Turn off pesky "these files might be harmful to your computer" network warning for your local NAS share

https://superuser.com/questions/149056/disable-these-files-might-be-harmful-to-your-computer-warning

PSF-B04 over the air flash to sonoff plus configuration

PSF-B04 appears to be the ESP8285

My photo showing 5v, ground, rx, tx, and GPIO 16 soldered to

Before soldering like I did, this post has more help with finding solder points that are easier, away from the chip- also advice to remove an unknown chip if you run into issues of the device rebooting when hitting all the relays at once.

https://community.home-assistant.io/t/hacking-the-psf-b04-esp8285-4-channel-relay-board-and-with-tasmota-and-unable-to-drive-all-4-relays-concurrently/155919

(photo from John's hacking blog - https://www.hagensieker.com/wordpress/2019/02/21/hacking-unknown-2-channel-relay-with-tasmota/)

Two relay board:
Backup original firmware:
https://notenoughtech.com/featured/is-it-worth-hacking-sonoff-basic/

Get into boot-loader:

button furthest from relays- changes latching setting of relays

middle button triggers relay closest to buttons

button closets to relay triggers relay closer to PSF module

random holding of buttons to get red LED fast blinking = wifi mode, the magic combo seems to be holding the button closest to relay down for about 7 seconds, then the next button over for about 7 seconds.

Serial method not working, either my TTL serial adapter is bad, or my soldering was bad.


Wifi method:
https://www.youtube.com/watch?v=ONFhXM5R-t4

Neither CMD or VisualStudio CMD line worked

Used Anaconda Prompt (Python)

Also command "pip3 install --user -r requirements.txt" is outdated, must use,
"py -m pip install --user -r requirements.txt"

(see this thread: https://www.reddit.com/r/learnpython/comments/a2xusa/pip3_is_not_recognized_as_an_internal_or_external/)


Then run python.exe sonota.py

SSID = ITEAD-1000705895
password = 12345678 (sonoff default).

Was getting AttributeError: 'NoneType' object has no attribute 'set_nodelay'

commented out section found here
https://github.com/mirko/SonOTA/issues/169

still seemed stuck- once got to a repeated cmd prompt output of "when download finishes, you have a few minutes to connect to final... wifi ... blah blah I rebooted the relay board and BOOM, the python script kicked in and the board flashed.  I don't think the commented out python line mentioned in the git thread fixed the issue, just lowered the 'log noise' in the prompt.

This was my 5th or so attempt, having the board in latch settings (relay stays open or closed, no delay action) might have helped per this other thread and method (but doubt this).
https://www.hagensieker.com/wordpress/2019/01/26/sonoff-rf-with-tasmota-firmware-in-homeassistant/

The device then presenting a wifi hotspot as sonoff-<four random numbers>

I did not connect to this, it went away eventually- I then found it's IP address via router

Typed in IP into we-browser and surprised to find a sonoff basic module webGUI

Fail - or so you would think - the Sonoff Basic Module is the first displayed, not the four channel - change via configuration in webGUI (makes me wonder about the actual four channel board that this brand sells- one could control two garage doors AND other features like lights).

Refer back to the blog that does the serial port wired hack on guidence
https://www.hagensieker.com/wordpress/2019/02/21/hacking-unknown-2-channel-relay-with-tasmota/



Amazon review mentions using one of the GPIOs for a reed switch to make the garage door status of being open or closed also a feature of this device (in combination of using samsung smart things, this might not be a feature easily setup in hass.io).
Per review, "Used it with my garage door opener project. Flashed it with Tasmota and found GPIO14 on the ESP chip which I use for connecting a reed switch (door sensor) too. "

CentOS 7 setup for golden image

Recently have been burning through CentOS VMs lately, and wanted to setup a CentOS 7 "golden image" to clone for future builds.

