The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 2,119 other followers

Archive for September 28th, 2020

Viewing a USB WebCam on Windows 10 without any fuzz

Posted by jpluimers on 2020/09/28

Windows 10 comes with a broken Camera viewer and before that, Windows 7 killed the one in Windows XP.

On a Mac you have the open source Quick Camera (which named QCamera before, seeViewing an USB camera on Mac OS X without mirroring and Capturing from a Magewell XI100USB on a Mac using OS X) at [WayBack] GitHub – simonguest/quick-camera.

For Windows 7, a long search initially revealed a lot of bloat-ware, but finally ended to these two both from the same author:

It is not open source (yet?), but since it is .NET, it is reasonable easy to see the innards.

Like QCamera, it does not require installation: just unzip and run. Enjoy!

Yes, I know there are Windows 10 workaround steps via Microsoft.CameraApp.App.ctor, but if you look at [WayBack] Win10 Home N – Camera App fails: System.IO.FileNotFoundException – Microsoft Community you will understand I did not apply them.

Similarly, when you install Skype from the app store, then sign-in, it will tell you that Skype is out of date.

–jeroen

via:

Posted in .NET, Apple, Development, Mac OS X / OS X / MacOS, Power User, Software Development, Windows | Leave a Comment »

pfSense OpenVPN server configuration steps

Posted by jpluimers on 2020/09/28

Saving an initial configuration without changing anything gives these errors:

Self signed certificate

If you are OK with self-signed certificates, then the first is solved by using this as the Server certificate:

Certificate authority

The second needs an additional step: you have to select or create a certificate authority first at hostname/system_camanager.php?act=new where hostname is the hostname or IP address of your pfSense configuration.

This order is actually explained in [WayBack] OpenVPN – The Open Source VPN: HOWTO and [WayBack] OpenVPN Configuration (pfSense) – ELITS, but I like stronger security.

For the Internal Certificate Authority (CA), use at least these settings:

  • “Key length (bits)” at least 2048 bits, but I prefer 3072 bits (to be safe after about 2030) as per
  • “Digest Algorithm” at least sha256, but I prefer sha512 as it will be safe for a longer period of time.
  • “Lifetime” by default is 3650 (10 years); can you keep your VM safe for that long? If longer, you can increase the lifetime, but also have to ensure you take large enough values for the Key length and Digest Algorithm.

You can view the possible settings in [WayBack] pfsense/system_camanager.php at master · pfsense/pfsense · GitHub.

Straightforward parameters

Further encryption hardening

  • DH Parameter Length
    • One problem here is that pfSense ships with pre-generated Diffie Helman (DH) parameters:

      This means they can potentially be re-used as an attack-vector, so you need to manually re-generate them as per [WayBack] DH Parameters – pfSense Documentation by using /usr/bin/openssl dhparam

      In order to speed that up, you have to either manually add a lot of entropy, or ensure your VM uses the host entropy by installing the open-vm-tools and rebooting.

      This can take quite some time as it depends on /dev/random as a pure random number source, which will wait if there is not enough initial entropy available yet (see [WayBack] prng – differences between random and urandom – Stack Overflow).

      In order to speed that up, you have to either manually add a lot of entropy, or ensure your VM uses the host entropy by installing the open-vm-tools and rebooting.

      On a single-coreIntel(R) Xeon(R) CPU E5-2630L v4 @ 1.80GHz, the timings of these

      /usr/bin/openssl dhparam -out /etc/dh-parameters.1024 1024
      /usr/bin/openssl dhparam -out /etc/dh-parameters.2048 2048
      /usr/bin/openssl dhparam -out /etc/dh-parameters.4096 4096

      using the [WayBack] FreeBSD Manual Pages: time command are (each measured twice):

      • ~4.5 seconds for 1024 bits:

      • ~23 seconds for 2048 bits:

      • ~150 seconds for 4096 bits:

      • You see that even within the same length, the duration varies highly.
    • Given you already burned those CPU cycles, choose the largest one: 4096
  • Encryption Algorithm
  • Enable NCP(Negotiable Cryptographic Parameters)
    • I enabled this, because I consider the ones below safe enough. If you just want to go for one algorithm, then disable this.
  • NCP Algorithms
    • See the previous one; only list the algorithm-length-mode combinations that you want to allow.. Since I am on AES, prefer GCM, and all key sizes are considered safe, my list is the one on the right:

      This is in decreasing order of secureness:

      • AES-256-GCM
      • AES-192-GCM
      • AES-128-GCM
  • Auth digest algorithm
  • Certificate depth
    • For now it is 1 (as it is self-signed)
    • In the future I will experiment with proper (hopefully Let’s Encrypt) signed certificates. I am not yet sure if that might need a larger depth.

Other settings

All networks are in CIDR notation, like 192.168.3.0/24.

