{TekCrack}

Thx to one comment, I just realized that all of the links on the post are screwed. Not exactly sure why this happened, but all of the URLs have been replaced by JavaScript BS. I will work on that today to get the issue resolved. My apologize in advance if you run into problems.

Also on the plate, I have plunged back into Electronics happily and purchased a Rigol DS1052E Oscilloscope. This is one sweet machine. It runs @ 50MHz resolution but can be hacked to run @ 100MHz. Have not attempted the hack yet as I figure I should play with it first in case I brick it. Found out about this scope over at EEVBlog. Check that site out…Dave’s Video Blogs rock.

Crazy busy right now and have not had a chance to get to these. I will very very shortly. Until then, here is a link to the server cabinet setup.

http://picasaweb.google.com/114701905311889616056/ServerCabinet

Its a work in progress but its coming along!

There are plenty of sites that will guide you through the steps to upgrade to Exchange 2010. I was on 2003 when I upgraded last week. I followed the following articles:

That being said, I want to cover a particular setup that no one seems to have really touched on with Ex2010. That is how to run it on the ultra cheap and get away with it.

In this tutorial, I will detail the process of creating and installing a self signed SANS certificate for Exchange. We will also explore what one must do to get Exchange working properly for your users. If you are a small shop and DO NOT want to spend money on a SANS Certificate, this tutorial is for you. If you want to learn a little more about OpenSSL for Windows, this might help too.

Our steps are as follows: we are going to create a Certificate Authority which will be used to sign any and all self signed certificates. I will detail how to implement this CA into XP/Vista/7 (tut part 3) so that your server certificates will be accepted on those clients. I will also show you how to create a SANS certificate that will work properly in Exchange 2008 and IIS 7. I will do my best to completely detail this process, but, if there are issues, please let me know.

Lets get started. We are about to download OpenSSL for Windows. You need to check Add/Remove Programs, etc to see if you have Visual C++ 2008 Redistributable. If it is not installed, that is your first task…Google..or download it off of the following site: http://www.slproweb.com/products/Win32OpenSSL.html. Make sure C++ 08 (warning) is installed first and then download the version of OpenSSL that works for your system. I went for the Win64 OpenSSL 1.0 0 download since I am running server 2008 x64. Install OpenSSL to your appropriate ‘Program Files’ directory.

(warning) You need to make sure you install the distrib only if you do not have it and make sure you install the right one x86/x64. I have read numerous bad posts about installing this twice!

What follows is a culmination of knowledge from different posts from the web. None covered it, but I would like to give special props now to Reinersmann’s Blog. He got me started in a very good way on this. Props to you sir!

Once OpenSSL is installed, open a DOS prompt or explorer window to the directory you installed OpenSSL into. You should see a bunch of directories like (bin, lib, etc). Create a directory next to those folders called SSL. You need to create the following sub directories inside SSL: certs, crl, newcerts, private.

Grab the following two files off of [working on link] and save them to your SSL directory. Once done, open them up and edit anything with [brackets] around it:

DOS on Server
Grab your friendly DOS prompt and get it into that SSL directory you created. At the DOS prompt, issue: echo 100001 >serial . Then issue: echo >certindex.txt. This will create a serial number file for your certs and also create a database called certindex.txt which will hold info on what we are about to do.

Creating a Private Key
At the prompt> ..\bin\openssl genrsa -aes256 -out private\RootCA.key -rand private\.rnd 2048

Creating a Root Certificate (CA) Off of that Private Key
At the prompt> ..\bin\openssl req -config openssl_root.cfg -new -x509 -days 3650 -key private\RootCA.key -out certs\RootCA.cer -rand private\.rnd

Note: The above will create a file called certs\RootCA.cer. This is what you will sign your Exchange Certificate with. This would be your "Verisign" certificate if you will.

Creating an Empty Revocation List
At the prompt> ..\bin\openssl ca -config openssl_root.cfg -gencrl -crldays 3650 -keyfile private\RootCA.key -cert certs\RootCA.cer -out crl\domain.crl

Note: This creates the revocation list for the CA cert…This will need to be accessible in IIS. I will show you how to do that in a bit.

