snap install core
snap refresh core

# run this to verify the renew command will work when the timer runs it:
certbot renew --dry-run


I mostly used this article to configure exim to use the letsencrypt certificate: https://www.geekrant.org/2017/04/16/install-exim4-starttls-using-a-free-letsencrypt-certificate/

I made a couple additions on my server to complete this.

Run these to create links so exim can find the current certificate:

ln -s /etc/letsencrypt/live/example.com/fullchain.pem /etc/exim4/exim.crt
ln -s /etc/letsencrypt/live/example.com/privkey.pem /etc/exim4/exim.key


Put a hook script here to fix the permissions after certbot renews a certificate:

vim /etc/letsencrypt/renewal-hooks/post/reset_letsencrypt_perms.sh

#!/bin/bash
chmod -R g+rX /etc/letsencrypt/live/
chmod -R g+rX /etc/letsencrypt/archive/
chgrp -R privkey_users /etc/letsencrypt/archive/
chgrp -R privkey_users /etc/letsencrypt/live
# END OF SCRIPT

Make it executable:

chmod +x /etc/letsencrypt/renewal-hooks/post/reset_letsencrypt_perms.sh


First, to recogize the USB device I had to turn off Fast Boot mode in the BIOS. Then I had to turn off secure boot and choose CSM mode instead of UEFI so it would boot the MBR partition on the USB drive.

In the past I would just make a USB drive or CD with NTPasswd on it. This didn’t work because the drive uses GPT and NTPasswd does not support it.

I found a neat trick to change your password. On the Windows login screen you can press SHIFT 5 times and it will show the dialog asking if you want to enable sticky keys. Apparently this program is sethc.exe. You can replace sethc.exe with cmd.exe. Then when you press SHIFT 5 times you will get the command prompt window running as administrator and you can do what you want.

So I need to get read-write access to the drive to copy cmd.exe to sethc.exe. This can be done with a Windows rescue disk. Just open command prompt from there. Or you can boot some kind of Linux which has GPT support and NTFS read-write support.

I found this neat Linux distro called sysresccd that fits the bill: http://www.sysresccd.org/Sysresccd-manual-en_How_to_install_SystemRescueCd_on_an_USB-stick

I booted that, mounted the partition, made the change, unmounted and rebooted.

These are roughly the commands:


# Verify it picked up the partitions:
dmesg | grep sd

# found it
cd /mnt2/windows/system32
# Make a backup copy of sethc.exe
cp sethc.exe ../../
# Overwrite sethc.exe with cmd.exe
cp cmd.exe sethc.exe
cd /
umount /mnt2
reboot


Boot into Windows again and do the SHIFT x 5 times trick. The command prompt window opens. You can then run net user Administrator NEWPASSWORD and it changes the password. Then you can login with the new password.

You should then reboot your computer into Linux again and put back the right sethc.exe or you will leave a backdoor open on your computer.

• Sometimes tomcat doesn’t stop gracefully and you have to reach for ps, grep and kill
• You have to sometimes pass in some configuration options to Tomcat to enable JMX, increase the max memory it can use, etc.
• The catalina.sh script doesn’t include the commands to make chkconfig and update-rc.d work.
• It doesn’t let you run Tomcat as a different user.
• The restart argument does not work

I started with the script from Yoryos here and modified it to suit my needs a little better: http://blog.valotas.com/2011/05/tomcat-initd-script.html

This script allows you to keep the configuration separate so you don’t have to edit catalina.sh directly. It also handles killing Tomcat in case it doesn’t gracefully shut down.

This script should be put in /etc/init.d/tomcat

On Debian-based systems run this to register the script:
update-rc.d tomcat defaults

On RedHat-based OSes use this to register the script:
chkconfig --add tomcat

#!/bin/bash
#
# tomcat This shell script takes care of starting and stopping Tomcat
# It also handles killing Tomcat in case it doesn't stop gracefully
# It uses a PID file to determine the process ID so it should work with multiple Tomcat instances on one server
#
# chkconfig: - 80 20
#
### BEGIN INIT INFO
# Provides: tomcat
# Required-Start: $network $syslog
# Required-Stop: $network $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Description: Tomcat service
# Short-Description: start and stop tomcat
### END INIT INFO

case $1 in
start)
start
;;
stop)
stop
;;
restart)
stop
start
;;
status)
pid=$(tomcat_pid)
if [ -n "$pid" ]
then
echo "Tomcat is running with pid: $pid"
else
echo "Tomcat is not running"
fi
;;
esac
exit 0

Mar 1 13:35:19 ltps imapd[12525]: imap service init from 192.168.1.42
Mar 1 13:35:19 ltps imapd[12525]: Unable to accept SSL connection, host=dave [192.168.1.42]
Mar 1 13:35:19 ltps imapd[12525]: SSL error status: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number


It turned out being interference from avast anti virus on my desktop causing this. Turn off it’s IMAP checking to work around this.

Here is a powershell script that finds all processes running on port 80 and kills them. This assumes the process is listening on 0.0.0.0 which means all IP’s and network interfaces.


netstat -ano | ? {$_ -like "*0.0.0.0:80 *"} |
% {
$_ -match "\d+$";
echo $matches[0];
taskkill /F /PID $matches[0]
}

Here is the command I’m using.

define command{
command_name check_service_cluster
command_line /usr/lib/nagios/plugins/check_cluster --service -c $ARG1$ -d "$ARG2$" -v
}


When using this command ARG1 indicates the threshold for non-ok data points at which a critical alert is returned. It uses the special threshold syntax.
An example:
@2:2 This means if there are exactly 2 data points in non-ok state return critical

ARG2 should be a comma-separated list of service statuses. The number 0 = OK. The number 2 = CRITICAL. A macro like the following will return the status of a service:
$SERVICESTATEID:host1:service1$

The following are two macros for two services separated by a comma:
$SERVICESTATEID:host1:service1$,$SERVICESTATEID:host2:service1$

The following check_command argument will monitor two services. The @2:2 means it will fail if 2 services are in a non-OK state. The service name is service1 and it will look on host1 and host2.
check_service_cluster!@2:2!$SERVICESTATEID:host1:service1$,$SERVICESTATEID:host2:service1$


One of the features I really liked on my ESPN Remote is the ability to view TV listings on the small screen, then click a button to tune to the channel. Unfortunately this service was recently discontinued.

Some of the things that I think can be accomplished:
– Re-create the TV listing service by redirecting requests to the click365 service and answering the queries with a local web server.
– Install other Windows Mobile programs on the remote.
– Make a web app to control everything in your house via home automation software like MisterHouse.
– Remotely control iTunes via Wi-Fi like the iPhone does.
– Backup all the configuration that has been done to make it work with all my devices.
– Share the programmed IR signals on the remote with other users so that it’s easier to program the remote to work with your devices. This can all be compiled in a database similar to the Logitech Harmony database.
– Control entertainment center devices remotely via the remote and maybe make things switch on/off on a schedule.

Does anybody know how to get into these devices and start hacking on them? What I know so far is as follows.

The remote is running the Windows CE Web Server on ports 80 and 443. I have no idea what any URL’s are that can be accessed though. If we can get to the file system on the remote we could maybe see what URL’s are valid.

Usually you can install ActiveSync or Windows Mobile Device Center and when you connect the device via USB to your PC it lets you browse the files on the device. While these remotes have a USB connector it does not connect with ActiveSync. There must be something disabled on the device causing this. Edit: Looks like this explains how

If there is any interest by other people we could create a project on Google Code or SourceForge and start documenting our work.

Here’s the easiest work-around I’ve found. In PuTTY set the  Terminal-type string under Connection > Data to “linux” instead of “xterm”. This also makes dark colors much brighter, which is great for editing files with comments; usually the dark blue comments are too hard  to read.

If you have many profiles already setup then doing the above can be a pain. To make this easier,  use PuTTY Session Manager. This program can export all your profiles to a reg file, then you can edit the file, do a search/replace (remember to make it case sensitive) and import the file back in. The program is here: http://puttysm.sourceforge.net/

DocuVantage