Technical notes, my online memory

Tuesday, October 23, 2012

Chrome enterprise policy controls

Chrome comes with a bunch of enterprise controls. These enable you to, amongst other things, whitelist/blacklist/force-install extensions. Also, if you want to install extensions automatically, but allow users to disable or remove them, there is an alternate way to get them installed.

Wednesday, October 17, 2012

Minimal OpenVPN setup: ubuntu server, OS X client

There are some good instructions for setting OpenVPN up quickly on ubuntu here, and I've also covered it previously on this blog. Because of a bug I was getting this error from pkitool when building the ca:

The correct version should have a comment that says: easy-rsa version 2.x

The solution was just a symlink, no need to mess with the vars file:

ln -s openssl-1.0.0.cnf openssl.cnf

To route all traffic through the VPN uncomment this line in the server.conf:

push "redirect-gateway def1 bypass-dhcp"

And then you'll want to add a NAT so that traffic comes back to the right clients, this iptables config also allows some services through:

# Generated by iptables-save v1.4.12 on Wed Oct 17 21:32:01 2012
*nat
:PREROUTING ACCEPT [293:18619]
:INPUT ACCEPT [3:148]
:OUTPUT ACCEPT [6:508]
:POSTROUTING ACCEPT [6:508]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Oct 17 21:32:01 2012
# Generated by iptables-save v1.4.12 on Wed Oct 17 21:32:01 2012
*filter
:INPUT DROP [1:42]
:FORWARD ACCEPT [571:142706]
:OUTPUT ACCEPT [589:168958]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth+ -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i eth+ -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i eth+ -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -s 10.8.0.0/24 -i eth+ -j ACCEPT
-A INPUT -s 10.8.0.0/24 -i tun0 -j ACCEPT
-A INPUT -j LOG
COMMIT
# Completed on Wed Oct 17 21:32:01 2012

To ssh to the server while the VPN is active, use:

ssh 10.8.0.1

On the client side (a mac), first install tunnelblick. You can use it to create an example config, which is a directory where you dump the ca and client cert. The most important bit in the config you need to set is:

remote myserver.com 1194

Tuesday, October 16, 2012

OS X Packaging (Luggage) Tutorial: hello world

Apple ships a GUI utility called PackageMaker to help you create .pkg files for deployment. It isn't included in newer versions of XCode, you'll need to download it, it's in the 'Auxiliary tools for XCode' package.

The problem is that reproducing builds with many different project collaborators is a PITA, enter The Luggage.

Here's a hello world.

Download git and clone and install the luggage.

git clone https://github.com/unixorn/luggage
cd luggage
make bootstrap_files

Write a simple Makefile (this assumes you have copied PackageMaker.app Auxiliary tools into /Applications):

include /usr/local/share/luggage/luggage.make
TITLE=Hello_World
REVERSE_DOMAIN=com.testing.something
PAYLOAD=pack-usr-local-bin-hello_world
PACKAGEMAKER=/Applications/PackageMaker.app/Contents/MacOS/PackageMaker

Create a dummy file to install, and build the dmg:

touch hello_world
make dmg

You'll get a Hello_World-20121016.dmg containing Hello_World-20121016.pkg, that when installed will create /usr/local/bin/hello_world

Monday, October 15, 2012

Registered mime-types and default handlers on OS X

Which application is the default handler for file type .blah on OS X? Turns out this is actually a pretty complicated question.

Launch Services keeps a database, into which applications can register themselves as mime handlers, using CFBundleDocumentTypes and CFBundleURLTypes in Info.plist in their application Contents, which are parsed periodically (not sure when). Here is part of Safari's:

$defaults read /Applications/Safari.app/Contents/Info.plist 
{
    "Application-Group" = "dot-mac";
    BuildMachineOSBuild = 12A251;
    CFBundleDevelopmentRegion = English;
    CFBundleDocumentTypes =     (
                {
            CFBundleTypeExtensions =             (
                css
            );
            CFBundleTypeIconFile = "document.icns";
            CFBundleTypeMIMETypes =             (
                "text/css"
            );
            CFBundleTypeName = "CSS style sheet";
            CFBundleTypeRole = Viewer;
            NSDocumentClass = BrowserDocument;
        },
                {
            CFBundleTypeExtensions =             (
                pdf
            );
            CFBundleTypeIconFile = "document.icns";
            CFBundleTypeMIMETypes =             (
                "application/pdf"
            );
            CFBundleTypeName = "PDF document";
            CFBundleTypeRole = Viewer;
            NSDocumentClass = BrowserDocument;
        },
[snip]