Exchange
Open up the Exchange Management Shell (Start>All Programs>Exchange Server 2010>EMS)
Here is the key:
[blah] means replace the whole thing including the brackets
CN= should be the Fully Qualified Domain Name (FQDN) that your clients will attempt to connect to
-DomainName: should match what you configured in the openssl_server.cfg file.
Make sure you match the openssl_server.cfg and get rid of the ", [more entries?]"
Italics = fill in the blanks, Bold Italics is important.

Enter Into EMS
EMS Prompt> $Data=New-ExchangeCertificate -GenerateRequest -SubjectName "CN=[internet-intranet-accessible.domain.com] , O=[CompanyNameHere] , L
=[CityHere] , ST=[StateHere] , C=[CountryHere(2 characters as in US)] , OU=[DivisionOfCompanyPublishingCertificate] " -DomainName owa.yourFQDN.com, autodiscover.yourFQDN.com, persephone.yourFQDN.com, www.yourFQDN.com, yourFQDN.com,
exchangeServer.yourFQDN.com, exchangeServer, [more entries?] -keysize 2048 -privatekeyexportable: $true

Note: Once done, you need to write the certificate request to file. Make sure the above is 110% correct before running the below as you may find 50 billion cert requests waiting for you later.

EMS Prompt> set-content -path "c:\endall.csr" -Value $Data

Note: The above creates a certificate request on the Exchange server specifying all of the details of the certificate. You need to MAKE SURE that the -DomainName part matches up with the openssl_server.cfg lines detailed above and contains all of the DNS entries that you want this certificate to cover.

Move and Edit the CSR
Now go to the path you entered into the second Exchange command, in this case, c:\endall.csr. Move this to the SSL directory you are currently working out of in DOS. Once it has been moved/copied, open it with Notepad. You need to clear the empty line between the certificate "crazy letters" and the "—–END NEW CERTIFICATE REQUEST—–" line, otherwise you will get an error from OpenSSL.

Sign the Exchange Certificate Request
Back to the DOS Promp> ..\bin\openssl ca -config openssl_server.cfg -name ServerCA -policy policy_anything -in server.csr -out certs\server.cer

Note: This signs the Exchange Cert Request with the custom CA you created above. If the domainname stuff was entered correct in the EMS and also in the openssl_server.cfg file, you will have a beautiful new SANS self-signed cert to play with!

Import You Certificates
If everything was successful, you are ready to import the certificates into the Certificate Store on the Exchange Server. Do so by:
Start>Run: Type mmc.exe and hit <enter/ok>.
In the MMC window, go to File>Add/Remove Snap-In, select the Certificates snapin and Add it for the "Current User". I would add a second Certificates add-in for Local Computer (this may not be necessary).
Go to the Personal Store in each (currentuser/localcomputer). Right click on the Certificates subfolder under Personal Store and select All Tasks>Import. Add the certificates you have created except for the RootCA.cer.
Go to the Trusted Root Certification Authority, right click on its Certificates subfolder, All Tasks>Import and import the RootCA.cer.
Repeat these steps for the Local Computer Certificates (Personal/Trusted Root).

Great you are almost done!

Exchange Management Console
I have only tested this with Server 2008 and Exchange 2010. Mileage may vary. You need to open the Exchange Management Console (Start>All Programs> MS Exchange 2010>EMC). Once the EMC is open click on Server Configuration. Your attention should be directed to the lower middle pane. If all went well, you should have an icon on the far left of each certificate with a very pretty blue check mark on top of it. If so, you are doing great…if not, check the above directions to see if you missed something.

Assign Exchange Services
If you see the blue check mark next to your certificate (you can confirm it is your cert by double-clicking on the name of the cert), you should right click on that certificate and select Assign Services to Certificate. This will take you through a quick wizard which will allow you to select what services use the certificate (POP, IMAP, SMTP, and/or IIS). On the Select Services ‘tab’, I was able to check everything but Unified Messaging. UM should only be checked if you installed it. Other check boxes may give you errors if you have more than one Exchange server running different tasks.

AutoGen Certificate
You will notice in that middle bottom pane that another SSL cert is listed. If you have no need for it, you can remove it.

