Archive for May, 2017

Disable Windows hibernate on a work notebook or Desktop Gamers PC – Save a lot of Space on Windows C Drive, delete hidefil.sys howto

Thursday, May 18th, 2017

how-to-to-disable-stop-hibernate-windows-8-10-to-save-disk-space-and-get-rid-of-hbierfil.sys-misteriously-occupying-space-improve-windows-performance

Some Windows  laptop / desktop users prefer not to shutdown computers (especially those coming back from Mac OS backgound) at the end of the day but  hibernate instead.

Hibernate is a great thing but historically we know well that in Windows hibernate is working much worser than on Macs and it is common that after multiple hibernates you will face problems with missing  C: drive space is it might be "misteriously" decreasing in a way that the PC performance degrades as the C:hibfile.sys hidden file occupies few 16Gigas or so (the occupied space by hibfile.sys does resemble the installed RAM Memory on the computer, so if your PC has 16Gigas the hibfile.sys will be lets say approximately 15 Gigabytes)

However most users never use hibernate and might never use it for a life time, especially those on a Desktop Windows PCs, I use Windows as a WorkStation as an employee of DXC (the ex Hewlett Packard or Hewlett Packard Enterprise that merged with CSC) but to be honest I've used hibernate function very raraly on the notebook, thus I find the hibernate more or less useless feature, especially because at many times I try to wake-up the PC after hibernate the computer boots but the display stays dark and I have to restart the Computer before I can go back to normal work operations. Of course my Windows 7 hibernation issues might be caused do to the corporate software installed on my PC or because the fact the hard drive is encrypted but nomatter that in my case and I guess in case of many the hibernate function on Windows 7 / 8 / 10 might be totally useless.
 


Few works is Hiberfil.sys File and Why you might want to complete disable / delete it


On Windows 7 / 8 / 10 the hiberfil.sys file is being used to store the PC current state at time of hibernation, so if you have to move from a place to place within an organization / university / office without a charger hibernation is a really nice way to save battery power without later wasting time for additional PC boot (where a lot of power is wasted for Operationg System to load and re-opening the opened Browser etc.

So in short sleeping the PC with Hibernate function does cause the Computer to write into C:hiberfil.sys all data at the moment stored in the PC RAM (Memory), which is being cleared up at time of Computer being in Sleep mode.
Once the computer receives a Wake-up call from the hibernation in order to present with the Desktop at the same state hiberfile.sys stored information is being red and transferred to PC flushable RAM so the RAM memory is again filled with same bits it used to have right before the hibernation was made.

Because hiberfil.sys is a system file it has the hidden attribute and it can only be write / read by a Administrator Win account and usually it is not a good idea to touch it

Some people haven't shutdown Windows for 20-30 days and especially if Windows has disabled updates it happens for some users to use the hibernate function for weeks (re-hibernating and waking up thousand times) for long periods so the effect is the hiberfile.sys might become gigantic and if you take the time to check what is file or directory is wasting all your C:> drive with leys say WinDirStat or SpaceSniffer you will notice the lets say 15Gigas being eaten by Hiberfil.sys.

Disable of hibfile.sys is also a great tip for Gamers desktop PCs as most gamers won't use hibernate function at all.

I. How to Disable Hibernate Mode in Windows 10, 8, 7, or Vista


In order to get rid of the file across Windows 7 / 8 / 10

Open command prompt (as an Administartor, right click on the Command Prompt cmd.exe and choose Run as Administartor) and issue below cmd:

disable-hibernate-on-windows-7-8-10-powercfg-off-screenshot

C:> powercfg -h off

If later you decide you need the hibernate function again active on the PC or notebook do issue:

C:> powercfg -h on

You’re likely reading this because you noticed a gigantic hiberfil.sys file sitting on your system drive and you’re wondering if you can get rid of it to free up some space. Here’s what that file is and how you can delete it if you want to.

