weechat for xchat refugees.

As I was looking for ways to improve my screen real estate. I started looking for alternative irc clients to the graphical one I was using (xchat).

So I began to research different clients (ones that could be run from a terminal) and started a personal selection process.

My research lead me to two clients (irssi and weechat) and in the end I settled on weechat.

• Note: This post is not to explain why I chose which client (I may do that in another post) however, this post is to document my move from xchat to weechat and how I made it feel similar to what I was used to.

I was inspired by Dennis Kaarsemaker's post on irssi for xchat refugees, and thus how I got the title for this post.

With that said, the weechat getting started guide is quite good, for any one starting with IRC or moving to the weechat client.

One of the hardest thing to understand (or find information on) about terminal based irc clients is what what each component of the main layout is or stands for.

Weechat in and of its self did not make this easy, however once you know where to look (the weechat users guide, on screen lay out), you quickly figure it out. In short, by default weechat gives you a chat area and 4 primary bar's (interactive areas). If you try and relate this to xchat its everything except the channels / servers (networks) list that you see on the left by default.

So out the door, weechat gets you fairly close to the default xchat layout with out having to do anything (this is nice if your looking to make a simple transition).

However while the title, input and nicklist bars are simple to understand/ decipher their content in the status bar left me baffled for some time. While its simple to understand the point of the status bar its contents were not clean until I looked up the configuration for weechat.bar.status.items.

/help weechat.bar.status.items
Option "weechat.bar.status.items":
  description: items of bar, they can be separated by comma (space between items) or "+" (glued items); special synta "@buffer:item" can be used to force buffer used when displaying the bar item
  type: string
  values: any string
  default value: "[time],[buffer_last_number],[buffer_plugin],buffer_number+:+buffer_name+(buffer_modes)+{buffer_nicklist_count}+buffer_zoom+buffer_filter,[lag],[hotlist],completion,scroll"
  current value: "[time],buffer_number+: +buffer_name,[lag],completion,scroll"

As you can see from the output I have changed my status bar to fit my needs, as I don't need or like all the default items. You can do the same, however the reason for explaining this again is to give you a reference for the default layout.

For someone used to xchat the channels/servers (networks) list will likely be important. To solve this, I went to the weechat plugin infrastructure and found 2 plugins (scripts), that build this list and keep it sorted in a similar way to xchat.

The buffers.pl script builds the channels/network (servers) list automatically and simply displays it to you. Installing it is quite simple, as it is with most plugins.

cd ~/.weechat/perl/autoload; wget https://weechat.org/files/scripts/buffers.pl

The next critical plugin to this layout (xchat conversion) is the autosort.py script that arages the channels/servers in alphabetical lists in the same way xchat does. Installing it is the same as the buffers.pl script above.

cd ~/.weechat/python/autoload; wget https://weechat.org/files/scripts/autosort.py

• Note:  I find it easiest to restart weechat to pick up the changes, however I know (and I use), alternative methods to reload scripts / plugins.

The only other change I made to weechat was to make 2 setting modifications so that the channels/servers list is without numbers and is indented (similar to xchat).

/set buffers.look.show_number off
/set buffers.look.indenting on

And with that, you have a terminal based weechat client that looks and feels like xchat.

Because F11, maps to full screen (for most thing) and F12 is my hot key for the Gnome Dropdown Terminal I also make the following change to my weechat.conf file:

diff weechat.conf{,_old}
< meta2-23;3~ = "/bar scroll nicklist * -100%"
< meta2-23~ = "/bar scroll nicklist * b"
< meta2-24;3~ = "/bar scroll nicklist * +100%"
< meta2-24~ = "/bar scroll nicklist * e"
---
> meta2-23~ = "/bar scroll nicklist * -100%"
> meta2-23;3~ = "/bar scroll nicklist * b"
> meta2-24~ = "/bar scroll nicklist * +100%"
> meta2-24;3~ = "/bar scroll nicklist * e"

• Note: You can make the same key binding changes with weechat running, however its simpler to find the F12/F11 keys using iniformation from http://www.weechat.org/files/doc/stable/weechat_user.en.html#key_bindings and https://weechat.org/news/ and make the modification in the configuration file.

With this change I make the configuration a little more useful, by mapping alt+F1[1|2] to be the scroll for  the nick bar, as opposed to only being able to see the top or bottom.

Another nice part about weechat is that plugins, like the hilight plugin,
are not needed because weechat can use regular expressions or denote phases in its highlight setting.

Option "weechat.look.highlight":
  description: comma separated list of words to highlight; case insensitive comparison (use "(?-i)" at beginning of words to make them case sensitive), words may begin or end with "*" for partial match; example: "test,(?-i)*toto*,flash*"

One thing that is lacking from weechat that xchat has is gnome integration, with notifications. To be fair to weechat, as this is a terminal tool, the primary notification method is the terminal beep.

To get such a gnome or GUI pop-up notification, I recommend using the lnotify.py (requires notify-python) plugin/script because of its simplicity.

•  Note: on a Fedora system you can get this by running: 

# sudo yum install notify-python.x86_64

One issue I had with it was that Fedora does not have a 'weechat' icon, by default.

Instead of making one (or finding one), I simply used one of the standard gnome icon names to set the plugins.var.python.lnotify.icon option (I use mail-unread), for the plugin, so that libnotify supply an image (instead of a blank space) sending notifications.

I was even able to find, a way to start weechat, so that it looks / feels like a stand alone GUI application, within gnome! 

To do this you can follow Gnome Desktop Files Developer's Guide, or you can simply create a file like the one below, and place it in /usr/share/applications.

[Desktop Entry]
Type=Application
Encoding=UTF-8
Name=WeeChat
Comment=WeeChat GUI
Exec=gnome-terminal --hide-menubar -e weechat
Icon=application.png
Terminal=false

What this does is starts, a gnome terminal, and weechat within it. By hiding the gnome menu bar, the terminal and weechat start to look like any other gnome application. 

With these simple modifications, I was able to quickly transition from xchat to weechat, and the following shows a side by side comparison of the transition. 

Real Estate - Optimizations for Fedora / Linux.

A long time ago, I wrote a post about setting up my move to Linux and some of the tools I was using / learning. Since I wrote that post, I have had a lot of time, to really learn various things about Fedora,and the gnome (window manager).

The most important lesson I feel I have learned in 2 years, is that the tools you choose are important.

Well Duh!

What I mean by this is that, over the last 2 years, I have had to change the way I work. In my job supporting RHEL and JBoss, I had a fairly well defined job role and because of this my tools could be generic or fairly oversimplified.

As I transitioned roles into supporting OpenShift and Cloud Products such as OpenStack, I had to become more mobile -- relying less on my "desktop" setup (with 3 monitors) and more on my "laptop" (with a single 15 inch screen).

In this transition I learned a lot about Screen Real Estate and how the tools you choose to do your day to day work can affect your performance.

In a lot of ways, downsizing to a laptop (solely) can be hard, however it does not have to be a productivity killer.

Gnome 3(the default window manager in Fedora) already has a lot of space saving concepts built in. For example Workspaces allow you to organize your work or tasks on the screen in such a way that you can quickly switch between whatever item needs your focus.

While this is great in my humble opinion it's simply not enough. To give you an idea of what I mean, consider the following:

1. I need a web browser (often takes a full screen, due to the number of tabs I have open). 
• I use this for things like reading email, research, ticketing system, etc.
2. I need a terminal (often takes a full screen, applications stopped following the 80 character rule)
• I use this for server management, log review, text editing, etc (this list could be a post in and of itself).
3. I need some way to communicate
   • IRC -- often takes a full screen, simply so I don't lose my mind.
4. Other tools (that require a full screen):
• Remote Support Client
• WireShark  

With this in mind, you can quickly see I generally get to 4 (or more) work spaces quite quickly. The concept works great if your not getting interrupted and don't have a need to switch between them all the time. It's simply just not effective in my opinion.

Back in my move to Linux I highlighted two tools that started my thought process to improve this situation. The tools were TMUX and the Gnome Drop Down Terminal.

With the Gnome Drop Down Terminal I get to remove one of my work spaces (or hide it), so that I can stay on the work space (or whatever work space I happen to be on) and switch directly to a terminal. In short my terminal is only every quick short cut away (not potentially 2+ short cuts away).

With a terminal only ever a shortcut away, a terminal multiplexer like Screen or TMUX make it simple to have multiple terminals within 2 keyboard shortcuts, no matter what I do.

However even with these tools I potentially still have 2+ work spaces, and this is why I say the tools you choose are important. Let's focus on my last required work space (the one I use for IRC). If the tool is generic or fairly oversimplified (like Xchat, or any GUI IRC client), something designed for the masses, you often have to compromise screen real estate.

Now I am not trying to pick on Xchat or GUI clients, however when it comes to thick clients or FAT applications, when your on a laptop or a limited screen real estate environment, these simply slow / hurt productivity.

So the final major change I made was to move from a GUI based IRC client to a terminal based IRC client.

• See my weechat for xchat refugees article to see how I moved from a GUI client to a terminal client. 

Again because I can get to any terminals with in 2 keyboard shortcuts, no matter what I do, it does not matter how many other optional GUI based applications I have open, because my required items are only every 2 keyboard shortcuts away.

These tools allow me to take full advantage of my limited real estate, while allowing me to expand out (provided I choose the right/most effective tools).

• Note: From the tools I listed above, I have more or less been able to move to 1 (most of them time) work space, as Wireshark can be replaced by tshark (a command line version of the GUI application), however this has quite a steep learning curve.

Quick Start to GNU Screen

Today I sought out to learn screen. So I started by looking at the screen manual to get a good understanding of how the tool worked.

While I was able to get what I feel are the basics down from reviewing the manual, I did not feel that the documentation provided enough information to get you off the ground quickly.

As the aim of this is to be a quick start, I will start with at tl;dr version, and then go into details on how I build out this list.

In short from this list you should be able to get started using screen and build out a productive work environment using a single TTY terminal.

Start Screen: screen
Show Displays: screen -ls
New Window: C-a C-c
Show Window List: C-a "
Switch to Window: C-a ' NUMBER
Next Window: C-a n
Previous Window: C-a p 
Close Window: (Kill Shell - exit) or C-a k (not recommended)
Name a Window: C-a A

Detach from Display: C-a d
Reattach to Display: screen -r NAME

Create Region Horizontal: C-a S
Create Region Vertical: C-a |
Close current Region: C-a X

Send a command to a Window: at NUMBER# stuff "COMMAND\r"
Send a command to all Windows: at \# stuff "COMMAND\r"

---

The first step to learning screen (outside of how to start the program) is how to get the program to do what you want. The key to this is a key binding known as C-a, and what key stroke does is tells screen to listen and intercept other keys as commands, or flags to alter the modes (similar to vim modes) in which screen runs.

- Note: to see if screen in running or how many screens your attached to run the following:

$ --> screen -list
There is a screen on:
        3664.pts-2.HOSTNAME     (Attached)
1 Socket in /var/run/screen/S-USER.

With this understood the next thing to know is how to type the C-a keystroke. C-a is really Ctrl + the 'a' key, and C-a is simply just the short hand notion for this key stroke.

Simply typing the keystroke does not thing unless its paired with other keystrokes (key bindings), of which well talk more about later (as these other key strokes are key to using screen), however its important to know how to interact or start an interaction with the screen utility and not interfere with the the terminal your running.

With an understanding of how to get the screen utilities attention its time to see how screen does what it does. The simplest way to see this is to use the following:

From this picture you can see that display are created and these directly map to tty sessions on the system you can see this with C-a * and who (the system command). 

C-a *

term-type   size         user interface           window       Perms

---------- ------- ---------- ----------------- ----------     -----

 xterm-256c 211x33       USER@/dev/pts/2          0(bash)       rwx

$ --> who

USER    :0           2014-12-18 06:55 (:0)

USER    pts/2        2014-12-18 06:59 (:0)

USER    pts/3        2014-12-18 06:59 (:pts/2:S.0)

USER    pts/5        2014-12-18 07:05 (:pts/2:S.2)

In the examples above you can see that I have 1 display and that its currently viewing window 0 (named bash). From the who output you can see I have another window (2) however it resides in the background. 

This is cool because it allows you to more that one thing at a time because you can switch between windows running different terminals.

To show you how you get to this point simply start screen, then run C-a C-c. The C-c command is what creates a new window. Because this can be done while you are running other tasks the current window is/does not need to be interrupted to get to terminal where you can continue working.

In addition to using windows for this you can use the screen display to do the same task.

Example:

$ --> screen
$ --> #start long running process
.....C-a d
## This detaches you from the screen display. 
$ --> screen -ls  ## -ls is short hand for -list
There is a screen on:
        3664.pts-2.HOSTNAME     (Detached)
...

The nice part about his is that it allows for you to do thing with one terminal that would often require that you back ground process (and loose output to standard out and standard error).

An added benefit to this is that you can share your screen or display. In short multiple users can use screen to attach to a display and from there view the windows that that display is managing.

Screen can also be used to setup a work environment (dual terminals) to you can work and review data at the same time. This is accomplished by using regions a consent that resides with in a display to separate the display in to segments. Using C-a S will create a horizontal split in your window and allow us to use C-a <tab> to move between the regions, and just like the horizontal split a vertical split can be created with C-a |. To then close or remove the region you can run C-a X.

---

One draw back to using screen is that you often loose your ability to scroll (with a mouse). Often this is frustrating for new users because long running tasks often have lots of long running output. To deal with this screen has a scroll feature that can be enable with C-a [. Once enabled you are given vim key bindings to move around the window.

- Note: for convince you can use C-u and C-d to scroll by half pages.

Stand Back I know Regular Expressions

This week I was in training for a Red Hat Certification Exam, and was tasked with setting up some of the RHEL networking components (statically).

All in all not hard, to convert from a dynamic setup to a static setup however to do so you have to know some very permanent information.

Such as your IP address.

All in all this is simple enough to find with the ip addr command however if you look at my system I have 5 interfaces (from docker, my VM network, Wireless, and local interfaces) finding your IP can be a challenge in all of that text. So you need something like grep to help at a very lease highlight what your looking for.

When you start searching the internet you'll likely find something similar to: (found here)

grep -E "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"

Now this does the job (and highlights just what I need), however it's quite the Regular Expression to remember.  If you know a bit about regular expressions you know that this can be simplified, to something like:

grep -E  "(([0-9]{1,3}\.){3}[0-9]{1,3})" 

Note: In the case of my interfaces this (shorter) grep statement does the same thing as the much longer one above. However it's not explicitly checking for valid IP's in the same way that the command above is.

Still not something I'm likely to remember of the cuff but, I at least have a chance of being able to understand what its doing at a quick glance (should I see it in a function, such as the one below). 

ip addr | awk '{print $NF "\t" $2}' | grep -E  "(([0-9]{1,3}\.){3}[0-9]{1,3})" |  sed -e 's/\/[0-9]\{1,2\}/ /g'

Fedora Security Lab | Flight 2 (burt forcing ecrypted drive)

In my last Security Lab Post I demonstrated some fairly simply steps for using Fedora's Security Lab to mount a LUKS encrypted drive.

After figureing out how to do this, I wondered how simple it would be to crack or break into the drive should I forget my password.

Yes, it happens and when it does it SUCKS, as if you off my 1 or 2 characters you have 6-8 permutations of your password to try. 

So I went off to implement a bash based brut force attack to help solve this problem and  have an automated script demonstrate the process.

After doing some research I found this blog post by Steven Hollingsworth and used this as a template for my script.

try: 12 of 64
ESTIMATED COMPLETION: Sun May 19 16:52:51 EDT 2013

********* PASSWORD *********** Success!

Its a simple script that takes a word list (as the 3rd argument) and attempts to unlock the encrypted drive one password at a time.

