem started I had just recently upgraded the RAM from the stock dual 512MB sticks to two 2GB sticks, the harddrive from 120GB to 320GB, VMWare server to the latest version and a handful of other software upgrades. Searching the web showed many people with the same issue presenting in many flavors of Linux but a few reported it in Windows too. Unfortunately, nobody had a solution other than change the keyboard map which is just a workaround.

First thing I did was try to detect the key that was actually registering as being pressed with the hopes that maybe something was just making a key stick. Passmark's KeyboardTest showed the Pause key being pressed under the AT107 setting but when set to a Dell laptop showed nothing. Seeing these results I assumed that Windows was infected with some malware even though I run Windows XP 64-bit Edition. To make sure it wasn't an OS problem I tried to boot into the Windows XP 32-bit version I have installed on the same drive. I was allowed to login and immediately log back out. Even more convinced that it was malware, I grabbed a Ubuntu 7.10 Desktop live CD and started it up only to find the problem was still there.

Since it wasn't a software problem I thought hardware was the next thing to test. So before calling Dell and going through the routine's with them I swapped my keyboard for one from a compatible system and the problem was still there. I put in my old hard drive and old RAM and the problem persisted. At this point it had to be a Mainboard problem. Before calling Dell I decided to check my warranty online and was in luck with 144 days remaining. While clicking around the site trying to find a working Dell support number I checked the downloads section and noticed a new BIOS version. The changelog showed no major changes but I grabbed it anyway. To my surprise after a couple of reboots the problem was gone.

I'm hoping that this problem won't return and would love to know the source of it. I upgraded my BIOS when I first received the laptop but that was six months prior to this issue. I suspect it has something to do with the high precision timer so if it continues I'll have to disable that setting in the BIOS. Now I just need to figure out why my Windows XP 32-bit install won't let me log in.

I maintain a network with 10 public access computers for the Livingston-Park County Public Library with plans to buy several more in the next few weeks. Until recently all of these computers were running Windows XP and were secured using software provided by the Gates Foundation. Despite being fully patched, locked down and running up-to-date antivirus software, malware still found a way to infect these systems. Applying updates every Patch Tuesday on every computer was consuming most of my time. Even a simple change required me to sit down at each system and make that change, usually fighting the security policy to make it stick.

A few days ago Windows started showing signs of corruption so I decided it was time to reinstall the OS. This time I considered securing them with Microsoft SteadyState, a free public access computer security tool. I recently used SteadyState on the new laptops and immediately remembered the problems with Adobe Flash and JAVA. Instead of rebuilding the systems with Windows, I decided to use Ubuntu as I was already familiar with it and 7.10 (Gutsy Gibbon) was recently released. One hour later I had downloaded, burned, installed and updated Ubuntu on the first computer. At this point I decided to make it boot via PXE. Booting Ubuntu via PXE would allow for one update on one system and all systems would be affected. This means no more wasted time typing the same command on every computer. Hard to argue with that.

Requirements

• A server (preferrably running Linux) capable of running a nfs server and tftpd server (I chose CentOS 4.5)
• Plenty of disk space on the server to hold the full client filesystem (recommend at least 10GB)
• Minimum 100Mbps network connection (1Gbps recommended)
• A client system with Ubuntu installed and a public user named "public"

Setting up the server
Install the DHCP server, SysLinux and the NFS server as root
yum install dhcp syslinux nfs-utils portmap
Download, compile and install the TFTP server
wget http://www.kernel.org/pub/software/network/tftp/tftp-hpa-0.48.tar.gz
tar -xzvf tftp-hpa-0.48.tar.gz
cd tftp-hpa-0.48
./configure
make
make install
cp tftp-xinetd /etc/xinetd.d/tftp

Configure DHCP server
Your DHCP server needs to be configured to offer the boot file "/tftpboot/pxelinux.0" from the specified TFTP server. In this example, the TFTP server is 192.168.252.1, specified by the "next-server" option.

# /etc/dhcpd.conf
allow booting;
allow bootp;
authoritative;
default-lease-time 86400;
max-lease-time 86400;
get-lease-hostnames false;
use-host-decl-names on;
ddns-update-style none;
subnet 192.168.252.0 netmask 255.255.255.0 {
option domain-name "lpcpublib.local";
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.252.255;
option domain-name-servers 208.67.222.222,208.67.220.220;
option routers 192.168.252.1;
range 192.168.252.100 192.168.252.199;
next-server 192.168.252.1;
filename "/pxelinux.0";
}

Start the DHCP server and set it to start at boot. Watch for any errors when starting dhcpd.

/etc/init.d/dhcpd start
chkconfig dhcpd on

Configure TFTP server
Edit the tftp entry for xinetd to use larger blocks,enable the service and add verbosity.

# /etc/xinetd.d/tftp
service tftp
{
socket_type             = dgram
protocol                = udp
wait                    = yes
user                    = root
server                  = /usr/sbin/in.tftpd
server_args             = -v -B 8192 -s /tftpboot
disable                 = no
per_source              = 11
cps                     = 100 2
flags                   = IPv4
}

Then restart xinetd and make sure it is set to start at boot.

/etc/init.d/xinetd restart
chkconfig xinetd on

Configure SysLinux
We need to download syslinux for the extra components. This step isn't critical but allows you to build a nice menu system. If you don't need a boot menu then you can skip to copying files to the "/tftpboot" directory.

wget http://www.kernel.org/pub/linux/utils/boot/syslinux/syslinux-3.54.tar.gz
tar -xzvf syslinux-3.54.tar.gz
cd syslinux-3.54
make install

Next you need to create your "/tftpboot" directory and place the syslinux components in it.

mkdir -p /tftpboot/pxelinux.cfg
mkdir /tftpboot/com32
cp /usr/lib/syslinux/pxelinux.0 /tftpboot/
cp /usr/lib/syslinux/vesamenu.c32 /tftpboot/com32/
mkdir /tftpboot/libubuntu

Configure NFS server
Create your "/nfsroot" directory and a directory for the new filesystem