<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>[blog.rayfoo] &#187; linux</title>
	<atom:link href="http://blog.rayfoo.info/tag/linux/feed" rel="self" type="application/rss+xml" />
	<link>http://blog.rayfoo.info</link>
	<description>Here&#039;s where I write stuff, and you read what I wrote.</description>
	<lastBuildDate>Fri, 30 Jul 2010 04:30:47 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=abc</generator>
		<item>
		<title>More automation needed</title>
		<link>http://blog.rayfoo.info/2010/07/more-automation-needed</link>
		<comments>http://blog.rayfoo.info/2010/07/more-automation-needed#comments</comments>
		<pubDate>Wed, 14 Jul 2010 15:25:04 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[automation]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[server administration]]></category>
		<category><![CDATA[TODO]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=641</guid>
		<description><![CDATA[Although I&#8217;ve managed to configure the server such that there&#8217;s a fair amount of automation for appropriate tasks (phone homes, automated monitoring and basic defenses), the time needed daily to monitor/maintain it still adds up&#8230;and is unreasonable collectively. Looks like I&#8217;ll have to look into further automating some of the tasks&#8230; Related posts that you [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2010/07/more-automation-needed/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Doing geolocation lookups in command line</title>
		<link>http://blog.rayfoo.info/2010/07/doing-geolocation-lookups-in-command-line</link>
		<comments>http://blog.rayfoo.info/2010/07/doing-geolocation-lookups-in-command-line#comments</comments>
		<pubDate>Thu, 08 Jul 2010 09:41:40 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[APT]]></category>
		<category><![CDATA[CLI]]></category>
		<category><![CDATA[Debian]]></category>
		<category><![CDATA[geolocation]]></category>
		<category><![CDATA[HOWTO]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[Ubuntu]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=624</guid>
		<description><![CDATA[Did you know that it&#8217;s possible to do your own geoip lookups from the linux command line? You need to install the geoip-bin package in Ubuntu/Debian&#8217;s APT system: $ sudo apt-get install geoip-bin Then after which, lookups can be done as simply as: $ geoiplookup 8.8.8.8 GeoIP Country Edition: US, United States Note that the [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2010/07/doing-geolocation-lookups-in-command-line/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Converting IDNs in Ubuntu</title>
		<link>http://blog.rayfoo.info/2010/07/converting-idns-in-ubuntu</link>
		<comments>http://blog.rayfoo.info/2010/07/converting-idns-in-ubuntu#comments</comments>
		<pubDate>Wed, 07 Jul 2010 15:56:06 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[APT]]></category>
		<category><![CDATA[CLI]]></category>
		<category><![CDATA[Debian]]></category>
		<category><![CDATA[DNS]]></category>
		<category><![CDATA[HOWTO]]></category>
		<category><![CDATA[ICANN]]></category>
		<category><![CDATA[IDN]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[punycode]]></category>
		<category><![CDATA[Ubuntu]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=613</guid>
		<description><![CDATA[With the start of Internationalized domain names (IDNs) it sparked my interest since it requires conversion to punycode in order to continue working with existing DNS systems/applications, which work with ASCII. Taking a search through Ubuntu&#8217;s APT system, to see whether any IDN related tools are available&#8230; $ apt-cache search punycode libidn11 &#8211; GNU Libidn library, [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2010/07/converting-idns-in-ubuntu/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>OS Profiling</title>
		<link>http://blog.rayfoo.info/2010/07/os-profiling</link>
		<comments>http://blog.rayfoo.info/2010/07/os-profiling#comments</comments>
		<pubDate>Tue, 06 Jul 2010 16:00:24 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[data mining]]></category>
		<category><![CDATA[information gathering]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[log analysis]]></category>
		<category><![CDATA[p0f]]></category>
		<category><![CDATA[Splunk]]></category>
		<category><![CDATA[tee]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=605</guid>
