To Compile ndiswrapper 1.58rc1 for Linux 3.5.4

ndiswrapper allows Linux users to use Windows drivers for PCI/USB network adapters on Linux. If you own a network device for which Linux support is still absent or premature, then you need to compile ndiswrapper yourself and install Windows driver for your network device. Fortunately, today's Linux supports most network devices out-of-box, so most distributions don't bother to include ndiswrapper. However, I am compiling ndiswrapper believing that Windows NDIS drivers would outperform native Linux drivers.

To my surprise, building the latest version of ndiswrapper (1.58rc1) did not require any patch. After compiling Linux 3.5.4, I downloaded the ndiswrapper source from the sourceforge site. I chose the testing version because I thought it would work better with Linux 3.5.x. I unpacked the source.

tar xzvf ndiswrapper-1.58rc1.tar.gz
cd ndiswrapper-1.58rc1

I typed the following commands to compile and install ndiswrapper.

KVERS=3.5.4 make uninstall
KVERS=3.5.4 make
KVERS=3.5.4 make install

Then, I generated modules.* files again.

depmod -e -m -F /boot/System.map-3.5.4 3.5.4

The following files were installed by ndiswrapper.

/lib/modules/3.5.4/misc/ndiswrapper.ko
/sbin/loadndisdriver
/usr/sbin/ndiswrapper
/usr/sbin/ndiswrapper-buginfo
/usr/share/man/man8/loadndisdriver.8
/usr/share/man/man8/ndiswrapper.8

Also read:

• Linux: Installing Windows Vista/7 Wireless Driver for use with ndiswrapper
  
• Linux: To Compile wpa_supplicant on Debian 3.1 Sarge
  

Build OpenSSL with MinGW

OpenSSL is an open-source library that provides cryptographic and network security functions. It is used by so many open-source software that require SSL/TLS support. To build OpenSSL for Windows, first install MinGW. There are two flavors of MinGW: mingw and mingw64. Just pick one of the following and set it up accordingly:

• Installing MinGW on Windows
  
• Setting up MinGW64 with Cygwin
  

Then, download the latest source tarball from the OpenSSL website and unpack it with 7-zip. 7-zip should be used because MinGW/MSYS tar has trouble with tarballs containing symlinks. However, cygwin has no problem with tarballs containing symlinks.

OpenSSL optionally incorporates the following libraries when found.

• zlib
  
• pthreads-win32
  

Assuming that you compiled both zlib and pthread as shown in the above links, configure OpenSSL like this.

./Configure -DHAVE_STRUCT_TIMESPEC -DPTW32_STATIC_LIB -L/mingw/lib -lz -lpthreadGC2 -lws2_32 --prefix=/mingw threads zlib mingw

Then, run make.

make

If you run into errors compiling some test codes, just copy dummytest.c over. However, it doesn't happen under Cygwin.

cp -iv test/dummytest.c test/md2test.c
cp -iv test/dummytest.c test/rc5test.c
cp -iv test/dummytest.c test/jpaketest.c

Then, install OpenSSL.

make install

ssh + netcat + tar + xz = Secure Network Transfer Link

I found a way to use simple command-line tools to transfer files between computers far apart. Using this method, I was able to duplicate the contents of an entire filesystem securely over a SSH tunnel between two computers. In this method, no NFS server or scp command is needed. However, netcat plays an important role in this method. Let's first make sure we have everything ready.

• OpenSSH
  
• netcat
  
• tar or cpio
  
• xz, lzma, lzo, bzip2 or gzip

I'll be really brief.

1. At the computer where you will receive files (say, 192.168.1.2), type the following commands to start netcat in listening mode and use tar + xz to unpack the incoming stream of data.

   
   
   

   cd /my/downdoad/folder
   nc -l 7749 | xz -dc | tar xvf -

   
   
   

2. At the computer where you will send files (say, 192.168.1.1), create a ssh tunnel to the computer receiving files (192.168.1.2).

   
   
   

   ssh -l username -L 5525:192.168.1.2:7749 192.168.1.2

   
   
   
3. Open another terminal window and type the following command to start sending files.
   
   
   

   tar cvf - . | xz -c | nc 127.0.0.1 5525

Partition Imaging with Netcat

Backing up hard drive partitions over the network can be accomplished with just a few simple tools like netcat. This is another handy usage of netcat. At the receiving computer where you'll store the backup, type the command to receive the partition image:

nc -l 7749 | lzma -dc | dd of=/dev/sda8 bs=640K

At the sending computer from which you'll transmit the partition, establish an SSH link first:

ssh -l username -L 5525:192.168.1.2:7749 192.168.1.2

Then compress the partition data and transmit over the secure SSH channel:

dd if=/dev/sda11 bs=640K | lzma -9c | nc 127.0.0.1 5525

Note that the transfer may take many hours for a large partition.