 

II. Disable Hibernate Mode in Windows XP

Hibernate function command is not present on Windows XP so in order to remove it on XP (hope you don't use XP any more and you're not a viction of the resent crypt catastrophic ransomware WannaCry 🙂

disable-hibernate-mode-windows-xp-screenshot

Control Panel -> Power Options

In the Power Options properties window, switch to the “Hibernate” tab and disable the “Enable hibernation” option.

After you disable hibernate mode, restart PC, and manually delete the hiberfil.sys file.

Now enjoy free-ing up few gigabytes of useless wasted C: hard drive space from your PC 🙂

Note: Removing hiberfil.sys is a precious thing to do on old Windows Computers which have been made with a little leys say 40Gigabyte partition drive C: whether with the time due to User profile use and Browsing caches the C: drive has left with leys say 1-2 Gigabyte of free space and the computers overall performance has fallen twice or so.

This post is in memoriam of Chriss Cornell (our generation used to grow with grunge and his music was one of the often listened by me and our generation)

R.I.P: Chriss Cornell (the head of SoundGarden and AudioSlave who passed away yesterday right on the day when we in Bulgarian Eastern Orthodox Church commemorate the memory of a great-martyr Nicolay Sofijski (Great Martyr Nicolas from Sofia martyred by Turkish Ottomans during year 1555).

I found surprising fact for me  that Chriss Cornell converted to Greek Eastern Orthodox faith under influence of his Greek Wife, below is paste from his Wikipedia page:

"

Chriss Cornell Personal life (Rest in Peace Chris)

Cornell was married to Susan Silver, the manager of Alice in Chains and Soundgarden.[123] They had a daughter, Lillian Jean, born in June 2000.[123] He and Silver divorced in 2004.[123] In December 2008, Cornell reported via his official website that he had finally won back his collection of 15 guitars after a four-year court battle with Silver.[124]

He was married to Vicky Karayiannis,[125] a Paris-based American publicist of Greek heritage. The union produced a daughter, Toni, born in September 2004, and a son, Christopher Nicholas, born in December 2005.[126] Cornell converted to the Greek Orthodox Church through her influence.[127]

When asked how Cornell beat all his addictions he stated, "It was a long period of coming to the realization that this way (sober) is better. Going through rehab, honestly, did help … it got me away from just the daily drudgery of depression and either trying to not drink or do drugs or doing them and you know, they give you such a simple message that any idiot can get and it's just over and over, but the bottom line is really, and this is the part that is scary for everyone, the individual kinda has to want it … not kinda, you have to want it and to not do that crap anymore or you will never stop and it will just kill you."[128]

In a 2011 interview,[129] Cornell said the major change with the reformed Soundgarden is a lack of alcohol: "The biggest difference I noticed … and we haven't even really talked about it: There are no bottles of Jack Daniel's around or beers. And we never talked about … it's just not there."


Enjoy!

 

Trip to Bakadjiiski ( Bakadji ) monastery Bulgaria near Yambol peak Bakadji and a Rocker Moto feast- A little known tourist Mountain virgin perl of Bulgaria

Saturday, May 13th, 2017

Bakadjiiski_monastery-Holy_Saviour_little-known-cheap-tourist-destination-perl-of-Bulgaria

Perhaps many of Bulgarian citizens and people in Europe who have heard about Bulgaria and its Capital Sofia or have been on a tourism trip to Bulgaria know Saint Alexander Nevski Cathedral in Bulgaria capital Sofia.

However perhaps few know or have heard that saint Alexander Nevskij's Cathedral is not the only Church dedicated to the Russian saint but earlier another small Christian church was build as a remembrance and honor of the Russian-Turkish War Bulgarian liberators who were consisting of (Russian, Belarusians, Ukrainian, Finish and Romanian) soldiers who have sacrificed there life (according to official sources about 70 000 – 100 000 deaths from Russian side) but unofficial sources says 200 000 – 300 000 as a real numbers of victims of Russians and about les say at least 80 000 victims of Bulgarian side.