  • IPv4 Tunnel network
  • IPv6 Tunnel network
    • I still need to implement IPv6 in full, so that is empty for now.
  • IPv4 Local networks
    • These are my local networks. Still need to test how well routing works, but given the default gateway knows about them too, I do not suspect problems.
  • IPv4 Remote networks
    • Empty as I do not use site-to-site VPN yet.
  • IPv4 Remote networks
    • I still need to implement IPv6 in full, so that is empty for now.
  • Concurrent connections
    • Still need to measure performance, so empty for now.
  • Compression
    • I kept the default “Omit Preference (Use OpenVPN Default)”.
    • I might choose compression lz4 or compression lz4-v2 in the future.
  • Push compression
    • Kept to unchecked: I dislike other VPN connections to push settings to me, so I do not want to push settings to others.
  • Type-of-Service
    • Kept to unchecked, although I might opt for checked later on: need to do some testing first.
  • Inter-client communication
    • Kept to unchecked: I do not want clients to talk to each other in this particular network, though I might for some specific OpenVPN setup
  • Duplicate Connection
    • Kept to unchecked
  • Dynamic IP
    • I have enabled this as I expect clients to switch IP addresses because of switching between networks
  • [WayBack] Topology: choose subnet (use net30 only for old 2.0.9 client compatibility on Windows; use p2p if you only have non-Windows clients)
  • Advanced client options
    • All defaults, as currently I do not run an internal DNS, but those will probably change in the future:
      • DNS Default Domain
      • DNS Server enable
      • DNS Server 1..4
      • Force DNS Cache Update
  • Custom options
    • None, but I will need to do some deeper reading on the possibilities here
  • UDP Fast I/O
    • Disabled as experimental
  • Send/Receive Buffer
    • Default, although I might increase this if speed is too slow.
  • Gateway creation
    • I choose the default Both
  • Verbosity level
    • Default

 

Enabling AES

Even if the underlying Intel/AMD processor supports AES, it is not enabled by default in pfSense as per web UI home page:

Intel(R) Xeon(R) CPU E5-2630L v4 @ 1.80GHz
AES-NI CPU Crypto: Yes (inactive)

I was quite surprised, but then remembered that enabling RDRAND in the OpenVPN settings was also non-default and dug a bit deeper into ….

There I found you have to go to the System menu, choose Advanced, then the Miscellaneous tab:

From there, browse down (or search for Hardware) to “Cryptographic & Thermal Hardware”, then enable the CPU based accelleration:

After pressing the Save button at the bottom, you are done:

AES-NI CPU Crypto: Yes (active)

I got this via [WayBack] AES-IN Inactive?, which also mentions this:

  • AES-NI loads aesni.ko
  • BSD Crypto loads cryptodev.ko
  • AES-NI and BSD Crypto loads both

Note that AES – as of FreeBSD-10 – AES-NI and other hardware implementations are only indirectly incorporated into /dev/random. The Linux kernel already did this in an indirect way. I think that is a good idea as when multiple entropy sources are merged together, it makes it much harder to influence to total entropy. FreeBSD implemented this using the Yarrow algorithm – Wikipedia and now has moved to a successor, the Fortuna (PRNG) – Wikipedia.

More background information:

padlock ACE support

Note there is a message about ACE support on the console and in the boot log that is related to AES:

padlock0: No ACE support.
aesni0: <AES-CBC, AES-XTS, AES-GCM, AES-ICM> on motherboard

The cause is that in the past, VIA PadLock Advanced Cryptography Engine (ACE) in the mid 2000s introduced encryption acceleration (see [WayBack] VIA PadLock support for Linux) a few years before AES-NI, so ACE is incompatible with AES-NI. AES-NI is now much more widespread than ACE, even the wikipedia VIA page padlock information has been removed.

An odd thing: unlike AES-NI which needs to be specifically enabled, VIA Padlock is always enabled, see

OpenVPN Client Export Package

Ensure you install the (optional, but highly recommended) [WayBack] OpenVPN Client Export Package:

Allows a pre-configured OpenVPN Windows Client or Mac OS X’s Viscosity configuration bundle to be exported directly from pfSense.

These config files work with Tunnelblick as well, which is a great free and open source OpenVPN tool on Mac OS X / MacOS:

Creating and exporting users

I have yet to cover these two; for now read [WayBack] How to setup OpenVPN on pFSense? | IT Blog and [WayBack] OpenVPN Remote Access Server – pfSense Documentation.

Further reading

I like this overview a lot:

–jeroen

Read the rest of this entry »

Posted in Internet, pfSense, Routers | Leave a Comment »

Windows 7 Blue Screen Of Death with error 0x7B – twm’s blog

Posted by jpluimers on 2020/09/28

[WayBack] Windows 7 Blue Screen Of Death with error 0x7B – twm’s blog:

To allow Windows 7 to boot in IDE as well as AHCI mode, I had to enable the following drivers (by setting “Start” to “0” in the registry, there might be other options to do this):

HKLM\System\CurrentControlSet\services\intelide
HKLM\System\CurrentControlSet\services\pciide
HKLM\System\CurrentControlSet\services\msahci
HKLM\System\CurrentControlSet\services\iastorV

The first two allow Windows 7 to boot from SATA in IDE mode. The second two allow Windows 7 to boot from SATA in AHCI mode.

–jeroen

Posted in Development, Power User, Windows, Windows 10, Windows 7, Windows 8, Windows 8.1, Windows 9 | Leave a Comment »

 
%d bloggers like this: