You’ve seen many time-tracking and billable hour tracker apps and devices. There has been a common flaw among all of those devices and apps! You should remember to clock-in and clock-out. Either via your fingerprint, employee card, etc. Let alone when you have to visit somewhere outside of the office for a meeting or on a project site.

We have good news for those who need time sheets, there is an Android app for automating it! Time-Clock is a location-based work hour tracker, it automatically logs the amount of time you stay in a location and at the end of the day, you just need to mark those locations as work-related (swipe right) or discard them as personal (swipe left). That’s it. You just leave the app there and it will generate the work log for you! with the exact location, project name and time stamp.

TimeClock is free, download it from google play. or visit their website here.

Once you have a busy database server, you would probably know that “mysqldump” is not the best option for backups. It is very slow and involves the database server itself for processing the backup dump, therefore slowing down the application too.

Percona has provided Xtrabackup (innobackupex) to get hot-backups, which means it doesn’t affect your mysql server at all. Instead it would copy the mysql data files and allows you to revert to your full backup by recovering the original data files inside /var/lib/mysql/. (Also take a look at holland backup manager if you’re not familiar with it)

Recently I experienced a bug in the application level which led to corrupted data in a single table and did not want to recover the whole database to yesterday’s backup. Therefor I decided to use my full backup to start another MySQL server instance, extract the required data and feed it back to the operational MySQL database. Here’s how I did it:

Assume:

1. You have an operational MySQL instance, listening on standard port 3306, using data dir /var/lib/mysql
2. Your backup is located at: /home/backups/holland/sib/20150705_120502/backup.tar.gz
3. The database name is “my_db_name”
4. The table we’re going to extract partial data from is “the_table”

Step 1: Extract the backup files and set ownerships

cd /home/backups/holland/sib/20150705_120502/
mkdir data
cd data
tar -xif backup.tar.gz
chown -R mysql:mysql /home/backups/holland/sib/20150705_120502/

Step 2: Create a fake mysql configuration file for the new instance (my.cnf)

contents of /home/backups/holland/sib/20150705_120502/data/my.cnf  (to start the new instance with a different working directory and port)

[mysqld]
datadir=/home/backups/holland/sib/20150705_120502/data
socket=/home/backups/holland/sib/20150705_120502/data/Xmysql.sock
user=mysql
port=3307
# Disabling symbolic-links is recommended to prevent assorted security risks
symbolic-links=0
max_connections=10
tmpdir=/home/backups/holland/sib/20150705_120502/data/tmp
log-bin=/home/backups/holland/sib/20150705_120502/data/Xlogbin
innodb_buffer_pool_size=524288000
innodb_force_recovery=6

[mysqld_safe]
log-error=/home/backups/holland/sib/20150705_120502/data/Xmysqld.log
pid-file=/home/backups/holland/sib/20150705_120502/data/Xmysqld.pid

Step 3: Run the mysql server

[root@sib12 data]# mysqld_safe --defaults-file=/home/backups/holland/sib/20150705_120502/data/my.cnf 
150706 10:37:03 mysqld_safe Logging to '/home/backups/holland/sib/20150705_120502/data/Xmysqld.log'.
150706 10:37:03 mysqld_safe Starting mysqld daemon with databases from /home/backups/holland/sib/20150705_120502/data

Step 4: Connect to the second instance to check if it is running

mysql -uroot -h 127.0.0.1 --port 3307 -p my_db_name

you can examine the old/backup data to see if you’re on the track or not. If the command above leads to any error, there is probably an error in the mysql startup. so check the log file you’ve mentioned in my.cnf above.

Step 5: Extract your partial data using mysqldump

mysqldump --extended-insert=FALSE --replace -t -h 127.0.0.1 --port 3307 -uroot -p my_db_name the_table --where="id IN (1,2,3,4,7,9,12)" > partial_data.sql

• -t parameter removes the table definition from the dump file (also removes the dangerous drop statement at the start of it)
• –replace writes REPLACE statement instead of INSERT, so that we can update our existing corrupted data instead of trying to insert new records
• Note the port is 3307 at which the new MySQL instance is listening

Step 6: Feed the recovered data back into production MySQL instance

mysql -uroot -h 127.0.0.1 --port 3306 -p my_db_name < partial_data.sql

Step 7: You’re done

Let’s kill the second instance by pressing “Ctrl+\” at the terminal you’ve started the mysql instance and clean the extracted backup files.

Assuming you have the svn and an empty GIT repository, first you need to check out the git repo:

git svn clone https://old.svn.server.com/svnpath

you’ll have the folder named ‘svnpath’ checked out and converted to git format.