The Russian-Turkish Liberation war of 1877 and liberation of Bulgarian from Ottoman slavery are among the most notable events for Bulgarian history.

With the coming of peaceful times, the warm feelings and high appreaciation of Bulgarian nation to Russian liberators have been demonstrated numerous times with the creation of innumerable number of Christian Churches and Chapel and other Christian monuments, the most notable along with saint Aleksander Nevski on the city center of Sofia is the monument of emperor Alexander Nikolaevich II-nd   the Liberator

Pametnik_Tsar_Osvoboditel_city-center-Sofia_Alexander_II_Nikolaevich-Russian-emperor-liberator-of-Bulgaria

The first monument in remembrance of the Russo-Turkish Bulgarian Liberation war was built nearby the city of Yambol after the victory of 23rd Donsk – Khazak regiment in Yambol is established 55th infantry (Podolski) regiment, 95th infantry regiment of Krasnoyarsk and some other Russian troop forces while finally in the end of year 1878 here is established 30th infantry regiment of the corups of General Skobelev-Junior.
In the beginning of next year the famous General discusses with Yambol citizens his idea to build a Church "for eternal remembrance of Russian soldiers on the battlefield during the liberation of Bulgarian of Ottoman slavery".

 

Bakadjika-monastery-Church-Saint_Alexander_Nevski-pic

It is decided the idea to be implemented with joint forces between the North slope on the first peak of Bakadjika – also known as "Saint Spas", and on its ridge – on the same place of the Destroyed by Turkish soldiers Monastery "Sveti Spas / Holy Saviour) during the Bulgarian Uprising of April (Aprilsko Vozstanie).
Gen Skobelev and the local people decided to build a small chappel in honor of Russian saint Alexander Nevski who played key role for the rise of Russian nation and thanks to whome Russians managed to escape slavery from the surrounding Turkish khan rulers like Bhatai Khan etc.

With the success of preliminary plan, the place become a common visited (usually mostly during Summer months) by citizens of about 12 km far Yambol city.

With the withdrawal of last Russian soldiers of the region while departing from there general Skobelev gave a precious gift to the newly built Church – an Evangelion with an Engraved Cross.

Evangelion-donated-by-general-Skobelev-to-Bakadjika-church-saint-Alexander-Nevski

Evangelion gift by general Skobelev

The_Crucifix-gift-by-general-Skobelev-to-commemoration-Church

The Cross gift by General Skobelev to the new built memoriam Church saint Alexander Nevski

Icon_Alexander_Nevski-XIX-century-Bakadjika-liberation-memorial-Church

Icon of Alexander Nevski kept in the St. Aleksander Nevski Memorial Church in Bakadjika Holy Saviour Monastery.

After the depearture of Russian soldiers the consturctuion works of the temple are completed by Bulgarians with the material aids from Russia.
The iconostasis follows the Russian Orthodox Church tradition engraved by Russian monks and moved in parts to be mounted in the Church.

monastery_Bakadjishki_Sv_Spas_Holy_Saviour

The gonfalons and most of the icons are brought by Kiev Pechersk Lavra (The biggest and one of oldest if not earliest monastery on Russian lands) nowdays in capital of Ukrain Kiev.

In 1884 with the presence of the Russian embassador for Eastern Romelia with many official guests and locals
the official sanctification of the Church-monumentum st. Alexander Nevski (nowadays Bakadjishki monastery) has beenmade.
The Church and monastery had gone through a really hard times during Communism (Socialism) in Bulgaria 1944-1989 and until 10-15 years ago it has been left in a very bad state.

However thanks to locals and a Hieromonk Sofronij (known by many locals as Stefan Bradata (Stefan The Beard), the monastery has been quickly starting to recover its material base.

