Le bloc-notes de Jérôme

Rooter son HTC G1 dream

2012-01-23T17:43:00.000+01:00

http://wiki.smartphonefrance.info/Default.aspx?Page=Mettre%20%C3%A0%20jour%20son%20HTC%20Dream%20&AspxAutoDetectCookieSupport=1

truecrypt

2012-01-17T16:20:00.001+01:00

/usr/bin/truecrypt
/usr/bin/truecrypt-uninstall.sh

Je ne pourrais dire mieux...

2012-01-17T02:13:00.002+01:00

http://www.paristechreview.com/2011/09/23/brevets-freinent-innovation/

http://lecercle.lesechos.fr/entreprises-marches/high-tech-medias/informatiques/221142104/brevets-logiciels-grande-imposture-prop

Le brevet logiciel une ineptie pourtant bien vivace

mpd sur macosx

2012-01-15T22:38:00.005+01:00

Tested on macosx 10.6

Install homebrew
Open a Terminal
/usr/bin/ruby -e "$(curl -fsSL https://raw.github.com/gist/323731)"
brew install git
- brew install mpd
- mkdir ~/.mpd
- mkdir ~/.mpd/playlists
- touch ~/.mpd/database
create a ~/mpd.conf configuration file with this:

~/music_directory "~/collectionMusique"
playlist_directory "~/.mpd/playlists"
db_file "~/.mpd/database"
pid_file "~/.mpd/pid"
state_file "~/.mpd/state"
sticker_file "~/.mpd/sticker.sql"
port "6600"
auto_update "yes"
audio_output {
type "osx"
name "My Mac Device"
mixer_type "software"
}

Applescript

launch the script editor application and copy the following lines

do shell script "/usr/local/bin/mpd ~/mpd.conf"

Compile it to check it works. Note that /usr/local/bin is the path for a homebrew installation, adjust it to your needs.

Save the script in a chosen folder and in the format field select "application", then go to the system preferences and put the application you just created in the start-up list for your user.

Now mpd should start on boot with settings given in ~/mpd.conf.

Stream on android thanks to mpdroid freely available on the market

http://www.webupd8.org/2011/02/stream-music-to-your-android-device.html

Stop the server

killall mpd

Archos 7 home Tablet v2

2012-01-10T14:40:00.002+01:00

http://forum.archosfans.com/viewtopic.php?f=81&t=49470&start=368

Un lien intéressant pour flasher cette tablette entrée de gamme

makemkv

2011-09-28T13:45:00.001+02:00

Blue-ray solution

http://www.makemkv.com/forum2/viewtopic.php?f=3&t=2568

Pas compliqué...

2011-04-14T16:03:00.000+02:00

de lire un bilan:

http://coursgratuits.net/compta/bilan2.php

Le WEP n'est pas sûr

2011-03-26T23:21:00.000+01:00

http://www.linuxconfig.org/how-to-crack-a-wireless-wep-key-using-air-crack

mathematica online

2011-03-08T13:51:00.001+01:00

http://www.wolframalpha.com/input/?i=x^2plus%28y-%28cuberoot%28x^2%29%29%29^2=1

htc G1 aller plus loin

2011-02-27T21:36:00.001+01:00

http://wiki.smartphonefrance.info/%28S%28ptiokt33txr2iy2dxvzd3nqz%29%29/Default.aspx?Page=firmware-htcdream&NoRedirect=1&AspxAutoDetectCookieSupport=1

root htc G1 dream

2011-02-25T20:27:00.001+01:00

http://wiki.smartphonefrance.info/Default.aspx?Page=root-htcdream&AspxAutoDetectCookieSupport=1

linux sur toshiba ac100

2011-02-21T00:56:00.000+01:00

http://hmmm-mhinsch.blogspot.com/2011/02/ubuntu-on-toshiba-ac100.html

Récupérer le mot de passe root sous Debian

2011-02-14T11:07:00.001+01:00

This is one of the problem faced by many person’s“what if i lost the root password”First thing that comes in mind is “use single user mode” but the answer is NO.
coz debian takes the system security to one more level up and by default ask’s for the root password.

so the BIG QUESTION IS HOW TO proceed further

follow these steps

1) on grub-boot prompt.
press “e” to enter edit mode

2) then press downarrow to reach the line that starts with “kernel “
press “e” again

3) at the end of this line type in “init=/bin/sh” or “/bin/bash”

4) then press enter to make that change and press “b” to boot

in a few seconds you will be on your “#” prompt

5) only one step left
“mount -o remount rw /”

this step is necessary coz in this case root file system is mounted as read only.

6) finally type “passwd” and you get the screen to change the password

and then type in “init 6? or “reboot”

NOTE FOR TECHNICAL USERS
those who are looking for the technical details, the main work is the init command that we passed as an argument to kernel, it told kernel to specifically run the command specified in parameter instead of working on normal routine.

TRICK = if you have any program you wish to run instead of this then you can do that too using init command only.

Tout pour le toshiba ac 100

2011-02-04T20:48:00.001+01:00

http://www.blogarm.net/cat/smartbooks/toshiba-ac-100/

appletv survitaminé...

2011-01-26T20:26:00.001+01:00

http://dannyruchtie.nl/2010/04/hacking-apple-tv-take-3/

webkit sous windows

2011-01-25T22:17:00.001+01:00

Even though installing and running the development version of WebKit is straightforward on Mac OS X (it is just a matter of downloading the .dmg file and copying the application bundle to /Applications), Windows users may find the task daunting.

But, they should not. Here is how to get WebKit running in four simple steps.

1. Download and install Safari.
2. Download the latest build of WebKit.
3. Unzip the downloaded file and copy the contents to the Safari installation folder. (It is safe to overwrite webkit.dll and the rest of the files.)
4. Execute run-nightly-webkit.cmd once and run Safari from the Start menu as you would normally.

UPDATE: You need to run run-nightly-webkit.cmd at least once, as in step 4.

encryption facile sous Linux gnome seahorse

2011-01-11T16:12:00.001+01:00

Seahorse - Encryption Made Easy
Seahorse is a GNOME application for managing encryption keys. It also integrates with nautilus, gedit and other places for encryption operations.

With seahorse you can...

* Create and manage PGP keys
* Create and manage SSH keys
* Publish and retrieve keys from key servers
* Cache your passphrase so you don't have to keep typing it
* Backup your keys and keyring
* more...

Market for foryo android 2.2 sur archos 70 IT

2011-01-02T10:10:00.000+01:00

http://forum.archosfans.com/viewtopic.php?f=63&t=42067&start=340

Youtube sur Archos 70 iT avec android 2.2 Froyo

2011-01-02T10:08:00.002+01:00

1. Download, install and start "android terminal emulator" from Market
2. Enter below lines in the app and finish each line with an enter

cd /data/test/froyo/system/app
rm YouTube.apk

3. Close the app (back out) and reboot
4. Download YouTube from Market.

retro gaming linux distribution

2010-12-14T23:21:00.000+01:00

http://scottjarvis.com/page105.htm

archlinux + Gnome = Kahelos.org

2010-12-13T22:38:00.000+01:00

http://www.kahelos.org/

Mise à jour du Firmware d'une PS3

2010-11-11T22:16:00.002+01:00

Procédure d'installation :

* Téléchargez le firmware par exemple à partir du site ps3gen.fr
* Créez, à la racine de votre support de stockage (clé USB, Memory Stick, ...) un répertoire PS3
* Dans le répertoire PS3, créez un répertoire UPDATE
* Dans le répertoire UPDATE, placez-y le firmware téléchargé ci-dessus
* Renommez le firmware en PS3UPDAT.PUP
* Retirez la clé de votre ordinateur aprés démontage puis insérez là dans votre PS3
* Allez sur l'icône de Mise à jour
* Choisissez support de stockage
* La mise à jour se lance.

Gnome theme on XP

2010-10-24T21:02:00.000+02:00

http://nithinkamath.info/archives/2006/12/make-windows-xp-desktop-look-like-gnome/

Post install virtualbox_bin sous archlinux

2010-10-18T17:44:00.001+02:00

==> Add your user to the vboxusers group:
==> # gpasswd -a USERNAME vboxusers
==>
==> You must load vboxdrv module before starting VirtualBox:
==> # modprobe vboxdrv
==>
==> You must load vboxnetflt for Host Interface Networking:
==> # modprobe vboxnetflt
==>
==> You must load vboxnetadp for Host-Only networking:
==> # modprobe vboxnetadp
==>
==> To load it automatically, add vboxdrv module to the "MODULES" array
==> "/etc/rc.conf".
==>
==> Run `/etc/rc.d/vboxdrv setup` as root every time your kernel is
==> upgraded, to compile the module for the new kernel version.
==>
==> If USB does not work for you out-of-the-box, add the following line
==> to "/etc/fstab":
==> "none /proc/bus/usb usbfs auto,busgid=108,busmode=0775,devgid=108,devmode=0664 0 0"

Dépendances optionnelles pour virtualbox_bin
qt: for GUI support
sdl: for VBoxSDL and GUI support
mesa: for OpenGL support
libgl: for shared OpenGL support
libxt: for shared clipboard support
alsa-lib: for ALSA support
pulseaudio: for PulseAudio support
Si vous appréciez ce paquet, installez aurvote
et votez pour l'inclure/conserver dans [community]

installation automatique archlinux

2010-10-12T18:16:00.002+02:00

http://calimeroteknik.free.fr/ctkarchlive/

sopcast howto

2010-10-12T16:19:00.000+02:00

==> A simple example of sp-sc command line:
==> ./sp-sc sop://broker.sopcast.com:3912/6098 3908 8908 > /dev/null &
==> Start to transfer channel 6098, and you can play it on 8908 with VLC or mplayer
==> by open the url: http://localhost:8908/tv.asf

rdesktop fixer la résolution

2010-04-13T14:31:00.001+02:00

networking#: rdesktop -g 1152x864 testxp2

mises à jour radar copilot

2010-01-04T15:23:00.001+01:00

http://www.alk.eu.com/files/safetycam.zip

meilleures applications pour android

2009-12-29T22:54:00.002+01:00

http://www.technobuzz.net/21-best-google-android-applications/

http://gizmodo.com/5053280/androids-10-most-exciting-apps

http://blogs.wsj.com/digits/2009/12/22/the-best-android-apps-of-2009/

http://101bestandroidapps.com/

wifi siemens facile

2009-12-28T14:17:00.000+01:00

You may try
$ sudo apt-get update
$ sudo modprobe acer-wmi

wireless on Fujitsu siemens laptop

2009-12-28T03:25:00.000+01:00

Re: wireless on Fujitsu seimens Amilo Li 1718 with ubuntu 9.10
Ok so wireless is working on my laptop and I'm a happy bunny. For any one who ends up here having the same problems these are the steps I used to get it up and running

1. I followed the steps outlined by Momo in this txt file

http://www.edbl.no/karmic/amilo_1718...buntu_9.10.txt

2. Downloaded and installed Acerhk GUI and followed its steps to load acerhk.ko which was incredibly simple because it does it automaticaly

Hope this helps anyone with a similar problem. Just as a little bonus my laptop is 10 degrees cooler at least while running which means it will have a longer life expectancy.
__________________

Canaux du 802.11a

2009-12-15T09:50:00.000+01:00

Un tableau clair à cette adresse:

http://infracom-france.com/blog2/?p=85

Mandriva: retour en grâce par la grâce d'une clé 3 G

2009-10-24T21:51:00.002+02:00

Je me suis battu quelques heures avec ma clé 3G Huawei fournie par Mobistar por l'installer sous Ubuntu 8.10 et Debian. Je me suis rappelé que Mandriva faisait sa pub sur un support nickel pour les clefs 3G, c'était vrai, on branche on met le code PIN et une petite config (iew.be) et on est connecté magique... Mandriva reprendrait-il l'avantage en terme de support matériel comme à la fin du siècle passé?
Pour configurer les dépôts il convient de faire un tour ici:
http://easyurpmi.zarb.org/

Wi-fi chipset intel en mode ETSI

2009-10-05T14:07:00.001+02:00

Modifier (Ubuntu 8.10) ou créer (Fedora 10) le fichier /etc/modprobe.d/options pour y rajouter :

options cfg80211 ieee80211_regdom=EU

dvb-t

2009-09-30T14:21:00.002+02:00

La carte usb DVB-T asus my cinema U3100 Mini est reconnue par ubuntu 8.10
totem lit le flux s'il y a un fichier dvb-channels.conf dans ~/gstreamer-0.10/
La commande pour le créer est:
scan -n -o zap -p /usr/share/doc/dvb-utils/examples/scan/dvb-t/be-St_Pieters_Leeuw > channels.conf

Le plan IT de la RW

2009-07-14T13:14:00.003+02:00

Prochaine législature: les petites touches IT de l'Olivier

13 juillet 2009 -- Brigitte Doucet
data news

Pas de pôle I(C)T dans l'accord de gouvernement intervenu, ce week-end, en Région wallonne et Communauté française - mais personne n'en espérait réellement un.

On le savait depuis quelque temps déjà, le 6ème pôle de compétitivité wallon sera orienté écologie et développement durable. Quant à l'ICT, elle demeure considérée comme une technologie 'transversale', destinée à soutenir, de l'intérieur, les divers axes d'activités. Elle n'est toutefois pas absente du texte de l'accord puisqu'on la retrouve à divers étages.
Société de la connaissance

Un chapitre est consacré la "société de la connaissance et de l'information" avec, pour ambition, de "lever toutes les barrières d'ordre éducatif, culturel ou sociologique".
Pour lutter contre la fracture numérique, le gouvernement "s'engage à poursuivre et améliorer la formation aux technologies de l'information et de la communication (TIC), à favoriser l'accès à Internet et à l'équipement, et à promouvoir l'utilisation de logiciels libres et de normes ouvertes." Le nombre d'EPN (espaces publics numériques) sera renforcé.
La formation aux TIC devra être assurée "dès le plus jeune âge" (dès l'enseignement primaire). Le projet CyberClasse se voit ainsi citer dans l'accord de gouvernement. Non pour parler d'une réévaluation ou d'un redimensionnement mais simplement pour constater qu'il devrait améliorer la norme d'équipement des écoles (1 ordinateur par 15 élèves au lieu de 33, jusqu'ici) et pour souligner que les Centres de compétence sont là pour assurer une formation gratuite aux enseignants et directeurs d'école.

Des pistes d'avenir sont néanmoins esquissées :
- poursuite des efforts d'amélioration de la maintenance du matériel usagé dans les écoles,
- développement de la formation des enseignants à l'utilisation des nouveaux outils informatiques,
- promotion de la connectivité haut débit,
- renforcement des formations prodiguées par les Centres de compétence (notamment au bénéfice de la promotion sociale),
- formation des jeunes et moins jeunes à une utilisation critique et sélective d'Internet.

Côté entreprises, l'accord de gouvernement parle de "développer leur compétitivité numérique" et d'"améliorer la progression de l'usage des TIC, en particulier l'e-business". Pour ce faire, l'AWT (agence wallonne des télécommunications) aura pour mission de conseiller davantage PME et indépendants pour faciliter l'accès aux réseaux haut débit et de renforcer son rôle de veille technologique pour les jeunes sociétés actives dans les TIC.
Le réseau fibre à haut débit sera renforcé et le nombre de zonings connectés sera accru.