		<description><![CDATA[Trying out p0f along with Splunk.. p0f allows you to determine the OS of the remote machine based on the TCP fields characteristics.  It can also tell whether the machine is behind a firewall, what kind of internet connection it is running from&#8230;pretty useful for information junkies like me Here&#8217;s what I did: ./p0f -t [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2010/07/os-profiling/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Visualizing sshd brute-force attempts</title>
		<link>http://blog.rayfoo.info/2010/05/visualizing-sshd-brute-force-attempts</link>
		<comments>http://blog.rayfoo.info/2010/05/visualizing-sshd-brute-force-attempts#comments</comments>
		<pubDate>Sun, 30 May 2010 17:25:27 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[data visualization]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[sed]]></category>
		<category><![CDATA[Splunk]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=575</guid>
		<description><![CDATA[Trying out with some interesting results&#8230; 1.&#8212; This one is a Splunk query, run over the span of the last 7 days: sourcetype="ossec_alerts" rule_number="5710"&#124; rex field=_raw "Invalid user (?&#60;userid&#62;[^ ]+) from"&#124; fields + src_ip,userid&#124;fields - _*&#124; dedup src_ip userid&#124; outputcsv ssh-atk-attempts-userid-ip 2.&#8212; Then some data massaging on the csv file&#8230; [edit: this is not needed...just [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2010/05/visualizing-sshd-brute-force-attempts/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Afterglow tests</title>
		<link>http://blog.rayfoo.info/2010/05/afterglow-tests</link>
		<comments>http://blog.rayfoo.info/2010/05/afterglow-tests#comments</comments>
		<pubDate>Sun, 30 May 2010 15:04:36 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[afterglow]]></category>
		<category><![CDATA[cut]]></category>
		<category><![CDATA[data visualization]]></category>
		<category><![CDATA[graphviz]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[neato]]></category>
		<category><![CDATA[network]]></category>
		<category><![CDATA[sed]]></category>
		<category><![CDATA[tcpdump]]></category>
		<category><![CDATA[tee]]></category>
		<category><![CDATA[uniq]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=564</guid>
		<description><![CDATA[Just tryin&#8217;&#8230; Connections from/to laptop sudo tcpdump -i wlan0 -p&#124;cut -d' ' -f3,5&#124;cut -d':' -f1&#124;tee dump cat dump &#124;uniq &#124;sed -r 's/^(.*)\.[^.]+ (.*)\.([^.]+)/\1,\3,\2/' &#62; local.csv cat local.csv &#124;./afterglow.pl &#124;neato -Tgif -o test.gif Connections from laptop Let&#8217;s try again, this time only focusing on the outgoing connections initiated: Related posts that you might be interested in...June [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2010/05/afterglow-tests/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>(Terminal) Easter Eggs</title>
		<link>http://blog.rayfoo.info/2010/02/terminal-easter-eggs</link>
		<comments>http://blog.rayfoo.info/2010/02/terminal-easter-eggs#comments</comments>
		<pubDate>Mon, 08 Feb 2010 09:07:57 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[APT]]></category>
		<category><![CDATA[easter egg]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[terminal]]></category>
		<category><![CDATA[Ubuntu]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=419</guid>
		<description><![CDATA[Friend of mine showed me a link to this video (http://www.youtube.com/watch?v=b-OhjAD937s) showing some easter eggs that can be done within Ubuntu&#8217;s terminal. Apparently it can be done on any linux terminal, as long as you have the correct version of apt or aptitude installed, so give it a try and enjoy! The commands that can [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2010/02/terminal-easter-eggs/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Updating APT&#8217;s trusted keys</title>
		<link>http://blog.rayfoo.info/2009/11/updating-apts-trusted-keys</link>
		<comments>http://blog.rayfoo.info/2009/11/updating-apts-trusted-keys#comments</comments>
		<pubDate>Sat, 28 Nov 2009 14:16:37 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[APT]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[Ubuntu]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=384</guid>
