BeejBlog

I'm not saying the vulnerability isn't fix...

2012-01-20T08:06:28.597-06:00

I'm not saying the vulnerability isn't fixable. It just takes effort, and it's not mentioned on your article... so so called "noobs" may setup a broken site without knowing better, that's all.

Anyway, going fw in my quest for the perfect Photo Gallery server I just tried Piwingo + "Stripped" extension (for theme) and it's looking good. It's as clean as Zenphoto's default template, plus it adapts dynamically for screen size really well and for me it's a killer feature. I guess I'm done with Zenphoto for now.

Here's a demo if you want to see what it looks like: http://photomathias.eu/photos/piwigo/

@Anoymous - I only dabble in Apache occasionally s...

2012-01-19T08:22:02.360-06:00

@Anoymous - I only dabble in Apache occasionally so you're not going to get any valuable direction out of me... but I wouldn't mind educating myself a bit, and clarifying this topic for other passersby, if you're up for it...

The default Zenphoto .htaccess installed on my system is only a list of RewriteRule's... so it doesn't seem like it's really involved in securing the Zenphoto site. Briefly reading Apache's .htaccess tutorial one quickly gets the gist that security matters should be administered at the server .htaccess file level anyway, not at a site level .htaccess file. Could you elaborate on "Zenphoto's default .htaccess files simply aren't enough for protecting the site while in a NTFS filesystem." Or provide references which demonstrate the specific concern?

What is the proposed malicious access path to either config or log files? I'd be really surprised if it's that difficult to configure Apache to not serve certain raw files/folders... that's basic security we should count on in any web server at this point. So i'm still not tracking on what you think the nefarious access path is here. I guess if we simply say Zenphoto may have buffer-overrun bugs which allow someone access to these files through manipulating Zenphoto's own executables... then yes it's a problem, but this common problem must be solved by counting on eliminating those bugs and eventually having a solid product. It's tough to implement a layer of security that is smart enough to know that this executable that would normally be allowed to access files, is somehow not allowed to access files in an errant circumstance, correct?

I really don't mean to burden you do death here but it seems like you have a particular vulnerability in mind that would be nice to identify more specifically... i.e. is there a key phrase for this vulnerability? you aware of any writeups that tee up what we should be watching out for?

Sorry I wasn't specific. The problem arises wi...

2012-01-19T07:41:56.914-06:00

Sorry I wasn't specific. The problem arises with Windows + Apache. Zenphoto's default .htaccess files simply aren't enough for protecting the site while in a NTFS filesystem.

Even if it isn't exactly ok visitors being able to see MySQLs root password the bigger problem is the log file, which may lead to unauthorized access through educated guessing based on unsuccessful logon info... and that is possible no matter what other layers of security are in place (besides disabling Zenphoto's logs or reconfiguring Apache and/or Windows permissions, of course).

@Anonymous[Jan 18, 2012] - IIS won't serve fil...

2012-01-18T07:36:17.679-06:00

@Anonymous[Jan 18, 2012] - IIS won't serve files with anything but well known sanctioned extensions... Apache must behave this way as well... (I'll confirm that these are excluded when I get home tonight).

The next thing that strikes me is that even with the MySQL password, they would need access to the database server to use that information. In my case, that's behind a router and I'd never forward that port through.

This does suggest an area where there could be some more documentation about the recommended environment... mentioning ports and NAT'ed routers, firewalls, etc.

But then, you must forgive me, this blog is primarily intended as a self reference first... unless/until someone chimes in, I'll spend my time on more obvious ROI's :) When someone does, it is a good opportunity to give it a little more time.

Anyway, taking those other layers of security into account, is there still a concern?
If so, please briefly describe an access breach scenario you have in mind so it could be checked.

Thats great... but in this little tutorial of your...

2012-01-18T06:47:22.577-06:00

Thats great... but in this little tutorial of yours you don't touch the .cfg and .log file security issue.

Zenphoto's default for windows is so insecure that literally anyone that visits your site can access all your logs and cfg. That's pretty bad because people can guess passwords much better having this kind of information.

Thank you for making Jared's awesome script ev...

2012-01-08T19:44:37.821-06:00

Thank you for making Jared's awesome script even better!

Through the system profiler on Vanilla SL. I'...

2011-12-09T05:53:48.890-06:00

Through the system profiler on Vanilla SL.

I've got your zip file and installed your Kexts and lo and behold it works, using the older Chameleon RC3/RC4 (can't remember which it is I have installed now!). As long as I have the EVOEnabler.kext in my Extras dir, I have a translucent menu bar and QE CI! I was positive I'd edited the two ATI Kexts properly and done the HEX editing, but obviously I messed something up.

Thanks so much for your help :)

How did you confirm that your DevID is really 7183...

2011-12-08T20:50:00.774-06:00

How did you confirm that your DevID is really 7183?
My 10.6.8 tweaked kexts for x1300 7183

Hey man. I'm on 10.6.8. Edited both of the AT...

2011-12-08T17:42:20.341-06:00

Hey man.