Also as an aside, safari has a list of file types that it will automatically open with the registered mime handler because they are considered 'safe'. The list is stored in:

/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/System

Where:

LSRiskCategorySafe: Safari will automatically open these files after download
LSRiskCategoryNeutral: Not auto-opened, no warnings
LSRiskCategoryUnsafeExecutable: Warning displayed when opened by the user.
LSRiskCategoryMayContainUnsafeExecutable: e.g. zip files. This will trigger a warning if Safari can't determine that the contents are safe or neutral

Back to the LaunchServices database. You can use API calls to register a mime-type, and there is also a helper utility called lsregister that provides a simple interface to the database. This command will dump the contents of the database, there are also options to force a registration:
There is also an app (RCDefaultApp) that presents a more usable grapical frontend to the data.

/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump | less

The user also has some control over mime-type registration, and that information is stored in:

$ defaults read ~/Library/Preferences/com.apple.LaunchServices
{
    LSHandlers =     (
                {
            LSHandlerRoleAll = "com.google.chrome";
            LSHandlerURLScheme = http;
        },
                {
            LSHandlerRoleAll = "com.google.chrome";
            LSHandlerURLScheme = https;
        },
                {
            LSHandlerContentType = "public.html";
            LSHandlerRoleViewer = "com.google.chrome";
        },
                {
            LSHandlerContentType = "public.url";
            LSHandlerRoleViewer = "com.google.chrome";
        }
    );
}

Reading the output of the database query and the plist above, it is difficult to determine which handler will fire for certain files where multiple handlers are registered. Apple provides some documentation, about how the mime handler is chosen for files and URLs in the case of multiple handers, but the flow chart ends with:

If two or more candidate applications remain after all of the foregoing criteria have been applied, Launch Services chooses one of the remaining applications in an unspecified manner.

The quickest way to check is to use 'open', which according to the man page:

opens a file (or a directory or URL), just as if you had double-clicked the file's icon.

So, creating a dummy css file and running open like this should pop up safari:

open blah.css

Find out a file's mime type with:

$ mdls -name kMDItemContentType -name kMDItemContentTypeTree test.dmg 
kMDItemContentType     = "com.apple.disk-image-udif"
kMDItemContentTypeTree = (
    "com.apple.disk-image-udif",
    "com.apple.disk-image",
    "public.archive",
    "public.data",
    "public.item",
    "public.disk-image"
)

Disable OS X auto-login after Filevault 2 unlock

Interesting nugget from the munki-dev list, a description of how to stop the auto-login that occurs after FileVault 2 unlock (I haven't tested this yet). You essentially disable the credential forwarding from the disk unlock window to the login window.

Edit /etc/authorization
Find the "system.login.console" array.
Find the "mechanisms" array within this.
Remove the line "builtin:forward-login,privileged".
Save and reboot.

Thursday, September 27, 2012

Extract and view application signing certs on OS X

To view the certs used to sign executables on OS X binaries, first dump out the cert signing chain:

$ codesign -d --extract-certificates /Applications/Utilities/Adobe\ Flash\ Player\ Install\ Manager.app/
Executable=/Applications/Utilities/Adobe Flash Player Install Manager.app/Contents/MacOS/Adobe Flash Player Install Manager

This will give you all the certs in the embedded cert chain in ASN.1 DER format, with codesign0 being the leaf:

$ ls codesign*
codesign0   codesign1   codesign2   codesign3

Then you can use openssl to look at the attributes in a super-ugly format:

$ openssl asn1parse -in codesign0 -inform DER    
    0:d=0  hl=4 l=1302 cons: SEQUENCE          
    4:d=1  hl=4 l=1022 cons: SEQUENCE          
    8:d=2  hl=2 l=   3 cons: cont [ 0 ]        
   10:d=3  hl=2 l=   1 prim: INTEGER           :02
   13:d=2  hl=2 l=  16 prim: INTEGER           :15E5AC0A487063718E39DA52301A0488
   31:d=2  hl=2 l=  13 cons: SEQUENCE          
   33:d=3  hl=2 l=   9 prim: OBJECT            :sha1WithRSAEncryption
   44:d=3  hl=2 l=   0 prim: NULL              
   46:d=2  hl=3 l= 180 cons: SEQUENCE          
   49:d=3  hl=2 l=  11 cons: SET               
   51:d=4  hl=2 l=   9 cons: SEQUENCE          
   53:d=5  hl=2 l=   3 prim: OBJECT            :countryName
   58:d=5  hl=2 l=   2 prim: PRINTABLESTRING   :US
   62:d=3  hl=2 l=  23 cons: SET               
   64:d=4  hl=2 l=  21 cons: SEQUENCE          
   66:d=5  hl=2 l=   3 prim: OBJECT            :organizationName
   71:d=5  hl=2 l=  14 prim: PRINTABLESTRING   :VeriSign, Inc.
   87:d=3  hl=2 l=  31 cons: SET               
   89:d=4  hl=2 l=  29 cons: SEQUENCE          
   91:d=5  hl=2 l=   3 prim: OBJECT            :organizationalUnitName
   96:d=5  hl=2 l=  22 prim: PRINTABLESTRING   :VeriSign Trust Network
  120:d=3  hl=2 l=  59 cons: SET               
  122:d=4  hl=2 l=  57 cons: SEQUENCE          
  124:d=5  hl=2 l=   3 prim: OBJECT            :organizationalUnitName
  129:d=5  hl=2 l=  50 prim: PRINTABLESTRING   :Terms of use at https://www.verisign.com/rpa (c)10
  181:d=3  hl=2 l=  46 cons: SET               
  183:d=4  hl=2 l=  44 cons: SEQUENCE          
  185:d=5  hl=2 l=   3 prim: OBJECT            :commonName
  190:d=5  hl=2 l=  37 prim: PRINTABLESTRING   :VeriSign Class 3 Code Signing 2010 CA
  229:d=2  hl=2 l=  30 cons: SEQUENCE          
  231:d=3  hl=2 l=  13 prim: UTCTIME           :101215000000Z
  246:d=3  hl=2 l=  13 prim: UTCTIME           :121214235959Z
  261:d=2  hl=3 l= 221 cons: SEQUENCE          
  264:d=3  hl=2 l=  11 cons: SET               
  266:d=4  hl=2 l=   9 cons: SEQUENCE          
  268:d=5  hl=2 l=   3 prim: OBJECT            :countryName
  273:d=5  hl=2 l=   2 prim: PRINTABLESTRING   :US
  277:d=3  hl=2 l=  19 cons: SET               
  279:d=4  hl=2 l=  17 cons: SEQUENCE          
  281:d=5  hl=2 l=   3 prim: OBJECT            :stateOrProvinceName
  286:d=5  hl=2 l=  10 prim: PRINTABLESTRING   :California
  298:d=3  hl=2 l=  17 cons: SET               
  300:d=4  hl=2 l=  15 cons: SEQUENCE          
  302:d=5  hl=2 l=   3 prim: OBJECT            :localityName
  307:d=5  hl=2 l=   8 prim: PRINTABLESTRING   :San Jose
  317:d=3  hl=2 l=  35 cons: SET               
  319:d=4  hl=2 l=  33 cons: SEQUENCE          
  321:d=5  hl=2 l=   3 prim: OBJECT            :organizationName
  326:d=5  hl=2 l=  26 prim: T61STRING         :Adobe Systems Incorporated
  354:d=3  hl=2 l=  28 cons: SET               
  356:d=4  hl=2 l=  26 cons: SEQUENCE          
  358:d=5  hl=2 l=   3 prim: OBJECT            :organizationalUnitName
  363:d=5  hl=2 l=  19 prim: T61STRING         :Information Systems
  384:d=3  hl=2 l=  62 cons: SET               
  386:d=4  hl=2 l=  60 cons: SEQUENCE          
  388:d=5  hl=2 l=   3 prim: OBJECT            :organizationalUnitName
  393:d=5  hl=2 l=  53 prim: PRINTABLESTRING   :Digital ID Class 3 - Microsoft Software Validation v2
  448:d=3  hl=2 l=  35 cons: SET               
  450:d=4  hl=2 l=  33 cons: SEQUENCE          
  452:d=5  hl=2 l=   3 prim: OBJECT            :commonName
  457:d=5  hl=2 l=  26 prim: T61STRING         :Adobe Systems Incorporated
  485:d=2  hl=3 l= 159 cons: SEQUENCE          
  488:d=3  hl=2 l=  13 cons: SEQUENCE          
  490:d=4  hl=2 l=   9 prim: OBJECT            :rsaEncryption
  501:d=4  hl=2 l=   0 prim: NULL              
  503:d=3  hl=3 l= 141 prim: BIT STRING        
  647:d=2  hl=4 l= 379 cons: cont [ 3 ]        
  651:d=3  hl=4 l= 375 cons: SEQUENCE          
  655:d=4  hl=2 l=   9 cons: SEQUENCE          
  657:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 Basic Constraints
  662:d=5  hl=2 l=   2 prim: OCTET STRING      [HEX DUMP]:3000
  666:d=4  hl=2 l=  14 cons: SEQUENCE          
  668:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 Key Usage
  673:d=5  hl=2 l=   1 prim: BOOLEAN           :255
  676:d=5  hl=2 l=   4 prim: OCTET STRING      [HEX DUMP]:03020780
  682:d=4  hl=2 l=  64 cons: SEQUENCE          
  684:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 CRL Distribution Points
  689:d=5  hl=2 l=  57 prim: OCTET STRING      [HEX DUMP]:30373035A033A031862F687474703A2F2F637363332D323031302D63726C2E766572697369676E2E636F6D2F435343332D323031302E63726C
  748:d=4  hl=2 l=  68 cons: SEQUENCE          
  750:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 Certificate Policies
  755:d=5  hl=2 l=  61 prim: OCTET STRING      [HEX DUMP]:303B3039060B6086480186F84501071703302A302806082B06010505070201161C68747470733A2F2F7777772E766572697369676E2E636F6D2F727061
  818:d=4  hl=2 l=  19 cons: SEQUENCE          
  820:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 Extended Key Usage
  825:d=5  hl=2 l=  12 prim: OCTET STRING      [HEX DUMP]:300A06082B06010505070303
  839:d=4  hl=2 l= 113 cons: SEQUENCE          
  841:d=5  hl=2 l=   8 prim: OBJECT            :Authority Information Access
  851:d=5  hl=2 l= 101 prim: OCTET STRING      [HEX DUMP]:3063302406082B060105050730018618687474703A2F2F6F6373702E766572697369676E2E636F6D303B06082B06010505073002862F687474703A2F2F637363332D323031302D6169612E766572697369676E2E636F6D2F435343332D323031302E636572
  954:d=4  hl=2 l=  31 cons: SEQUENCE          
  956:d=5  hl=2 l=   3 prim: OBJECT            :X509v3 Authority Key Identifier
  961:d=5  hl=2 l=  24 prim: OCTET STRING      [HEX DUMP]:30168014CF99A9EA7B26F44BC98E8FD7F00526EFE3D2A79D
  987:d=4  hl=2 l=  17 cons: SEQUENCE          
  989:d=5  hl=2 l=   9 prim: OBJECT            :Netscape Cert Type
 1000:d=5  hl=2 l=   4 prim: OCTET STRING      [HEX DUMP]:03020410
 1006:d=4  hl=2 l=  22 cons: SEQUENCE          
 1008:d=5  hl=2 l=  10 prim: OBJECT            :1.3.6.1.4.1.311.2.1.27
 1020:d=5  hl=2 l=   8 prim: OCTET STRING      [HEX DUMP]:30060101000101FF
 1030:d=1  hl=2 l=  13 cons: SEQUENCE          
 1032:d=2  hl=2 l=   9 prim: OBJECT            :sha1WithRSAEncryption
 1043:d=2  hl=2 l=   0 prim: NULL              
 1045:d=1  hl=4 l= 257 prim: BIT STRING

Wednesday, September 26, 2012

Disable Captive Network Support in OS X

iOS4+ and OS X (10.7+) Devices have a feature called Captive Network Support, which when you connect to an access point tries to download:

http://www.apple.com/library/test/success.html

to see if the device is connected to the internet. If it doesn't get the success response it assumes you are behind a captive portal and pops a webkit window so you can do the portal dance. This is mostly useful if you are using thick-client apps, since if you're using a browser you're going to see the portal page as soon as you go anywhere.

To disable it, set this preference:

sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.captive.control Active -boolean false