Un effort sera fourni, d'une part, du côté des échanges et de la collaboration entre entreprises et filières qui développent des produits et services s'appuyant sur l'IT (e-santé, télémédecine, animation 3D...) et, de l'autre, de l'"encouragement" à utiliser les TIC dans les domaines des transports, de la construction, du tourisme, du secteur médical... Une petite phrase qui résonne comme un adoubement du nouveau plan d'action de l'Infopole (cluster TIC wallon) et de la volonté déjà exprimée des divers 'clusters' et autres pôles de compétitivité d'accentuer leurs collaborations.

En matière d'ICT pour entreprises, deux axes semblent avoir la préférence : d'une part, la promotion de l'e-business et, de l'autre, la sécurité dans l'usage des TIC (prévention, sensibilisation, aide à l'investissement dans les protections).
Un paragraphe est par ailleurs consacré aux jeunes pousses (sans distinction de technologies) qui sont l'émanation d'universités, de hautes écoles ou de centres de recherche. Les diverses étapes de leur existence (création, développement, arrivée à maturité) devraient faire l'objet de "mécanismes de soutien (plus) spécifiques."
La promotion du 'libre'

Le secteur public, lui, semble avoir été enjoint de montrer l'exemple en matière d'utilisation de normes ouvertes et de logiciels libres :
- promotion et utilisation, "dans la mesure du possible", de normes ouvertes et logiciels libres dans les administrations publiques, organismes d'intérêt public et cabinets ministériel ;
- développement d'une plate-forme d'échange, de coopération et d'information en matière de logiciels libres et de normes ouvertes entre tous les acteurs publics actifs dans les TIC ;
- promotion de l'usage des logiciels libres auprès des citoyens et entreprises, notamment par des actions de sensibilisation et de formation ;
- promotion et formation à l'utilisation des logiciels libres dans les écoles.

Deux phrases font allusion à l'orientation future de l'informatique des services publics wallons, dont on sait qu'elle traverse une période cruciale après la dénonciation du GIEI et le rapatriement de certaines compétences (voire applications). A l'avenir, lorsque des développements devront encore être faits sur mesure, le gouvernement demandera à être "propriétaire des codes source ou d'en avoir la disponibilité selon une licence libre reconnue."

Les cahiers de charges (toujours pour des développements sur mesure) devront être adaptés de telle sorte à favoriser les candidatures de PME.
A noter aussi l'organisation, par le Conseil de la Politique scientifique Wallonie-Bruxelles, d'un processus de "technology assessment" devant "éclairer les décideurs politiques, notamment les parlementaires, sur les enjeux technologiques et scientifiques."
L'iT en transversal

L'accord de gouvernement signale au passage, mais sans s'y attarder, l'intérêt de voir les nouvelles technologies être davantage mises au service de la mise à l'emploi. Le Forem est ainsi invité à "intensifier l'envoi d'offres d'emploi individualisées par le biais des nouvelles technologies (sms, courriel, ...) et à développer notamment un système de matching entre l'offre et la demande."

On retrouve encore l'ICT citée dans 3 domaines spécifiques :
- le soutien aux exploitations agricoles, où il s'agira de "promouvoir les outils informatiques de gestion technique et économique au sein des exploitations agricoles" ;
- la participation active des aînés à la vie en société, en leur permettant de "s'initier à l'informatique, notamment à l'accès au réseau Internet" ;
- la lutte contre le surendettement, via l'"harmonisation de la gestion informatique des dossiers de services de médiation de dettes."

Howto setup an EAP-TLS WPA network with freeradius

2009-03-18T12:03:00.000+01:00

A WPA entreprise network secured with EAP/TLS & Freeradius

Introduction

The most important choice to make when implementing WPA entreprise is which flavor of EAP to use. This choice is mainly limited by your client platform. Indeed, the freeradius server licensed under the free GPL license could be made compliant with virtually all EAP method you may dream of. Your wireless access point is EAP agnostic. You only have to verify that it supports WPA entreprise sometimes mentioned as 802.1x by some vendors. It simply passes EAP traffic from clients to servers, without requiring explicit support for any particular EAP subtype.
What your client platform supports is a function both of your client operating system and of its wireless hardware. For example, a Microsoft Windows XP system with an Centrino chipset supports EAP-TLS and PEAP, but EAP-TTLS isn't an easy option if using a Microsoft OS. At the opposite if you run Linux with wpa_supplicant, you have a much wider range of choices available.

Here we choose to use EAP-TLS. EAP-TLS requires client certificates, which in turn requires you to set up a certificate authority (CA). TLS authentication provides strong security thanks to X.509 certificate. In fact it doesn't require that much work to use OpenSSL to create your own CA.

In this howto, Windows XP clients use EAP-TLS to connect to a WPA-enabled access point. The access point, in turn, is configured to authenticate on a FreeRADIUS server running Linux (Debian Lenny).

Freeradius with EAP-TLS/TTLS/PEAP support

Debian's freeRadius package is built without support for EAP/TLS/TTLS/PEAP because of the licensing problems of the OpenSSL library. We want to implement 802.1x network authentication with strong security, so we need it. We will build Debian package (lenny, stable at time of writing 10 March 2009) linked to libssl and with EAP/TLS/TTLS/PEAP support compiled in.

I suppose you made a minimal installation of lenny and you added a minimal gnome environment.

$ apt-get install x-window-system-core
$ apt-get install gnome-core synaptic

Then in order to build the missing packages you need to install dpkg-dev and fakeroot (to limit root access)

$ apt-get install dpkg-dev fakeroot

Download the newest source package (orig.tar.gz), Debian diffs (diff.gz) and description file (dsc) from the freeradius package page. The version I tested the procedure with is freeradius-2.0.4+dfsg

Unpack the source and switch to the resulting directory like this:

# dpkg-source -x *.dsc
dpkg-source: extracting freeradius in freeradius-2.0.4+dfsg
dpkg-source: unpacking freeradius_2.0.4+dfsg-6.diff.gz
dpkg-source: applying ./freeradius_2.0.4+dfsg-6.diff.gz
# cd freeradius-*

There are two files that must be edited in order to successfully build the package:

1. Edit debian/rules, search for eap and change every mentioning of --without-rlm_eap-* to --with-rlm_eap-* excepted --without-rlm_eap_ikev2, --without-rlm_eap_tnc --without-rlm_sql_oracle --without-rlm_sql_unixodbc --without-rlm_otp
A few lines below, in the same file, replace --without-openssl with --with-openssl.

So it should look like:

--with-rlm_eap_tls \
--with-rlm_eap_ttls \
--with-rlm_eap_peap \
--without-rlm_eap_tnc \
--without-rlm_otp \
--with-rlm_sql_postgresql_lib_dir=`pg_config --libdir`\
--with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \
--with-openssl \
--without-rlm_eap_ikev2 \
--without-rlm_sql_oracle \
--without-rlm_sql_unixodbc \

Still editing the same file, find the following code and comment it entirely:

for pkg in ${pkgs} ; do \
if dh_shlibdeps -p $$pkg -- -O 2>/dev/null | grep -q libssl; then \
echo "$$pkg links to openssl" ;\
exit 1 ;\
fi ;\
done

2. Finally, edit debian/control and at the end of the line starting with Build-Depends: add , libssl-dev

Finally, I needed to install some packages before running "dpkg-buildpackage -rfakeroot":

# apt-get install libssl-dev debhelper libgdbm-dev libiodbc2-dev libkrb5-dev libldap2-dev libltdl3-dev libmysqlclient15-dev libpam0g-dev libpcap-dev libperl-dev libpq-dev libsasl2-dev libsnmp-dev python-dev

You can now build new packages with EAP/TLS/TTLS/PEAP support like this:

# dpkg-buildpackage -rfakeroot

If everything goes well, you'll find 10 debian packages in the parent directory which you can now install. Don't forget to hold newly installed packages in your package manager. Otherwise new official versions (without EAP/TLS/TTLS/PEAP support) should overwrite your custom built packages when upgrading.

A way to achieve the "hold" is by using dpkg

Put a package on hold
echo “package hold” | dpkg --set-selections
Example
echo “freeradius hold” | dpkg --set-selections
Remove the hold
echo “package install” | dpkg --set-selections
Example
echo “freeradius install” | dpkg --set-selections
Knowing the status of your packages
dpkg --set-selections

Now I show you what's happening when installing the newly created packages on a frenchspeaking lenny server (hostname: hp-debian-stable.multitel.be)

hp-debian-stable:/home/hanoteau# dpkg --install freeradius-common_2.0.4+dfsg-6_all.deb
Sélection du paquet freeradius-common précédemment désélectionné.
(Lecture de la base de données... 99926 fichiers et répertoires déjà installés.)
Dépaquetage de freeradius-common (à partir de freeradius-common_2.0.4+dfsg-6_all.deb) ...
Paramétrage de freeradius-common (2.0.4+dfsg-6) ...
Ajout de l'utilisateur freerad au groupe shadow
Traitement des actions différées (« triggers ») pour « man-db »...

hp-debian-stable:/home/hanoteau# dpkg --install libfreeradius2_2.0.4+dfsg-6_i386.deb
Sélection du paquet libfreeradius2 précédemment désélectionné.
(Lecture de la base de données... 100311 fichiers et répertoires déjà installés.)
Dépaquetage de libfreeradius2 (à partir de libfreeradius2_2.0.4+dfsg-6_i386.deb) ...
Paramétrage de libfreeradius2 (2.0.4+dfsg-6) ...

hp-debian-stable:/home/hanoteau# dpkg --install freeradius_2.0.4+dfsg-6_i386.deb
(Lecture de la base de données... 100317 fichiers et répertoires déjà installés.)
Préparation du remplacement de freeradius 2.0.4+dfsg-6 (en utilisant freeradius_2.0.4+dfsg-6_i386.deb) ...
Dépaquetage de la mise à jour de freeradius ...
Paramétrage de freeradius (2.0.4+dfsg-6) ...
suppression du / final
suppression du / final
suppression du / final
Starting FreeRADIUS daemon: freeradius.

Now Freeradius is supposed to run, let's go further

Creating a Certificate Authority

Before we configure FreeRADIUS, we need to create some certificates. And before we create any certificates, we must create our CA.
A CA is a system that acts as the root of a public key infrastructure. It's the central authority that guarantees, by way of digital signatures, the authenticity of all certificates issued in your organization. It also periodically issues certificate revocation lists (CRLs), lists of certificates the CA no longer guarantees, for example, certificates issued to people who've left the organization, servers that are no longer on-line and so on.
None of this requires your CA to act as an actual server; in fact, it's better if it doesn't. For a CA to be trustworthy, it must be protected carefully from misuse. So your CA should be on a not permanently connected server or on a virtual machine.I recommend you virtual box OSE for freely creating virtual machines.
If you already have a CA that you've used to create certificates for Web servers or other applications that use TLS then just use it for WPA too. If not, here's how to create a CA. First, make sure your designated CA system has OpenSSL installed. OpenSSL is a standard package on all popular Linux distributions, not to mention BSD. One quick way to make sure you have OpenSSL is to issue the command which openssl. This command returns the path to your OpenSSL command, if it's installed.

On debian Lenny the path is: /usr/bin/openssl

Next, change your working directory to wherever your system keeps OpenSSL's configuration and certificate files. On debian lenny, this is /etc/ssl.
Now, open the file openssl.cnf with your text editor of choice, do you know vim? We will tweak some default settings so as to make certificate creation speedier later on. Feel free to adapt this to your special needs or go to the next step if you are in a hurry.

Changes to openssl.cnf for Optimal Certificate Creation

# First we change the CA root path in the CA_default
# section to reflect the CA we're about to create

[ CA_default ]
dir = ./jhCA # Where everything is kept by default ./demoCA

# The following lines are further down in openssl.cnf:

countryName_default = Be
stateOrProvinceName_default = Hainaut
0.organizationName_default = Multitel ASBL

Next, we should edit the CA creation script to change our CA's root directory to something other than demoCA, that is, to match the dir variable we just changed in openssl.cnf. I use the script CA.sh, which on Debian lenny systems is located in /usr/share/ssl/misc. The line you need to change is CATOP=./jhCA.

If you changed your working directory to edit this file, change back to your SSL configuration directory, for example, /etc/ssl. From there, run the CA.sh script with the -newca option, for example, /usr/lib/ssl/misc/CA.sh -newca. You then are prompted to create a new root certificate and to type a passphrase for its private key. Choose a difficult-to-guess passphrase, and write it down in a safe place—if you forget it, you'll be unable to use your CA.

If you really want to follow this howto witout needing any personal input feel free to type the proposed password. Doing so you will have an unsecure EAP-TLS test infrastructure.

passphrase: strongpasswordbebete
challenge password: telematique

After the script is done, your SSL configuration directory should contain a new directory, jhCA in our example. At the root level of this directory is your new CA's public certificate; by default this file is named cacert.pem. You need to copy this file to your FreeRADIUS server and to each wireless client.
There's one more thing you need to do before creating certificates if you've got Windows XP wireless clients. Windows XP expects certain attributes in server and client certificates, so you need to create a file called xpextensions that contains the lines shown below.

Contents of xpextensions

[xpclient_ext]
extendedKeyUsage=1.3.6.1.5.5.7.3.2

[xpserver_ext]
extendedKeyUsage=1.3.6.1.5.5.7.3.1

It should be in the same directory as openssl.cnf.

In EAP-TLS, a wireless client and your RADIUS server mutually authenticate each other. They present each other with their respective certificates and cryptographically verify that those certificates were signed by your organization's certificate authority. In some ways, this is an elegant and simple way to handle authentication. After you install the CA's public certificate on the FreeRADIUS server, you don't need to configure any other client information explicitly, such as user names, passwords and so on.
That doesn't mean EAP-TLS is less work than user name-password schemes, however. You still need to use OpenSSL to create certificates for all your users and copy those certificates over to them. You also need to ensure that everyone has a copy of the root CA certificate installed in the proper place.

Creating Certificates

For EAP-TLS, you need at least two certificates in addition to your CA certificate, a server certificate for your FreeRADIUS server and one client certificate for each wireless client on your network. Creating certificates is a three-step process:

Generate a signing request, that is, an unsigned certificate.
Sign the signing request with your CA key.
Copy the signed certificate to the host on which it will be used.

Let's start by creating a server certificate signing request using OpenSSL's req command:

$ openssl req -new -nodes -keyout server_key.pem -out server_req.pem -days 730 -config ./openssl.cnf
(challenge password : telematique)

This command creates the files server_req.pem, which contains the actual request—an unsigned certificate—and server_key.pem, its passphrase-less private key. First, though, you are prompted for your organization's Country Code, State and so on, much of which can use the default values defined in openssl.conf. Pay special attention, however, to Common Name. When prompted for this, type the fully qualified domain name of your server, for example, hp-debian-stable.multitel.be.

Next, let's use our CA key to sign the request by using OpenSSL's ca command:

$ openssl ca -config ./openssl.cnf \
-policy policy_anything -out server_cert.pem \
-extensions xpserver_ext -extfile ./xpextensions \
-infiles ./server_req.pem

(strongpasswordbebete)

This command reads the file server_req.pem and, after prompting for your CA key's passphrase, saves a signed version of it plus its corresponding private key to the file server_cert.pem. Notice the -extensions and -extfile options—this is why earlier we created the file xpextensions.
Open your signed certificate with the text editor of your choice and delete everything before the line -----BEGIN CERTIFICATE-----. Concatenate it and your key into a single file, like this:

$ cp server_cert.pem server_cert.pem-backup

$ cat server_key.pem server_cert.pem > \
server_keycert.pem

(strongpasswordbebete)

Now we've got a server certificate with a key that we can copy over to our FreeRADIUS server. Its private key isn't password-protected, however, so be sure to delete any extraneous copies after you've got it in place.