I'm on 10.6.8. Edited both of the ATI1300Controller.kext and ATIRadeonX1000.kext info.plist files, plus hex edited the ATIRadeonX1000.kext as you detailed. I have also edited the info.plist in EVOENABLER.kext, which lives in my Extra folder setting the IOPCIMatch0x71831002

However, even when booting with -f and -v I still am having no joy with QE/CI.

I have tried using Chameleon RC3 and RC4 with GraphicsEnabler but neither works. I am now on RC5 by Dr Hurts from downloaded TonyMac (and had to rename my com.apple.Boot.plist to org.chameleon.Boot.plist) but when I try and register on Voodoo Projects it keeps preventing me giving me an anti-spam error message, even if I try and register via a proxy. As such I cannot get the ATI enabler modules for RC5.

Can you help me at all? If you still have the Snow Leopard files that worked for you with the X1300, would you be able to zip them up and email me them? Hope you can help :)

It is certainly good advice to take if you can. I...

2011-12-04T09:13:50.015-06:00

It is certainly good advice to take if you can.
I did find out some more information about the HIS card that I am using. HIS claims that it is a 5450 card, however the device ID reveals that it is actually a 5430M card that is using the elemuer framebuffer as default however i am assuming that since this is a mobile card on a desktop platform things are different and that is why loading the generic framebuffer yields multiple displays and the proper one does not. While this card does work in 10.7.2 I would suggest to anyone out there to avoid the HIS-5450 card.
Model information is H545HO512
Description:
HIS 5450 Silence 512MB (32 bit) DDR3 PCI-E
HDMI/DVI/VGA
Note: it lists 32 bit in the string but works fine in 64bit mode kernel in Lion 10.7.2

according to my notes above i jumped in on 10.6.3 ...

2011-11-23T13:54:51.726-06:00

according to my notes above i jumped in on 10.6.3 so i'd go ahead and rule out that you're on a known good version number since that's such an easy thing to do... why are you not going right up to 10.6.8 for that matter?

besides text changes to info.plist you have to hex edit the ATIRadeonX1000.kext/MacOS/ATIRadeonX1000 ... you didn't mention that so i'm wondering if you're one of those jokers that can't follow the basics? sorry, but there's more of those out there than not... and frankly, it's hard to have much pity... folks like that were born to simply buy a real mac... those basic mods are spelled out as succinctly as they could possibly be... the kext file being outright gone is weird... maybe it's just become a hidden file somehow... "ls -al" from terminal would be a quick way to determine if they're there but hidden... even if the Darwin boot doesn't load them, it leaves them in place... otherwise what tool are you using to install the kexts? I prefer "Kext Utility" especially now there's a lion compatible version... the, perhaps non obvious, usage is that you drag the kexts onto Kext Utility icon (preferably in your Dock) to install them... so copy them to your desktop, edit them there and then drag them on to KextUtil to install... i do know what you mean about the time wasted... this game really requires one to pay (in blood, sweat and tears) to play... i spent forever banging my head on the leap from 10.6.8 to 10.7... as close as it seems, i don't think anybody has cracked it for this little card yet... and it's such a cute little capable card :) but frankly, the $30-$40 ATI 5450's are just as cute and work like a champ... are you sure your time is so worthless that you can't justify $40... to simply be done with this silly game and running the very latest shiny 10.7.2?

lastly, absolute rebuilds are fairly avoidable if you use the trick of having a working backup OS that you boot into and restore known good kexts in place of the busted ones... Windows + MacDrive works pretty easy... fire up the trial and see how far you can get... even simply deleting the bad kexts and booting into a less than optimal environment works sometimes... you can often get into safe mode (via -x at your chameleon boot screen) and delete the bad kexts out of the way from there... follow the helpful default advice to diskcheck and mount the sys volume... then just rm -R \path\name.kext

any of that help?

Beej....I am running 10.6.2 with ATI X1300 Pro and...

2011-11-23T10:18:54.353-06:00

Beej....I am running 10.6.2 with ATI X1300 Pro and I am baffled how you got it to ger a resolution higher than 1024x768...I used the Text editor to change the info.plist values to 7183.....now the kext file after reboot is no longer there....This is the onlything my system in lacking. I am getting more despressed by the day after 23 complete mac reinstalls to recover from Panics, and 3+ days working on it. I am plain baffled.

I suppose I found the reason. Mine controller is R...

2011-11-18T01:06:50.813-06:00

I suppose I found the reason.
Mine controller is Rocket620
Not RocketRaid 620, but while booting BIOS says that it is RocketRaid and I can create Raids, but no reaction in Mac OS X

The only difference that mine don't have one small chip, but the main chip its the same – Marvell ;(
The rest is absolutely the same

Be attentive when buying them

i'll tinker when i get home from work and let ...

2011-11-16T08:34:58.876-06:00

i'll tinker when i get home from work and let you know... but to be frank, are you sure you care?? that ui is way ugly and i've *never* needed it... do the raid config from a typical bios screen and that's it.

Tried everything – always the same – can't sta...

2011-11-16T01:30:50.376-06:00

Tried everything – always the same – can't start web gui in mac os x.
localhost:7402 – not found.
tried under lion and snow leopard in 64bit and 32bit modes.

may be there is something special I need to do?