** NOTES, IRT Splunk severs, do not install GUI (causes proxy bridge interface weirdness), setup firewall rules).

- Install Centos7 with decent VM specs (two core, 2 gigs ram)
- Install NIC
- Install net-tools (for ifconfig command)
- install GUI (DO NOT INSTALL GNOME, BREAKS ALL THE THINGS)
- yum update
- remove virbr0 interface and libvirtd service as it messes up the Splunk install (TBD if the issue)
- disable SELinux
- disable or create firewall rules
- install A3Sec app on Splunk
- Set timzone
- Trouble shoot why having A3Sec and Snort for Splunk at the same time breaks Splunk's time parsing capability.


Ensure during boot up from CentOS7 ISO in VMWare datastore, select turning on the NIC in the GUI installation process, specify drive (30 gig size from earlier configuration), create root password and user account.

Install networking on headless CentOS7 build
https://lintut.com/how-to-setup-network-after-rhelcentos-7-minimal-installation/

Install ifconfig
https://linuxconfig.org/howto-install-ifconfig-on-centos-7-linux

Install nano:  yum install nano

Mount CD for Splunk ISO
https://linuxconfig.org/how-to-mount-cd-dvd-rom-on-centos-rhel-linux

Install GUI ** DO NOT DO !! ***
https://www.itzgeek.com/how-tos/linux/centos-how-tos/install-gnome-gui-on-centos-7-rhel-7.html

And then for good fun, install htop
http://cheapwindowsvps.com/blog/how-to-install-htop-on-centos-7/

neofetch
http://www.vassox.com/linux-general/install-neofetch-on-centos-7-rhel/

LNAV log
https://www.unixmen.com/install-use-lnav-on-centos-7/

- adding epel-release for LNAV makes htop available as well.

virbr0 and libvirtd removal
https://www.thegeekdiary.com/how-to-remove-virbr0-and-lxcbr0-interfaces-on-centos-rhel-5-and-rhel-7/

disable SELinux
https://linuxize.com/post/how-to-disable-selinux-on-centos-7/

disable firewall
https://www.liquidweb.com/kb/how-to-stop-and-disable-firewalld-on-centos-7/

Make firewall rules- add exceptions for 8000, 8089, 9997, 514, 1514
https://blog.christophersmart.com/2014/01/15/add-permanent-rules-to-firewalld/

Install Splunk on CentOS
https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchTutorial/InstallSplunk

A3Sec App
https://splunkbase.splunk.com/app/2739/#/details

Set timezone
https://www.cyberciti.biz/faq/centos-linux-6-7-changing-timezone-command-line/

Trouble shoot A3 sec time stamp parsing breaking- update props.conf to parse time
https://answers.splunk.com/answers/626816/pfsense-event-date-time-wrong.html

Change splunk license to free immediately before expatriation of trail.

OpenVPN import in Ubuntu

Oh the joy of Linux and importing VPN configurations from pfSense OpenVPN client export wizard/generator.

On Ubuntu 16.04 LTS, the trick was not to use the OpenVPN.oval file, but to manually import the file not using the OpenVPN part of the GUI- using the 'archive' option from the pfSense file generator.

I updated to Ubuntu 18.04 LTS and now the trick was to download the Mac/Windows viscosity bundle, unpack, and run that .conf.

Oh Linux network manager and your VPN 'turn key' GUI, you trickster you.

Increased sensitivity to A3Sec's Splunk pfsense app's scanned panel

So playing around with A3Sec's pfsense Splunk app, I moved the threshold of the scanned panel around to see how many more IPs/geolocations popped up on the map.  I then even had a friend run a standard/default nmap scan on my IP, and cranked the search string's sensitivity down to where it caught it, this is the new string.

index=gw_pfsense sourcetype=pfsense_filterlog action=blocked  | dedup src dest_port | transaction src maxspan=5m maxpause=12s keeporphans=false | where eventcount > 3 | iplocation src | geostats latfield=lat longfield=lon count(src)

Shinobi NVR

Being a glutton for punishment, I didn't want the standalone NVR unit built for my PoE security cameras- I was head strong that I would buy BlueIris, or get Zoneminder working.