Now we need to create a client certificate signing request. The OpenSSL command to do this is similar to that used to create server certificates:

$ openssl req -new -keyout client_key.pem \
-out client_req.pem -days 730 -config ./openssl.cnf

As you can see, we're writing our signing request and key to the files client_req.pem and client_key, respectively. Unlike with the server signing requests, however, we're omitting the -nodes option. Therefore, when you run this command, you are prompted for a passphrase with which the certificate's private key can be encrypted.
Enter PEM pass phrase: devil1

Next we sign the client certificate's signing request:

$ openssl ca -config ./openssl.cnf \
-policy policy_anything -out client_cert.pem \
-extensions xpclient_ext -extfile ./xpextensions \
-infiles ./client_req.pem

(challenge password : telematique1)

Again, this is similar to the equivalent command for our server, except this time the -extensions command references a different entry in xpextensions. Also, if your clients run Linux, you should delete the extraneous stuff in the certificate, like you did with server_cert.pem. You then either can leave the certificate and key files separate or concatenate them. From there, copy your client certificate file(s) to your Linux client system.

If your certificate is to be used by a Windows XP client, you have one more step to take. You need to convert the certificate file(s) to a PKCS12-format file, with this command:

$ openssl pkcs12 -export -in client_cert.pem \
-inkey client_key.pem -out client_cert.p12 -clcerts

(enter passphrase for ./jhCA/private/cakey.pem devil1)

You are prompted for client_key.pem's passphrase and then for a new passphrase for the new file; you can use the same password as before if you like. You may be tempted simply to press Enter instead, especially given that the WPA supplicant in Windows XP works only when you store its certificates without passphrases. It could be dangerous to move private keys around networks unprotected, so It would be good practice if you remove the passphrase after this file is copied safely over to your Windows XP client.

The resulting file, in this example client_cert.p12, contains both your signed certificate and its private key. Copy it to your Windows XP client system.

So we have generated server and client certificates and transferred them to their respective hosts. Now we need to configure FreeRADIUS, our access point and our wireless clients.

The tasks at hand are:

To install the server and CA certificates we created last time onto our FreeRADIUS server.
To configure FreeRADIUS to use these certificates with EAP-TLS to authenticate users for our access point.
To configure our access point to redirect authentication to our FreeRADIUS server.
To install the client and CA certificates we created last time onto a Windows XP client and configure it to use WPA when connecting to the WLAN.

Configuring the freeradius server

We created three X.509 digital certificates: a certificate authority certificate, called cacert.pem; one server certificate, called server_keycert.pem; and a client certificate, called client_cert.p12. The server and client files contain both a certificate and its private key, so each of these must be handled carefully. The CA certificate, however, is stored separately from its key, so you can distribute cacert.pem freely.
FreeRADIUS stores its configuration files in /etc/freeradius/ in Debian lenny. This directory contains a subdirectory, certs/—this, naturally, is where you need to copy your CA certificate and your server certificate/key. Make sure that cacert.pem is owned by the user root and that its permissions are set to -r--r--r--.
server_keycert.pem, on the other hand, should be owned by the user freerad and its permissions set to -r--------.

cp /etc/ssl/jhCA/cacert.pem /etc/freeradius/certs/cacert.pem
cp /etc/ssl/server_keycert.pem /etc/freeradius/certs/server_keycert.pem

Hereafter, the listing shows the long directory listings for these two files.

-r--r--r-- 1 root freerad 1294 2009-02-10 01:05 cacert.pem
-r-------- 1 freerad freerad 1894 2009-02-10 01:00 server_keycert.pem

You also should make sure that the file /var/log/freeradius/radius.log and the directory /var/run/freeradius/ are writable by freerad. Both radius.log and freeradius/ may be owned by freerad.

Before we edit freeradius' configuration files, we need to create two files that freeradius must have in order to use TLS. The first is a Diffie-Hellman parameters file, or dh file, which is used for negotiating TLS session keys. To create a dh file, change your working directory to /etc/freeradius/certs/ directory and issue this command:

# openssl dhparam -check -text -5 512 -out dh

The second file you need is a data file that contains a random bitstream that also is used in TLS operations. From within certs, run this command:

# dd if=/dev/urandom of=random count=2

Both of these files need to be readable by the user freerad, but they should not be writable by anybody.

# chown freerad dh
# chmod o-w dh

We're finally ready to configure freeradius. You may be afraid when you see the long list of files in /etc/freeradius, but don't be. For WPA with EAP-TLS, we need to edit only three files: radiusd.conf, eap.conf and clients.conf.

In radiusd.conf, all we need to do is verify the user and group accounts that the radiusd process runs as. By default these are inherited from whatever user starts the dæmon. If you run radiusd from a startup script, this is root; however, you definitely do not want to run radiusd as root. Therefore, you should set the user and group parameters in radiusd.conf, both set to freerad, as shown below.

Two Parameters to verify in radiusd.conf

user = freerad
group = freerad

Naturally you can choose different nonprivileged user and group accounts instead of freerad and freerad, but if you do so, you need to adjust the ownerships and permissions on the certificate files we created earlier. Regardless, make sure your nonprivileged user's entry in /etc/password sets the user's shell to a non-shell, such as /bin/false or /bin/true—this account should not be usable for SSH, telnet or similar programs. For that matter, make sure both the user and group accounts exist in the first place, and create them if they don't.
Other parameters may be set in radiusd.conf, but these really are the most important parameters we have to check.

The next file we need to edit is eap.conf; here's where the real heavy lifting occurs. Listing below shows the lines you need to edit in eap.conf.

Changes in eap.conf

eap {
# There are several generic EAP parameters you can
# set here, but the important one for our purposes
# is default_eap_type:

default_eap_type = tls

# Next come parameters for specific EAP types. Since
# we're going to use EAP-TLS, the tls{} section is
# the one we care about:

tls {
#
# These is used to simplify later configurations.
#
certdir = ${confdir}/certs
cadir = ${confdir}/certs
private_key_password = whatever
private_key_file = ${certdir}/server_keycert.pem

# If Private key & Certificate are located in
# the same file, then private_key_file &
# certificate_file must contain the same file
# name.
#
# If CA_file (below) is not used, then the
# certificate_file below MUST include not
# only the server certificate, but ALSO all
# of the CA certificates used to sign the
# server certificate.
certificate_file = ${certdir}/server_keycert.pem

# Trusted Root CA list
#
# ALL of the CA's in this list will be trusted
# to issue client certificates for authentication.
#
# In general, you should use self-signed
# certificates for 802.1x (EAP) authentication.
# In that case, this CA file should contain
# *one* CA certificate.
#
# This parameter is used only for EAP-TLS,
# when you issue client certificates. If you do
# not use client certificates, and you do not want
# to permit EAP-TLS authentication, then delete
# this configuration item.
CA_file = ${cadir}/cacert.pem

#
# For DH cipher suites to work, you have to
# run OpenSSL to create the DH file first:
#
# openssl dhparam -out certs/dh 1024
#
dh_file = ${certdir}/dh
random_file = ${certdir}/random

#
# This can never exceed the size of a RADIUS
# packet (4096 bytes), and is preferably half
# that, to accomodate other attributes in
# RADIUS packet. On most APs the MAX packet
# length is configured between 1500 - 1600
# In these cases, fragment size should be
# 1024 or less.
#
fragment_size = 1024

# include_length is a flag which is
# by default set to yes If set to
# yes, Total Length of the message is
# included in EVERY packet we send.
# If set to no, Total Length of the
# message is included ONLY in the
# First packet of a fragment series.
#
include_length = yes

# Check the Certificate Revocation List
#
# 1) Copy CA certificates and CRLs to same directory.
# 2) Execute 'c_rehash '.
# 'c_rehash' is OpenSSL's command.
# 3) uncomment the line below.
# 5) Restart radiusd
# check_crl = yes
# CA_path = /path/to/directory/with/ca_certs/and/crls/

#
# If check_cert_issuer is set, the value will
# be checked against the DN of the issuer in
# the client certificate. If the values do not
# match, the cerficate verification will fail,
# rejecting the user.
#
# check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"

#
# If check_cert_cn is set, the value will
# be xlat'ed and checked against the CN
# in the client certificate. If the values
# do not match, the certificate verification
# will fail rejecting the user.
#
# This check is done only if the previous
# "check_cert_issuer" is not set, or if
# the check succeeds.
#
check_cert_cn = %{User-Name}
#
# Set this option to specify the allowed
# TLS cipher suites. The format is listed
# in "man 1 ciphers".
cipher_list = "DEFAULT"

#

# This configuration entry should be deleted
# once the server is running in a normal
# configuration. It is here ONLY to make
# initial deployments easier
# make_cert_command = "${certdir}/bootstrap"
}

}

We have specified a server-key passphrase with the private_key_password parameter. This actually should be empty if you created your server certificate and key with OpenSSL's -nodes option.
Make sure that eap.conf is owned and readable only by root . This may seem paradoxical doesn't freerad need to be able to read configuration files? But, if you start the freeradius daemon as root, it reads its configuration files, including radiusd.conf, eap.conf and clients.conf, before demoting itself to freerad.
Finally, you need to create an entry for your access point in clients.conf. The listing below shows such an entry for a 3com 7760 a/b/g Access Point (default IP address is 169.254.2.2 when no DHCP server is answering its request).

Access Point Entry in clients.conf
client 169.254.2.2/32 {
secret = testing123
shortname = liv1

}

The client statement specifies the access point's IP address. Its secret parameter specifies a string that your access point uses as an encryption key for all queries it sends to your FreeRADIUS server. shortname simply is an alias for your access point to be used in log entries and so on.
You now can (re)start freeradius by using the rc.radiusd script, for e0xample, rc.radiusd start or by typing freeradius -X -f.

Configuring the Access Point

The next step is the easiest part of this entire process: configure your wireless access point to use WPA and to point to your FreeRADIUS server. This requires only two pieces of information, the RADIUS secret you entered in your FreeRADIUS server's clients.conf file and the IP address of your FreeRADIUS server.
How you present those two pieces of information to your access point depends on your particular hardware and software. The access point used in this howto is a 3com 7760 configuring it via http is a piece of cake.

If your access point and RADIUS server are separated by a firewall, you need to allow the access point to reach the RADIUS server on UDP ports 1812 and 1813. Doing so also allows the RADIUS server to send packets back from those ports.

Configuring Windows XP Clients

Configuring a Windows XP wireless client to use your WPA-enabled access point.
In summary, you need to:
Run the command mmc from Start→Run....
In Microsoft Management Console, select File→Add/Remove Snap-in, add the Certificates snap-in and set it to manage certificates for My user account and, on the next screen, only for the Local computer.
Copy your CA (cacert.pem) certificate to your Windows system's hard drive, for example, to C:\cacert.pem.
From within MMC, expand Console Root and Certificates - Current User and right-click on Trusted Root Certification Authorities. In the pop-up menu, select All Tasks→Import. Tell the subsequent wizard to import the file C:\cacert.pem and to store it in Trusted Root Certification Authorities.
Copy your client certificate/key file to your Windows system, for example, to C:\client_cert.p12.
From within MMC→Console Root→Certificates, expand Personal and right-click on Certificates. In the pop-up menu, select All Tasks→Import. Tell the subsequent wizard to import the file C:\client_cert.p12.
The certificate-import wizard then prompts you for the certificate's passphrase. In the same dialog, it offers the option to enable strong private key protection. Unfortunately, enabling this breaks WPA, so be sure to leave this option unchecked. Also, leave the option to mark this key as exportable unchecked—you're better off backing up the password-protected file you just imported rather than allowing the imported nonprotected version to be exportable.
In the subsequent screen, let the wizard Automatically select the certificate store.
Now your Windows XP system is ready to go—all that remains is to create a wireless network profile. This, however, varies depending on your wireless card's drivers and which Windows XP Service Pack you're running. According to my little experience on using WPA entreprise on Windows XP, SP2 is a minimal requisite if you want a quite functional and stable connection. I set Network Authentication to WPA, Data encryption to TKIP and EAP type to Smart Card or other Certificate. Windows automatically determined which client certificate I used—this is because we took pains to create a client certificate that references Windows XP's extended attributes
.
After you configure your wireless network profile, your Windows system should connect automatically to your access point and negotiate a WPA connection. If this succeeds, Network Connections should show a status of Authentication succeeded for your Wireless Network Connection entry.

Freeradius avec EAP-TLS/TTLS/PEAP

2009-02-26T12:15:00.003+01:00

Debian's FreeRadius package is built without support for EAP/TLS/TTLS/PEAP because of the licensing problems of the OpenSSL library. But, if you want to implement 802.1x network authentication with strong security, you'll need it. This is a short tutorial that explains how to build Debian (sid aka unstable) package linked to libssl and with EAP/TLS/TTLS/PEAP support compiled in.

I suppose you work with lenny (minimal installation + apt-get install x-window-system-core + apt-get install gnome-core synaptic)

First apt-get install dpkg-dev fakeroot

Download the newest source package (orig.tar.gz), Debian diffs (diff.gz) and description file (dsc) from the freeradius package page. The version I tested the procedure with is freeradius-2.0.4+dfsg$

Unpack the source and switch to the resulting directory like this:

% dpkg-source -x *.dsc
dpkg-source: extracting freeradius in freeradius-2.0.4+dfsg$
dpkg-source: unpacking freeradius_2.0.4+dfsg-6.diff.gz
dpkg-source: applying ./freeradius_2.0.4+dfsg-6.diff.gz
% cd freeradius-*

There are four changes that must be done in order to successfully build the package:

1. edit debian/rules, search for eap and change every mentioning of --without-rlm_eap-* to --with-rlm_eap-* excepted --without-rlm_eap_ikev2, --without-rlm_eap_tnc --without-rlm_sql_oracle --without-rlm_sql_unixodbc
2. few lines below, in the same file, replace --without-openssl with --with-openssl
3. still editing the same file, find the following chuck of code and comment it entirely:

for pkg in ${pkgs} ; do \
if dh_shlibdeps -p $$pkg -- -O 2>/dev/null | grep -q libssl; then \
echo "$$pkg links to openssl" ;\
exit 1 ;\
fi ;\
done

4. finally, edit debian/control and at the end of the line starting with Build-Depends: (second line in the file) add , libssl-dev

Finally, I needed to install piles of packages before running "dpkg-buildpackage -rfakeroot":

# apt-get install libssl-dev debhelper libgdbm-dev libiodbc2-dev libkrb5-dev libldap2-dev libltdl3-dev libmysqlclient15-dev libpam0g-dev libpcap-dev libperl-dev libpq-dev libsasl2-dev libsnmp-dev python-dev

That should do it, you can now build package like this:

% dpkg-buildpackage -rfakeroot

You're doing all the above steps as a normal user, and if everything goes well, you'll find 10 debian packages in the parent directory which you can now install. Don't forget to hold newly installed packages in your package manager so that you don't experience breakage when you pull upgrades next time, and new official versions (without EAP/TLS/TTLS/PEAP support) overwrite your custom built packages.
To hold the packages, as suggested after step 4, I used the command:
# aptitude hold freeradius-common freeradius freeradius-dbg freeradius-iodbc freeradius-krb5 freeradius-ldap freeradius-mysql freeradius-postgresql freeradius-utils libfreeradius-dev libfreeradius2

Then you can see that they are in the "hold" state when you use aptitude. Although for some reason they appear in the "install" state when you use:
# dpkg --get-selections freer*
Probably why they say you shouldn't mix and match dpkg and apt.