RR62x-mac-v110-091222.dmg

The link to driver for 62x is broken and its not a...

2011-11-14T05:09:35.712-06:00

The link to driver for 62x is broken and its not available on official website. Please upload it to somewhere else.
I need it very much

Thanks! now it works great

2011-11-07T17:30:07.088-06:00

Thanks! now it works great

@Ludacrisp - this is the Gigabyte 5450 i got... it's still the same $40 price that your HIS was, is there still time to return it? If you're like me and have already well paid your blood, sweat and tears on an X1300 and you're going with another card to be done with all this frustration... then i think we deserve something as easy as this card. i don't know enough to speculate why your 5450 would be less cooperative. The Gigabyte shows no issues under Lion after running for several hours. in the interest of full disclosure, the only weird thing i've seen is under Win7, single display - the video driver will occasionally crash... i can always get it to recover with a few Windows-P iterations... and i've found that it doesn't seem to happen if i run two displays with extended desktop... interesting, since that would seem to be the more taxing configuration of the two. It is a nicely appointed card with TWO HDMI's plus VGA plus DisplayPort. And the mounting pins on the heat spreader make it pretty easy to canibalize the fanless heat spreader from the x1300 so we don't have to put up with any additional noise signature.

@Ludacrisp Here's my ATI5000Injector.kext... i didn't have to patch anything else, just Kext Helper'ed the injector into Sys-Lib-Ext.
My SysInfo just says "ATI Radeon HD 5000" which is no better than yours... FYI, my Device ID = 0x68f9
OpenGL Extensions Viewer (OEV) says "ATI Radeon Cedar PRO Prototype OpenGL Engine" - interesting, that's slighty different than yours... running its basic cube test in windowed mode on my main 1200p HDMI display was consistently 60 FPS when i allowed the cube test window to overlap the mac dock...with no overlap, it would be near 300 as was full screen mode... when i plugged in a second 720p HDMI projector (and restarted OEV), it did seem to knock it down a bit (275'ish).
Somehow my Chameleon boot log says Megalodon framebuffer but i was under the impression (from Azimutz) that Megalodon was nixed in OSX 10.6.8 and higher... not sure what to make of that... is there a more definitive active framebuffer check?

@Pupin - You are right. Sorry about the misdirecti...

2011-11-06T12:25:12.522-06:00

@Pupin - You are right. Sorry about the misdirection there. Confirmed: The RR64x driver within the "HPT-Quad-eSATA...dmg" currently listed on HighPoint's own support page for this model did not work for me either. RR62x driver from the disc that came in the the box reupped.

Thanks for the update, I too have now moved on to ...

2011-11-06T01:23:50.820-05:00

Thanks for the update, I too have now moved on to an HIS ATI 5450 512mb card for 39.99 ... for some reason OSX sees a 5430 card and it only does dual displays when it loads a generic framebuffer. Graphics Enabler says its supposed to have Elemuer or something close to that, I added the card to ATI5000 and the X3000 kexts to have QE/CI support. The frame rates are terrible though (150fps - 130fps running dual monitors at 1920x1200x32@60Hz and 1920x1080x32@60Hz) and OpenGL Extensions Viewer 4.0 sees it as "ATI Radeon Park LP Prototype OpenGL"
So if I boot with GE=No I get dual displays over DVI->HDMI cable and VGA havent tried the actual HDMI port though. If I boot with GE=Yes I can have only one display, no mirroring either. I have tried 4 alternate frambuffers with the same results. Hoolock, Langur, Orangutan, Zonalis, and the default Elemuer all yield single monitor support.

What is the ATI5000Injector that you are using? I ask as it may allow me to have a proper framebuffer loaded and have higher framerates. Not that I am using it for gaming or anything that needs really high framerates its just the animations of the Stacks on the Dock are kind of laggy and Launchpad transitions are slow. Then again that may just be the way it is with the resolutions I am running and the card being an econo card. In SL there didnt seem to be as much lag using the X1300.

The links are live, however the mac driver links t...

2011-11-05T21:30:18.799-05:00

The links are live, however the mac driver links to rr620c page on hptmac.com.cn, where the downloadable file currently seems to be "HPT-Quad-eSATA-mac-v100-100120.dmg", and not the v1.1.0 driver you are referring to. The HPT-Quad driver does not support the RocketRaid 620, so I'm quite certain that's not the driver you are using. Could you please confirm this and hopefully post the correct driver?

Thanks,
Pupin

Seems that highpoint changed the link in the chine...

2011-11-05T13:48:33.850-05:00

Seems that highpoint changed the link in the chinese site, to some driver in the USA site that doesn't work... Could you please upload the driver you are using somewhere?
Thanks

@Ludacrisvp - sorry, not actively messing with the...

2011-10-31T12:32:22.578-05:00

@Ludacrisvp - sorry, not actively messing with the X1300 anymore... i went with a half height $30 Gigabyte ATI 5450 and haven't looked back... works on all FOUR ports (3 simul displays with DP) with a single ATI5000Injector.kext under Lion... i moved the passive cooler over from the X1300 and it seems to keep it cool enough... couldn't possibly ask for more for that price.