		<description><![CDATA[If you&#8217;re running an apt-get install or aptitude install command, and you get WARNING: The following packages cannot be authenticated!, running sudo aptitude reinstall ubuntu-keyring might do the trick~ [via Fool's Wisdom] Related posts that you might be interested in...July 8, 2010 -- Doing geolocation lookups in command line (0)July 7, 2010 -- Converting IDNs [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2009/11/updating-apts-trusted-keys/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>OpenVPN client fails after running update-resolv-conf</title>
		<link>http://blog.rayfoo.info/2009/11/openvpn-client-fails-after-running-update-resolv-conf</link>
		<comments>http://blog.rayfoo.info/2009/11/openvpn-client-fails-after-running-update-resolv-conf#comments</comments>
		<pubDate>Tue, 17 Nov 2009 02:46:17 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[OpenVPN]]></category>
		<category><![CDATA[Ubuntu]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=352</guid>
		<description><![CDATA[OpenVPN client on Ubuntu &#8220;suddenly&#8221; stopped working.  A look through the logs showed that the update-resolv-conf script seems to be failing&#8230; ovpn-openvpn[3552]: /etc/openvpn/update-resolv-conf tun0 1500 1542 x.x.x.x x.x.x.x init ovpn-openvpn[3552]: script failed: external program exited with error status: 1 A quick trace of the update-resolv-conf script shows that the problem&#8217;s with resolvconf: resolvconf: Error: /etc/resolv.conf [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2009/11/openvpn-client-fails-after-running-update-resolv-conf/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Testing Slowloris against nginx</title>
		<link>http://blog.rayfoo.info/2009/10/testing-slowloris-against-nginx</link>
		<comments>http://blog.rayfoo.info/2009/10/testing-slowloris-against-nginx#comments</comments>
		<pubDate>Mon, 12 Oct 2009 05:59:24 +0000</pubDate>
		<dc:creator>ray</dc:creator>
				<category><![CDATA[Everything]]></category>
		<category><![CDATA[Apache]]></category>
		<category><![CDATA[linux]]></category>
		<category><![CDATA[nginx]]></category>
		<category><![CDATA[RSnake]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[Slowloris]]></category>
		<category><![CDATA[testing]]></category>
		<category><![CDATA[tools]]></category>
		<category><![CDATA[web server]]></category>

		<guid isPermaLink="false">http://blog.rayfoo.info/?p=244</guid>
		<description><![CDATA[CCCCCCCCCCOOCCOOOOO888@8@8888OOOOCCOOO888888888@@@@@@@@@8@8@@@@888OOCooocccc:::: CCCCCCCCCCCCCCCOO888@888888OOOCCCOOOO888888888888@88888@@@@@@@888@8OOCCoococc::: CCCCCCCCCCCCCCOO88@@888888OOOOOOOOOO8888888O88888888O8O8OOO8888@88@@8OOCOOOCoc:: CCCCooooooCCCO88@@8@88@888OOOOOOO88888888888OOOOOOOOOOCCCCCOOOO888@8888OOOCc:::: CooCoCoooCCCO8@88@8888888OOO888888888888888888OOOOCCCooooooooCCOOO8888888Cocooc: ooooooCoCCC88@88888@888OO8888888888888888O8O8888OOCCCooooccccccCOOOO88@888OCoccc ooooCCOO8O888888888@88O8OO88888OO888O8888OOOO88888OCocoococ::ccooCOO8O888888Cooo oCCCCCCO8OOOCCCOO88@88OOOOOO8888O888OOOOOCOO88888O8OOOCooCocc:::coCOOO888888OOCC oCCCCCOOO88OCooCO88@8OOOOOO88O888888OOCCCCoCOOO8888OOOOOOOCoc::::coCOOOO888O88OC oCCCCOO88OOCCCCOO8@@8OOCOOOOO8888888OoocccccoCO8O8OO88OOOOOCc.:ccooCCOOOO88888OO CCCOOOO88OOCCOOO8@888OOCCoooCOO8888Ooc::...::coOO88888O888OOo:cocooCCCCOOOOOO88O CCCOO88888OOCOO8@@888OCcc:::cCOO888Oc..... ....cCOOOOOOOOOOOc.:cooooCCCOOOOOOOOO OOOOOO88888OOOO8@8@8Ooc:.:...cOO8O88c. . .coOOO888OOOOCoooooccoCOOOOOCOOOO OOOOO888@8@88888888Oo:. . ...cO888Oc.. .oOOOOOOOOOCCoocooCoCoCOOOOOOOO COOO888@88888888888Oo:. .O8888C: .oCOo. ...cCCCOOOoooooocccooooooooCCCOO CCCCOO888888O888888Oo. .o8Oo. .cO88Oo: :. .:..ccoCCCooCooccooccccoooooCCCC coooCCO8@88OO8O888Oo:::... .. :cO8Oc. . ..... :. .:ccCoooooccoooocccccooooCCC :ccooooCO888OOOO8OOc..:...::. .co8@8Coc::.. .... ..:cooCooooccccc::::ccooCCooC .:::coocccoO8OOOOOOC:..::....coCO8@8OOCCOc:... ....:ccoooocccc:::::::::cooooooC ....::::ccccoCCOOOOOCc......:oCO8@8@88OCCCoccccc::c::.:oCcc:::cccc:..::::coooooo .......::::::::cCCCCCCoocc:cO888@8888OOOOCOOOCoocc::.:cocc::cc:::...:::coocccccc ...........:::..:coCCCCCCCO88OOOO8OOOCCooCCCooccc::::ccc::::::.......:ccocccc:co .............::....:oCCoooooCOOCCOCCCoccococc:::::coc::::....... ...:::cccc:cooo ..... ............. .coocoooCCoco:::ccccccc:::ccc::.......... ....:::cc::::coC . . ... .... [...]]]></description>
		<wfw:commentRss>http://blog.rayfoo.info/2009/10/testing-slowloris-against-nginx/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
