Archive

Archive for the ‘how-to’ Category

Simple XSLT ifnull for numbers

June 19th, 2014 No comments

Answer to question how to display zero instead of NaN in XSLT for non existing node containing number values (kind of ifnull or coallesce functions that are available in SQL).

You can do it by standard expressive XSLT way, with using variable and <xsl:choose>, or abuse built-in sum() function and do whole thing in one line.

Standard way:

<!– read the value –>
<xsl:variable name=”val”>
<xsl:choose>
<xsl:when test=”//number[1]“><xsl:value-of select=”//number[1]“/></xsl:when>
<xsl:otherwise>0</xsl:otherwise>
</xsl:choose>
</xsl:variable>
<!– print the value out –>
<xsl:value-of select=”$val“/>

 

Quick way:

<!– read and printout –>
<xsl:value-of select=”sum(//number[1])“/>

 

Both codes will print value of first node named number or zero if the node is not present.  Because it is a sum() function, it’s a good idea to limit nodeset only to first one, otherwise you will get a sum of all existing number nodes.

Btw. do you know the best XSLT reference out there ? No ? Look at ZVON XSLT reference.

 

Categories: how-to, time saver, xsl Tags:

Disable Windows 7 hotkeys

March 17th, 2014 No comments

This little script disables Windows 7 hotkeys if you have no local admin rights and registry editor (regedit) is also disabled.  Simply save it as hkey.vbs and execute.

Option Explicit
'Declare variables
Dim WSHShell, rr, MyBox, val, ttl
Dim jobfunc, itemtype
On Error Resume Next
Set WSHShell = WScript.CreateObject("WScript.Shell")
val = "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DisabledHotkeys"
itemtype = "REG_EXPAND_SZ"
ttl = "Result"
jobfunc = "Value: "
'write the registry key value.
WSHShell.RegWrite val, "1234567890", itemtype
rr = WSHShell.RegRead(val)
MyBox = MsgBox(jobfunc & rr, 4096, ttl)

This example disabled WIN+0 – WIN+9 keys. To disable other keys simply modify second RegWrite parameter.
For more technical info on windows hotkey codes see http://www.geoffchappell.com/notes/windows/shell/explorer/globalhotkeys.htm

Categories: how-to Tags:

windows – exporting non-exportable private key

April 5th, 2012 No comments

If you are trying to export windows certificate with private key, and windows export wizard provides no such possibility (export with private key is grayed out) because private key has been install as non-exportable (what is the default when importing, what almost nobody changes), there is a great tool mimikatz that makes this possible.

Download it from http://blog.gentilkiwi.com/mimikatz.

And follow this procedure:

  1. crypto::patchcapi (or crypto::patchcng if previous did not work)
  2. crypto::listKeys (or crypto::listCertificates) to list keys/certificates
  3. crypto::exportKeys (or crypto::exportCertificates) to export what you want

That’s all. Exported keys will be protected with password ‘mimikatz‘ – you will need to enter it when importing certificate again.

 

Categories: admin, how-to, security, time saver Tags:

solution: subversion not working under redmine

July 5th, 2011 No comments

If you have problem to use subversion under redmine, but svn command itself works ok, the problem might be in incorrect home directory configured for user which is running redmine (can be apache user, fcgi user id…etc). Incorrect here means home directory points to a file instead of directory (ie. /dev/null) . One can reproduce this with setting HOME to point to file.

Example:

$ HOME=/dev/null svn --version
svn: Can't open file '/dev/null/.subversion/servers': Not a directory
$ HOME=/dev/null svn --version --quiet
svn: Can't open file '/dev/null/.subversion/servers': Not a directory

Solution is pretty simple, just change user home directory configuration (via usermod) or set somehow $HOME variable of the redmine execution environment to point to some directory (ie. HOME=/var/empty).

This misbehavior has been reported as subversion defect.

Categories: admin, how-to, time saver Tags:

Secure remote access to subversion repository

December 3rd, 2009 No comments

I was dealing with problem how to remotely access subversion server in secure way. There are (as far i know) two basic ways to do this and I was not satisfied with neither of them, due to some security and hard-to-setup-or-maintain problems. So I have created my own way how to remotely access subversion repository in secure and easy way.

First, I’ll try to describe existing ways to do this and what problems they have. I’m not mentioning use of svnserve listening on widely open Internet port, because this is so insecure that I’m not going to talk about it.

Apache DAV Subversion module

Pros:

  • You can use Apache modules  for user authentication (ie. via LDAP)
  • Use PKI certificates to secure network communication channel
  • Access rights managed by subversion configuration (svnserve.conf)

Cons:

  • Apache ? What is it some dummy alternative to nginx or lighttpd ?
  • You have to use Apache and its modules – this means one more layer with possible security problems and bugs (proper use PKI certificates will prevent most of this problems, but not all of them)
  • iI you run single instance of Apache, it will have read-write permission to your subversion repositorories, so will all possibly buggy web apps running under Apache – thats huge security problem – one bug in your web CMS can give attacker full access to all your repositories – thats nothing I’m dreaming off
  • Of course, you can run second instance of Apache to prevent previously mentioned problems, but this is second instance of Apache you have to take care of, configure it, maintain it and another point of possibly security problems.

So this points me to decision not to use Apache as server for SVN repositories (and also, I don’t want Apache on my system).

Subversion in tunnel mode (ie. ssh)

Pros:

  • You have to setup almost nothing, works out of the box (the tunnel, repository access rights needs a little work)
  • Secured by ssh

Cons:

  • All repository users must have access rights to repository (ie. single group with group read-write access on repository files)
  • Multiple repositories, means you should have separate group for each and manage access rights by adding/removing users from groups
  • Must setup users umask and possibly run svnserve with setgid set to have consistent filesystem rights
  • Again, each user needs read-write access to whole repository – this means each user can copy your whole repository, modify or even delete it – very secure ;-)
  • Users must have system account (either local or ldap based, for ldap you have to carrefully limit which ldap users to import to system and what they can do (ie. only 10 from 1000 of employees work with svn)
  • Each user should have shell access to system (but ok, i think it is posible to limit shell access only to use svnserve, but who does it ?)

Again nothing to think about, too many possible problems for me, I don’t trust my users and no one should! So I’ve created simple solution that I think solves most (maybe all) mentioned problems previous solutions have.

Subversion in tunnel mode via svnserve

It is important that this mode works exactly the same way as standard subversion tunnel mode works, there is nothing to hack on client side and client doesn’t even notices that it is not using standard tunnel mode – there is only one exception, subversion client will not cache users repository password. It’s a bit disturbing and uncomfortable but it gives you a bit more security, so right now I think it is another positive side effect of this solution.

How it works:

  1. setup svnserve as usual (with all user accounts ans security permissions), under special user account (without shell access) on top of some repository, listening on some port on localhost (ie. 3690)
  2. setup another account for ssh access with shell pointing to our tunnel script (see bellow).
  3. for this account you can setup ssh key or certificate of anything your ssh allows you – this ssh can be distributed to svn users – I think you can event make it avaible on some internal site from where everyone can download it, because ssh is here used only for securing communication channel and not for authentication and authorization – this will do svnserve itself
  4. and thats all. You can integrate subversion server with your LDAP Directory Server using eldap SASL extension, to make user management easier.
  5. users can now access repository as usual using  svn+ssh://<server>/<directory> URL

Sample tunnel script:

#!/bin/bash -l
exec /bin/nc -q 1 -w 3 localhost 3690

For multiple repositories you should setup multiple subversion servers and have multiple access accounts, and modify tunnel script accordingly.

Pros:

  • works out of the box and very easy to setup, easier than two previously mentioned usage scenarios)
  • repository access fully managed by svnserve
  • all things configured on place – svnserve.conf, here you can limit user access to certain repository tries and so on
  • access secured by ssh (imho, very good piece of software)
  • command line svn (and possibly also other clients) doesn’t caches users passwords

Cons:

  • command line svn doesn’t caches users passwords
  • maybe compared to HTTP access to subversion, problems on some LANs where only HTTP/HTTPS port is allowed to use. But this problem has also standard subversion tunnel mode and this can be bypassed by use of OpenVPN, which will be surely helpful also for other purposes.
Categories: admin, cm, how-to Tags: