Tuesday, November 30, 2021

Enabling Older Key Algorithms in SSH

Supposedly the server we want to access is at address 192.168.1.11 and it only supports older key hash algorithms.  Add those algorithms in ~/.ssh/config, such as:


 Host 192.168.1.11
        KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1
        PubkeyAcceptedAlgorithms +ssh-rsa
        HostkeyAlgorithms +ssh-rsa



On another occasion, when I do that on Windows 11, I have to create a file %USERPROFILE%\.ssh\config with the content:


Host 192.168.1.11
    KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1
    HostkeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa
    MACS hmac-md5,hmac-sha1




Monday, November 29, 2021

Some tools to display EXIF data

 exifprobe

exiftags

exiftran

exiv2

fim

mediainfo (my favorite)


To install some of those, just install the following:

forensics-all

forensics-extra


Saturday, November 27, 2021

Storage Format for USB Hard Disk

 I recently bought a 5 TB USB3 hard disk to back up my data (mostly my photo and video files.  I had a data disaster recently, so I bought the EaseUS disaster backup data recovery tool, but it required a huge amount of data to restore).

Out of the box, without paying attention to the factory default format it has (extFAT), the 5 TB space has only about 0.6 TB space left.  I doubt I had that much-used data (as the source of the recovered data is from a 1 TB hard drive).  After doing some investigation (the detail is down below), I found out that the allocation unit size (AUS) of the removable hard disk is pretty big, I think it is too big to storage average files.  So I am in the process of backing up the data to my other hard drive (NTFS, 4k AUS), before I can reformat the drive to have a smaller AUS.

Meanwhile, I am not decided whether to stick with extFAT or change it to NTFS.  I don't really care about portability to other OSes, especially Apple products (sorry MacOS!), as I am pretty much a Windows (plus Linux) user.   Yes, I am all aware that so far Linux supports R/W to NTFS in userspace only (the kernel driver only supports read and some limited write access, but that requires some enabling).  But, the good news is that, according to the recent news, a company called Paragon is willing to make its full-blown proprietary NTFS driver (which fully supports NTFS features) to the Linux community.  The effort is planned to be available starting in Kernel 5.15.  This will really boost the performance and features of NTFS in Linux.[1]

To have 256K AUS seems too expensive.  According to [3] for Test 3 and 4 (Read & Write, 1 GB of data file), extFAT is slightly faster, but for smaller files (Test 1 and 2, 1 GB file size), NTFS prevails.  For duplication or deletion (Test 8 and 9), NTFS is more than 1.60 faster than FAT32 and 1.3 faster than extFAT).

Some useful information:

For  2 TB to 16 TB hard drive, 4 KB AUS is enough for an NTFS-formatted hard drive.[2]


Disk Partition Information:


C:\Windows\System32>diskpart


Microsoft DiskPart version 10.0.22000.1
Copyright (C) Microsoft Corporation.

On computer: ASUS-ROGSTRIX-X

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online         3726 GB  1024 KB   *    *
  Disk 1    Online          698 GB      0 B   *    *
  Disk 2    Online          298 GB  1024 KB   *    *
  Disk 3    Online          931 GB  3072 KB        *
  Disk 4    Online         4657 GB      0 B        *
  Disk 5    Online           14 GB      0 B

DISKPART> list volume

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
  Volume 0     X   BACKUP_DISK  NTFS   Simple      3726 GB  Healthy
  Volume 1     Z   SpannedDisk  NTFS   Spanned      996 GB  Healthy
  Volume 2         System Rese  NTFS   Partition    549 MB  Healthy
  Volume 3     C                NTFS   Partition    929 GB  Healthy    Boot
  Volume 4                      NTFS   Partition    544 MB  Healthy
  Volume 5                      FAT32  Partition    299 MB  Healthy    System
  Volume 6                      NTFS   Partition    609 MB  Healthy    Hidden
  Volume 7     I   One Touch    exFAT  Partition   4657 GB  Healthy
  Volume 8         EFI          FAT32  Partition    200 MB  Healthy    Hidden
  Volume 9     E   Win10Pro     NTFS   Removable     14 GB  Healthy

DISKPART> select disk 4

Disk 4 is now the selected disk.

DISKPART> list partition

  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    System             200 MB    20 KB
  Partition 2    Primary           4657 GB   201 MB


select partition 2

Partition 2 is now the selected partition.


DISKPART> filesystems

Current File System

  Type                 : exFAT
  Allocation Unit Size : 256K
  Flags : 00000000

File Systems Supported for Formatting

  Type                 : NTFS (Default)
  Allocation Unit Sizes: 4096 (Default), 8192, 16K, 32K, 64K, 128K, 256K, 512K, 1024K, 2048K

  Type                 : exFAT
  Allocation Unit Sizes: 512K, 1024K, 2048K (Default), 4096K, 8192K, 16384K, 32768K

DISKPART>





Ref:

[1] Linux boosts Microsoft NTFS support as Linus Torvalds complains about GitHub merges | ZDNet

[2] Default cluster size for NTFS, FAT, and exFAT (microsoft.com)

[3] Flexense - Data Management Software - FAT32 vs. exFAT vs. NTFS USB3 Performance Comparison

Thursday, November 18, 2021

Xfinity Superfast still slow

I recently upgraded my Internet connection plan with Xfinity from Internet 200 Mbps plus TV to 900 Mbps Superfast plan (with TV plan dropped.  Who cares with TV these days?).  It was a good deal plan, as I now pay less with a lot faster nominal Internet speed.

In the beginning, after waiting an hour as told by the customer service, I saw the upstream speed improved to 20+ Mbps, but the upstream speed did not increase (stayed at around 140 Mbps).  A few calls/chats with the customer service representatives (they sent a few update signals) and modem and router reboots nothing improved.

After the last call to them, they decided to send a technician to visit the next day.  I had tried almost everything (except setting the router's settings to factory defaults). My home network setup is little bit complicated, with the AP router and DOCSIS 3.1 modem sitting in a mounted rack in the walking closet.  

The coaxial cable from ISP is split through a 1-to-8 Moca-Ready splitter (5-2300 MHz, -11 dB drop between Out and In), because I need to connect the TV in the living room through MoCA as well as some bedrooms and home office.  In the beginning, I thought the chocking was due to interference with MoCA (as the DOCSIS cable modem shared the same coax medium with MoCA modems).   Not sure whether I still need to change that splitter (-11 dB drop is a little too much, not counting the bandwidth is only up to 2300, not 2400 or 2500 MHz.  But when I checked the MoCA specs, the frequency span for MoCA 2.5 is from 1002 to 1675 MHz.)

Out of my patience (I use the Internet on a daily basis as part of Work From Home with Citrix connection, hence requires constant and speedy internet link), I decided to simplify the connection by removing the set-top box (which soon I'd return as I'd no longer have TV service), so the cable modem was wired directly to the ISP (not through splitter).  This did not resolve the data rate, although it improved the SNR in the modem.

Out of my frustration, I factory reset my Synology Router Rt2600a and redid the speed test.  And...voila! I got 700+ Mbps.  Yes, it's still far from 900 Mbps as promised, but at least it's 4x faster than what I got before.  Turned out, the "Threat Prevention" add-on feature in Synology Router was the culprit.  It was CPU-intensive processing, which shouldn't be performed by a normal CPU, probably by a special or dedicated CPU doing this kind of inspection and prevention.

I still really need to have an intrusion prevention feature as it has been securing my home network heavily from hackers and spam.  Perhaps it is time to shop for a dedicated intrusion prevention device.