The you need to change the author names, we’ll use a feature called ‘filter-branch’ in git to change author names and email addresses:

git_change_author_names.sh

#!/bin/bash

hput() {
  eval "$1""$2"='$3'
}

hget() {
    eval echo '${'"$1$2"'#hash}'
}

# The original SVN usernames
hput originals x1 "Nadalizadeh"
hput originals x2 "sina.bahar"
hput originals x3 "faraz.shamshirdar"
hput originals x4 "elrusho"

# The new GIT Names
hput names x1 "Ali Nadalizadeh"
hput names x2 "Sina Baharlouie"
hput names x3 "Faraz Shamshirdar"
hput names x4 "Soroush Khodaii"

# The new GIT Email Addresses
hput emails x1 "ali@emaildomain1.com"
hput emails x2 "sinabaharlouei@emaildomain1.com"
hput emails x3 "faraz@emaildomain1.com"
hput emails x4 "soroush@emaildomain1.com"

for h in ${!names*}; do
    key=${h#names*};
    export oldname=`hget originals $key`;
    export newname=`hget names $key`;
    export newemail=`hget emails $key`;

    echo "Changing $oldname to $newname <$newemail>"
git filter-branch -f --commit-filter '
        if [ "$GIT_AUTHOR_NAME" = "$oldname" ];
        then
                GIT_COMMITTER_NAME="$newname";
                GIT_AUTHOR_NAME="$newname";
                GIT_COMMITTER_EMAIL="$newemail";
                GIT_AUTHOR_EMAIL="$newemail";
                git commit-tree "$@";
        else
                git commit-tree "$@";
        fi' HEAD

done

Run the above script inside root of your git repository and ofcourse you need to change the names and emails your own values you get from “svn log” and “git log”

Finally push your new git repository to your remote address:

git remote add origin git@new.gitserver.com:git-group/my_repository.git
git push -u origin master

Faced a problem while downloading JDK from the shell?
Yes, Oracle checks for cookies and here’s a small trick to install latest JDK right from oracle’s website:

wget --no-check-certificate --no-cookies --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com" -O jdk-linux-x64.rpm "http://download.oracle.com/otn-pub/java/jdk/7u51-b13/jdk-7u51-linux-x64.rpm"

rpm -Uvh jdk-linux-x64.rpm

When you run a DNS server on your dedicated server, it will be the target DNS amplification attacks.  To prevent these attacks from succeeding and using up your bandwidth (which you will pay for), you need to configure your DNS server not to answer recursive queries.

Check if your server is vulnerable

You can send a DNS query to your server, e.g. “thatserver.dedicated.co.za” using dig or nslookup.

dig @thatserver.dedicated.co.za www.isc.org

Alternatively:

nslookup

> server thatserver.dedicated.co.za

> isc.org

Non-authoritative answer:

Name:    isc.org

Address: 149.20.64.42

If you receive an answer that includes an answer of the IP address of www.isc.org, then your server is vulnerable, because it did the work of finding out the answer and presenting it to you.

Secure named (bind) on Linux

Add this to the “options” section of /etc/named.conf :

    recursion no;
    additional-from-auth no;
    additional-from-cache no;

Then restart named so that it will use the new secure options:

    /etc/init.d/named restart

For detailed information see http://www.cymru.com/Documents/secure-bind-template.html

Secure Microsoft DNS server

If you have installed or enabled Exchange then you have implicitly turned on DNS, which by default runs as a recursive service and can be horribly attacked.  Usually you can just firewall the DNS service.

Run this command:

    dnscmd . /Config /NoRecursion 1

Or follow this procedure:

    Start | Administrative Tools | DNS (DNS manager)

    Right click DNS server | 
        Properties | 
        Advanced | 
        Server options | 
        Disable recursion -> Yes, OK

Unfortunately, it is not possible to prevent the Microsoft DNS server from replying with cached values, so your non-recursive DNS server will provide a small amount of useful traffic amplification for attackers.  Where possible, add a firewall rule that blocks incoming traffic from unauthorised clients towards port 53/UDP (and port 53/TCP for good measure).

iptables rules for Linux

If your DNS server is used only by the machine on which you are running it, you can block external queries as follows:

iptables -A  INPUT -p udp -m udp --dport 53 -i ! lo -j DROP

These iptables firewall rules will to prohibit excessive ANY queries to a non-recursive DNS:

iptables -A  INPUT -p udp -m udp --dport 53 \
   -m string --hex-string "|0000ff0001|"  --algo bm --from 48 --to 65535 \
   -m recent --set --name dnsanyquery  --rsource

iptables -A INPUT -p udp -m udp --dport 53 \
    -m string --hex-string  "|0000ff0001|" --algo bm --from 48 --to 65535 \
   -m recent --rcheck  --seconds 60 --hitcount 5 --name dnsanyquery --rsource \
   -j DROP

If you for some reason have to run an open DNS resolver, you can limit rate limit the rate at which you will accept queries:

iptables -A INPUT -p udp --dport 53 -m hashlimit \
--hashlimit-name DNS --hashlimit-above 20/second --hashlimit-mode srcip \
--hashlimit-burst 100 --hashlimit-srcmask 28 -j DROP

If you know what the above means you can install these rules in your system.

Reference information

You can read more about this here:

• http://www.publicsafety.gc.ca/prg/em/ccirc/2009/av09-011-eng.aspx – securing your server
• http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack – what the attacker is trying to do
• http://technet.microsoft.com/en-us/library/cc771738.aspx – fixing Microsoft DNS
• http://www.cymru.com/Documents/secure-bind-template.html – fixing Linux DNS

Source: https://support.afrihost.com/?/Knowledgebase/Article/View/344/0/securing-dns-against-ddos-amplification-attacks

Dan McDougall just publicly released the source code to Gate One, which is an HTML5-powered terminal emulator and SSH client. It is unique in that it doesn’t require any browser plugins (it uses WebSockets) and supports multiple simultaneous terminals/SSH sessions in a single browser tab. It can resume users’ sessions after being disconnected, and supports both client and server-side session recording/playback (view as a log or like a video). Gate One can also be embedded into other web-based applications such as administration interfaces, serial port concentrators, virtual appliances, or whatever.