Linux: To Compile wpa_supplicant on Debian 3.1 Sarge

I was using good old Debian Linux 3.1 Sarge when I found out Sarge's wpasupplicant couldn't work well with ndiswrapper-supported Windows network drivers. So I set out to compile wpa_supplicant on my own. First, I installed the following development packages.

• gcc-3.4
  
• libssl0.9.7
  
• make
  

Then, I downloaded the wpa_supplicant source (wpa_supplicant-0.6.9.tar.gz) from http://hostap.epitest.fi/wpa_supplicant. I unpacked the source and read the README files.

tar xzvf wpa_supplicant-0.6.9.tar.gz
cd wpa_supplicant-0.6.9/wpa_supplicant

I went into the wpa_supplicant subfolder and created .config to customize my build. The following is the contents of my .config:

CONFIG_WIRELESS_EXTENSION=y
CONFIG_DRIVER_HOSTAP=y
CONFIG_DRIVER_ATMEL=y
CONFIG_DRIVER_WEXT=y
CONFIG_DRIVER_RALINK=y
CONFIG_DRIVER_NDISWRAPPER=y
CONFIG_DRIVER_IPW=y
CONFIG_IEEE8021X_EAPOL=y
CONFIG_EAP_MD5=y
CONFIG_EAP_MSCHAPV2=y
CONFIG_EAP_TLS=y
CONFIG_EAP_PEAP=y
CONFIG_EAP_TTLS=y
CONFIG_EAP_GTC=y
CONFIG_EAP_OTP=y
CONFIG_EAP_SIM=y
CONFIG_EAP_AKA=y
CONFIG_EAP_PSK=y
CONFIG_EAP_SAKE=y
CONFIG_EAP_GPSK=y
CONFIG_EAP_PAX=y
CONFIG_EAP_LEAP=y
CONFIG_EAP_IKEV2=y
CONFIG_EAP=y
CONFIG_WPS=y

Then, I began compilation by running make.

make

The compilation was successful. I installed wpa_supplicant with the following command.

make install

The following files are copied to the system.

/usr/local/sbin/wpa_supplicant
/usr/local/sbin/wpa_passphrase
/usr/local/sbin/wpa_cli

Ethernet File Transfer between Windows XP and Windows Vista

I found it hard to set up file transfer between Windows XP and Windows Vista using direct Ethernet connection. Sometimes, Windows Vista can see a Windows XP machine, but Windows XP somehow can't see a Windows Vista machine. I connected a PC running Windows XP and a PC running Windows Vista with a Ethernet crossover cable.

Setting Up Windows XP for direct Ethernet connection

1. Make sure that the following items are enabled in the Local Area Connection Properties dialog.
   
   
   • Client for Microsoft Networks
     
   • File and Printer Sharing for Microsoft Networks
     
   • Internet Protocol (TCP/IP)
   
   
   

   You can open the Local Area Connection Properties dialog by opening Control Panel, Choosing Network and Internet Connections category, clicking Network Connections icon, right-clicking the icon for your Ethernet connection and choosing Properties from the right-click menu.

   
   
2. Select Internet Protocol (TCP/IP) and click Properties. Internet Protocol (TCP/IP) Properties dialog will show up. Click Use the following IP address and specify IP address and subnet mask. Then, click OK to close the Internet Protocol Properties dialog.
   
   
   
3. Open the Advanced tab and click the Settings button in Windows Firewall area.
   
   
   
4. Windows Firewall window will show up. Open the Exceptions tab and make sure that File and Printer Sharing is enabled. Click OK to close Windows Firewall window. Then, click the Close button in the Local Area Network Properties window.
   
5. Now connect the PC running Windows XP to a PC running Windows Vista with a Ethernet crossover cable.
   
6. In the Network Connections window, click and select the icon for your Ethernet connection. In the left pane of the Network Connections window, click Set up a home or small office network. Keep clicking the Next button until you reach the Select a connection method step. Choose Other. Then choose "This computer belongs to a network that does not have an Internet connection" and click Next.
   
7. Make sure that your Computer name is unique. Click Next.
   
8. Type a Workgroup name that will be shared with a PC running Windows Vista. Click Next.
   
9. Turn on the file and printer sharing. Click Next.
   
10. Review your network settings and click Next.
    
11. Select "Just finish the wizard." Click the Finish button to close the wizard.
    

Setting Up Windows Vista for direct Ethernet Connection

1. Open the Control Panel. Under the Network and Internet category, select View network status and tasks. In the left pane, click Manage network connections. Right-click the icon for your Ethernet connection and choose Properties.
   
