IBNeko's Journal-Nyo~!

[ Warning | Ramble-ly. Pretty technical. Probably boring. I'd skip if I were you. ]

So I finally got around to poking at the 1U HP DL320 G5 server (HP ProLiant DL320 G5 C352 3.20GHz Server, I think?) I picked up sometime back off the side of the street one night on the way home from broad games. It was marked "free" and "works", just missing hard drives and hard drive mounting rails.

I finally got around to booting it up. Threw in two 80GB SATA hard drives, replaced 2x 512MB chips of RAM with 2x 1GB, bringing the total up to a respectable 4 GB.

Surprisingly, everything works except for the DVD-RW drive, which is a tad bit of a pity. Rather, the drive works on boot, but it seems to die after sometime. Ended up downloading Ubuntu 12.04 and dumping it onto a USB stick.

Ran into an odd problem where it kept thinking it was supposed to read from /cdrom. Had to switch into the shell and manually mount /dev/sdc /cdrom, then exit. Rest of the installation went pretty smoothly, aside from learning about LVM and messing up my GRUB install the first time around.

Just finished installing openssh, apache, rvm (ruby-head, etc), mysqld, memcached (not sure why I decided to install that - I'm probably not likely to get around to using it, actually), node.js...

Today I learned about "apt-cache search ...". And how to copy and paste in vi. You'd think I'd know the latter, but I usually get away with using the MacOS X Terminal, where I usually have a pointing device to select text and do your normal copy and pasting.

I just wish it wasn't so damn loud. Stupid fans. Compared to my Mac Mini (that acts as my primary server and backup computer while my laptop gets repaired*), it sounds like a hurricane. Even when the fans aren't on full blast. :\ I dunno, maybe I could sell this for $600-800 and buy another Mac Mini. Although a friend has offered to host this in his basement, and that would work quite nicely, I guess.

I guess the next step is probably going to be to find some way to mask the majority of the sound without tossing it into a closet and causing it to overheat. :\ Failing that, maybe I'll take an early vacation out to Chicago to visit my friend and install the server at his place. XD


*Wifi/Bluetooth cable managed to break. I think a combination of heat and stress and casual use resulted in weakening the surface mount adaptor head or something. Either way, covered by AppleCare and is somewhere in the repair process.

Authentication:
We'll generate a new challege string. This will be composed of:
- a random lifespan
- a random character
- and probably the mysql key for the row we're temporarily storing our randomness in.
We'll encode this in MD5 and send it to the client as the challenge.
Client encodes (password+challenge) with MD5 and sends this back to us.
We compare MD5(password+challenge) with what client replies with.
If they match, they're authenticated.

--
Did I get that right? I've been reading various articles and also looking at livejournal code. I'm pretty sure it's right, as... even if the MD5 hash gets intercepted by someone in the middle, they can't guess the password, since it'll be quite different each time: changing one letter in the string used to generate MD5 will result in a vastly different MD5 hash, if my memory isn't lying. And our challenge string will be different each time.

despiojarse12 mentioned that not only was his computer locked with a BIOS password, but also a HDD Password. Not really haven't heard of hard drive passwords, I went hunting, and here are the results~

(Although, before that, here's stuff on BIOS Password resetting:
http://www.tech-faq.com/reset-bios-password.shtml
http://www.elfqrin.com/docs/biospw.html)

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=15&postdays=0&postorder=asc&start=0
http://ask.slashdot.org/article.pl?sid=03/12/09/2054235
http://www.rockbox.org/lock.html
https://forum.hackinthebox.org/viewtopic.php?p=83468

Technical background:
The ATA Password is part of the ATA-3 specs, designed, and usually enabled on laptops to prevent drive use once the drive is stolen. There are two passwords, one master, one user. Passwords are _not_ stored in the BIOS, so resetting the BIOS will not help you. May do more harm than help? I don't know. The passwords are stored in the drive firmware and failure to enter the password will result in all reads and writes being denied. There is also usually a certain amount of time you can try the password before the drive will lock up, and refuse further attempts until it is powercycled (eh, turned off, then turned back on.)

Information found:
--> May be possible to stick the ATA drive in an IDE USB enclosure. That _may_ bypass the password requirement? One reported success...
--> May be possible, but less likely, to swap the controllers...would require a similar disk drive though.
--> A clean room recovery by moving the actual disk platters to another drive may work.
--> Recovery is possible with professional services, although costly.
--> There are recovery tools online, for a fee. Usually, they're remote services (You install a program, program calls home, and stuff is repaired from there)
--> There are some programs out there to alter settings. Names I've seen include:
-----ATA Password Tool 1.1 (Included in the Ultimate Boot CD: PC repair boot CD)
-----atapwd
--> Formatting the drive may not do you any good; the passwords are apparently stored in firmware, and not on the actual drive...?
--> There's some tool by some company in the UK that'll do something about the password. Vogon was the company name, I believe.