More info about package management here:
http://www.debian.org/doc/FAQ/ch-pkg_basics.en.html

Installation:
-------------

hp-debian-stable:/home/hanoteau# dpkg --install freeradius-common_2.0.4+dfsg-6_all.deb
Sélection du paquet freeradius-common précédemment désélectionné.
(Lecture de la base de données... 99926 fichiers et répertoires déjà installés.)
Dépaquetage de freeradius-common (à partir de freeradius-common_2.0.4+dfsg-6_all.deb) ...
Paramétrage de freeradius-common (2.0.4+dfsg-6) ...
Ajout de l'utilisateur freerad au groupe shadow
Traitement des actions différées (« triggers ») pour « man-db »...

hp-debian-stable:/home/hanoteau# dpkg --install libfreeradius2_2.0.4+dfsg-6_i386.deb
Sélection du paquet libfreeradius2 précédemment désélectionné.
(Lecture de la base de données... 100311 fichiers et répertoires déjà installés.)
Dépaquetage de libfreeradius2 (à partir de libfreeradius2_2.0.4+dfsg-6_i386.deb) ...
Paramétrage de libfreeradius2 (2.0.4+dfsg-6) ...

hp-debian-stable:/home/hanoteau# dpkg --install freeradius_2.0.4+dfsg-6_i386.deb
(Lecture de la base de données... 100317 fichiers et répertoires déjà installés.)
Préparation du remplacement de freeradius 2.0.4+dfsg-6 (en utilisant freeradius_2.0.4+dfsg-6_i386.deb) ...
Dépaquetage de la mise à jour de freeradius ...
Paramétrage de freeradius (2.0.4+dfsg-6) ...
suppression du / final
suppression du / final
suppression du / final
Starting FreeRADIUS daemon: freeradius.

firefox sous os imposé

2009-02-24T15:28:00.000+01:00

IE TAB (windowsupdate avec explorer IE6)
NEOFOX IE 6 (look IE6)

Ubuntu 8.10 ati drivers images saccadées pour reproduction video

2009-02-23T10:28:00.001+01:00

Tu dois désactiver l'accélération vidéo de ton serveur X en changeant le module de sortie vidéo qui est utilisé par tes logiciels de réproduction vidéo.
Pour utiliser totem et tous les logiciels utilisant le gstreamer backend, ouvre le terminal et exécute ce command:

gstreamer-properties

Ensuite clique sur l'onglet "Video" et sous Défaut Sortie sélectionne "X Window System (pas d' Xv)" pour le plugin.
Redémarre Totem.

Pour utiliser VLC sélectionne Configurations > Préférénces , puis à droite au bas de la fenetre marque "Options Avancèes". Apres ça enlarge la sectionne Vidéo à gauche et selectionne "Modules de Sortie". Ensuite modifie le module qui se trouve à droite dans la liste "module de sortie vidéo" en "Sortie vidéo X11"

Rédemarre VLC.

GScrot change de nom

2009-02-23T09:29:00.001+01:00

et devient shutter

dès lors il faut changer la source de dépôt (p. ex. ubuntu 8.10):

deb http://ppa.launchpad.net/shutter/ppa/ubuntu intrepid main

Script erreur d'encodage dos

2009-02-12T15:58:00.001+01:00

bash: ./bootstrap: /bin/sh^M: bad interpreter: Aucun fichier ou répertoire de ce type

Tu as le ^M typique du fichier DOS sous Unix.
Utilise la commande dos2unix pour avoir un fichier Unix ( a cause de \n qui n'est pas code de la meme facon sous DOS et UNIX

apt-get install tofrodos

unix2dos file.txt

gestion du démarrage rc.d (serveur x ou pas)

2009-02-12T12:46:00.002+01:00

sudo apt-get install rcconf

sudo rcconf

Pilotes nvidia et ati sous ubuntu 8.10

2009-02-12T12:39:00.000+01:00

sudo apt-get install envyng-core

ctrl-alt-F1:

sudo envyng -t

elisa wiimote

2009-02-04T16:33:00.001+01:00

http://elisa.fluendo.com/wiki/TipsAndTricks/HowToUseNintendoWiimote

Erreur de droits sur $HOME/.dmrc (ubuntu 8.10)

2009-02-04T15:29:00.002+01:00

erreur:

your $home/.dmrc has incorrect permissions and is being ignored. This prevents the default session and language from beeing saved. File should be owned by user and have 644 permission

solution:

chmod 644 ~/.dmrc
sudo chown votre_login /home/votre_login/.dmrc
chmod 700 /home/votre_login

Clés ppa liste des sources ubuntu

2009-02-04T10:40:00.001+01:00

PROBLEME:

sudo apt-get update

W: GPG error: http://ppa.launchpad.net hardy Release: Les signatures suivantes n'ont pas pu être vérifiées car la clé publique n'est pas disponible : NO_PUBKEY 632D16BB0C713DA6

SOLUTION:

gpg --keyserver hkp://keyserver.ubuntu.com:11371 --recv-key 632D16BB0C713DA6
gpg -a --export 632D16BB0C713DA6 | sudo apt-key add -
sudo apt-get update

dvd sous linux

2009-02-03T23:06:00.001+01:00

http://doc.ubuntu-fr.org/lire_un_dvd

comment ajouter des "shapes" dans les menus (feuilles) de dia

2009-01-13T15:22:00.000+01:00

Voir cet excellent lien: http://dia-installer.de/howto/create_shape/

liste des paquets installés ubuntu

2009-01-08T16:12:00.000+01:00

La solution est pourtant assez simple, il suffit de penser à se servir de dpkg :
D’abord, on génére la liste des paquets installés sur le poste original :

$~ dpkg --get-selections > /tmp/liste_paquets.txt
Ensuite on copie la liste de paquets sur la machine cible
Et on finit par installer tous les paquets de la liste avec une simple ligne :

$~ dpkg --set-selections < /tmp/liste_paquets.txt
$~ dselect

Encore une fois, ce n’est pas une astuce très élaborée, mais elle m’a permit d’aller beaucoup plus vite avec mes installations…

Sauvegarde de DVDs

2009-01-05T22:26:00.001+01:00

Lancez vobcopy. Il copiera automatiquement tous les VOBS qui correspondent au titre contenant le plus de chapitres sur votre disque dur.

* Tout d'abord, montez votre DVD si c'est encore nécessaire sur votre distribution: mount /media/cdrom0 (par exemple pour mon lecteur dvd graveur de cds)
* Copiez les VOBs avec vobcopy: vobcopy -i /media/cdrom0 -m

Ceci copiera les VOBs du DVD et les écrira dans le répertoire courant (que vous pouvez modifier avec, par exemple, -o /space). Ils seront nommés selon le titre du DVD (par exemple, j'ai ALLY_MCBEAL_DISC21-1.vob, ALLY_MCBEAL_DISC21-2.vob etc.). L'option -m demande à vobcopy de créer un miroir du contenu du DVD, en incluant les fichiers .IFO - utiles car vous pouvez alors utiliser la copie locale avec MPlayer/MEncoder ou transcode comme si c'était le vrai DVD. Cela prendra du temps. Soyez patient.

Inspiré de http://www.bunkus.org/dvdripping4linux/fr/separate/ripping.html

Démarrer sur une clé usb avec un asus eeepc 701

2008-11-27T15:21:00.000+01:00

Au démarrage appuyer sur la touche Esc ou Echap (clavier belge ou français)
Choisir USB et c'est parti

Truc: UNetbootin pour créer une clé usb à partir d'une image iso

Une démo de snort

2008-10-29T11:12:00.000+01:00

Installation :

http://www.howtoforge.com/intrusion-detection-with-snort-mysql-apache2-on-ubuntu-7.10

c'est un bon début (à développer)

Lancement:

hanoteau@lenovo-pdbl:~$ sudo snort -i eth2 -c /etc/snort/snort.conf

Exploitation des résultats:

http://localhost/web/base-1.3.8/base_main.php

Un scan histoire de peupler la base de données:

hanoteau@remote:~$ nmap 172.16.100.192

VLAN sous Linux

2008-04-08T22:36:00.000+02:00

Linux implémente la prise en charge du protocole 802.1Q, et permet donc à la carte réseau d’être

« vlan informé » (Vlan aware).

La version de noyau doit être supérieure à 2.4.14.

Sur une distribution Debian, la commande

"grep VLAN /usr/src/linux" doit répondre

"CONFIG_VLAN_8021Q=y"

La suite de commandes suivantes teste la présence du module 802.1Q, inhibe l’interface « réelle »

puis l’associe au vlan 2 avec une adresse IP.

modprobe 8021q

ifconfig eth0 0.0.0.0 up

vconfig add eth0 200

ifconfig eth0.200 192.168.50.1 up

Installation OCS

2008-02-14T09:48:00.000+01:00

OcsAgentSetup.exe /S /SERVER:ocs.networking.multitel.be /NP

latex beamer les bases

2008-02-13T16:24:00.000+01:00

vim introlinux.tex
:syntax on
pdflatex introlinux.tex
evince introlinux.pdf

vim surligne la syntaxe

2008-01-22T11:21:00.000+01:00

:syntax on

Correction orthographique en français dans (g)vim7.1 sous ubuntu 7.10

2008-01-22T11:14:00.000+01:00

1) télécharger:

fr.latin1.spl
fr.latin1.sug
fr.utf-8.spl
fr.utf-8.sug

2) les copier dans le répertoire

/usr/share/vim/vim71/spell/

3) dans vim mode de commande

:set spl=fr spell

outils snmp de base ss debian

2007-12-05T16:40:00.000+01:00

mbrowse
snmp
snmpd
(ap-utils)
snmptrapfmt
snmptranslate

snmptrapd -f -P -n -a -OS -mALL

les MIBs sont à compiler dans /usr/share/snmp/mibs

nagios et exchange

2007-12-05T16:35:00.001+01:00

Simple Checkcommands based on check_nt to monitor the Exchange Server (V 5.5) Health, Queues, Mailloops, etc.

command[ExchangeIMC_queued_Outbound]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l \"\\\\MSExchangeIMC\\Queued Outbound\" -w 10 -c 25 command[ExchangeIMC_queued_Inbound]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l \"\\\\MSExchangeIMC\\Queued Inbound\" -w 2 -c 5 command[ExchangeIMC_Connections_Outbound]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l \"\\\\MSExchangeIMC\\Connections Outbound\", -w 5 -c 10 command[ExchangeIMC_Connections_Inbound]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l \"\\\\MSExchangeIMC\\Connections Inbound\" -w 5 -c 10 command[ExchangeIMC_final_delivery]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l \"\\\\MSExchangeIMC\\Queued MTS-IN\" -w 5 -c 10 command[ExchangeIMC_to_convert]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l \"\\\\MSExchangeIMC\\Queued MTS-OUT\" -w 5 -c 10 command[ExchangeIMC_Loops_detected]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l \"\\\\MSExchangeIMC\\Total Loops Detected\" -c 1 command[ExchangeDS_AB_Browses]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l \"\\\\MSExchangeDS\\AB Browses/sec\" -w 10 -c 25 command[ExchangeIS_private_recoverable_items]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l \"\\\\MSExchangeIS Private\\Total Count of Recoverable Items\" -w 100 -c 250 command[ExchangeIS_private_recoverable_size]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l \"\\\\MSExchangeIS Private\\Total Size of Recoverable Items\" -w 15000 -c 30000 command[ExchangeIS_private_delivery_time]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v COUNTER -l \"\\\\MSExchangeIS Private\\Average Delivery Time\" -w 15 -c 30 command[NTExchangeserver]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v SERVICESTATE -l MSExchangeDS,MSExchangeES,MSExchangeIMC,MSExchangeIS,MSExchangeMTA,MSExchangeSA command[NAVMX]=/usr/local/nagios/libexec/check_nt -H $HOSTADDRESS$ -p 1248 -v SERVICESTATE -l \"NavExchange\"

tri des syslog

2007-12-05T16:27:00.000+01:00

des syslog viennent de plusieurs ap cisco on les trie via:

sur le ciso on met comme facility local use 0 qui devient local0

# /etc/syslog.conf Configuration file for syslogd.
#
# For more information see syslog.conf(5)
# manpage.

local0.* /var/log/apnetworking.log
#

Activation syslog et snmp sur des Cisco

2007-12-05T14:58:00.000+01:00

strict minimum pour activer syslog et/ou snmp sur équipement cisco

show run (pour voir la config actuelle)

conf t

syslog
------

logging buffered 4096 debugging (taille et niveau de ce qu'on stocke en local)
logging console critical    (ce qu'on affiche à la console)
logging trap warnings     (ce qu'on envoye par trap)
logging 172.16.5.106       (serveur où on envoye les logs; plusieurs lignes pour plusieurs serveurs)

snmp
----

snmp-server community nagios RO + acl éventuellement (RO = read only et nagios comme mdp)
snmp-server host 172.16.5.74 nagios (où on envoye les traps + mdp en option)
snmp-server enable traps  (on peut compléter pour n'envoyer qu'un seul niveau)

exit


+ show snmp (?)
+ sh mib
--------

syslogd

2007-12-05T14:16:00.000+01:00

Sur une debian pour accepter les logs d'une autre machine il faut modifier le fichier vim /etc/default/syslogd

Là dedans on met:

# For remote UDP logging use SYSLOGD="-r"

SYSLOGD="-r"
aulieu de SYSLOGD=""

virtualbox en plein écran

2007-11-29T15:09:00.000+01:00

VBoxSDL -vm {fichierdelamachinevirtuelle} -fullscreen

backtrack 2

2007-11-27T17:26:00.000+01:00

loadkeys be-latin1
------------------------------------------------------
ifconfig eth0 up
dhcpcd eth0
wlassistant
support intel 3945: backtrack -> Radio Network Analysis -> 80211 -> Misc -> load ipw3945
--------------------------------------------------------------------------------------------------------------------------

airodump-ng --ivs --write 3com2 --channel 1 -w eth1

aireplay-ng -3 -e 3com2 -b 00:1A:C1:7D:D0:40 -h 00-1B-77-02-5C-0A eth1

aircrack-ng -x *.ivs

--------------------------------------------------------------------------------------------------------------------------

networkmanager ubuntu

2007-11-25T11:11:00.000+01:00

networkmanager ne fonctionne qu'en dhcp!!!!!

Contrôle de NetworkManager en ligne de commande

Pour démarrer le service

sudo /etc/dbus-1/event.d/26NetworkManagerDispatcher start
sudo /etc/dbus-1/event.d/25NetworkManager start

Pour arrêter le service

sudo /etc/dbus-1/event.d/26NetworkManagerDispatcher stop
sudo /etc/dbus-1/event.d/25NetworkManager stop

Pour activer la connexion

dbus-send --system \
  --dest=org.freedesktop.NetworkManager \
  /org/freedesktop/NetworkManager \
  org.freedesktop.NetworkManager.wake

Pour arrêter la connexion

dbus-send --system \
  --dest=org.freedesktop.NetworkManager \
  /org/freedesktop/NetworkManager \
  org.freedesktop.NetworkManager.sleep

WPA entreprise PEAP: mise en oeuvre de démo

2007-11-12T09:49:00.007+01:00

Installation rapide d'une solution fonctionnelle de réseau 802.11 avec sécurité WPA2 entreprise PEAP (mschapv2).

