Tom's IT and Photography

Adding One Time Passwords to Apache

2011-07-22T08:58:00.007+02:00

If you have some restricted information on your website then you would want to protect access to it. The standard procedure to just add a static user/password pair is not very secure. Even when using an encrypted HTTPS site the password is not fully secure from being intercepted. The transmission over the internet is encrypted, but in many cases you are not in full control over the browser you use.

When you are using a browser in an Internet cafe it may have been tampered with and it might pass information you enter to others. Even in some corporate environments the browser has been modified to use a proxy with so called Deep Packet Inspection. The IT department will install a new trusted CA certificate in the browser you use and with or without your knowledge all HTTPS traffic (including private passwords) will be decrypted and inspected for eg virus contamination or other suspicious activities.

So using a static password is not very safe. A common solution for this problem is using One Time Passwords combined with Two Factor authentication.

The concept is simple, allow a password to be used only once or let it have a very limited lifetime. When your password has been intercepted and an intruder wants to use it, then he'll discover that it is no longer valid.

So how do we get One Time passwords?

Simply use an App on your smart-phone. Each time you need to login you enter your 4 digit PIN in the App and you'll receive a one time password in return.

Many OTP apps exist, you should start at http://motp.sourceforge.net to find one for your device. My favorite is DroidOTP for my Android device. You can find it in the Android market.

The other part of the solution is configuring your Apache for MOTP. I'll describe the procedure for an installed Apache22 on FreeBSD, but the Linux procedure would be the same.

http://code.google.com/p/mod-authn-otp/ hosts the code you need. Download the file (currently mod_authn_otp-1.1.4.tar.gz) and extract it in a directory of your choice.

Simply executing:


make
make install

installed it without any problems or warnings on my machine.

The next step is to adapt the httpd.conf.

Add the following line to load the module:


LoadModule authn_otp_module   libexec/apache22/mod_authn_otp.so

Now we need to create the OTP user configuration. Create a directory


/usr/local/etc/apache22/otp/users

and create a file users in it. The owner should be www and the permissions should be 600. The information in it should only be readable by the Apache server because it contains the secret information for the One Time password generation for each user.


cd /usr/local/etc/apache22/otp/users
touch users
chown www users
chmod 600 users

Now add a single line for each user to this file, eg:


MOTP yourname 1234 1234abcdef567812

The first field specifies that we are using the MOTP implementation, the second field is the name of the user, the third a private PIN you have choosen and finally the secret which is used to configure the smart-phone App. How you get this secret depends on the App you use. Most Apps generate this secret for you when you start using them. They show it once and you should copy it to the users file.

With all this in place usage is quite simple. Just enter the following configuration in the .htaccess file in the directory with content you want to protect:


AuthType Basic
AuthName "My restricted data"
AuthBasicProvider OTP
OTPAuthUsersFile /usr/local/etc/apache22/otp/users
OTPAuthLogoutOnIPChange on
OTPAuthMaxOTPFailure 4
OTPAuthMaxLinger 1800
Require user yourname

When you access the content with your browser then you need to enter your username and the OTP password. Grab your phone and start your MOTP App. Enter your pin and type the 6 character string you receive from the App in the password field.

Now you can browse for 1800 seconds. After this period you are asked to enter a new OTP password. If you are paranoid you can lower the 1800 interval.

Dynamic Desktop Background

2011-07-22T07:33:00.020+02:00

Some Linux distributions have the option to refresh your desktop background wallpaper with a random image from a list of images or a specified directory. Ubuntu Natty (11.04) does not offer that option, but even if it did, I have some extra requirements:

Load the image recursively from a tree of directories

Skip portrait orientation images (these will not show nicely on you wide screen)

Skip small images (thumbnails)

So I wrote my own script to dust of my (bash) scripting skills:

RandomBG

It requires the installation of ImageMagick and jhead from your distribution. These are needed for determining the orientation of the image.
Store the script on your computer ($HOME/bin is a good place) and invoke it with two arguments, the image directory (tree) and the delay in seconds between refreshments, e.g.:


RandomBG /data/MyImageCollection 300

You can start the script when you login on your desktop by adding it to the list of startup programs. On Ubuntu Natty you can find this setting as Startup Applications under System Settings.

The default minimum size of an image is 200k. You can easily change it in the script on line 44 by adapting the find command.
Adapting it for KDE or XFCE would require just replacing the single gconftool command.