Bakadjishki_Monastery_Church_Sv_Spas_St_Alexander_Nevski

hramov_Praznik_Sv-Spas-Bakadjika-near-Yambol-monastery

Fr. Sofronij has been in process of building monastic corups where guests can stay for a night or few but is facing financial problems and he is kindly asking anyone who has the finances and love for Christ and the Eastern Orthodox Church to help with finances, material goods or even workforce and of course novice monks are always needed.

Bakadjishki-monastery-Sv-Spas-interior-Bulgarian-monastery-near-Yambol

Nearby the monastery there is a famous Cave well (holy spring water), which according to the local tradition has been revealed in a dream to a monk and the monks has dug hardly the cave wall about 30 meters and then dug down exactly the the place where the monk had the Vision of the Blessed Mother Mary.
Just like in the dream the Miraculous Holy Spring water has emerged exactly on the place shown in the dream, because of the resemblance of the Well found with the Evangelion story of the Samaritan woman at the well – whose name btw in Christian Eastern Orthodox tradition is Photinia, the well later received a name The Well of Samaritan.

The_Well-of-the-Samaritan-Woman-meeting-Christ-in-Bakajdkishki-monastery-Bulgaria


The entrance door leading to the Cave Samaritan Well

the-well-of-the-samaritan-holy-spring-monastery-bokadjika-near-yambol

The_Well-of-the-Samaritan-Holy-Spring-near-Bakadjishki-monastery-Holy-Savior-Bulgaria-Abbot-Hieromonk-Sofronij

Fr. Sofronij with the Italian sculteres of the Lord Jesus Christ and the Samaritan

Well-cave-near-Bakadjika-monastery

The Well with (Buklica – traditional water vessel in Bulgaria)

The_Samaritan-Well-in-Sveti_Spas_monastery-near-Bakadjika-peak-Bulgaria-Bakadjishki-monastery

Italian statues of Christ and the Samaritan Woman at the Well (Holy Water / Agiasmo / Aiazmo Spring)

In case if you want to spend the night in Bakadjika Monastery for a really cheap – 5 euro please contact:

Yambol Bakadjicite
089 895 4611
bradara_indjata@abv.bg


Each on Bakadjika it has become a local tradition for Rockers / Metalheads and Moto fans all around Southern Bulgaria
to gather near Bakadji just 1 km away from Bakadjiski monastery.
Since ancient times the spiritual centers has always attracted people and perhaps this is also true for Bakadjika which earlier has been a place for a heroic battles for freedom and nowdays has become a rocker arena of a different understanding of wild life and human freedom.

This year 2017 it is the 20th anniversary for Rockers gathering on 12 of May on Bakadjika-Yambol Moto feast to meet other who are alike. The rocker event is about to last 3 days until 15 of May.
For the safety of Rockers this year the rockers has been granted a great honor as a Bishop of the Bulgarian Orthodox Church (Bishop of Agathopol – Ierotey Kosakov his whole biography is on Bg-Patriarchy website here) has personally come to the event to pray (with the so called Vodosvet – Or Blessing of Water) for the well being of the Rockers who are to ride and take participation of organized games and racing events of Bakadjika feast.

Bishop_Ierotey_Ksakovof_Agathopol-Bishop-of-Bulgarian-Orthodox-Church_Moto-rocker-feast-Bakadjika-2017

What is famous near the monastery and perhaps little known outside of Bulgaria and perhaps in Eastern Europe is the existence of Gigantic Monument (Soviet times / Communist) of Bronze build in year 1987 in honor of 110 years of the Liberation of Bulgarian from Ottoman Turkish Slavery. The monument is a kind of symbiosis between concrete plate with plastics and 32 tons of bronze.

The monument depicts events related to Bulgarian history divided on 3 parts.