On part du principe que les machines sont installées en XP et qu'on n'a pas l'autorisation d'installer un OS plus complet dessus.

Composants:

Un pc fixe XP qui fera office de serveur Freeradius (connexion ethernet classique), serveur DHCP et serveur Web.

Un pc portable avec carte wi-fi supportant le wpa2

Un point d'accès supportant la variante entreprise du WPA (norme IEEE802.11i)

Un commutateur ethernet pour relier le radius au point d'accès

On est sur un réseau indépendant et non connecté à l'Internet

1) Configuration du PC serveur radius, DHCP et web

- téléchargement d'un serveur DHCP:

http://tftpd32.jounin.net/tftpd32_download.html

-téléchargement d'un serveur web:

http://www.cherokee-project.com/download/windows/
Il suffit d'installer par défaut et le serveur tourne sur les différentes interfaces du serveur http://127.0.0.1 et http://x.y.w.z

- téléchargement de freeradius pour windows:

sur le site http://www.freeradius.net/ on trouve un exécutable pour Windows qui est compilé à partir des sources du projet principal freeradius

à la date du 12/11/2007 il s'agit de FreeRADIUS.net-1.1.7-r0.0.2.exe

Après l'installation on se retrouve avec un menu de ce type et une petite icône dans la barre des tâches (zone de notification).

Il faut éditer les fichiers de configuration clients.conf, users.conf et eap.conf. Si l'accès depuis le menu n'est pas fonctionnel les différents fichiers de configuration se trouvent par défaut dans le répertoire suivant:

C:\FreeRADIUS.net\etc\raddb\

Comme éditeur je ne saurais trop recommander d'utiliser gvim afin d'avoir un affichage correct (notepad semble ne pas comprendre les retours charriot du fichier clients.conf) et ne pas risquer de générer des caractères parasites à l'enregistrement (wordpad). Ceci étant je pratique peu notepad et wordpad.

Dans users.conf, on va définir le login/password des utilisateurs qui peuvent se connecter au réseau wi-fi. En environnement de production on utilise en général une solution d'authentification centralisée standardisée comme LDAP ou Active Directory (si on accepte de renoncer à l'interopérabilité) vers laquelle les requêtes sont redirigées. Un utilisateur testuser testpw est défini par défaut, on peut l'utiliser pour tester rapidement sans devoir éditer ce fichier.
testuser User-Password == "testpw"

Dans eap.conf, on va définir ici le type de méthode EAP dans notre cas: peap
default_eap_type = peap

Dans clients.conf, on va définir les points d'accès qui peuvent interroger le serveur radius.
Le fichier de conf clients.conf se trouve par défaut ici:
C:\FreeRADIUS.net\etc\raddb\clients.conf
Il n'y a pas de raccourci dans le menu radius

On ajoute ceci pour permettre au point d'accès 3com qui a pour adresse IP par défaut 169.254.2.2 d'adresser les requêtes. Le secret est fait pour sécuriser les choses.

client 169.254.2.2 {
secret = testing123
shortname = liv1
}

Via le menu de freeradius, lancer le serveur radius en mode debug.

Il existe un outil de test pour le serveur radius intitulé NTRadPing téléchargeable ici http://www.dialways.com. On l'utilisera pour valider les choses le cas échéant.

l'adresse ip du serveur radius sera choisie dans le "range" 169.254.0.0/16 conformément à la RFC 3927 (Dynamic configuration of IPv4 Link-local Adresses). C'est une adresse de ce type que windows s'attribue lorsqu'il ne trouve pas de serveur DHCP et qu'il n'a pas d'adresse IP configurée manuellement. Microsoft parle de ce concept sous le vocable APIPA (Automatic Private Internet Protocol Addressing)

Admettons que l'adresse IP soit : 169.254.96.171

Si on le souhaite on peut définir ce PC comme faisant office de serveur DHCP par exemple avec l'outil Tftpd32 by Ph. Jounin

2) configuration du point d'accès 3com modèle 7760

Son comportement est le suivant:
sans serveur DHCP le point d'accès prend l'IP 169.254.2.2 ( admin/password )

avec serveur DHCP le point d'accès prend une IP et il faut la retrouver à partir de la mac
ou bien utiliser l'application (windows seulement)

ensuite on peut se connecter via un navigateur et lancer la configuration de base via le setup Wizard (voir les captures d'écran)

L'alternative avec utilisation d'un point d'accès LANCOM nécessite de faire un reset LONG du point d'accès puis de pointer son navigateur sur l'adresse ip par défaut de celui-ci qui est 172.23.56.254

3) Sur le client qui doit se connecter, on doit d'une part installer le certificat du réseau (celui fournit par le serveur radius) et d'autre part lui signifier la méthode d'authentification.

Il convient donc d'installer le certificat fourni par Freeradius.net sur le PC client. Le certificat se trouve dans C:\Freeradius.net\etc\raddb\certs\freerADIUS.net\Democerts\ et se nomme Freeradius.net-CA.crt.

La configuration se fait via windows de la façon suivante:

On the Wireless Network tab, select the network and click Configure to open the network properties. Then

Select the Authentication tab
Select Protected EAP on the drop-down list
Click Properties
Enable "Validate server certificate"
In Trusted Root Certification Authorities list, enable the root.der certificate.
In Select Authentication Method, select "Secured password (EAP-MSCHAPv2)"
Click Configure

Découverte et cartographie réseau

2007-11-10T23:16:00.000+01:00

NetWhistler, qui construit une carte réseau, avec une vérification permanente du plan d'adressage IP

CellWriter: Open source handwriting recognition for Linux

2007-11-10T22:49:00.000+01:00

enfin un programme de reconnaissance de caractères en open source....
http://risujin.org/cellwriter/

FreeRadius et client XP

2007-11-09T14:37:00.001+01:00

FreeRADIUS/WinXP Authentication Setup

This post describes how to build a FreeRADIUS server for TLS and PEAP authentication, and how to configure the Windows XP clients (supplicants). The server is configured for a home (or test) network.

Three papers have been written about TLS authentication with a FreeRADIUS server:

1) www.missl.cs.umd.edu/wireless/eaptls
2) www.freeradius.org/doc/EAPTLS.pdf
3) www.denobula.com

These papers provide an excellent background, but are somewhat out of date. Where appropriate, I will simply refer to these documents rather than repeating the information. I recommend that you follow the steps I give below rather than the steps in these documents.

In the steps below, I give examples from the FreeRADIUS server that I installed yesterday in my Red Hat 9 computer. If you follow this example, please make the needed changes to the names of the files. I installed the FreeRADIUS and OpenSSL files in special local directories. This ensures that there is no interaction between the base Linux files and the new files. It also allows you to easily remove all of the newly installed files.

One word of caution: Be prepared for some frustration. The FreeRADIUS and OpenSSL snapshots used in constructing the server are beta software. Don't be surprised if you encounter some problems.

1. Download and Install OpenSSL and FreeRADIUS

The first step is to download and install the latest snapshot versions of OpenSSL and FreeRADIUS.

a. OpenSSL -- Download the latest OpenSSL-0.9.7-stable snapshot. I downloaded the OpenSSL snapshot to my home directory. The snapshots are located at:

»ftp://ftp.openssl.org/snapshot/

Then I used the following nine steps:

mkdir -p /usr/src/802/openssl
cd /usr/src/802/openssl
cp /home/jbibe/openssl-0.9.7-stable-SNAP-20040202.tar.gz \
openssl-0.9.7-stable-SNAP-20040202.tar.gz

gunzip openssl-0.9.7-stable-SNAP-20040202.tar.gz
tar xvf openssl-0.9.7-stable-SNAP-20040202.tar
cd openssl-0.9.7-stable-SNAP-20040202

./config shared --prefix=/usr/local/openssl
make
make install

That completes the work with OpenSSL, except for building the required certificates.

When you perform the config, make, and make-install here and in the FreeRADIUS install described below, I recommend that you log the information. For example, instead of using the simple "make" command, use:

make > mymake.log 2>&1

If you encounter problems, you can review mymake.log (or myconfig.log, or myinstall.log) for errors.

b. FreeRadius -- Download the latest FreeRADIUS snapshot. Again, I downloaded the file to my home directory. The snapshot is located at:

»ftp://ftp.freeradius.org/pub/radius/CVS-snapshots/

Then I used the following nine steps:

mkdir -p /usr/src/802/radius
cd /usr/src/802/radius
cp /home/jbibe/freeradius-snapshot-20040203.tar.gz \
freeradius-snapshot-20040203.tar.gz

gunzip freeradius-snapshot-20040203.tar.gz
tar xvf freeradius-snapshot-20040203.tar
cd freeradius-snapshot-20040203

./configure --with-openssl-includes=/usr/local/openssl/include \
--with-openssl-libraries=/usr/local/openssl/lib \
--prefix=/usr/local/radius
make
make install

That completes the work with FreeRADIUS, except for building certificates, making the changes to the FreeRADIUS configuration files, moving the server certificates to their final location, and building a wrapper for radiusd.

2. Produce Certificates

Server and client certificates are needed for TLS and PEAP. To produce the required certificates, I recommend that you use CA.all that is included with FreeRADIUS. CA.all uses the configuration information in openssl.cnf.

a. openssl.cnf -- Update openssl.cnf for your configuration. The configuration file is located at:

/usr/local/openssl/ssl

A portion of the information from my openssl.cnf is given below. (The company information is does not describe an actual company located in Brentwood, TN.) Note that the configuration information includes the password "whatever". It is the certificate password.

When CA.all executes, it uses this information three times. The first pass through this information produces the root certificates. If you set up your configuration as shown below, you will be able to accept all of the settings in the first pass. The second pass through this information produces the client certificates. You only need to change the commonName to the client name. In my case, I changed the commonName to jbibe. The third pass through this information produces the server certificates. You only need to change the commonName to the server name. In my case, I changed the commonName to micron.

----- Example -------------------------------------------


...
# req_extensions = v3_req

# The extensions to add to a certificate request

[ req_distinguished_name ]

countryName = Country Name (2 letter code)
countryName_default = US
countryName_min = 2
countryName_max = 2

stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Tennessee

localityName = Locality Name (eg, city)
localityName_default = Brentwood

0.organizationName = Organization Name (eg, company)
0.organizationName_default = Helava

organizationalUnitName = Organizational Unit Name
organizationalUnitName_default = Engineering

commonName = Common Name (eg, YOUR name)
commonName_max = 64
commonName_default = HAI

emailAddress = Email Address
emailAddress_max = 40
emailAddress_default = ohb@cmcast.net

# SET-ex3 = SET extension number 3

[ req_attributes ]

challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
challengePassword_default = whatever

unstructuredName = An optional company name

---------------------------------------------------------

b. CA.all -- Update the CA.all script for your requirements. The file is located at:

/usr/src/802/radius/freeradius-snapshot-20040203/scripts

If you use the default password "whatever", you only need to verify that the path in the script points to the installed openssl information. No changes should be necessary, but there is one gotcha. At about line 30, the path will probably be in error. Look for the following line and update the path as needed.

echo "newreq.pem" | /usr/local/openssl/ssl/misc/CA.pl -newca

When CA.all executes, it produces nine certificates:

root.pem, root.p12, root.der
cert-clt.pem, cert-clt.p12, cert-clt.der
cert-srv.pem, cert-srv.p12, cert-srv.der

For TLS and PEAP, the server needs root.pem and cert-srv.pem. For TLS, the Windows XP client needs root.der and cert-clt.p12. For PEAP, the Windows XP client needs root.der.

In the event that you want to use TLS authentication with multiple clients, Document 3 provides the needed script. Look for the CA.clt script in Section 6.

3. Configure Server for TLS

There are only a few changes and additions needed for TLS authentication. The clients.conf, users, and radiusd.conf are located at:

/usr/local/radius/etc/raddb

a. clients.conf -- This file contains the basic configuration for the Access Point. Look for the following line then uncomment and modify as appropriate:

#client 192.168.0.0/24 {


client 192.168.1.0/24 {
secret = AP_Shared_Secret
shortname = WLAN
}

b. users -- This file contains the basic user information. Look for the following line and then add the user name:

#"John Doe" Auth-Type := Local, User-Password == "hello"
#

jbibe

Note that for TLS, you should not include an Auth-Type or a password. The server is able to determine the correct Auth-Type, and a password is not needed because the client uses a client certificate for authentication.

c. radiusd.conf -- This file contains the server configuration information. Look for the following lines and then change the default_eap_type from md5 to tls:


eap {
default_eap_type = md5

Change md5 to tls.

Move down to the following line, and then uncomment and modify the information, as shown below. Note that I placed the server certificates, dh file and random file in a new directory 1x on my system. Modify the path as needed for your server:

#tls {


tls {
private_key_password = whatever
private_key_file = /usr/local/radius/etc/1x/cert-srv.pem
certificate_file = /usr/local/radius/etc/1x/cert-srv.pem
CA_file = /usr/local/radius/etc/1x/root.pem
dh_file = /usr/local/radius/etc/1x/dh
random_file = /usr/local/radius/etc/1x/random
fragment_size = 1024
include_length = yes
}

No other changes are needed in radiusd.conf for TLS.

d. Server Certificates, DH File, and Random File -- I added a new directory 1x in the radius etc directory, and then copied the server certificates (root.pem and cert-srv.pem) into the directory. Finally, I used the following trick to produce dh and random:

date > dh
date > random

If you prefer, use your keyboard to enter some random characters in these files. Or even better, use the OpenSSL tools to produce the random information for these files.

e. Run-Radius -- The only server addition remaining is wrapper for radiusd. I added a new file run-radius in the /usr/local/radius/sbin directory. The script is from Document 3:

----- Wrapper Script ------------------------------------
#!/bin/sh -x

LD_LIBRARY_PATH=/usr/local/openssl/lib
LD_PRELOAD=/usr/local/openssl/lib/libcrypto.so

export LD_LIBRARY_PATH LD_PRELOAD

/usr/local/radius/sbin/radiusd $@
---------------------------------------------------------

After entering and saving the script, make run-radius executable:

chmod u=rwx run-radius

The server is complete.

4. Install Windows XP Certificates and Setup Client for TLS

The Windows XP certificates need to be installed, and client needs to be configured. I recommend that you follow Raymond McKay's example in Document 3, Section 10, XP Client (Supplicant) Setup. When this step is complete, the client is ready.

5. AP Setup

The AP configuration needs to be modified. This is the setup I used with my ZyXEL B-1000v2. (I assume that the B-1000 has been configured previously to use WEP keys and MAC addresses.)

At the wireless 802.1x tab:

Wireless Port Control = Authentication Required
ReAuthentication Timer = 1800 seconds
Idle Timeout = 3600 seconds
Authentication Database = RADIUS only
Dynamic WEP Key Exchange = 128-bit WEP

At the RADIUS tab for authentication:

Active = Yes
Server IP = 192.168.1.10
Port Number = 1812
Shared Secret = AP_Shared_Secret

6. Test TLS

The final step is to test the server. With Windows XP computer off, start the server in the debug mode by entering:

/usr/local/radius/sbin/run-radius -X -A

The server should start, displaying various debug information before it displays:

----- Example --------------------------------------------

Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on 1814/udp.
Ready to process requests

----------------------------------------------------------

If you don't see the message, look through the debug information for errors and missing information. If you see this message, start the Windows XP computer.