I started to get sticker shock at BlueIris, its $60.00 for the server software, and that doesn't even come with the $10.00 Android app!  The second gripe was that it only runs on Windows, and I've found Win10 to be really bad for uptime- I have had to firewall my Win10 VM (currently used for the PoE client from the company that is very limited in features) off from the internet so it doesn't randomly update and restart (with my luck this would be right during a brake-in).

A quick VM spin up of a zoneminder build showed me I wanted NOTHING to do with that software.  Getting so discouraged I started to entertain the idea of buying the PoE brand's NVR,  then I came along Shinobi- the new kid on the block but solid looking.  So onto the pro-tips earned by hours of fail (not Shinobi's fail, my fails).

Install from site, great instructions, well packaged, one of the easier Linux installs
https://shinobi.video/docs/start

Reddit support forum:
https://www.reddit.com/r/ShinobiCCTV/

- do not build on CentOS, trust me.
- Currently on Ubuntu server 16.xx
- If a VM, make a snap shot after updating the OS and installing Shinobi, not just as best practice but there are a number of "land mind" settings in Shinobi that if set but not right for your PoE camera, Shinobi will become totally un-responsive.  Its easiest to just start over from the snap shot.

Adding cameras:  Reolink RLC-410 Bullet, RLC-420 dome, RLC-422 5mp zoom dome.
Some info on Reolink from Zoneminder trail blazers:  https://forums.zoneminder.com/viewtopic.php?t=25874

Reolink:  h265 camera facts.
https://reolink.com/h265-ip-cameras-buying-guide/

- rtsp://user:password@IPaddress:554/h264Preview_01_main

Stream types for reolink:
- Poseidon is lagging
- HLS  *AVOID* causes system to be un-usable and requires reverting to snapshot
- FLV doesn't work
- JPEG with audio is decent

Notes from the Zoneminder attempt:
- Reolink has two feeds per each camera, one is high frame rate, one much slower (and I believe lower resolution).  For the OEM client I believe the slower FR is for motion sensing.

Current result- all four of my Reolinks are feeding in, but there is severe frame skipping, or just lock up of the feed all together.

Auditing FreeNAS CIF/SMB activity

Having setup Splunk to ingest pfSense router/firewall/snort IDS/IPS logs and my windows laptop logs, I have a lot of goals, so little skills:
- build upon already great splunk apps for the above logs
- One of those apps is for FreeNAS, and I want to also catch smb share activity
- Ingest Foxhound Raspi BRO logs

For FreeNAS, first off before even tackling the Splunk setup, I began searching how to setup auditing on FreeNAS to even create the SMB activity logs, and found this thread:

https://forums.freenas.org/index.php?threads/tutorial-add-full-logging-on-samba-shares-full_audit-freenas-9-3.13840/

Basically adding in the SMB edit part of the GUI:

full_audit:prefix = %u|%I|%m|%S
full_audit:failure = connect
full_audit:success = mkdir rename unlink rmdir pwrite
full_audit:facility = LOCAL5
full_audit:priority = NOTICE

A bit noisy, another config is:


full_audit:prefix = %u|%I|%m|%S
full_audit:failure = connect
full_audit:success = mkdir rename unlink rmdir
full_audit:facility = LOCAL5
full_audit:priority = NOTICE

More stuff about CIF/SMB logging:
http://a32.me/2009/10/samba-audit-trail/

I can't help but feel its outdated for v11 though.  I did the first part of the tutorial (to wait to see results before then worrying about log retention) and the results were not there.  Then when simply using the GUI to go to services > logging "normal", then I started to see user activity in var/log/samba4/log.smbd--- I'm not sure if both the tutorial and my last bit both have to be done, or if with v11 all one needs to do is set logging to "normal".

* note, freebsd freenas requires `clog -f` instead of `tail -f`, but in FreeNAS `tail -f` is used...

Never the less, the security auditor nerd in me rejoiced when seeing detailed activity of videos and pdf docs accessed from a linux laptop user.