2. In the Local Area Connection Properties dialog, make sure the following items are enabled.
   
   • Client for Microsoft Networks
     
   • File and Printer Sharing for Microsoft Networks
     
   • Internet Protocol Version 4 (TCP/IPv4)
     
   • Link-Layer Topology Discovery Responder
     
   • Link-Layer Topology Discovery Mapper I/O Driver
     
   
   
3. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties. Click Use the following IP address and enter unique values for IP address and Subnet mask.
   
   
   
4. Go back to the Network and Sharing Center. Unidentified network will be shown. Click Customize and choose Private.
   
5. In the Sharing and Discovery area, make sure that you have the following settings.
   
   
   • Network discovery: On
     
     Expand the Network discovery section and verify that the workgroup is the same as with Windows XP.
     
   • File Sharing: On
     
   • Public folder sharing: On
     
     Expand this section and enable Turn on sharing so anyone with network access can open, change, and create files
     
   • Printer sharing: On or Off
     
   • Password protected sharing: Off
     
     To avoid unnecessary problems, check it off.
     
   • Media sharing: On
     
   
   

Linux: Atheros AR9285 Driver for Toshiba NB205

My Toshiba netbook NB205 was pre-installed with Windows XP. After extensive manipulation of partitions, the original Windows XP installation was gone. I booted my old Linux from a USB thumb drive but couldn't go online for lack of a Linux driver for the built-in Atheros AR9285 wireless card. So I looked for the AR9285 Windows driver because my Linux kernel has ndiswrapper support. I found a working driver (x600_wlan785_x_nb.zip) at the MSI support site.

• x600_wlan785_x_nb.zip
  
• x600_wlan785_x_nb.zip

After I downloaded x600_wlan785_x_nb.zip, I unzipped it. A new directory XP_7.7.0.348_20090701 is created.

unzip x600_wlan785_x_nb.zip

There you'll find two drivers, athw.sys and athwx.sys. Go to the ndis5x directory.

cd XP_7.7.0.348_20090701/ndis5x/

Install the Windows driver to be used with ndiswrapper.

ndiswrapper -i netathw.inf

The ndiswrapper tool will copy the Windows driver to a folder in /etc/ndiswrapper. To check your ndiswrapper installation, run the following command:

ndiswrapper -l

If you haven't, load the ndiswrapper kernel module.

modprobe ndiswrapper

Then, use your favorite Wireless configuration tool to connect to your wireless network.

Linux: Installing Windows Vista/7 Wireless Driver for use with ndiswrapper

I booted Linux on my Toshiba Mini NB205 netbook. My Linux system is installed on a USB memory stick and I boot it by plugging it in and using GRUB to load the Linux kernel and a custom initrd image. My Linux system doesn't have network connection yet because it doesn't have the driver for Atheros AR9285 wireless LAN adapter. It can't start X Windows either because I haven't installed the X.org driver package for Intel chipsets yet. Once I set up my wireless connection, I'll update my system, install the Intel video driver, and then set up X Windows.

I tried to install the Windows driver for my Atheros Wireless LAN card which will be loaded by ndiswrapper. First, I had to mount the NTFS partition which is hosting my Windows 7 system.

fdisk -l /dev/sda
mount -t ntfs-3g /dev/sda1 /mnt

I changed my working directory to DriverStore/FileRepository.

cd /mnt/Windows/System32/DriverStore/FileReposity

I tried to find the Vendor ID and Device ID of my wireless LAN card by reading the output of lspci -nn.

lspci -nn

The command above gave me the following output.

03:00.0 Network Controller [0280]: Atheros Communications Inc. AR9285 Wireless Network Adapter (PCI-Express) [168c:002b]

In order to make it easy to find the driver for my wireless LAN card, I created a script file /usr/local/bin/findmydrv.sh with the following contents:

#!/bin/sh
FILETYPE=`file $1`
case "$FILETYPE" in
    *UTF-16*)
        iconv -f utf16 -t utf8 $1 | \
        grep -i $2 | \
        grep -iq $3 && \
        echo "Found the driver for your device $2:$3 in $1"
        ;;
    *)
        grep -i $2 $1 | \
        grep -iq $3 && \
        echo "Found the driver for your device $2:$3 in $1"
        ;;
esac

Then, I used the following command.

find -type f -iname \*.inf -exec findmydrv.sh \{\} 168c 002b \;

The previous command will show the location of the .INF file that contains the driver setup information. Once I found the folder that contains the Atheros driver, I went there and installed the driver.

cd netathr.inf_x86_neutral_*
ls -l
ndiswrapper -i netathr.inf

I checked whether the driver was successfully installed by running:

ndiswrapper -l

This displayed the following.

