feldspaten.org – Applied technology, resilience, survival, photography and Mate

Urgent: Nextcry ransomware

2019-11-19 by phoenix

A recently disocever bug, CVE-2019-11043 opens the door for a newly identified ransomware named "Nextcry". If you configured your Nextcloud to run on nginx as reverse proxy (as I have done) you could be affected. Update php-fpm NOW.

Mitigation

On this Nextcloud page you find instructions how to mitigate the issue. I post it here as personal mirror

You need two changes in your nginx.conf:

location / {
     rewrite ^ /index.php$request_uri;
 }

location / {

rewrite ^ /index.php$request_uri;

}

Becomes

location / {
             rewrite ^ /index.php;
}

location / {

rewrite ^ /index.php;

}

And

location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+).php(?:$|\/) {
     fastcgi_split_path_info ^(.+?.php)(\/.*|)$;
     include fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_param PATH_INFO $path_info;
     fastcgi_param HTTPS on;
     # Avoid sending the security headers twice
     fastcgi_param modHeadersAvailable true;
     # Enable pretty urls
     fastcgi_param front_controller_active true;
     fastcgi_pass php-handler;
     fastcgi_intercept_errors on;
     fastcgi_request_buffering off;
 }

location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+).php(?:$|\/) {

fastcgi_split_path_info ^(.+?.php)(\/.*|)$;

include fastcgi_params;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_param PATH_INFO $path_info;

fastcgi_param HTTPS on;

# Avoid sending the security headers twice

fastcgi_param modHeadersAvailable true;

# Enable pretty urls

fastcgi_param front_controller_active true;

fastcgi_pass php-handler;

fastcgi_intercept_errors on;

fastcgi_request_buffering off;

}

Becomes (Add $try_files $fastcgi_script_name =404;)

location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+).php(?:$|\/) {
     fastcgi_split_path_info ^(.+?.php)(\/.*|)$;
     try_files $fastcgi_script_name =404;
     include fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_param PATH_INFO $path_info;
     fastcgi_param HTTPS on;
     # Avoid sending the security headers twice
     fastcgi_param modHeadersAvailable true;
     # Enable pretty urls
     fastcgi_param front_controller_active true;
     fastcgi_pass php-handler;
     fastcgi_intercept_errors on;
     fastcgi_request_buffering off;
 }

location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+).php(?:$|\/) {

fastcgi_split_path_info ^(.+?.php)(\/.*|)$;

try_files $fastcgi_script_name =404;

include fastcgi_params;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

fastcgi_param PATH_INFO $path_info;

fastcgi_param HTTPS on;

# Avoid sending the security headers twice

fastcgi_param modHeadersAvailable true;

# Enable pretty urls

fastcgi_param front_controller_active true;

fastcgi_pass php-handler;

fastcgi_intercept_errors on;

fastcgi_request_buffering off;

}

Here I post my configuration, that is slightly modified as I run currently on FreeBSD.

root […]   # Wherever the root is
 location / {
     rewrite ^ /index.php;
 }
 location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+).php(?:$|\/) {
     fastcgi_split_path_info ^(.+?.php)(\/.*|)$;
     try_files $fastcgi_script_name =404;
     include fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     #fastcgi_param PATH_INFO $path_info;
     fastcgi_param PATH_INFO $fastcgi_path_info;
     fastcgi_param HTTPS on;
     # Avoid sending the security headers twice
     fastcgi_param modHeadersAvailable true;
     # Enable pretty urls
     fastcgi_param front_controller_active true;
     fastcgi_pass unix:/var/run/php-fpm.sock;
     fastcgi_intercept_errors on;
     fastcgi_request_buffering off;
 }

root […] # Wherever the root is

location / {

rewrite ^ /index.php;

}

location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+).php(?:$|\/) {

fastcgi_split_path_info ^(.+?.php)(\/.*|)$;

try_files $fastcgi_script_name =404;

include fastcgi_params;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

#fastcgi_param PATH_INFO $path_info;

fastcgi_param PATH_INFO $fastcgi_path_info;

fastcgi_param HTTPS on;

# Avoid sending the security headers twice

fastcgi_param modHeadersAvailable true;

# Enable pretty urls

fastcgi_param front_controller_active true;

fastcgi_pass unix:/var/run/php-fpm.sock;

fastcgi_intercept_errors on;

fastcgi_request_buffering off;

}

Backups!

And a kind reminder, that the only viable protection against Ransomware are occurring offline backups on separate media. I burn my backups still on Blue-Rays, as this is the only fool-proof way of protecting your data against software threads like Ransomware or stupid user errors.

Sourdough - Day 4

2019-11-09 by phoenix

After another 24h both glasses are already raising. The sourdough started is now active and can be used for baking. I'll still feed them and let them stand for another day, but in principle this is how it should look and what you need to do.

Finished sourdough in jam glasses. Left: Rye based, Right: Wheat/Spelt based

Sourdough in about 4-5 days from scratch, using nothing but flour and water. Nature provides really everything you can wish for 🙂

Sourdough - day 3

2019-11-08 by phoenix

After another day, the sourdough should be already pretty active. A slight soury smell and visible bubbles are arising. This shows us, the bacteria are active and doing exactly what they are supposed to be doing.

Bubbles and a mild sour smell. That's how it should be!

Until now I made a very generic sourdough. Now it's time for the dough to specialise. With specilise I mean, that we create trunks for the different flour types we intent to use. I mostly bake with wheat/spelt and with rye, so I'm gonna create two types of sourdough.

Ultimately I want to have two different jam glasses in the fridge, one for wheat/spelt and one for rye. In general sourdough likes it to always have the same kind of flour and because wheat, spelt and rye are different grains it's recommended to have different sourdough for each of them. I mix spelt and wheat together, because until now I had good results with this combination.

So, I take now two jam glasses, fill them 1/4 with flour and add 4 tablespoons of our sourdough to each of them. Then I mix the contents and add warm water until we reach a very liquid, but sill doughy consistence. This we now let raise for another day.

Left is the rye-based sourdough, right is the wheat/spelt based sourdough. They are now going to raise for 12h

In about 12h we're probably have to feed them again. Now the activity of the sourdough should be already pretty good.

Sourdough - day 2

2019-11-062019-11-06 by phoenix

Day two of making sourdough from scratch. The dough starts to have some larger bubbles and already smells mildly sour. Looks good so far!

This is how your sourdough should look after 1-2 days. Some larger bubbles form as result of the process the bacteria are doing in the dough

I removed more than half of the dough and fed the remains with fresh flour and water. After re-feeding all of the bubbles are gone. After some minutes some small new bubbles start to form. This is a good sign for activity and shows us, that we are on the right way. Actually a bit faster than I though 🙂

Mixed sourdough after feeding shows almost no bubbles
After some minutes some small bubbles appear

Looks like we're soon ready to make new bread again 🙂

Sourdough - Day 1

2019-11-05 by phoenix

Just a tiny update on the sourdough process. After 1 day some small bubbles start to form. I've fed the dough using again 50g flour and 50g water. On day 1 I don't remove old dough, as I think the number of absolute bacteria is still low and needs to be increased first.

Developing sourdough, already has some small bubbles after 1 day

We're having about 19 degrees here in the house. It's not optimal but it seems to work. Could be that it's slowed down a little bit because of the temperature. Anyways, the bacteria are pretty resilient, so no need to worry. Might just take a day longer 😉

Sourdough from Scratch

2019-11-04 by phoenix

I'm starting a new sourdough culture from scratch. All you need is flour, water a nice and warm spot and some time.

Recipe

50g wholemeal flour
50g universal flour
ca. 50-100g water

Mix everything nicely together and put to rest for a day. The bacteria prefer temperature between 20 and 25 degrees. Low temperature encourage lactate-bacteria growth (sour taste), higher temperature yeast bacteria. In the end you want to have both, so keeping the temperature in this range is recommended.

Also making sourdough and bread from it is one of the crucial skills everyone should know for the unavoidable upcoming zombie apocalypse 😉

Windows 10 Clock in UTC

2019-11-03 by phoenix

If you are running Windows and Linux in dual boot, you will soon find out, that the clocks are not matching. Most probable the reason is that Windows by default expects the computer time to be set to local time, while Linux assumes it to be UTC.

I consider the approach of Linux the better one: The BIOS/UEFI system time is there set to a global harmonised standard, UTC. The operating system then translates this to the local time. This means you can install as many operating systems in parallel without interference of them with the system time - just immagine if you have for example, Windows, FreeBSD and two Linux distributions on your computer and every one of them wants to account for daylight saving time .... When setting the system clock to UTC, this problem will never arise.

Setting Windows to use UTC as system time

Registry magic! Create a new registry key named RealTimeIsUniversal.reg with the following contents.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation]
      "RealTimeIsUniversal"=qword:00000001

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation]

"RealTimeIsUniversal"=qword:00000001

Alternatively you can create a QWORD (or DWORD for 32-bit Windows) with the value "1" in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation\RealTimeIsUniversal

Then reboot Windows and set the time zone to UTC

If unsure, try another reboot to check if the settings persists, but that should do the job.

Welcome to our new home

2019-11-01 by phoenix

That's my first blog post from our new home place. Life is a big journey and no doubts this is one of my biggest adventures so far 🙂

Bye-Bye Rescue Service

2019-10-162019-10-16 by phoenix

I'm sad.

On Saturday, 12.10.2019 I had to sign my resignation from the White Cross. After about 13 years of service and many friendships this was an incredible hard step to make. Indeed, up to now this was probably the hardest signature I ever had to do (And I'm still sorry that I had to do this Luke, I really am!)

When you are moving to a new country, you got to cut down some of your roots. It hurts, and I keep on repeating a good old saying

If you want something new, you have to stop doing something old.
Peter F. Drucker

I'm now heading to my next big thing: moving to another country. And I'm sure, there will be new opportunities to contribute and socialize. Fire brigades are all over the places and the Red Cross is also active there 🙂

CCCamp 2019 - Pictures

2019-09-012019-09-01 by phoenix

I've created a new Album with some of my CCCamp pictures. Three pictures I also uploaded to my Unsplash [1] [2] [3]

CCCamp overview
TROC
Middle tower

With a mild form of post-camp depression, it's time to move on and prepare the next big jump.
Bye bye Mildenberg, thanks for a great time with lots of friendship, nerdism and cool stuff 🙂