Developing the word list is realy where the problem is! Here is why ((its time for some math):

Lets assume you have no clue what teh password is (but seeing as most passwords are between 0 an 8 characters long and you know that there are no special characters.

So we can create an alphabet with the following:

echo {a..z} {A..Z} {0..9}

This gives us 62 characters:

echo {a..z} {A..Z} {0..9} | wc -w

 So if our pasword or passphrase was only 1 character long you would have 62 itterations to try before you could be sure that your passphrase is not 1 character long.  So lets say that you think your password is 2 characters long.

2^62

This would give you 4611686018427387904 permutations or itterations that you would have to try before you could confirm that your password is not 2 characters long.

That is not only translates into a time consuming opperation but a resource issue for your system (this was my problem) if you are trying to build this list in memory.

It is because of this reason that building a dictionary is done outside of my script. It is this way for 2 reasons.

1. So that other more efficent tools (or better ideas) can generate the list. 
2. The list can be shorten or created in a way the user chooese. 

My way of doing this is by using bash's carteasina product (rember the command above that I used to create my alphabet, well just remove the spaces).

echo {a..z}{A..Z}{0..9}

This will create a word list of 3 letters with the first letter being a lower case letter, the second being an uppercase letter, and the last being a numeric digit. Or 6760 permutations. This also allows us to narrow our dictionary to passwords that are more likely to be the password that you are looking for.

Example:

for x in $(echo {K,C,k,c}{4t,4t,at,at}{s,z,S,Z,$}); do echo $x >> dictionary; done

With this set up forgoten LUKS passwords are not forgotten long.

Enviornment - (My own little world [changing to Linux])

A while back I wrote about setting up a working enviornment, and some of my favorte power tools (many [all of them I think] of them FREE and OpenSource).

Since writing these articles I have taken a new job with Red Hat, supporting RHEL and JBoss  and have switched my enviornment to Fedora, where all of these Power Tools come standard.

What makes Fedora so great is that it works as a Desktop or Laptop system and with Gnome Extentions, as these extentions allow you to make your desktop your ownt world. This in turn helps you to get familuar with the Power Tools.

I have also found VIM adventures a fun way to learn vim.

Why do I bring up VIM, well in my new enviornemtn VIM is king, Why?

Because my favort tools in Fedora are TMUX and the Gnome Drop Down Termal.  These tools allow me to take full advantage of the my SHEL and keep it just one click away (F12).

Over the last year its allowed me to pick up on other OpenSource Power tools such as curl and awk.

Fedora Security Lab | Flight 1 (examining an ecrypted drive)

Tonight I started to dig into learning more about Computer Security and Forensic. As a new employee to Red Hat I'll be working to expand my knowlage of how Fedora's Security Spin can help me in this process. 

Tonights journy was to install the Spin, and see if I could gain access to my Laptops HDD. 

It was a success.

Now to tell you how I did it. While this may seem failry basic it took arround 2hr to complet this taks (this includes 30 min to download and install the spin). 

Once I became familuar with the spin I began trying to mount my HDD (sda). 

A fairly simply task (for my boot partition)

mount /dev/sda1 /media

I unmount the partition here (so that I can use media as a general mount point).

However mounting my second partition (sda2) was not so easy, for two reasons.

1. I use LUX to encrypt this partition
2. I use LVM to further partition this block partition. 

Be cause of this I first had to find a way to mount my LUKS partitoin, this means unlocking the partition.

cryptsetup luksOpen /dev/sda2 drive
Enter passphrase for /dev/sda2:

What this command does is provides me an LVM mapping for sda2 to /dev/mapper/drive.  With this complete I can then scan all of the drives on the system and provide LVM mappings for each of the LVM partitions. 

vgscan
vgchange -ay VolGroup00

Followinig these commands you simply mount the partitions from your LVM voulum group just like you would any regular partition.

mount /dev/mapper/VolGroup00-root /media/

As I stated at the begining while not overly complicated if your unfamiluar with working with storage devices and LVM and LUKS this process can be fairly complicated and involved.