When the Windows XP starts, you will see various messages and certificates exchanged between the client and the server. If all is well, you should see the client authenticated and the user logged on. The following partial example is from Document 3. It shows the last few lines of a successful authentication:

----- Example ---------------------------------------------
...
MS-MPPE-Recv-Key = 0xe032765ca06c052e5fe7c2a7534a4252daec44a08505bdb459d4
fa81e70390f2221d2b06071eb0625e0ba67452a890909662
MS-MPPE-Send-Key = 0xe03131ce085bc266127528e749bd4753d3e1702df2d4d8c080351
380f52eae2c24a9fa78015c24e0d140bcd01b23d6c0cacc
EAP-Message = "\003_\000\004"
Message-Authenticator = 0x00000000000000000000000000000000
Finished request 5
Going to the next request
-----------------------------------------------------------

If you see MS-MPPE-Recv-Key and MS-MPPE-Send-Key, the server authenticated the client. You should be able to surf.

7. Change Server Configuration for PEAP

To change the server for PEAP authentication, only a few changes need to be made.

a. users -- Return to the users file and add the user password:

jbibe User-Password == "My-XP-Password"

b. Radiusd.conf -- Return to the radiusd.conf file and make the following changes:

Change the default_eap_type from tls to peap:


eap {
default_eap_type = peap

Move to the PEAP section below the TLS section and uncomment the following lines:


peap {
default_eap_type = mschapv2
}

The server is now ready for PEAP authentication.

8. Change Windows XP for PEAP

On the Wireless Network tab, select the network and click Configure to open the network properties. Then

Select the Authentication tab
Select Protected EAP on the drop-down list
Click Properties
Enable "Validate server certificate"
In Trusted Root Certification Authorities list, enable the root.der certificate.
In Select Authentication Method, select "Secured password (EAP-MSCHAPv2)"
Click Configure
If desired, enable "Automatically use my Windows logon name and password".

I did not enable "Automatically use my Windows ..." In my HP laptop, the software adds HP\\ before the user name; e.g., HP\\jbibe. If you don't enable this option, windows will ask for your user name and password the first time the laptop tries to connect to the network. The computer will then use the user name and password exactly as entered.

On the original Authentication screen, I disabled the "Authenticate as computer when computer information is available"

Windows XP is now ready for testing.

9. Test PEAP

The final step is to test the server. With Windows XP computer off, start the server in the debug mode by entering:

/usr/local/radius/sbin/run-radius -X -A

The server should start, displaying various debug information. If it displays "Ready to process requests", the server is running. This message is identical to the TLS start message. If you review the debug information, you will see additional messages as peap and mschapv2 start.

If you see the Ready message, start the Windows XP computer. As the client and server communicate, you will see various messages exchanged. If all is well, you should see the client authenticated and the user logged on. Again you will see the MS-MPPE-Recv-Key and the MS-MPPE-Send-Key.

If you review the debug messages, you will see the TLS tunnel being built. Once it is built, you will see verification that messages are passing through the tunnel. Finally, you will see the user authenticated.

Réglages du Wi-Fi sur une machine de l'usine à FUD

2007-10-29T09:57:00.000+01:00

Netmanager c'est pratique mais parfois on doit s'en passer.

Les différents paramètres du genre seuil de segmentation ou seuil pour le RTS/CTS se retrouvent dans la base de registre:

Bon alors la base des registres on y arrive via la ligne de commande:

Start, Run..., regedit

En dehors de cela la configuration de la connexion se fait soit par les drivers de la carte soit via Windows et l'on doit choisir un moyen à l'exclusion de l'autre.

Si l'on veut que ce soit windows qui gère la configuration du wifi, il faut sélectionner cette option dans les propriétés de la carte:

Start > Settings > Network Connections
Clic droit sur l'icône de la "wireless network connection puis properties et on va dans l'onglet wireless networks et il faut alors cocher la case Use windows to configure......

Si l'onglet wireless networks n'apparaît pas dans les propriétés de la carte c'est qu'elle est gérée par l'application du constructeur (intel par exemple) et qu'en plus le service Windows zero conf n'est pas démarré.

Pour le démarrer on va dans Start, Settings, Control Panel, Administrative tools, services

Si on souhaite le gérer par l'application du constructeur de la carte c'est du cas par cas mais on n'a plus d'infos qu'avec l'outil windows par exemple on sait le canal utilisé

Dans le cas de Intel on a une icône dans la barre des taches et on peut choisir qui gère la carte en faisant un clic droit dessus:

tunnel SSH

2007-10-23T23:47:00.000+02:00

ssh -L 8080:www.google.be:80 -l root 193.190.194.197

ensuite http://127.0.0.1:8080

pidgin on rhel5

2007-10-09T16:51:00.001+02:00

> On Fri, 2007-08-03 at 06:38 -0400, Jean-David Beyer wrote:
>> In particular, I run Red Hat Enterprise Linux 5.
>>
>> It complained about missing stuff, libsilc-1.0.so.2 and
>> libsilcclient-1.0.so.1
>>
>> I downloaded and installed libsilc-1.0.so.2 which also included
>> libsilcclient-1.0.so.2.
>
> How did you install these?

I downloaded libsilc-0.9.12-1.i386.rpm from somewhere (rpmfind) and did rpm
-Uvh libsilc-0.9.12-1.i386.rpm and it loaded both of them.
>
>> Is this a bug in your yum dependencies, or must I load libsilc from
>> somewhere else to get the older version, or what?
>
> It appears Red Hat have dropped libsilc from RHEL5, but as I build the
> RPMs using the CentOS RHEL rebuild which appears to have maintained
> libsilc the Pidgin RPMs have SILC support. You can install the CentOS
> libsilc RPM from here to satisfy the missing dependency:
>
> http://mirror.linux.duke.edu/pub/centos/5/os/i386/CentOS/libsilc-1.0.2-2.fc6.i386.rpm
>
>
Thanks. I removed the rpm I had installed and installed the one you
suggested and it now seems to work. No one I know is logged in at the
moment, but it looks somewhat as I remember it from a few months ago. There
are superficial differences, but that does not matter as I am not a power user.

clavier révolutionnaire

2007-10-09T13:07:00.001+02:00

The 1 hand keyboard is the Twiddler.

You can get more information at:
http://www.handykey.com/

Unfortunately they seem to have production problems.
Anyway we could develop and enhanced version using the results of FASTY
and combining it with ZigBee to make it wireless.

Another option would be to use a camera on the wirst, replacing the leds
on the quite innovative http://www.lightglove.com/

RHEL5

2007-10-09T10:16:00.000+02:00

8. Disabling IPv6

To disable IPv6 you need to:

· Add this line to /etc/modprobe.conf:
alias net-pf-10 off

NOTE: if the line "alias net-pf-10 ipv6" exists in the file, change it.

· Add this line to /etc/sysconfig/network
NETWORKING_IPV6=no

NOTE: If the line "NETWORKING_IPV6=yes" exists in the file, change it.

Recompilation plugin nagios

2007-07-31T13:58:00.000+02:00

apt-get build-dep nagios-plugins
apt-get source nagios-plugins
cd /nagios-plugins1.4.5
dpkg buildpackage

PC écologique

2007-07-26T17:12:00.000+02:00

http://www.fit-pc.com/specifications.htm

Solutions pour la surdité

2007-07-26T12:03:00.000+02:00

backup des posts sur blogspot-blogger

2007-07-24T11:12:00.000+02:00

http://googlesystem.blogspot.com/2007/02/how-to-backup-blogger-blog.html

MRTG configuration

2007-07-18T14:15:00.000+02:00

Doc standard MRTG

/usr/bin/cfgmaker --global 'WorkDir: /var/www/mrtg' --global 'Options[_]: bits,growright' --output /etc/mrtg.cfg public@172.16.11.104

ou pour plusieurs

/usr/bin/cfgmaker --global 'WorkDir: /var/www/mrtg' --global 'Options[_]: bits,growright' --output /etc/mrtgessai.cfg public@172.16.11.102 nagios@172.16.5.25

RUNNING MRTG

Once you have created a configuration file, try the following:

 /usr/local/mrtg-2/bin/mrtg /home/mrtg/cfg/mrtg.cfg

This will query your router and also create your first mrtg trafic graphs and webpages. When you run mrtg for the first time there will be a lot of complaints about missing log files. Don't worry, this is normal for the first 2 times you start mrtg. If it keeps complaining after this time you might want to look into the problem.

Starting mrtg by hand is not ideal in the long run. So when you are satisfied with the results you can automate the process of running mrtg in regular intervals (this means every 5 minutes by default).

You can either add mrtg to your crontab with a line like this:

 0,5,10,15,20,25,30,35,40,45,50,55 * * * * \
   /mrtg /mrtg.cfg \
            --logging /var/log/mrtg.log

or if you live in Linux Land the line may look like this if you are using crontab -e

 */5 * * * *  /mrtg /mrtg.cfg \
                   --logging /var/log/mrtg.log

or like this if you use /etc/crontab

 */5 * * * *  mrtg-user  /mrtg /mrtg.cfg \
                             --logging /var/log/mrtg.log

You can also run mrtg as a daemon process by adding the line

 RunAsDaemon: Yes

to your mrtg configuration file and then creating a startup script in your system startup sequence. Unfortunately, adding startup scripts differs widely amongst different unix systems. The modern ones normally have a directory called /etc/init.d or /etc/rc.d/init.d where you put scripts which starts the process you want to run when the system boots. Further you must create a symbolic link in /etc/rc3.d or /etc/rc.d/rc?.d called S65mrtg (this is just a sample name ... it is just important that it starts with S followed by a two digit number). If you are not sure about this, make sure you consult the documentation of your system to make sure you get this right.

A minimal script to put into init.d might look like this:

 #! /bin/sh
cd /usr/local/mrtg-2.15.2/bin && ./mrtg --user=mrtg-user \
   /home/httpd/mrtg/mrtg.cfg  --logging /var/log/mrtg.log

Note that this will only work with RunAsDaemon: Yes in your mrtg.cfg file.

----------------------------------

env LANG=C /usr/bin/mrtg /etc/mrtg.cfg

sur une debian 4.0 en français cette commande est nécessaire

------------------------------

dans le fichier services

# check bandwidth
define service {
host_name switch104
service_description port 1 bandwidth usage
check_command traffic_average!/var/www/mrtg/172.16.11.104_1.log!2000,2000!50000,50000
use generic-service
notification_interval 0 ; set > 0 if you want to be renotified
}

------------------------------------------------------------------------------------

# 'traffic_average' command definition
define command{
command_name traffic_average
command_line /usr/lib/nagios/plugins/check_mrtgtraf -F $ARG1$ -a AVG -w $ARG2$ -c $ARG3$ -e 10
}

Compilation plugins nagios debian

2007-07-17T17:50:00.000+02:00

apt-get build-dep nagios-plugins
apt-get source nagios-plugins
cd nagios-plugins_....
dpkg-buildpackage

mise à jour du nom dns via le client dhcp

2007-07-10T15:38:00.000+02:00

dans le fichier /etc/dhcp3/dhclient.conf

send host-name "hostnamesansledomaine";

nb: la ligne est en commentaire par défaut

Nagios2 sur Debian 4.0

2007-07-10T15:23:00.002+02:00

installation de debian etch via le réseau système de base seulement

ajout de contrib et non-free dans /etc/apt/sources.list

en root:

apt-get install nagios2 nagios-images nagios-plugins nagios2-doc openssh-server

On obtient typiquement quelque chose de ce type:
PDBL:~# apt-get install nagios2 nagios-images nagios-plugins nagios2-doc openssh-server
Reading package lists... Done
Building dependency tree... Done
openssh-server is already the newest version.
The following extra packages will be installed:
fping libnet-snmp-perl libradius1 nagios-plugins-basic
nagios-plugins-standard nagios2-common qstat radiusclient1 snmp
Suggested packages:
libcrypt-des-perl libdigest-hmac-perl libdigest-sha1-perl
libio-socket-inet6-perl nagios-text nagios nagios-nrpe-plugin
The following NEW packages will be installed:
fping libnet-snmp-perl libradius1 nagios-images nagios-plugins
nagios-plugins-basic nagios-plugins-standard nagios2 nagios2-common
nagios2-doc qstat radiusclient1 snmp
0 upgraded, 13 newly installed, 0 to remove and 1 not upgraded.
Need to get 0B/6020kB of archives.
After unpacking 14.9MB of additional disk space will be used.

cd /etc/nagios2/
htpasswd -c htpasswd.users nagiosadmin

!!!! si on choisit un autre nom d'utilisateur que nagiosadmin,
il faut faire le changement dans /etc/nagios2/cgi.cfg

Pour pouvoir lancer des vérifications de puis l'interface graphique

chown nagios.www-data /var/lib/nagios2/
chown nagios.www-data /var/lib/nagios2/rw/

chmod u+rwx /var/lib/nagios2/rw/
chmod g+rwx /var/lib/nagios2/rw/

chmod g+s /var/lib/nagios2/
chmod g+s /var/lib/nagios2/rw/

----------------------------------------------------

quand on fait une modification dans un des fichiers de configuration,
on peut vérifier que tout est ok en faisant:

/usr/sbin/nagios2 -v /etc/nagios2/nagios.cfg

afin de pouvoir lancer des checks depuis l'interface web:

dans /etc/nagios2/nagios.cfg

check_external_commands=1 (mis à 0 par défaut)

---------------------------------------------------

Monitoring d'une machine windows:

sur la machine windows il faut installer un client

Installing the Windows Agent

Before you can begin monitoring private services and attributes of Windows machines,
you'll need to install an agent on those machines. I recommend using the NSClient++ addon, which can be found at http://sourceforge.net/projects/nscplus. These instructions will take
you through a basic installation of the NSClient++ addon, as well as the configuration
of Nagios for monitoring the Windows machine.

1. Download the latest stable version of the NSClient++ addon from http://sourceforge.net/projects/nscplus

2. Unzip the NSClient++ files into a new C:\NSClient++ directory

3. Open a command prompt and change to the C:\NSClient++ directory

4. Register the NSClient++ system service with the following command:

 nsclient++ /install

5. Install the NSClient++ systray with the following command ('SysTray' is case-sensitive):

 nsclient++ SysTray

6. Open the services manager and make sure the NSClientpp service is allowed to interact
with the desktop (see the 'Log On' tab of the services manager). If it isn't already allowed
to interact with the desktop, check the box to allow it to.