That should cover everything for this Tut. More to come. (2of3) will focus on IIS and Outlook and (4of4) will focus on phones. Specifically Windows Mobile 6 and Android since my business partner and I carry them.

Any corrections are welcome. So are questions. I hope my English/Grammar was not too bad for you. Thanks for reading TekCrack!

You may already know it. You may already work in it. If you don’t, thanks to our Prez, you should get into it. "Medical ID" is coming like a freight train. It will be a standard faster than you know it. It will clunk like an old VDub, but its here to stay, and it will be the engine that CAN!

In the next few years, businesses large and small will race to find qualified, certified leaders in the IT development field to pull off one of the biggest feats in US history. It has already started! We have to take a whole lot of misinformation and process it down to the nitty-grity for the rest of the continent.

I just have to say…this is one billion times bigger than Y2K! This is Zombie Land on steroids. This is F***ing huge!

We will be expected to provide…

1. An all-in-one system, which protects doctors, patients, and even insurance companies.
2. It will keep all data secure (haha, hrm, the stories!)
3. Be able to import medical records from an array of programs, none of which, know how to speak with each other fluently (‘csv’,'dumbass?’)
4. Use standards set forth by Microsoft all the way to Open Source
5. Able to detect and decipher complex diagnostic codes
6. Hopefully define a new system for those diag codes (since the UN, the US, and Europe can’t figure out that you need more than 6-7 characters to diagnose a disease and a treatmeant:::Face in Palm!
7. Ultimately, back to security, a very good way to share all of this information with the right people, the right services, the right computers, at the right time without vulnerabilities.

No one has pulled it off yet. Not IBM, Microsoft, or GE. On top of it all, to get on board with them, you have to buy their software. That sounds good if you have deep pockets, but what about the small businesses of the world. We need a truly open standard. Something we can all download, run, and debug. What can we do to protect them, help them, and make a healthy profit? After all, we have to eat right?

The medical market offers many opportunities for all of us in this SH*TTY economy. We should take advantage.

To the .Net Programmers who don’t get kewl Intel commercials featuring them!
You know who they are…the ones that make the world go round.

Sláinte (that means to your health…with a Guinness in your hands!)

What do you think? Comments are appreciated!

Hello fellow hackers. I come to you with great news!

I am back! It took a while, but yeah. I had a run-in with Eve Online, got married, etc.

Scary stuff…I am now working part time between SOHO and doing contract work for companies using c#/VB/ASP for enterprise dev. Been out of coding for a year until the past few month. Its amazing how much you can forget when you don’t use it.

Anyways, I will continue to add to the hardware hacking area of the blog but will also start to discuss things about ASP, Windows Apps, Windows Services, and mobile apps.

Here is the really kewl thing…I think I can tie a lot of this stuff into my previous experiences with Arduino and the Make Controller! I can’t wait…this may be fun!

I will start posting on a regular basis about a variety of stuff. Hope you don’t mind, until then…

Happy Hacking!

For this exercise, I will be basing my walk through off of AVR Freak’s Wiki documentation. For other updating options, please refer to the Firmware Upgrade page on AVR Freak’s Wiki.

Using NGW100′s Root FS & WGET to Load /usr FS

1. Get booted all the way into the root filesystem on the NGW100.
2. Run ps at the root prompt. You will be shown a list of all running processes on the NGW100.
3. We must kill all processes running from /usr. Here is the command I used: killall dnsmasq telnetd inetd httpd dropbear nmbd
4. Now issue umount /usr to unmount the partition. If it fails, you still have something running for the /usr partition. Check ps.
5. Now we erase the /usr partition, otherwise known as /dev/mtd3 by issuing flash_eraseall /dev/mtd3.
6. Once that is finished, we need to make sure we are in root (/) directory. Run cd ~ just to make sure.
7. Now we download the usr image with

Next I am going to look at using TFTP to restore or upgrade the /root filesystem on the NGW100. The /root file system will require more intereaction with U-Boot so let us get started!

For this exercise, I will be basing my walk through off of AVR Freak’s Wiki documentation. For other updating options, please refer to the Firmware Upgrade page on AVR Freak’s Wiki.