1. A Russian Soldier and a Bulgarian (opalchenec = guerilla of the liberation war) – symbol of the heroic victory over Ottoman enslavers and the Victory of Christianity on Bulgarian lands over islam

2. Second comes plastics depicting a mother with a child – symbol of continuity between generations

3. A Cosmonaut (Spaceman) – a symbol for Bulgarian-Russian achievements in science and the mastering of cosmic space  and on the top with a plastic is a young-woman – a symbol for advance of resurrected Bulgarian nation

Bakadjik-memorial-of-Russian-liberators

Bakadjik-memorial-of-Russian-Liberators-3

Bakadjik-memorial-of-Russian-Liberators-1

Bakadjik-memorial-of-Russian-Liberators-4

 

How to set the preferred cipher suite on Apache 2.2.x and Apache 2.4.x Reverse Proxy

Thursday, May 4th, 2017

how-to-set-the-preferred-default-delivered-ssl-cipher-suite-apache-2.2-apache-2.4-how-ssl-handshake-works

1. Change default Apache (Reverse Proxy) SSL client cipher suite to end customer for Android Mobile applications to work

If you're a sys admin like me and you need  to support client environments with multiple Reverse Proxy Apache servers include old ones Apache version 2.2.x (with mod_ssl compiled in Apache or enabled as external module)
and for that reason a certain specific Apache Reverse Proxy certificate SSL encoding cipher default served suite change to be TLS_DHE_RSA_WITH_AES_128_CBC_SHA in order for the application to properly communicate with the server backend application then this article might help you.

There is an end user client application which is Live on a production servers some of which running on  backend WebSphere Application Servers (WAS) / SAP /  Tomcat servers and for security and logging purposes the traffic is being forwarded from the Apache Reverse Proxies (whose traffic is incoming from a roundup Load Balancers).

Here is a short background history of why cipher suite change is necessery?

The application worked fine and was used by a desktop PCs, however since recently there is an existent Android and Apple Store (iOS) mobile phone application and the Android Applications are unable to properly handle the default served Apache Reverse Proxy cipher suite and which forced the client to ask for change in the default SSL cipher suite to:

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

By default, the way the client lists the cipher suites within its Client Hello will influence on Apache the selection of the cipher suite used between the client and server.

The current httpd.conf in Apache is configured so the ciphers for RP client cipher suite Hello transferred between Reverse Proxy -> Client are being provided in the following order:

 

1.    TLS_RSA_WITH_RC4_128_MD5
2.    TLS_RSA_WITH_RC4_128_SHA
3.    TLS_RSA_WITH_RC4_128_CBC_SHA
4.    TLS_DHE_RSA_WITH_AES_128_CBC_SHA


This has to be inverted so:

4. TLS_DHE_RSA_WITH_AES_128_CBC_SHA
becomes on the place of
1. TLS_RSA_WITH_RC4_128_MD5


A very good reading that helped me achieve the task as usual was Apache's official documentation about mod_ssl see here


So to fix the SSL/TLS cipher suite default served order use SSLCipherSuite and SSLHonorCipherOrder directives.

 

SSLCipherSuite directive is used to specify the cipher suites enabled on the server.
To dictate also  preferred cipher suite order directive and that's why you need SSLHonorCipherOrder directive (note that this is not available for older  Apache 2.x branch), the original bug for this directive can be seen within
 

For Example:

 

 

SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:AES128-SHA:AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DES-CBC3-SHA

 

 

 

So here is my fix for changing the Ciphersuite SSL Crypt order (notice the TLS_DHE_RSA_WITH_AES_128_CBC_SHA being given as first argument):

 

SSLHonorCipherOrder On
SSLCipherSuite TLS_DHE_RSA_WITH_AES_128_CBC_SHA:RC4-SHA:AES128-SHA:AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DES-CBC3-SHA

if you want also to enable TLSv1.2 certificate cipher support you can use also:
 

SSLProtocol -all +TLSv1.2

SSLHonorCipherOrder on

 