netathr : driver installed
        device (168C:002B) present

I tried the newly installed Windows driver.

modprobe ndiswrapper

Related Posts

• Linux: Atheros AR9285 Driver for Toshiba NB205
  
• MSI Driver for Atheros wireless chips: x600_wlan785_x_nb.zip
  

Vista: Sharing Wireless Internet Connection with Ad-Hoc Network

Wireless networks are so common today. Yet, one shortcoming of wireless networks is that sometimes the signal from the access point (a.k.a wireless router) cannot reach all your computers due to various reasons, such as a physical obstacle or interfering signals. In such cases, we can set up a computer in reach of the access point to act as a gateway to out-of-reach computers in an ad-hoc wireless network. Then, Internet Connection Sharing feature of Windows Vista will be used to extend your wireless network. Let's assume we have computer A within the range of a wireless router, therefore can access the Internet. Also, we have computer B that's near computer A but too far from the wireless router.

To help computer B access the Internet, we need 2 wireless adapters for computer A and one for computer B. Now, set up computer A to access the Internet via wireless router as usual.

At the same time, with the extra wireless adapters, set up an ad-hoc wireless network between computer A and computer B. To do so, select Set up a connection or network in the left side of the Network and Sharing Center (See the picture above). This brings up the following window. Select Set up a wireless ad-hoc (computer-to-computer) network and click Next.

Choose the secondary wireless network connection of Computer A that will be used to communicate with computer B.

Set up a wireless ad-hoc network in the next windows.

Don't choose Turn on Internet connection sharing yet.

After you set up a wireless ad-hoc network, bring up the Network Connections window.

Right-click the primary wireless network connection and choose Properties. In the Sharing tab, enable Internet Connection Sharing as follows:

Now, go to computer B and connect to the ad-hoc network you just created. In most cases, you'll be able to access the Internet. If not, bring up the Network Connections, right-click the Wireless Network Connection and select Properties in the right-click menu.

In the Network Properties window, select Internet Protocol Version 4 (TCP/IPv4) and click Properties.

In case computer B still can't access the Internet, manually set up its connection like this:

Building GnuTLS 2.10.5 for Win32

GnuTLS is a library providing network security and used by many open-source software. I am compiling GnuTLS for Windows in order to port open-source software from Linux. GnuTLS depends on the following libraries:

• zlib


• libgpg-error


• libgcrypt


• libtasn1

The following commands are meant to be typed in a MSYS terminal. If you don’t understand what MSYS is, follow the instruction in this post to install MinGW first. Then, open a MSYS terminal from the desktop or Start menu.

1. Zlib

   
   

   Although zlib is optional for GnuTLS, you can compile zlib as in this post.

   
   
   

2. libgpg-error 1.10

   
   

   Compile libgpg-error:

   
   

   ./configure --prefix=/mingw --enable-static
   make
   make install





3. libgcrypt 1.5.0

   
   

   Compile libgcrypt:

   
   

   ./configure --prefix=/mingw --enable-static
   make
   make install

   
   
   

4. libtasn1 2.13

   
   

   Compile libtasn1:

   
   

   ./configure --prefix=/mingw
   make
   make install

   
   
   

5. GnuTLS 2.10.5

   
   

   Build GNUtls:

   
   

   ./configure --prefix=/mingw --disable-guile --enable-static
   make
   make install

   
   

Building GnuTLS 3.0.22

1. zlib

   
   

   First, compile zlib as shown in this post.
   
   

2. GMP

   
   

   Download the pre-compiled GMP library from MinGW and install it.

   
   
   

3. Nettle

   
   

   Then, compile nettle:

   
   

   ./configure --prefix=/mingw && make && make install

   
   
   

4. libtasn1

   
   

   Compile libtasn1:

   
   

   ./configure --prefix=/mingw
   make
   make install

   
   
   

5. gnutls 3.0.20

   
   

   Then, build gnutls:

   
   

   ./configure --prefix=/mingw --enable-static -enable-threads=win32 --disable-guile --disable-nls
   make
   make install

   
   

VNC4 vs TightVNC

A frequent question people have when setting up and using VNC is what differences are there between VNC4 and TightVNC. These differences are summarized in the table below.