7. Edit the NSC.INI file (located in the C:\NSClient++ directory) and make the following changes:

Uncomment all the modules listed in the [modules] section, except for CheckWMI.dll and RemoteConfiguration.dll
Optionally require a password for clients by changing the 'password' option in the [Settings] section.
Uncomment the 'allowed_hosts' option in the [Settings] section. Add the IP address of the Nagios server to this line, or leave it blank to allow all hosts to connect.
Make sure the 'port' option in the [NSClient] section is uncommented and set to '1248' (the default port).

voilà un exemple de fichier de config NSC.INI fonctionnel:

[modules]
;# NSCLIENT++ MODULES
;# A list with DLLs to load at startup.
; You will need to enable some of these for NSClient++ to work.
; ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !
; * *
; * N O T I C E ! ! ! - Y O U H A V E T O E D I T T H I S *
; * *
; ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !
FileLogger.dll
CheckSystem.dll
CheckDisk.dll
NSClientListener.dll
NRPEListener.dll
SysTray.dll
CheckEventLog.dll
CheckHelpers.dll
;
; CheckWMI IS AN EXTREM EARLY IDEA SO DONT USE FOR PRODUCTION ENVIROMNEMTS!
;CheckWMI.dll
;
; RemoteConfiguration IS AN EXTREM EARLY IDEA SO DONT USE FOR
PRODUCTION ENVIROMNEMTS!
;RemoteConfiguration.dll

[Settings]
;# OBFUSCATED PASSWORD
; This is the same as the password option but here you can store the password
in an obfuscated manner.
; *NOTICE* obfuscation is *NOT* the same as encryption, someone with access
to this file can still figure out the
; password. Its just a bit harder to do it at first glance.
;obfuscated_password=Jw0KAUUdXlAAUwASDAAB
;
;# PASSWORD
; This is the password (-s) that is required to access NSClient remotely.
If you leave this blank everyone will be able to access the daemon remotly.
password=test
;# ALLOWED HOST ADDRESSES
; This is a comma-delimited list of IP address of hosts that are allowed to talk
; to the all daemons.
; If leave this blank anyone can access the deamon remotly (NSClient still requires
; a valid password).
; The syntax is host or ip/mask so 192.168.0.0/24 will allow anyone on that
; subnet access
allowed_hosts=172.16.0.0/16
;
;# USE THIS FILE
; Use the INI file as opposed to the registry if this is 0 and the use_reg in the
; registry is set to 1
; the registry will be used instead.
use_file=1

[log]
;# LOG DEBUG
; Set to 1 if you want debug message printed in the log file (debug messages
; are always printed to stdout when run with -test)
debug=1
;
;# LOG FILE
; The file to print log statements to
file=NSC.log
;
;# LOG DATE MASK
; The format to for the date/time part of the log entry written to file.
date_mask=%Y-%m-%d %H:%M:%S

[NSClient]
;# ALLOWED HOST ADDRESSES
; This is a comma-delimited list of IP address of hosts that are allowed to talk
; to NSClient deamon.
; If you leave this blank the global version will be used instead.
allowed_hosts=172.16.27.43
;
;# NSCLIENT PORT NUMBER
; This is the port the NSClientListener.dll will listen to.
port=1248
;
;# BIND TO ADDRESS
; Allows you to bind server to a specific local address.
;This has to be a dotted ip adress not a hostname.
; Leaving this blank will bind to all avalible IP adresses.
bind_to_address=

[Check System]
;# CPU BUFFER SIZE
; Can be anything ranging from 1s (for 1 second) to 10w for 10 weeks.
; Notice that a larger buffer will waste memory
; so don't use a larger buffer then you need (ie. the longest check you do +1).
;CPUBufferSize=1h
;
;# CHECK RESOLUTION
; The resolution to check values (currently only CPU).
; The value is entered in 1/10:th of a second and the default is 10
; (which means ones every second)
;CheckResolution=10

[NRPE]
;# NRPE PORT NUMBER
; This is the port the NRPEListener.dll will listen to.
;port=5666
;
;# COMMAND TIMEOUT
; This specifies the maximum number of seconds that the NRPE
; daemon will allow plug-ins to finish executing before killing them off.
;command_timeout=60
;
;# COMMAND ARGUMENT PROCESSING
; This option determines whether or not the NRPE daemon will
;allow clients to specify arguments to commands that are executed.
;allow_arguments=0
;
;# COMMAND ALLOW NASTY META CHARS
; This option determines whether or not the NRPE daemon will allow clients to specify nasty (as in |`&><'"\[]{}) characters in arguments. ;allow_nasty_meta_chars=0 ; ;# USE SSL SOCKET ; This option controls if SSL should be used on the socket. ;use_ssl=1 ; ;# BIND TO ADDRESS ; Allows you to bind server to a specific local address. This has to be a dotted ip adress not a hostname. ; Leaving this blank will bind to all avalible IP adresses. ; bind_to_address= ; ;# ALLOWED HOST ADDRESSES ; This is a comma-delimited list of IP address of hosts that are allowed to talk to NRPE deamon. ; If you leave this blank the global version will be used instead. ;allowed_hosts= ; ;# SCRIPT DIRECTORY ; All files in this directory will become check commands. ; *WARNING* This is undoubtedly dangerous so use with care! ;script_dir=scripts\ [NRPE Handlers] ;# COMMAND DEFINITIONS ;# Command definitions that this daemon will run. ;# Can be either NRPE syntax: ;command[check_users]=/usr/local/nagios/libexec/check_users -w 5 -c 10 ;# Or simplified syntax: ;test=c:\test.bat foo $ARG1$ bar ;check_disk1=/usr/local/nagios/libexec/check_disk -w 5 -c 10 ;# Or even loopback (inject) syntax (to run internal commands) ;# This is a way to run "NSClient" commands and other internal module commands such as check eventlog etc. ;check_cpu=inject checkCPU warn=80 crit=90 5 10 15 ;check_eventlog=inject CheckEventLog Application warn.require.eventType=error warn.require.eventType=warning critical.require.eventType=error critical.exclude.eventType=info truncate=1024 descriptions ;check_disk_c=inject CheckFileSize ShowAll MaxWarn=1024M MaxCrit=4096M File:WIN=c:\ATI\*.* ;# But be careful: ; dont_check=inject dont_check This will "loop forever" so be careful with the inject command... ;# Check some escapings... ; check_escape=inject CheckFileSize ShowAll MaxWarn=1024M MaxCrit=4096M "File: foo \" WIN=c:\\WINDOWS\\*.*" ;# Some real world samples ;nrpe_cpu=inject checkCPU warn=80 crit=90 5 10 15 ;nrpe_ok=scripts\ok.bat

8. Start the NSClient++ service with the following command:

 nsclient++ /start

9. If installed properly, a new icon should appear in your system tray.

It will be a yellow circle with a black 'M' inside.

10. Success! The Windows server can now be added to the Nagios monitoring configuration...

sur le serveur nagios

créer un fichier avec toutes les machines windows

cd /etc/nagios2/conf.d/

cp host-gateway_nagios2.cfg host-windows_nagios2.cfg
vim host-windows_nagios2.cfg

renseigner le hostname, l'alias, l'adresse et le parent

rajouter le service:
optiplex:/etc/nagios2/conf.d# vim services_nagios2.cfg

# check that NSClient is up
define service {
host_name pc-simulation
service_description NS Client Version
check_command check_nt!CLIENTVERSION
use generic-service
notification_interval 0 ; set > 0 if you want to be renotified
}

dans /etc/nagios-plugins/config/nt.cfg s'assurer que le mot de passe défini
dans NSC.INI est bien présent (par défaut non)

command_line /usr/lib/nagios/plugins/check_nt -H $HOSTADDRESS$
-v $ARG1$ -s test (le -s test est à rajouter)

define service{
use   generic-service
host_name   winserver
service_description NSClient++ Version
check_command  check_nt!CLIENTVERSION
}

Add the following service definition to monitor the uptime of the Windows server.

define service{
use   generic-service
host_name   winserver
service_description Uptime
check_command  check_nt!UPTIME
}

Add the following service definition to monitor the CPU utilization on the
Windows server and generate a CRITICAL alert if the 5-minute CPU load
is 90% or more or a WARNING alert if the 5-minute load is 80% or greater.

define service{
use   generic-service
host_name   winserver
service_description CPU Load
check_command  check_nt_cpuload!10,80,90,20,80,95,30,80,95
}

!!!!!  Il faut rajouter ceci dans le fichier /etc/nagios-plugins/config/load.cfg
# 'check_nt_cpuload command definition
define command{
command_name check_nt_cpuload
command_line /usr/lib/nagios/plugins/check_nt -H $HOSTADDRESS$ -p 1248 -
s test -v CPULOAD -l $ARG1$
}

Add the following service definition to monitor memory usage
on the Windows server and generate a CRITICAL alert if memory
usage is 90% or more or a WARNING alert if memory usage is 80% or greater.

define service{
use   generic-service
host_name   winserver
service_description Memory Usage
check_command  check_nt!MEMUSE!-w 80 -c 90
}

Add the following service definition to monitor usage of the C:\ drive on
the Windows server and generate a CRITICAL alert if disk usage is 90%
or more or a WARNING alert if disk usage is 80% or greater.

define service{
use   generic-service
host_name   winserver
service_description C:\ Drive Space
check_command  check_nt_disk!C!80!90
}

!!!!!  Il faut rajouter ceci dans le fichier /etc/nagios/-plugins/config/disk.cfg
# 'check_nt_disk command definition
define command{
command_name check_nt_disk
command_line /usr/lib/nagios/plugins/check_nt -H $HOSTADDRESS$ -p 1248 -
s test -v USEDDISKSPACE -l $ARG1$ -w $ARG2$ -c $ARG3$
}

Add the following service definition to monitor the W3SVC service
state on the Windows machine and generate a CRITICAL alert if
the service is stopped.

define service{
use   generic-service
host_name   winserver
service_description W3SVC
check_command  check_nt!SERVICESTATE!-d SHOWALL -l W3SVC
}

Add the following service definition to monitor the Explorer.exe process
on the Windows machine and generate a CRITICAL alert if the process
is not running.

define service{
use   generic-service
host_name   winserver
service_description Explorer
check_command  check_nt!PROCSTATE!-d SHOWALL -l Explorer.exe
}
----------------------------------------------------------------

monitoring de "switches" et routeurs

Creating Required Definitions

You'll need to create some object definitions in order to monitor a new switch.
These definitions can be placed in their own file or added to an already exiting
object configuration file.

First, its best practice to create a new template for each different type of host
you'll be monitoring. Let's create a new template for switches.

define host{ name generic-switch ; The name of this host template use generic-host ; Inherit default values from the generic-host template check_period 24x7 ; By default, switches are monitored round the clock check_interval 5 ; Switches are checked every 5 minutes retry_interval 1 ; Schedule host check retries at 1 minute intervals max_check_attempts 10 ; Check each switch 10 times (max) check_command check-host-alive ; Default command to check if routers are "alive" notification_period 24x7 ; Send notifications at any time notification_interval 30 ; Resend notifications every 30 minutes notification_options d,r ;
Only send notifications for specific host states contact_groups admins ; Notifications get sent to the admins by default register 0 ; DONT REGISTER THIS - ITS JUST A TEMPLATE }

Notice that the switch template definition is inheriting default values from the generic-host template, which is defined in the sample localhost.cfg file.

Next, define a new host for the switch that references the newly created generic-switch host template.

define host{ use generic-switch ; Inherit default values from a template host_name linksys-srw224p ; The name we're giving to this switch alias Linksys SRW224P Switch ; A longer name associated with the switch address 192.168.1.253 ; IP address of the switch hostgroups allhosts ; Host groups this switch is associated with }

Add an optional hostgroup for switches. This is useful if you create additional switches in the future and want to view them together in the CGIs. It can also be useful for object definition tricks that you can use to manage larger configurations later on.

define hostgroup{ hostgroup_name switches ; The name of the hostgroup alias Network Switches ; Long name of the group members linksys-srw224p ; Comma separated list of hosts that belong to this group }

The linksys-srw224p host will be a member of two hostgroups - allhosts (which is referenced in the host definition and defined in localhost.cfg) and switches (which is defined above).

Monitoring Packet Loss and RTA

Now its time to define some services that should be associated with the switch. First off, we should monitor packet loss and round trip average between the Nagios host and the switch.
This can be accomplished by using the check_ping plugin. A command definition for using the check_ping plugin that has been defined in the commands.cfg file. That command definition looks like this...

define command{ command_name check_ping command_line $USER1$/check_ping -H $HOSTADDRESS$ -w $ARG1$ -c $ARG2$ -p 5 }

Let's create a service called PING as follows...

define service{ use generic-service ; Inherit values from a template host_name linksys-srw224p ; The name of the host the service is associated with service_description PING
; The service description check_command check_ping!200.0,20%!600.0,60%
; The command used to monitor the service normal_check_interval 5
; Check the service every 5 minutes under normal conditions retry_check_interval 1
; Re-check the service every minute until its final/hard state is determined }

Notice that the check_command directive is passing "200.0,20%" and "600.0,60%" to the check_ping command, where they are substituted for the $ARG1$ and $ARG2$ macros, respectively. This means that the PING service will be:

CRITICAL if the round trip average (RTA) is greater than 600 milliseconds or the packet loss is 60% or more
WARNING if the RTA is greater than 200 ms or the packet loss is 20% or more
OK if the RTA is less than 200 ms and the packet loss is less than 20%

Monitoring SNMP Status Information

If your switch or router supports SNMP, you can monitor a lot of information by using the check_snmp plugin. A command definition for using the check_snmp plugin that has been defined in the commands.cfg file. That command definition looks like this...

define command{ command_name check_snmp command_line $USER1$/check_snmp -H $HOSTADDRESS$ $ARG1$ }

Monitoring the uptime of a switch is fairly common. A service definition that would accomplish that looks like this...

define service{ use generic-service ; Inherit values from a template host_name linksys-srw224p service_description Uptime check_command check_snmp!-C public -o sysUpTime.0 }

The check_command directive will pass the "-C public -o sysUpTime.0" options to the $ARG1$ macro in the check_snmp command definitions. The "-C public" tells the plugin that the SNMP community name is "public" and the "-o sysUpTime.0" is the OID that we want to check.

If you want to ensure that a specific port/interface on the switch is in an up state, you could create a service definition like this:

define service{ use generic-service ; Inherit values from a template host_name linksys-srw224p service_description Port 1 Link Status check_command check_snmp!-C public -o ifOperStatus.1 -r 1 -m RFC1213-MIB }

In the example above, the "-o ifOperStatus.1" refers to the OID for the operational status of port 1 on the switch. The "-r 1" option tells the check_snmp plugin to return an OK state if "1" is found in the SNMP result (1 indicates an "up" state on the port) and CRITICAL if it isn't found. The "-m RFC1213-MIB" is optional and tells the check_snmp plugin to only load the "RFC1213-MIB" instead of every single MIB that's installed on your system, which can help speed things up.

That's it for the SNMP monitoring example. There are a million things that can be monitored via SNMP, so its up to you to decide what you need and want to monitor. Good luck!

Tip: You can usually find the OIDs that can be monitored on a switch by running the following command (replace 192.168.1.253 with the IP address of the switch): snmpwalk -v1 -c public 192.168.1.253 -m ALL .1

helo mal configuré sur serveur exim4

2007-07-04T15:12:00.000+02:00

LE problème:

Testing HELO configuration

One way of testing whether your mail server is misconfigured is to send an email through it to helocheck@cbl.abuseat.org. You will get a virtually immediate rejection.

In other words, you will get bounce message back that appears to indicate that your email to helocheck didn't work. It did. It's _supposed_ to work that way. The important piece to check is the error message you see.

Examine the error message, and you should see something like one of the following lines:

#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "localhost.localdomain"
#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "localhost"
#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "smtp"
#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "1.2.4.6"
#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "[1.2.4.6]"
#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "mail.example.com"

It should be the fully qualified domain name for your mail server or an IP address enclosed in square brackets.

In the above example, the first four examples are syntactically wrong by RFC2821. The last two are valid.

If it isn't like one of the last two examples, you have found the problem that needs to be fixed.

If the HELO you see from "helocheck" is a fully qualified domain (such as "mail.example.com"), your mail server software is configured correctly, but something else in your environment is attempting to send email, and you need to hunt it down. Check for sender verify code, challenge/response or proxy trojans (common on certain flavours of web servers). Eg: check the running tasks for anything you don't immediately recognize.