# Old Commented configuration from my httpd.conf – no RC4, 3DES allowed
#SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA 3DES-EDE-CBC-SHA RC4 !aNULL !eNULL !LOW !MD5 !EXP !PSK !SRP !DSS !RC4"

 

Because there was also requirement for a multiple of SSL cipher encryption (to support large range of both mobile and desktop computers and operating systems the final) cipher suite configuration in httpd.conf that worked for the client looked like so:
 

SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!DHE-RSA-AES128-GCM-SHA256:!DHE-RSA-AES256-GCM-SHA384:!DHE-RSA-AES128-SHA256:!DHE-RSA-AES256-SHA:!DHE-RSA-AES128-SHA:!DHE-RSA-AES256-SHA256:!DHE-RSA-CAMELLIA128-SHA:!DHE-RSA-CAMELLIA256-SHA

 


Once this was done the customer requested HTTP cookie restriction to be added to the same virtual host.
There initial request was to:

2. Set HTTP cookie secure flag and HttpOnly on every cookie that is not being accessed from Internal website JavaScript code

To make Apache Reverse Proxy to behave that way here is the httpd.conf config added to httpd.conf
 

# vim httpd.conf

 

   #Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
   Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

Finally an Apache restart was necessery

Linux: /var/log/wtmp – No such file or directory quick fix and why it might be missing on a server

Thursday, May 4th, 2017

fix-var-log-wtmp-btmp-no-such-file-or-directory-linux_last_command-howto-quick-fix

If you have to occasionally log  into some client old inherited (not installed by you) Linux servers on and just out of curiosity and for security sake dediced do a quick security (last user login) evaluation, e.g. issued the
last command just to find out you get the error:

last: /var/log/wtmp: No such file or directory

Perhaps this file was removed by the operator to prevent logging last info.

Then this might be a sure indicator that some malicious script kiddie (hax0r) activity has been run over the server or the ex-system administrator if fired recently decided to wipe out all his login tracks among with installing some other nasty rootkit or backdoor.

Under some circumstances the error might be caused also by badly written end user rotate script bugs (like shell or perl script) bugs or by a buggy deployment of Linux OS virtual machine.
The last: /var/log/wtmp: No such file or directory error is likely to happen on Ubuntu / Debian / Redhat / CentOS Linux distributions running on a Cloud PaaS service such as Amazon EC2, some of the Cloud services vendors do choose to explicitly remove /var/log/wtmp for the reason that many of end customers are using their Linux VM servers (Xen Virtualization / OpenVZ / LXC – Linux Containers) etc. irresponsibly and hence become a victim of script kiddie attacks and the failed logins attempts logged in /var/log/wtmp grow to many gigabytes.

Even some Linux distributions or system administrators of Linux server login hosts that has to keep tens of thousands of  login records monthly or are concentrating on simplicity and on an attempt to reduce size has purposefully deleted the last login entry file /var/log/wtmp file to save space.

But anyways if you happen to be missing this file always bear in mind that you might have been a victim of intrusion and you better run chkrootkit and rkhunter

Run below commands to fix the missing /var/log/wtmp

touch /var/log/wtmp
chmod 0664 /var/log/wtmp
chown root:utmp /var/log/wtmp

On some Linux distributions such as Ubuntu and Fedora you might also want to create /var/log/btmp (which is used to log failed login attempts to server)

touch /var/log/btmp
chmod 0664 /var/log/btmp
chown root:utmp /var/log/btmp

Once the files are created the last command will start logging server in logins and logouts as it is supposed to be again, e.g.:
 

linux:~# last -15
root pts/0 192.168.0.15 Fri May 5 16:41 still logged in


This article was inspired by a prior article found on root.bg the site is in Bulgarian so unfortunately you might not be able to read it, but as a content and concept it is pretty similar to pc-freak.net, actually the site author Nikolay Nikolov (known in Internet Relay Chat IRC under the pseudonym Joni-B, happened to be an old friend from youth geek IT years 🙂

Enjoy