	VNC4	TightVNC
Developer	RealVNC Limited	TightVNC.com
License	Only free edition is open-source	Open-source
Platfrom	Windows, Linux	Windows, Linux
Installed Size	4648 KB	1432 KB
Linux Dependencies	libsm6, libstdc++6, libxext6, zlib1g	libxext6, libjpeg62, zlib1g
Supported Encodings	ZRLE, Hextile, Raw	copyrect, tight, hextile, zlib, corre, rre, raw
Inetd supported mode	Wait, Nowait	Nowait
Shared Sessions from Inetd	Shared, Non-shared	Non-shared

Manually Starting a VNC Server

Manually starting a VNC server is necessary for testing VNC. Once you got VNC to work correctly, you can copy the command line to a script or inetd.conf. First, I created an executable script ~/.vnc/xstartup with the following contents:

#!/bin/sh

exec /etc/X11/Xsession

This file has to be made executable, of course. Prior to starting vnc4server, make sure your X session can start normally by checking your ~/.xsession file. My .xsession file looks like this:

#!/bin/sh

exec openbox

Then, I started vnc4server:

vnc4server -geometry 800x600 -depth 16 -name VNC4

The first time you run vnc4server, it will ask you for the password. Create a password that only you can guess and memorize it. Next, I installed TightVNC U3 package on my Sandisk U3 flash. I went over to another PC running Windows and plugged in my USB flash. The U3 menu popped up and I clicked on the TightVNC icon. Then, I specified the address of my Linux box running vnc4server:

192.168.1.234:1 or

192.168.1.234::5901

After I was done with vnc session, I killed the vnc4server with the following command:

vnc4server -kill :1

When vnc sessions don't seem working, check the log file: ~/.vnc/*.log

Related Posts

• Remote Desktop Session with VNC4Server & TightVNC
  
• Connecting to a VNC Server through a SSH Tunnel
  

Connecting to a VNC Server through a SSH Tunnel

For security and privacy, VNC connection should be done through a SSH tunnel. Here, I am using Putty to set up a SSH Tunnel. First, type in the host name:

Next, type in the user name:

Check the following options. Also, move Blowfish up for speed:

Set up a SSH tunnel. The Source port will be the local port through which the VNC viewer will connect. The destination port is the remote port whereby the VNC server listens. Click Add button:

Save the Putty session.

Now that you set up a SSH tunnel, you can use a VNC viewer like TightVNC to connect through the SSH tunnel to the remote VNC server. For example, specify localhost::5900 as the server host to TightVNC.

Related Posts

• Remote Desktop Session with VNC4Server & TightVNC
  
• Manually Starting a VNC Server
  

Remote Desktop Session with VNC4Server & TightVNC

We are in a computing era in which we run applications from a remote computer or server. There are many ways for us to have remote desktop sessions. RDP, NX and VNC all are protocols designed to implement remote desktops. Of those, VNC is the most used and supported. This post is about many ways of setting up and using VNC in Linux and Windows. Below I explain how I set up a VNC remote session between my Linux box and a TightVNC viewer running on a Windows PC.

Setting up Inetd to start VNC on Incoming Connections

First, I installed vnc4server on my Debian Linux box. Alternatively, I could install tightvncserver instead. TightVNC is lighter than vnc4server. Anyway, to have inetd automatically start a VNC server on incoming connections, I added the following line to my /etc/inetd.conf file. This is all one line:

5995 stream tcp,rcvbuf=64k,sndbuf=256k wait nobody:nogroup /usr/bin/Xvnc Xvnc -inetd -query localhost -once -geometry 960x600 -depth 16 -AlwaysShared -rfbauth /etc/vnc/passwd -desktop myOffice -dpi 96 -fp /usr/share/fonts/X11/Type1 -co /etc/X11/rgb

For tightvncserver, the inetd.conf line would look slightly different because tightvncserver panics when wait is used instead of nowait. This means that tightvncserver sessions can never be shared when started from inetd:

5960 stream tcp,rcvbuf=64k,sndbuf=256k nowait nobody:nogroup /usr/bin/Xvnc Xvnc -inetd -query localhost -once -geometry 960x600 -depth 16 -desktop myOffice -dpi 96 -fp /usr/share/fonts/X11/Type1 -co /etc/X11/rgb

Typical port values are in the range from 5900 to 5999. Make sure everything in the following checklist is OK for VNC to work:

• A display manager, such as gdm, kdm, xdm or wdm, must be running and set up to accept XDMCP requests. Read the sections below about setting up XDMCP for VNC sessions.
  
• A VNC password must be created and stored in the readable file /etc/vnc/passwd. To create it, run:
  
  

  vncpasswd
  
  mkdir /etc/vnc
  
  mv ~/.vnc/passwd /etc/vnc
  
  chmod 644 /etc/vnc/passwd

  
  
• At least, fixed and cursor fonts must be present in the default font paths. If not, specify the font paths with -fp parameter.
  