Next is to get the Splunk FreeNAS TA working, and adding to it's dashboard panels that highlight smb file activity.

--- 4.17.2020 the sega continues ---

Getting data into Splunk:

There is a two-prong approach here- Splunk has an app for FreeNAS but I believe it uses a REST API to gain data, and the data is about the FreeNAS itself such as drive use, temps etc.

Having those logs are nice, but I want the SMB logs as well.  The issue in the earlier post about filling up internal drive space with log data might become a non-issue if the data gets spirited away and FreeNAS overwrites effectively (without having to be told to do so, we will see if some crash on audit fail happens or the data just dries up).

You can setup a syslog output from FreeNAS.  System > General > at the bottom will be a Syslog Server line.  I put my splunk host IP and went with port 9083.  Respectively, put this as a data input in Splunk and ensure the firewall allows 9083 traffice.

Success:

So next is to tell FreeNAS to grab those SMB logs and spirit them away via syslog as well, ontop of the generic general default syslog data (that maybe we want to blacklist later?)

This person's thread is a good start:

https://www.ixsystems.com/community/threads/samba-audit-logs-to-centralise-log-servers.79133/

Read how he/she fixed in a few posts later, and try to implement this.

```destination m_samba_audit { file("/mnt/ie/logs/smb/smb.log"); };
log { source(src); filter(f_local5); destination(m_samba_audit); flags(final); $
destination loghost { udp("192.168.3.42" port(5514) localport(514)); };
log { source(src); filter(f_info); destination(loghost); };```
But the mistake was putting "flags(final);"     Remove that part, and tailor the rest of the lines to match my environment =

"destination m_samba_audit { file("/var/log/samba4/log.smbd"); };

log { source(src); filter(f_local5); destination(m_samba_audit);

Syslog.conf if found in etc/

Looking at syslog.conf (copy below):

# $FreeBSD$
#
#       Spaces ARE valid field separators in this file. However,
#       other *nix-like systems still insist on using tabs as field
#       separators. If you are sharing this file between systems, you
#       may want to use only tabs as field separators here.
#       Consult the syslog.conf(5) manpage.
*.err;kern.warning;auth.notice;mail.crit                /dev/console
*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err   /var/log/messages
security.*                                      /var/log/security
auth.info;authpriv.info                         /var/log/auth.log
mail.info                                       /var/log/maillog
lpr.info                                        /var/log/lpd-errs
ftp.info                                        /var/log/xferlog
cron.*                                          /var/log/cron
!-devd
*.=debug                                        /var/log/debug.log
*.emerg                                         *
# uncomment this to log all writes to /dev/console to /var/log/console.log
# touch /var/log/console.log and chmod it to mode 600 before it will work
#console.info                                   /var/log/console.log
# uncomment this to enable logging of all log messages to /var/log/all.log
# touch /var/log/all.log and chmod it to mode 600 before it will work
#*.*                                             /var/log/all.log
# uncomment this to enable logging to a remote loghost named loghost
#*.*                                            @loghost
# uncomment these if you're running inn
# news.crit                                     /var/log/news/news.crit
# news.err                                      /var/log/news/news.err
# news.notice                                   /var/log/news/news.notice
# Uncomment this if you wish to see messages produced by devd
# !devd
# *.>=notice                                    /var/log/devd.log
!ppp
*.*                                             /var/log/ppp.log
!*
include                                         /etc/syslog.d
include                                         /usr/local/etc/syslog.d

Noticed some commented out lines that look like when uncommented out, allow all logs to go over syslog.

---- Later ----

I noted making changes to etc/syslog.conf (or the cp of the file to syslog.conf.backup) didn't stick.  Turns out FreeNAS has the "real" riles somewhere else, the changes I make are in RAM I guess, it will not be persistent

The path to do so (and really break stuff) is /conf/base/etc
in there will be syslog-ng.conf

Also look up beadm.  Its a way to create a new boot environment.  Or in this case backup the current boot environment before editing stuff.

I input the following:

Now, time to edit /conf/base/etc/local/syslog-ng.conf to look at /var/log/samba4/log.smbd to syslog output.  (backup syslog.ng with cp syslog.ng syslog.ng.backup)

Taken from a forum post, need to change paths and names to match my environment:
"destination m_samba_audit { file("/mnt/ie/logs/smb/smb.log"); };
log { source(src); filter(f_local5); destination(m_samba_audit);

Mine should be more like:

"destination m_samba_audit { file("/var/log/samba4/log.smbd"); };

log { source(src); filter(f_local5); destination(m_samba_audit);

The difference in path is I believe that other poster has the samba logs going into a smb share foler first- then to be take from there to go to syslog. This is probably best practice for storage space and data retention concerns.

Buuuut...

Files in this path are unwritable even to root.  Is there a chmod to fix this?  Or a mount command?

The fix seems a bit heavy handed but the advice given was to upgrade from 11.2-U7 to 11.3-U2.  After the upgrade, the paths above will be writeable.



Manual here (11.7?  I'm on 11.2, is FreeNAS even on 11.7?)  is pretty interesting- has a section on enabling syslog-ng

https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/configtuning-syslog.html

When you enable syslog in the WebUI, it appears it just enables ```syslog_ng_ebable="YES"``` and below that, ```nginx_enable="YES"```

This explains that the only logs into Splunk so far have nginx inside the raw data.

In theory, I need to edit rc.conf found in /conf/base/etc to have syslog-ng enabled, the stanza is
```syslogd_ebable="YES"```.  It is currently at default ```syslogd_enable="NO"```

Then edit the syslog-ng.conf in /conf/base/etc/local to have the direction and log stanzas calling out the samba log.


After the mods just like Linux, ```service syslogd restart```

Also, link on how to send test syslog traffic to check connectivity:
https://www.freebsd.org/cgi/man.cgi?query=logger&sektion=1&manpath=freebsd-release-ports

Default syslog-ng.conf for reference.  What my noob brain takes away is that even though destinations are not commented out, I am not seeing logs from those destinations when syslog is enabled because further down their respective 'log' lines of the path are commented out (though the log specifications below are not, I assume without context as to what destination they apply to it gets skipped over).clea

root@freenas:/conf/base/etc/local # more syslog-ng.conf
@version:3.19
@include "scl.conf"

#
# This sample configuration file is essentially equilivent to the stock
# FreeBSD /etc/syslog.conf file.
#
# $FreeBSD: head/sysutils/syslog-ng/files/syslog-ng.conf.sample 340872 2014-01-24 00:14:07Z mat $
#

#
# options
#
options { chain_hostnames(off); flush_lines(0); threaded(yes); };

#
# sources
#
source src { system();
             udp(); internal(); };

#
# destinations
#
destination messages { file("/var/log/messages"); };
destination security { file("/var/log/security"); };
destination authlog { file("/var/log/auth.log"); };
destination maillog { file("/var/log/maillog"); };
destination lpd-errs { file("/var/log/lpd-errs"); };
destination xferlog { file("/var/log/xferlog"); };
destination cron { file("/var/log/cron"); };
destination debuglog { file("/var/log/debug.log"); };
destination consolelog { file("/var/log/console.log"); };
destination all { file("/var/log/all.log"); };
destination newscrit { file("/var/log/news/news.crit"); };
destination newserr { file("/var/log/news/news.err"); };
destination newsnotice { file("/var/log/news/news.notice"); };
destination slip { file("/var/log/slip.log"); };
destination ppp { file("/var/log/ppp.log"); };
destination console { file("/dev/console"); };
destination allusers { usertty("*"); };
#destination loghost { udp("loghost" port(514)); };