Please don't contact us and say "but our mail server software isn't doing it". It may not be, but SOMETHING at the listed IP IS.

Hit the browser button to see hints on how to fix this.

La solution:

rajouter la variable

primary_hostname = name.domain

avant la ligne

domainlist local_domains = DEBCONF.....

dans le fichier /etc/exim4/exim4.conf.template

et puis faire un

dpkg-reconfigure exim4-config

impression qualité photo epson r800

2007-06-29T19:54:00.000+02:00

il faut absolument aller dans les options avancées et sélectionner le bon papier et la bonne qualité:

Capture d'écran sous macosx

2007-06-29T19:36:00.000+02:00

tiré de wikipedia (excellentissime)

MacOSX offre plusieurs possibilités pour réaliser une capture d'écran :

Combinaisons de touches :

majuscule - commande (touche pomme) - 3(pas sur le pavé numérique) capturera l'écran entier, et placera le résultat dans un fichier Image x.png (où x est un chiffre). Si vous utilisez une configuration multi-écrans, un fichier par écran sera créé.
majuscule - commande (touche pomme) - 4(pas sur le pavé numérique) fera apparaitre une croix permettant de délimiter la zone de l'écran à capturer. Une pression sur la barre espace transformera cette croix en appareil photo, permettant de prendre une capture d'un élément de l'écran (menu, fenêtre, dock ...). L'élément qui sera capturé est mis en surbrillance lors du passage de la souris.

Si vous appuyez sur la touche contrôl (ctrl) lors de la capture, le résultat ne sera pas stocké dans un fichier, mais dans le presse papier. Vous pourrez alors le coller dans n'importe quelle application acceptant les images.

Sous Mac OS X 10.4 "Tiger", le format par défaut des fichiers créés est le PNG. Il est possible de modifier ce format, mais cela nécessite une manipulation en ligne de code : dans le Terminal, entrez :

defaults write com.apple.screencapture type format

où format peut êre BMP (Windows bitmap), GIF, JPEG 2000, JPEG, PDF, PICT, PNG, PSD, SGI, TGA & TIFF.

Pour finir, entrez

killall SystemUIServer

pour redémarrer le serveur graphique (c'est totalement invisible et immédiat). Vous pouvez aussi relancer la session si vous n'aimez pas les lignes de commandes.

caractères de protection en bash

2007-06-08T16:02:00.000+02:00

PROTECTION

Les protections (quoting) permettent de forcer l'interpréteur à ignorer la signification spéciale de certains caractères ou mots. Les protections peuvent être utilisées pour empêcher le traitement des caractères spéciaux, éviter la reconnaissance des mots-réservés ou empêcher le développement des paramètres.

Tous les méta-caractères mentionnés dans le paragraphe DÉFINITIONS plus haut ont des significations spéciales pour le shell, et doivent être protégés pour garder leur propre valeur. Il y a trois mécanismes de protection : Le caractère d'échappement, les apostrophes (quote) et les guillemets (double-quote).

Un caractère backslash (\), quand il n'est pas protégé, représente le caractère d'échappement. Il préserve la valeur littérale du caractère qui le suit, à l'exception du . Si une séquence \ apparaît, et si le backslash n'est pas protégé, l'ensemble \ est considéré comme une continuation de ligne (autrement dit, il est ignoré).

Encadrer des caractères entre des apostrophes simples préserve la valeur littérale de chacun des caractères. Une apostrophe ne peut pas être placée entre deux apostrophes, même si elle est précédée d'un backslash.

Encadrer des caractères entre des guillemets préserve la valeur littérale de chacun des caractères sauf $, `, et \. Les caractères $ et ` conservent leurs significations spéciales, même entre guillemets. Le backslash ne conserve sa signification que lorsqu'il est suivi par $, `, ", \, ou . Un guillemet peut être protégé entre deux guillemets, à condition de le faire précéder par un backslash.

Les caractères spéciaux * et @ ont des significations spéciales lorsqu'ils se trouvent entre guillemets (voir le paragraphe PARAMÈTRES ci-dessous).

Les mots de la forme $'chaîne' sont traités différemment. Le mot est développé en chaîne avec les séquences d'échappement remplacées par les séquences standards du C ANSI:

\a: alerte (cloche alias bip)
\b: effacement arrière
\e: un caractère escape
\f: fin de page
\n: fin de ligne
\r: retour chariot
\t: tabulation horizontale
\v: tabulation verticale
\\: anti-slash
\nnn: le caractère dont le code ASCII en octal est nnn (un à trois chiffres)
\xnnn: le caractère dont le code ASCII en hexadécimal est nnn (un à trois chiffres)

Le résultat après traduction est protégé par des apostrophes comme si le symbole dollar n'avait pas été présent.

Une chaîne entre guillemets précédée d'un symbole dollar ($) sera traduite selon la localisation en vigueur. Si la locale courante est C ou POSIX, le symbole dollar est ignoré. Si la chaîne a subi une traduction ou des remplacements, le résultat est protégé par des guillemets.

reconfiguration de vmware

2007-06-01T10:48:00.000+02:00

Au changement de noyaux, il faut reconfigurer vmware en lancant le script:
/usr/bin/vmware-config.pl

pour recompiler il faut installer les derniers headers
uname -a
apt-get install linux-headers-2.6.15-28-386

et préciser le chemin
/usr/src/linux-headers-2.6.15-28-386linux-headers-2.6.15-28-386/include
les machines virtuelles se trouvent dans le sous répertoire vm de mon home directory

monitoring du wifi: aircrack

2007-05-22T14:42:00.000+02:00

apt-get install aircrack

pour capturer du traffic sur l'interface eth1 et le channel 3 et le sauvegarder dans un format lisible par wireshark/ethereal

sudo airodump eth1 wlantest 3

ensuite on lit le contenu de wlantest dans wireshark

monitoring du wifi: kismet

2007-05-22T14:35:00.000+02:00

apt-get install kismet

éditer le fichier de config:

vi /etc/kismet/kismet.conf

changer 4 lignes:
suiduser=hanoteau (mettre à la place de hanoteau votre utilisateur)
source=ipw2200,eth1,ipw2200 (pour mon latitude D610 avec centrino ipw2200 cfr lspci)
defaultchannels=IEEE80211b:1,7,13,2,8,3,9,4,10,5,11,6,12
defaultchannels=IEEE80211g:1,7,13,2,8,3,9,4,10,5,11,6,12

Pour le lancer:
sudo kismet

dans l'interface appuyer sur s pour lister les différents réseaux et pouvoir les sélectionner
h = help

Accélérer le Mac

2007-03-15T10:02:00.000+01:00

Lorsque votre Mac se fait plus lent qu'à l'accoutumé, il est temps de d'exécuter ces 11 commandements :

Supprimer des applications qui se lancent à l'ouverture de la session (Préférences Systèmes/Comptes/Ouverture)
Désactiver l'accès universel, le Bluetooth et la reconnaissance vocale.
Nettoyer les Préférences Systèmes "Autre".
Contrôler la version du logiciel : éviter les applications tournant sous Rosetta.
Supprimer le code superflu : les dernières applications contiennent le code destiné aux processeurs PowerPC et Intel. XSlimmer permet de ne garder que le code nécessaire à votre machine.
Supprimer les langues qui vous sont inutiles à l'aide d'utilitaires comme Monolingual.
Améliorer le refroidissement de votre Mac : Divers utilitaires permettent de contrôler la vitesse de rotation du ventilateur du processeur.
Réduire le nombre de Widgets.
Garder un oeil sur le Moniteur d'Activité (situé dans les utilitaires). Il permet de surveiller la charge du processeur et la disponibilité de la RAM.
Nettoyer votre disque dur.
Exécuter OnyX.

Les étapes à suivre sont détaillées sur le site Low End Mac

wpa supplicant et ms chap v2

2007-03-14T17:16:00.000+01:00

copié du site: http://pthichat.net/index.php/Linux

Voici les différentes étapes de configuration pour utiliser le réseau WIFI de l'Université de Bretagne Occidentale sous Linux.

"Installation de wpa_supplicant"

Pour cela il suffit de télecharger le paquet wpa_supplicant pour votre distribution favorite. Pour les gens qui utilisent Debian

apt-get install wpa_supplicant

"Configuration du SSID"

Pour cela il faut préciser qu'on va utiliser le vlan enseignement et non pas le SSID wifiUBO (Saleté d'AP CISCO je me suis fait avoir).

iwconfig ath0 essid enseignement

"Configuration wpa_supplicant"

Le réseau wifi utilise le protocol 802.1x/PEAP/MS-ChapV2 pour cela veuillez renseigner le fichier wpa_supplicant.conf comme suit :

network={
ssid="enseignement"
key_mgmt=IEEE8021X
eap=PEAP
phase2="auth=MSCHAPV2"
identity="numero etudiant"
password="password"
}

"Lancement de wpa_supplicant"

Je vous laisse lire la doc de wpa_supplicant pour savoir quelles options utiliser (Dans mon cas ma carte wifi ath0 et j'utilise ndiswrapper avec le driver wext)

wpa_supplicant -Dwext -iath0 -c/etc/wpa_supplicant/wpa_supplicant.conf &

Il vous reste maintenant à lancer le dhcp et vous voila prêt a utiliser le wifi

dhclient ath0

Config d'une IP sur un ap cisco 1242

2007-02-28T15:36:00.000+01:00

enable
(passwd Cisco)
configure terminal
no logging console
interface bvi1
ip address 172.16.1.115 255.255.255.0
exit
exit
copy run start

connecteurs RF & microwave

2007-02-28T10:32:00.001+01:00

Cisco vers antennes :

Reverse TNC mâle jack ->OK -> reverse TNC femelle plug

Reverse TNC mâle jack -> reverse TNC femelle plug/N femelle jack (adaptateur 7603400, 242131, be.farnell.com) -> N mâle plug/N mâle plug (câble 50cm 1056158, be.farnell.com) -> N femelle jack

Proxim vers antennes :

Reverse MMCX femelle ->voir anixter (1086-PGTL pigtail cable N mâle plug) -> N femelle jack/reverse TNC mâle jack ????? -> reverse TNC femelle plug

Reverse MMCX femelle -> voir anixter (1086-PGTL pigtail cable N mâle plug) -> N femelle jack

Zyxel/d-link vers antennes :

Reverse SMA mâle jack -> reverse SMA femelle plug/reverse TNC mâle jack ??? -> reverse TNC femelle plug

Reverse SMA mâle jack -> OK -> N femelle jack

--------------------------------------------------------------------------------------------

AP Cisco 1242 reverse TNC Male Jack
AP Proxim 4000 reverse MMCX Femelle
AP Zyxel 3000/570U Reverse SMA Male Jack
AP d-link 2000 Reverse SMA Male Jack

Antenne Cisco (2,2 dBi et Yagi) Reverse TNC femelle plug
Antenne proxim 1086 9.5 dBi, d-link 0800 8 dBi & 1080 8 dBi N femelle jack

script conversion tif jpg (basename est mon ami)

2007-01-21T16:20:00.000+01:00

#!/bin/bash

#for img in `ls *.TIF`
#do
# convert $img $img.jpg
#done
mkdir jpeg
FILES=$(ls *.tif)
echo $FILES
for i in $FILES; do
# sed -e 's/\.TIF.jpg$/\.jpg/';
# convert $i $i.jpg
convert $i `basename $i .tif`.jpg
# sed -e 's/\.tif.jpg/\.jpg/';
done

Files=$(ls *.TIF)
#echo $Files
for i in $Files; do
# sed -e 's/\.TIF.jpg$/\.jpg/';
convert $i `basename $i .TIF`.jpg
done
cp *.jpg jpeg/

Extraction de cd soundjuicer

2006-12-21T22:32:00.000+01:00

Par défaut sound juicer extrait au format ogg, si on veut extraire au format wav sans perte et codage alors il faut faire la modif suivante:

Sound Juicer/Edition/Préférences/Format de sortie/Editer les profils/Wav/Edition/Pipeline GStreamer
Il faut modifier les valeurs indiquées ci dessous :
audio/x-raw-int,rate=22050,channels=1 ! wavenc name=enc (par défaut)
audio/x-raw-int,rate=44100,channels=2 ! wavenc name=enc (aprés correction)

sinon sound juicer refuse de lier le pipeline

2006-11-09T10:25:00.000+01:00

Le défi proposé:

connecter un téléphone UTstarcomm (VoWiFi) sur un AP Cisco Aironet 1131AG IOS 12.3(8ja) avec la sécurité WPA

Les solutions:

avoir ces paramètres sur le point d'accès sinon aucune connexion possible

dot11 wpa handshake timeout 500
interface Dot11Radio0
no dot11 extension aironet
dot11 qos mode
no world-mode (dot11d country BE both) (à priori pas nécessaire)

conversion ext2 vers ext3

2006-10-24T11:14:00.000+02:00

Converting the / directory
First, think long and hard before deciding to convert the root directory. Ext3's primary purpose is shorter recovery from disaster rather than data loss prevention. Converting the root directory from Ext2 to Ext3 isn't difficult, but converting it back from Ext3 to Ext2 is a treacherous process fraught with problems. But, if you really must perform the Ext2 to Ext3 conversion on the root directory, here's how, assuming /dev/hda2 is mounted as the root directory and /dev/hda1 is mounted as /boot:

* Log in as root
* Edit /etc/fstab and change ext2 to ext3 on the line referencing the root directory.
* tune2fs -j /dev/hda2
* cd /boot
* mv initrd-2.4.18-26.8.0.img initrd-2.4.18-26.8.0.img.ext2
* mkinitrd initrd-2.4.18-26.8.0.img 2.4.18-26.8.0
* reboot

In the preceding, you MUST perform all the steps, including the mkinitrd, before rebooting. Failing to perform all the steps before rebooting produces a "buried shovel" where if only you could boot the machine, you could run the mkinitrd command, and if only you could run the mkinitrd command, you could boot the machine.

changer la configuration du clavier

2006-10-23T11:22:00.000+02:00

Changement non persistant à la volée:

terminal: loadkeys be-latin1|us|uk|...

serveur X: setxkbmap

Persistant distribution spécifique:

RHEL : system-config-keyboard
Debian: dpkg-reconfigure console-data

Wine basics

2006-10-20T13:47:00.000+02:00

Wine Quickstart Guide

This Quickstart Guide will help you to get Wine running. Make sure you have Wine installed. If you don't check this page on installing Wine: http://winehq.org/site/docs/wineusr-guide/getting-wine

Installing an application

In this guide I will show you how to install MS Office 97.
In order to install an application you must know the name of the file to run and the location of the file.
In this example I must run setup.exe which is loacted in /media/cdrom.
To install Office I must run the following command:

$ wine /media/cdrom/setup.exe

The application will now be installed.

Running an application

The application will be installed in a directory called .wine in your HOME directory. If your file manager doesn't show this directory make sure that it shows hidden files/directories (.wine is a hidden directory).

Office is installed in ~/.wine/drive_c/Program Files/Microsoft Office/Office
If I want to run Word I must type the following lines:

$ cd ~/.wine/drive_c/Program Files/Microsoft\ Office/Office
$ wine winword.exe

It might be a good idea to create a file that launches Word. It could look like this:

#/bin/sh
cd ~/.wine/drive_c/Program Files/Microsoft\ Office/Office
wine winword.exe

Save this as word.sh in ~/bin and make it executable by typing chmod +x word.sh
You can now start Word by typing word.sh