Tell inetd to reload settings in /etc/inetd.conf with the following command:

kill -1 $(pidof inetd)

Setting up GDM to handle VNC logins

It is rather simple to make GDM accept XDMCP requests from a VNC server. Open the file /etc/gdm/gdm.conf and add the following lines in the [XDMCP] section:

[xdmcp]

Enable=true

Port=177

DisplaysPerHost=8

The lines above enable GDM to accept logins at UDP port 177. Also, GDM is set up to accept up to 8 users from localhost. Otherwise, GDM may refuse remote logins through SSH tunnel when there are already a couple of users logged in at localhost.

For security, it is recommended to add the following line to /etc/hosts.deny:

gdm: ALL

Then, add the following line to /etc/hosts.allow:

gdm: 127.0.0.1

Setting up XDM for use with VNC

XDM is lighter than gdm or kdm, so XDM is ideal for VNC sessions where network bandwidth and CPU resource are precious. In fact, XDM can coexist with gdm or kdm. In Debian, set HEED_DEFAULT_DISPLAY_MANAGER to false in the script /etc/init.d/xdm:

[ -z "$HEED_DEFAULT_DISPLAY_MANAGER" ] && HEED_DEFAULT_DISPLAY_MANAGER=false

To set up XDM to handle VNC logins and deliver a user's desktop, XDMCP support has to be enabled first. Open the file /etc/X11/xdm/xdm-config and locate the following line:

DisplayManager.requestPort: 0

Change the number 0 to 177. Then, open the file /etc/X11/xdm/Xaccess and specify the range of addresses to allow access to XDM. Usually, it is sufficient to add only the following lines to /etc/X11/xdm/Xaccess:

localhost

127.0.0.1

Optionally, you can change the look of the login screen. Open the file /etc/X11/xdm/Xsetup and enter a command to set the background image:

#!/bin/sh

hsetroot -fill /usr/local/share/pixmaps/Repressed.jpg

You can also change the welcome line and the face image by editing the file /etc/X11/xdm/Xresources:

xlogin*greeting: Remote VNC Session

xlogin*logoFileName: /usr/share/X11/xdm/pixmaps/xorg.xpm

Using TightVNC in Windows to Run a Linux Destop

I installed TightVNC U3 package on my USB thumbdrive so I can connect to my VNC server anywhere. However, I had to tweak TightVNC a little bit to open a VNC session to my Linux desktop.

The default encoding Tight doesn't work well with vnc4server. So I had to change it to CoRRE.

Related Posts

• Manually Starting a VNC Server
  
• Connecting to a VNC Server through a SSH Tunnel
  

Linux: Connecting to Wireless Networks with wpa_supplicant

Connecting to a wireless network in Linux is easy with wpa_supplicant. If you haven't, install the wpasupplicant package first. Also, install wireless-tools.

Of course, the driver for the wireless adapter has to be installed and loaded too. You can either use Linux native driver or Windows NDIS driver for your wireless device. The Linux kernel itself provides native driver modules for popular wireless chips. Alternatively, you can use a Windows driver in Linux with the help of ndiswrapper. I prefer using ndiswrapper to enable my wireless adapters. Once ndiswrapper is configured correctly, the following command will load the driver for the wireless network adapter.

modprobe ndiswrapper

In order to be able to control wpasupplicant with wpa_cli and wpagui, you should add useself to the netdev group.

adduser username netdev

To automatically have wpasupplicant take care of wireless connections, you should edit two files, /etc/network/interfaces and /etc/wpa_supplicant/wpa_supplicant.conf. The following is a sample /etc/network/interfaces file.

auto lo wlan1

iface lo inet loopback

iface default inet dhcp

iface WPA_hidden inet static
        address 192.168.1.250
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1

iface wlan1 inet manual
        wpa-driver wext
        wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf

Then, you need to create a configuration file /etc/wpa_supplicant/wpa_supplicant.conf. Its contents typically looks like this:

ap_scan=1
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev

network={
        ssid="MyWifiNet"
        scan_ssid=1
        key_mgmt=WPA-PSK
        proto=WPA
        pairwise=TKIP
        group=TKIP
        psk="WPA password"
        id_str="WPA_hidden"
}

network={
        ssid="linksys"
        key_mgmt=NONE
        wep_key0=e2c45314910abf72e871beda87
        wep_tx_keyidx=0
}

In the example above, the ssid= and psk= lines should to be adjusted for each wireless network. The second nework linksys is an example of WEP networks. Next, run the following command to start a WPA connection to your wireless network.

wpa_supplicant -c /etc/wpa_supplicant.conf -i wlan1 -B

The steps below finalize wirless network setup.

ifconfig wlan0 192.168.1.201 up

route add default gw 192.168.1.1

Additionally, check the contents of /etc/resolv.conf which set up DNS servers.

To Kill WPA_supplicant

To terminate wpa_supplicant, execute wpa_cli and type the following commands:

terminate
quit

Hacking WEP with Backtrack 3

Today, we commonly find wireless networks around us. Most wireless networks are encrypted using WEP or WPA encryption methods. I covered the dictionary attack on WPA networks in a previous post. Compared to WPA, WEP has weak mechanism and is easy to crack.

Theory

At the time of conception, WEP, short for wired equivalent privacy, was believed to be secure. However, a security flaw was found in the IV headers of data packets that makes it possible to crack WEP if enough IV headers are collected. This tutorial takes advantage of this weakness in the initialization vectors of wireless packets to crack WEP. However, a problem may arise when there are multiple keys in use instead of just one.

What's Needed To Test Your Wireless Network

To crack WEP, you need a Backtrack CD and basic knowledge of Linux. Backtrack is a set of tools for testing network security. Download Backtrack and burn it onto a black CD with InfraRecorder or any other tool.

Then, boot your computer with the Backtrack CD. Hopefully, you'll be automatically presented with a nice and dark GUI screen of KDE.

Surveying Wireless Networks with Kismet

Launch Konsole which is located right next to the KDE Start menu. Open /usr/local/etc/kismet.conf in a text editor and edit the source= line to include your wireless device. For example, for Broadcom 43xx based card, put source=bcm43xx,eth1,bcm43xx. Save kismet.conf and start kismet.

Once kismet starts detecting wireless networks around, press s and P to sort the network list by packet counts in descending order. Press Up or Down key to move to the target network and press i for network information or c for client list. Write down such information as:

• ESSID (wireless network name)
  
• BSSID (MAC address of access point)
  
• channel of wireless network
  
• MAC address of clients
  

In Kismet, the flags for encryption are Y (WEP), N (No encryption), or O (WPA/WPA2). Press x to close popup windows and Q to exit Kismet.

Dumping Wireless Traffic with Airodump

To hack WEP, you need to use airodump-ng to sniff wireless traffic of the target network and collect good IV's (initialization vectors, a part of WEP encryption data). Type the following commands in a terminal window:

airmon-ng stop wlan0

airmon-ng start wlan0

airodump-ng -w logfile -c 9 --ivs wlan0

The commands above put the network device wlan0 in monitor mode and then use airodump-ng to log the wireless traffic. The -c option specifies the channel to listen to. The screen will show wireless networks and associated clients, if any, with a set of numbers increasing. Don't stop airodump-ng or close the terminal yet. Just leave the terminal open.

Using Aireplay-NG To Generate Traffic

Aireplay-ng is a handy tool that can be used to generate more wireless traffic in order to collect enough good IV's. It does so by injecting or replaying captured packets to fool the access point into giving us what we need.

To Force Association of Clients with Access Point

Open another terminal and enter the following command to associate the target wireless client with the access point:

aireplay-ng -1 30 -e belkin -a 00:11:22:33:44:55 -h 00:fe:21:83:f4:e5 wlan0

The -e option specifies the network name, the -a option specifies the MAC address of the AP, and the -h option specifies the MAC address of the wireless client.

You can use macchanger to view and change your MAC address, for example, macchanger -s wlan0. Then, you can associate your wireless adapter when there are no clients connected to the wireless network in the first place.

ARP Injection with Aireplay

ARP injection is slow but always works. While airodump-ng is listening, run the following command:

aireplay-ng -3 -b 00:11:22:33:44:55 -h 00:fe:21:83:f4:e5 wlan0

Whereas the -b option specifies the MAC address of the AP and -h specifies MAC address of the associated client. Let it run and airodump-ng will pick up traffic. If no client is connected, we can create one by fake authentication described above.

Interactive Packet Replay

This attack generates traffic by asking the access point to resend data packets.

aireplay-ng -2 -b <AP> -h <Client MAC> -n 160 -p 0841 -c FF:FF:FF:FF:FF:FF wlan0

Aircrack in Action

After collecting enough IV packets, aircrack-ng can be used to crack the WEP key. The syntax of the aircrack-ng command to use is like:

aircrack-ng -a 1 -b A0:B1:C2:D3:E4:F5 -n 128 logfile-01.ivs

Replace the filename with your log file that was previously generated with airodump-ng. Also, specify the access point's MAC address with -b option. The -n option specifies whether the WEP strength is 64-bit or 128-bit. The -a 1 option specifies that we're cracking WEP.

Can't Crack?

If you still can't crack WEP with tons of IV's, increase the fudge factor with -f N option (N>=2). It'll take much longer to crack but you'll have a better chance at success.

Related Posts

• Hacking WPA/WPA2 with Backtrack 3
  

Hacking WPA/WPA2 with Backtrack 3

WPA is an encryption scheme designed to secure the wireless network of your home or office from intruders and eavesdroppers. It is reportedly safer than WEP. There have been numerous attempts to break WEP and WPA encryption with mixed results. This tutorial discusses currently available techniques for testing the wireless network security. Be aware that breaking into your neighbor's network without permission is wrong.

What You Need

To test security of wireless networks, you can use the live CD Linux distribution called Backtrack. You can download its latest ISO image from Remote-Exploit.org and burn it with any CD burner program like InfraRecorder or CDBurnerXP. Alternatively, you can try the SliTaz Aircrack-NG distribution which is lighter and simpler than Backtrack.

Here's a list of what you need to crack WPA/WPA2:

• a very powerful computer
  
• a wireless card/adapter supported by Aircrack-NG
  
• Backtrack or SliTaz Aircrack-ng Distro
  
• A little knowledge of Linux
  
• Optional: WPA-PSK Rainbow Tables (7 GB or 33 GB)
  
• Optional: coWPAtty program
  

Reboot your computer with a Backtrack CD and you'll be presented with the KDE environment.

Surveying Wireless Networks with Kismet

Launch Konsole which is located right next to the KDE Start menu. Open /usr/local/etc/kismet.conf in a text editor and edit the source= line to include your wireless device. For example, for Broadcom 43xx based card, put source=bcm43xx,eth1,bcm43xx. Refer to Kismet documentation section 12. Save kismet.conf and start kismet.

Once kismet starts detecting wireless networks around, press s and P to sort the network list by packet counts in descending order. Press Up or Down key to move to the target network and press i for network information or c for client list. Write down such information as:

• ESSID (wireless network name)
  
• BSSID (MAC address of access point)
  
• channel of wireless network
  
• MAC address of clients
  

Press x to close popup windows and Q to exit Kismet.

Brute-Force Dictionary Attack

This is the classic brute-force attack.

airmon-ng stop wlan0

airmon-ng start wlan0

The commands above put your wireless device in monitor mode. The monitor mode is the mode whereby your wireless card can listen to wireless traffic passively. Replace wlan0 with your wireless device name, such as eth1. Type iwconfig to make sure your card is in monitor mode.

airodump-ng -w test wlan0

Skip the step above if you used Kismet as in the previous section. Here airodump-ng is used to survey the wi-fi networks. Press Ctrl+C to stop airodump-ng. Copy BSSID (MAC address) of the target network.

airodump-ng -w logfile -c 3 --bssid A0:B1:C2:D3:E4:F5 wlan0

Sniff and log the target network (specified with --bssid option) on the specified channel (-c option) to the specified log file (-w option). Wait until WPA Handshake message appears on the screen. Then, stop airodump-ng by pressing Ctrl+C.

Optionally, if you see a client connected to the target network but no authentication handshake, then you can deauthenticate the client by running the following example command in a separate terminal:

aireplay-ng -0 5 -a 00:14:6C:7E:40:80 -c 00:0F:B5:FD:FB:C2 wlan0

where -a option specifies the access point and -c option specifies the client to deauthenticate. Hopefully, the command above will trick the client to renegotiate a 4-way authentication handshake with the access point. Otherwise, you'll have to wait until a handshake message shows up on airodump-ng outpout.

zcat /pentest/password/pico/cowpatty/final-wordlist.txt.gz > /tmp/wordlist.txt

aircrack-ng -a 2 -w /tmp/wordlist.txt logfile*.cap

Begin a brute-force dictionary attack using the saved log file(s) and the specified dictionary (-w option). Aircrack-ng will try every word in the dictionary until the correct passphrase is found. It may take hours or several days depending on the size of dictionary and the speed of your CPU to try every word in the dictionary. However, if the passphrase is not found in the dictionary or made up of random alphanumeric characters, then you are out of luck and just wasting your time. In this case, the dictionary attack won't be any good.

Finding a Good Dictionary

You need a good dictionary to crack WPA. Backtract 3 CD has wordlist files at the following locations:

/usr/local/john-1.7.2/password.lst

/pentest/fuzzers/spike/src/password.lst

/pentest/fuzzers/spike/src/wordlist

/pentest/password/pico/cowpatty/final-wordlist.txt.gz

/pentest/wireless/aircrack-ng/test/password.lst

/pentest/wireless/eapmd5pass/sample-wordlist.txt

/opt/windows-binaries/wordlist.txt.gz

Also, aircrack FAQ page has an extensive list of places where you can download good wordlists from. In addition, I found a good wordlist called 9-final-wordlist.zip here.

Further Readings

• More on WPA/WPA2
  
• Ars Technica: Battered, but not broken: understanding the WPA crack
  
• Practical Attacks against WEP and WPA, PDF
  
• Hacking WEP with Backtrack 3