#
# log facility filters
#
filter f_auth { facility(auth); };
filter f_authpriv { facility(authpriv); };
filter f_not_authpriv { not facility(authpriv); };
#filter f_console { facility(console); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_ftp { facility(ftp); };
filter f_kern { facility(kern); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail); };
filter f_news { facility(news); };
filter f_security { facility(security); };
filter f_user { facility(user); };
filter f_uucp { facility(uucp); };
filter f_local0 { facility(local0); };
filter f_local1 { facility(local1); };
filter f_local2 { facility(local2); };
filter f_local3 { facility(local3); };
filter f_local4 { facility(local4); };
filter f_local5 { facility(local5); };
filter f_local6 { facility(local6); };
filter f_local7 { facility(local7); };

#
# log level filters
#
filter f_emerg { level(emerg); };
filter f_alert { level(alert..emerg); };
filter f_crit { level(crit..emerg); };
filter f_err { level(err..emerg); };
filter f_warning { level(warning..emerg); };
filter f_notice { level(notice..emerg); };
filter f_info { level(info..emerg); };
filter f_debug { level(debug..emerg); };
filter f_is_debug { level(debug); };

#
# program filters
#
filter f_ppp { program("ppp"); };
filter f_slip { program("startslip"); };

#
# *.err;kern.warning;auth.notice;mail.crit              /dev/console
#
log { source(src); filter(f_err); destination(console); };
log { source(src); filter(f_kern); filter(f_warning); destination(console); };
log { source(src); filter(f_auth); filter(f_notice); destination(console); };
log { source(src); filter(f_mail); filter(f_crit); destination(console); };

#
# *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages
#
log { source(src); filter(f_notice); filter(f_not_authpriv); destination(messages); };
log { source(src); filter(f_kern); filter(f_debug); destination(messages); };
log { source(src); filter(f_lpr); filter(f_info); destination(messages); };
log { source(src); filter(f_mail); filter(f_crit); destination(messages); };
log { source(src); filter(f_news); filter(f_err); destination(messages); };

#
# security.*                                            /var/log/security
#
log { source(src); filter(f_security); destination(security); };

#
# auth.info;authpriv.info                               /var/log/auth.log
log { source(src); filter(f_auth); filter(f_info); destination(authlog); };
log { source(src); filter(f_authpriv); filter(f_info); destination(authlog); };

#
# mail.info                                             /var/log/maillog
#
log { source(src); filter(f_mail); filter(f_info); destination(maillog); };

#
# lpr.info                                              /var/log/lpd-errs
#
log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); };

#
# ftp.info                                              /var/log/xferlog
#
log { source(src); filter(f_ftp); filter(f_info); destination(xferlog); };

#
# cron.*                                                /var/log/cron
#
log { source(src); filter(f_cron); destination(cron); };

#
# *.=debug                                              /var/log/debug.log
#
log { source(src); filter(f_is_debug); destination(debuglog); };

#
# *.emerg                                               *
#
log { source(src); filter(f_emerg); destination(allusers); };

#
# uncomment this to log all writes to /dev/console to /var/log/console.log
# console.info                                          /var/log/console.log
#
#log { source(src); filter(f_console); filter(f_info); destination(consolelog); };

#
# uncomment this to enable logging of all log messages to /var/log/all.log
# touch /var/log/all.log and chmod it to mode 600 before it will work
# *.*                                                   /var/log/all.log
#
#log { source(src); destination(all); };

#
# uncomment this to enable logging to a remote loghost named loghost
# *.*                                                   @loghost
#
#log { source(src); destination(loghost); };

#
# uncomment these if you're running inn
# news.crit                                             /var/log/news/news.crit
# news.err                                              /var/log/news/news.err
# news.notice                                           /var/log/news/news.notice
#
#log { source(src); filter(f_news); filter(f_crit); destination(newscrit); };
#log { source(src); filter(f_news); filter(f_err); destination(newserr); };
#log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); };

#
# !startslip
# *.*                                                   /var/log/slip.log
#
log { source(src); filter(f_slip); destination(slip); };

#
# !ppp
# *.*                                                   /var/log/ppp.log
#
log { source(src); filter(f_ppp); destination(ppp); };