[HEA-0] Home Entertainment Automation (DIY) - Introduction

I have recently been playing around with my TV. In this series of postings, I will be discussing various exploits that I have been doing in my home. I will outline various tools and accessories that I have utilised in achieving HEA. The following is a list of the headings that I will assign to this series.

Components of a Home Entertainment Nework
Networked Media
Playing with my TV
Taking advantage of Android to achieve home entertainement automation

How Google makes its money

© 2011 WordStream, Inc.

Google+ invites available

I've got a few Google+ invites, anyone who wants one?
Just comment, including your email and I will send you the invite.
Cheers all!

My SELinux Quick Reference

tested for RHEL/Centos 5

Check status of selinux

sestatus

List security context of file and/or directories

ls -Z /dir

List security context of a/processes

ps axZ | proc

Change security context for a file/dir

chcon -Rv --type=proc_sys_content_t /dir (reboot persistent)
semanage fcontext -a -t proc_sys_content_t "/dir(/.*)?" (filesystem relable persistent)

Restore security contect of a file/dir

restorecon -Rv /dir/subdir

Allow access to a port, eg.

semanage port -a -t http_port_t -p tcp 81

Toggling SELinux policies with boolean commands;

see this wiki

When you are hitting a security restriction in your server that's being enforced by SELinux (in enforcing mode) You can troubleshoot such issues by first setting selinux to permissive and check the audited security context breaches.

setenforce 0

If SELinux (in permissive mode) is complaining about a specific process' access to files(/var/log/audit/audit.log), we can resolve these issues by reviewing what SELinux would have wanted inorder to allow access. e.g for snmpd:

grep snmpd_t /var/log/audit/audit.log | audit2allow -r

If the results look reasonable, then make custom policy module to allow the actions;

grep snmpd_t /var/log/audit/audit.log | audit2allow -M snmpdlocal

and then load the module

semodule -i snmpdlocal.pp

then check if module is loaded correctly

semodule -l

Monitor the audit.log to see if issue is resolved. If all looks ok, then revert your SELinux to enforcing

setenforce 1

Configuring squid proxy for ldap authentication

This article is intended for someone with prior knowledge of how squid proxy server works. It seeks to summarise and simplify the process of configuring squid to authenticate against an ldap directory and possibly setup access controls to web resources against ldap groups.

Note that you probably need kernel-devel openldap-devel packages on your system.

Make sure that your squid is compiled with ldap support. If not already so, you can reconfigure your squid by re-running './configure' as follows:

]# ./configure --sysconfdir=/etc/squid --bindir=/usr/sbin --includedir=/usr/include --localstatedir=/var --with-logdir=/var/log/squid --datadir=/usr/share --libexecdir=/usr/lib/squid --enable-basic-auth-helpers="LDAP MSNT NCSA" --enable-external-acl-helpers="ip_user ldap_group unix_group wbinfo_group"

Then in your squid.conf you should configure authentication by modifying the auth paragraph/directives

auth_param basic program /usr/lib/squid/squid_ldap_auth -b "ou=yourou,o=yourorg" -f "uid=%s" -h your_ldap_server.domain.com
auth_param basic children 10
auth_param basic realm "Domain.Org Proxy-Cache"
auth_param basic credentialsttl 5 minutes

To be able to filter users with ldap groups, you need to configure external acl like:

external_acl_type ldap_groups %LOGIN /usr/lib/squid/squid_ldap_group -b "ou=your_ou,o=your_org" -f "(&(cn=%g)(memberUid=%u))" -h your_ldap_server.domain.com

On the acls, you specify the handle for your auth

acl ldap_authenticated proxy_auth REQUIRED
acl allowed_groups external ldap_groups mygroup
acl subnet1 src 10.0.0.0/255.255.0.0

Then finally on the http_access section:

http_access allow subnet1 ldap_authenticated allowed_groups

Here, you should remember that squid access rules are read sequencially top-down and when a match is found, processing stops. so the order of your access/deny directives matter very much.
The above statement matches all users in subnet1 who are successfully authenticated and belong to ldap group 'mygroup'

Test your setup to see if auth is working ok, On the command prompt run:

/usr/lib/squid/squid_ldap_auth -b "ou=yourou,o=yourorg" -f "uid=%s" -h your_ldap_server.domain.com

and supply a username 'space' password
If it returns 'OK' then your auth is setup ok. Make sure there is only a single space between username and password

As a bonus: you may consider immunising your squid conf

]# chattr +i /etc/squid/squid.conf

This has been tested against Centos 5.3 squid-3.0.STABLE12 installed from source.

HTTP Rewrite

Someone may find this useful. If you have configured your site for https access, and you want anyone who tries to acess it using normal http to automatically redirect to https, you can use rewrite in this fashion:

# This rewrites all hits on port 80 to port 443
<>VirtualHost *:80>
     RewriteEngine On
     RewriteCond ^{HTTPS} !on
     RewriteRule ^/?(.*) https://%{HTTP_HOST}/$1 [R,QSA,L]
<>/VirtualHost>

On the ssl configuration, you may want to:
<>VirtualHost *:443>
     ...
     RewriteEngine On
     # Now send everyone to your https base(document root)
     RewriteRule ^/(.*) http://your_https_site/$1 [L,P]
<>/VirtualHost>

For help with the flags used, check http://borkweb.com/story/apache-rewrite-cheatsheet. Of course you need mod_rewrite in your apache.

[zenoss] employ ping down dependency to suppress other events

sum = str(evt.summary)
if getattr(evt, 'severity', 0) > 0 \
and getattr(evt, 'eventClass', '/Unknown') != '/Status/Ping' \
and device and device.getPingStatus() > 0:
       evt._action = "drop"

if (sum.find("Command timed out")>=0) \
or (sum.find("Socket timeout")>=0) \
or (sum.find("Unable to read")>=0) \
or (sum.find("Process not running")>=0) \
or (sum.find("SNMP agent down")>=0) \
or (sum.find("No response from")>=0):
     if device.getPingStatus() <= 0:
           time.sleep(8)
           if device.getPingStatus() > 0:
                  evt._action = "drop"
     else:
           evt._action = "drop"

   if getattr(evt, 'prodState', 99)<400:
      evt._action = "drop"