Category: Mac

I host a bunch of Internet services. Some, like this site, are for public use but most are intended for personal use. And since I want to keep them personal, security is important.

Most Internet applications can be secured by SSL certificates. This includes HTTPS access for web sites, IMAPS instead of IMAP, encrypted access to subversion repositories. The list goes on.

For a number of years I have been creating my own certificates with the help of OpenSSL. Much can be said about OpenSSL but it is not exactly point-and-click. I created a few scripts to assist me but still I found myself looking through the documentation whenever I needed to create a new certificate or renew an existing one.

To solve this I have now created the attached Bash script to wrap OpenSSL to be able to set up a two-level certificate hierarchy. The result is a menu-driven text based application that will no doubt save me time in the future. Perhaps it can help you too.

I use this to create certificates to be used by Apache, Subversion, Postfix, Dovecot, Microsoft IIS, Microsoft Exchange and a few others.

There are some limitations to this. The hierarchy will be two levels deep, not more and not less. In other words you will get a root certificate authority and one or more subordinate certificate authorities. User certificates will be signed by one of the subordinate CAs. Also, while it supports subject alternative names it only does so for DNS names (I only needed that for Exchange 2007 support). For real-world certificate authorities the certificate signing requests (CRSs) are created outside the certificate authority. Since I will be handling everything myself I have set it up so that CSRs are created inside this application. For that reason it is imperative to keep access to the CA folder structure secure so that the private keys are not compromised.

To use this script just download and extract the attached file. Inside the folder which will be created there will be two files. The file ‘ca’ is the Bash script and the other is a template configuration file. Run the script from within the folder. Certificates will be available in the folder ‘all’ and backups of the certificate hierarchy will be placed in the folder ‘backup’. For more help, please comment.

The script has been verified on Ubuntu 9.04 and Mac OS X 10.5. I don’t think there are any dependencies that aren’t already met by standard OS installations.

Download: ca_v1.tar.gz

The -f switch to the tail command is a great help when it comes to keeping track of what is going on in some log file. But sometimes you just can’t keep your eyes on the output to see if something is happening. At those times it would help to have some other indication that there is activity. The following small Perl script emits a beep whenever there is a line of data being output.

#!/usr/bin/perl
while(<>) 
{
	print "\007" . $_;
}

Just tack the script somewhere in your path. Then, whenever you want some audio feedback just pipe the output to the Perl script (i.e. {some command} | beeper.pl).

I borrowed a brand new Netgear WNDR3300 from a colleague the other day. I quickly powered it up and accessed the internal configuration web page only to be met by the automatic update function which I hadn’t seen in previous Netgear wireless routers. Before I knew it I had mistakenly aborted the update and the router was more or less dead. The power LED just kept blinking, the router replied to ping but the configuration web page was nowhere to be seen.

I managed to solve the issue by downloading the firmware file from the Netgear site. It is a 3MB file with a .chk file extension.

I then uploaded the firmware using TFTP. The following step-by-step guide is from my Mac but should work on Linux. Start by connecting the wireless router to the computer but don’t power it up. Then open a terminal and type:

tftp 192.168.1.1
binary
rexmt 1
timeout 60
trace
put WNDR3300_V1.0.29_1.0.29NA.chk

Directly after the last line you should then power up the WNDR3300 and wait. Hopefully it will pick up the firmware file from the TFTP client. Once the file has been transferred it will take a few minutes while the router flashes its memory with the new firmware. This is normal. Just wait and hopefully you will have your wireless router back.