Update for Ubuntu 11.10 Oneiric Ocelot Unity desktop:

replace the gconftool line with


dconf write /org/gnome/desktop/background/picture-uri "'file:///$foto'"


#!/bin/bash

DIR=${1:?Need an image dir for this arg}
SLEEP=${2:-300}

function Ori()
{
FILE="$1"
ORI=`jhead -v "$FILE"|grep "Orientation ="`
set `identify -format "%w %h" "$FILE"`
W=$1
H=$2

if [[ "$ORI" == "" || "$ORI" =~ 256 ]]
then
    if (( $W > $H ))
    then
      echo "l"
    else
      echo "p"
    fi
else
    if [[ "$ORI" =~ 1 ]]
    then
      if (( $W > $H ))
      then
        echo "l"
      else
        echo "p"
      fi
    else
      if [[ "$ORI" =~ 6 ]]
      then
        echo "p"
      else
        echo "-p"
      fi
    fi
fi
}

OLDIFS=$IFS
IFS=$'\n'
fotos=( $(find $DIR \( -name '*.jpg' -o -name '*.JPG' \) -size +200k) )
IFS=$OLDIFS

while :
do
  ori="x"
  while test $ori != "l"; 
  do
    foto="${fotos[ $RANDOM % ${#fotos[@]} ]}"
    ori=$(Ori "$foto"); 
  done
  echo $foto
  gconftool -t string -s /desktop/gnome/background/picture_filename "$foto"
  sleep $SLEEP
done

Pentax shake reduction with long lenses

2009-05-03T21:35:00.007+02:00

I read a few times that the in body shake reduction is less effective for longer focal lengths. I own an old Tokina-ATX 400mm AF lens and a K10D and wondered how effective it would be. So I did a quick test, three hand held shots at 1/15s, ie 5 stops below 1/600s.

Result: good, moderate, decent

and with SR off: bad, bad, bad

Conclusions, even with my old trusty K10D a very decent result!

First the three SR images, followed by 3 without SR:

Pentax 540 and Metz 58 comparison

2009-03-29T11:00:00.012+02:00

I've had a Metz58 flash for a year and a half and received a Pentax 540FGZ a few months ago.

I wanted to test various combinations of these flashes, see the effect of contrast control, etc.

First some remarks not related to the flash behavior:

I like both units, the bodies of both feel sturdy. I would perhaps rate the feel of the 540 flash head higher than the Metz. On the other hand the 540 has a battery cover which feels fragile, I operate it with care. Also the control sliders of the 540 feel less solid, but not in such a way that I feel that they are likely to malfunction.

Completely subjective: the 540 has slightly better looks.

You can find the complete 21 page test report in PDF form here (Updated June 2009).

Final conclusions:

Contrast mode

Contrast mode works, but not in the way I would expect, c.q. wish it to work. The flash with contrast-on emits less light, but contrast-on does not work for the on camera master. So one cannot have the on camera master act as fill.

Contrast mode implementation on the Metz and 540 are not completely similar. The 540 produces slightly different results (lower ratio for the off camera slave?) than the Metz as off camera slave.

When using 2 slaves the contrast-on option gives inconsistent results. If the Metz has contrast-on then the option has no effect. If the 540 has the option on then the Metz does not fire.

In a controlled environment one should use manual for really predictable results.

In a dynamic environment with a master flash on the camera one should move the slave flash away/towards the subject to change the master/slave ratio or play with exposure compensation on both flashes.

Which Flash?

Both the Metz-58 as the Pentax 540 are really nice flashes. I think I prefer the Metz as on camera bounce flash with the option to use the second reflector as fill. The 540 is really good as off camera flash and even has an optical slave mode.

I also considered the Metz-48 and Pentax 360 flashes. They are good options as long as one is not interested in using multiple flashes. The drawback of the Metz-48 is that it cannot act as a master/controller on camera, otherwise it would be a great second flash for me. The main drawback for me of the Pentax 360 is not that it doesn't have the swivel head (I assume I could live with that), but that off camera the automatic power off option cannot be disabled. I use off camera flashes a lot with optical or radio triggers and having to turn the 360 manually on after a few minutes (and restoring all its settings) is no option for me.

See Mattdm's site: http://pttl.mattdm.org/

for more flash options and all kinds of details about the flashes.

An Ultra Narrow Grid Spot for your flash

2009-03-28T18:08:00.002+01:00

Last week I made a grid spot from drinking straws for my flashes. You can read about these DIY devices here.

It took me a few hours to build one with 4.5 cm straw fragments. The result was nice. The spot creates a circle of light about 20 cm wide when used from a distance of about 1.5 meters. (Note: In The Netherlands you can find these black straws at the Xenos or the Ikea)

I wished however for a tighter beam of light and wondered if I could use the complete straws in a construction. I'm a bit lazy and didn't want to glue a cardboard/straw assembly together only to discover that it did not work. So I tried the following:

I bundled two packs of straws with two rubber bands (a band on each end) so that they formed a nice circle. I used an already home made snoot as container, c.q. flash mounting device. To prevent light leakage I wrapped a black cloth (a.k.a. a pair of socks) around the straws and put this in the front of the flash mounted snoot:

The result was great! This grid created a spot as shown on the first image. The hot spot is about 5 cm when used from a distance of about 1.5 meters. Not only was it quick to assemble, but this way the snoot can function as a snoot AND a grid spot. So the bundle of straws and the sock get a nice permanent place in my flash bag...