Quick TFTP Setup

1. Open a console on your Ubuntu development desktop.
2. Run sudo apt-get install tftpd to install the tftp server.
3. Make sure /srv/tftp exists on the desktop system.
4. Restart tftpd with /etc/init.d/openbsd-inetd restart.
5. Download the /root filesystem (rootfs.avr32.jffs2-root) from atmel.no.
   Note: Make sure you grab the right version to match u-boot.
6. Copy this file to your TFTP server directory (/srv/tftp). You are ready to go!

Using U-Boot and TFTP To Restore The Root Filesystem

This section assumes that your Linux desktop is not your DHCP server. I don’t know too many people who would have this setup normally so why even bother screwing with that when its quite easy to type a few extra lines and get the same results.

1. Make sure your desktop and NGW100 are connected via serial cable and that you are connected via a terminal program. Also connect and ethernet cable between the NGW100′s WAN port and your network. Power the NGW100 on if needed.
2. If you only have U-Boot installed, you will end up at a Uboot> prompt. If not watch carefully when the board frist starts.
   Note: There is a line mentioning that you have one second to hit space. Doing so will drop you to U-boot. 
3. You can run the command dhcp real quick to have uboot grab an ip address for your ethernet connection.

   You may get an error saying that ethaddr is not set. So we will set a bogus mac address for the the NGW100 as follows:
   Uboot> set ethaddr 00:11:95:00:00:00
   

4. If NGW100 did not get an IP from your DHCP server, run this line.

   Uboot> set ipaddr 192.168.100.105
   Set to an IP that is available on your network

5. Now we set the rest of the important environment variables for TFTP.

   Uboot> set tftpip 192.168.100.103
   Change to your TFTP Server IP
   Uboot> set serverip 192.168.100.103
   Change to your TFTP Server IP
   Uboot> tftp
   This command will fail because you did not specify a file but it should show that it connected to the TFTP server and tried to download a file. If it did try to load one, you are ready to actually erase the existing root image. I personally find the above test methods much better then erasing the flash first before knowing you can get to the file.

6. Now we are ready to flash the root filesystem to the NGW100 as follows:

   Uboot> protect off 0×20000 0x7EFFFF
   This turns off /dev/mtd1 flash protection.
   Uboot> erase 0×20000 0x7EFFFF
   This erases the entire /dev/mtd1 flash chip.
   Uboot> tftp 0×90000000 rootfs.avr32.jffs2-root
   This connects to your TFTP server, downloads the root image file and places it into SDRAM for temporary storage.
   Uboot> cp.b $(fileaddr) 0×20000 $(filesize)
   This copies the file (fileaddr) located in SDRAM to the start of the /dev/mtd1 flash chip and it also specifies its size. These two variables are added to the environment when you ran tftp above.
   Uboot> protect on all
   Turns read only protection back on for /dev/mtd1.

7. Now just reboot your NGW100 and watch as Linux loads!
   Note: If you are upgrading the root filesystem from an older version, you will notice that the SYS LED now blinks red. This is normal. It represents the CPU’s heartbeat. No need to freak out (I know I did at first)!

Note: The first time I tried to boot the root filesystem, I got some unexpected errors. For more information check here.

That wasn’t too difficult. Next we will use WGET to load the /usr filesystem.

I did run into a bit of a problem after restoring u-boot and the root filesystem with the JTAG ICE. It appears that the version the board shipped with was setup to boot the linux kernel off of /dev/mtdblock1 at /uImage but the latest build, 2.3.0, had the kernel located at /boot/uImage. I was constantly getting the following error from u-boot:

Wrong Image Format for bootm command
ERROR: can’t get kernel image!
UBoot>

After a bit of Googling, I found a blog on the subject which suggested the following:

Booting By Internal Flash

To boot the kernel and root file system off of the internal flash (/dev/mtd1), get into u-boot and enter this:

Uboot> askenv bootcmd
Please enter ‘bootcmd’: fsload /boot/uImage; bootm
Uboot> askenv bootargs
Please enter ‘bootargs’: console=ttyS0 root=/dev/mtdblock1 rootfstype=jffs2
Uboot> saveenv
Uboot> bootm

Booting By SD Card

To boot the kernel and root file system off of SD card (/dev/mmcblk0p1), get into u-boot and enter this:

Uboot> askenv bootcmd
Please enter ‘bootcmd’: mmcinit; ext2load mmc 0:1 0×103000000 /boot/uImage; bootm 0×103000000
Uboot> askenv bootargs
Please enter ‘bootargs’: console=ttyS0 root=/dev/mmcblk0p1 rootwait
Uboot> saveenv
Uboot> bootm

You can test to see if u-boot can read the card by issueing the command ext2ls mmc 0:1. It should list all of the files on the card.

I did notice while I was looking around that if you have problems on the NGW100 board with the above SD u-boot settings, that it is recommended to try setting rootwait to rootwait=1. Hope that will help someone else.

So as I mentioned, I attempted the flash method to update u-boot to the latest version. I got to the erase flash part of the instructions and I ended up getting a support call and had to run. Storm rolled through while I was gone and killed the power and, because it was down for more than an hour, the battery backup too. So I returned home to find a ‘dead’ NGW100 board.

Just to mention, there are three ways to perform a NGW100 U-Boot/Root FS update. They are as follows:

• Update through u-boot itself
• Update using Atmel’s flash-update program
• Update with the JTAG ICE MKII (which I will demonstrate)
• You can also update the root filesystem via SD Card, Network, Serial, or JTAG. I decided to use JTAG ICE to restore both U-Boot and the root filesystem.

For this exercise, I will be basing my walk through off of AVR Freak’s Wiki documentation. For other updating options, please refer to the Firmware Upgrade page on AVR Freak’s Wiki.

Notes

• U-Boot is stored in /dev/mtd0. Its partition is from 0×000000 – 0x01FFFF.
• Root Filesystem is stored in /dev/mtd1. Its partition is from 0×020000 – 0x7EFFFF.
• The U-Boot environment area (used for storing environmental variables for U-Boot) is located in /dev/mtd2. Its partition is from 0x7F0000 – 0x7FFFFF.
• Usr Filesystem is stored in /dev/mtd3.
• If you have an old root image. Do not worry if the system light blinks red after updating. The code in the kernel has changed to represent a cpu heartbeat and is normal.

After purchasing the JTAG ICE MKII and after setting up Ubuntu with a AVR32 development environment, I did the following to replace u-boot.

Prepare NGW100 For JTAG ICE Restore

1. Remove power to the NGW100 board.
2. Connect the JTAG ICE MKII to power and connect a USB cable between Linux and the programmer.
3. Make sure the JTAG ICE power is off. Now connect the JTAG connector to the NGW100 (I’ve included a picture above with the correct way to plug the connector into the NGW100.
4. Now power the JTAG ICE device. If you check /var/log/messages on your Linux box, you should see that your system detected the JTAG programmer.
5. Now apply power to the NGW100.
6. Go to atmel.no/buildroot/binaries and pick the latest version. I downloaded the following files from version 2.3.0: u-boot.bin and root.avr32.jffs2-root.
7. Next we restore u-boot with the JTAG ICE

Use JTAG ICE To Flash U-Boot and Root On The NGW100

1. First we erase the entire flash of the NGW100 board with sudo avr32program erase -fcfi@0 to ensure the board is clear.
2. Now we flash the u-boot image onto the NGW100 board with sudo avr32program program -F bin -vfcfi@0 u-boot.bin.
3. Now we flash the root image onto mtd1 with sudo avr32program program -F bin -vfcfi@0 -O 0×20000 root.avr32.jffs2-root.
4. All done! Unplug the power from the NGW100 and turn off the JTAG ICE MKII.
5. Disconnect the JTAG connector from the NGW100.
6. Plug in your NGW100 board and watch it fly.

Note: The first time I tried to boot the root filesystem, I got some unexpected errors. For more information check here.

That is how you use a JTAG ICE MKII to restore/upgrade/install a fresh u-boot and root image onto your Atmel NGW100 board. You can also use TFTP to load a root image or you can move on to loading the usr filesystem.