Vikas N Kumar's Website

SETTING UP INBOUND AND OUTBOUND CALLING ON PHONE SYSTEM WITH ASTERISK

Fri, 27 Feb 2026 00:00:00 -0500

Previously we saw how to setup and internal phone system using Asterisk and old Cisco® phones with extensions. You could call any phone extension in the system directly. However, it did not do any outbound calling to actual phones or receive inbound calls from them.

This post explains how to use a VOIP provider like Twilio or Vonage or VOIP.ms using the concept of SIP Trunking.

By setting up the Asterisk system to use SIP trunking, the phone system can now make outbound calls and receive inbound calls from regular phones. Back in the day, the USA had analog telephones, commonly known as POTS or PSTN, but in the last ten years or so these telephones have completely disappeared and replaced with VOIP phones. Historically, you would have needed a custom PCI-E card to convert your VOIP to POTS technology, but today you do not need that anymore. You can use a VOIP service provider like Twilio or Vonage or VOIP.ms and be successful at doing calls to regular phones. All over the internet using your existing internet connection without paying too much extra.

1. SIP Trunking With Twilio
2. Setting Up Asterisk Configuration
3. Setting Up Firewall Rules
4. References

SIP TRUNKING WITH TWILIO

I chose Twilio to do the SIP trunking, since I already had an external VOIP number with them which was not being used much over the years. The phone number that you can buy from Twilio can also receive text messages. I setup the text message forwarding using Twilio’s TwiML apps to forward to my actual cellphone and let the phone calls on that number be used for SIP trunking with Asterisk.

Here’s a summary of the steps you need to follow. All details are provided in their excellent documentation.

Login to Twilio and access your Dashboard
Create a new SIP Trunk
Disable Secure Trunking for now.
Create a username and password for the SIP trunk authentication from your Asterisk setup. Make sure the password is at least 24-32 characters.
Add your Asterisk server’s external WAN IP address to the allow list. If you have a home IP address since you are setting Asterisk up at home like me, you may want to periodically check this IP address allow list, or allow all IPs (insecure). You may be able to use a Dynamic DNS FQDN here too.
Note down the PSTN host name for your SIP trunk.
Note down all the Twilio IP addresses for your region.

Once you have all this information you can proceed to update the Asterisk configuration to perform calls via the Twilio SIP Trunk.

The setup is identical if you instead choose to use Vonage or VOIP.ms SIP trunking. The only things that will change will be the PSTN hostname which will be unique to each SIP provider, the authentication credentials and the IP addresses.

Twilio notes in their Asterisk setup documentation that they only support ulaw codecs and not others.

SETTING UP ASTERISK CONFIGURATION

Make sure you have Asterisk setup as described in the previous post.

This section will describe adding to that configuration.

You want your Asterisk, which most likely is behind a NAT or Firewall in a LAN, to connect to Twilio over your network’s external IP address that you may have allowed in Twilio’s SIP Trunking setup above.

Asterisk will need to be told that information too.

In /etc/asterisk/sip.conf add the following lines to the [general] section. Remember from the previous post that we used chan_sip and not chan_pjsip in our Asterisk setup.

[general]
;add IP addresses
localnet=192.168.9.0/24         
;externaddr=XXX.XXX.XXX.XXX      
externhost=myhomeip.example.com
externrefresh=180

As you have seen in the previous post, the local LAN address is 192.168.9.0/24 for my system, and maybe different for yours. You have to set that to the localnet configuration option. If you have a known external IP address, you can set that using the externaddr option. If you have a Dynamic DNS setup, you can set that to the externhost option, with a refresh rate set to externrefresh in seconds.

Use either the externhost or the externaddr option, but not both. The externaddr takes precedence.

Now setup the Twilio outbound calling template and details in the sip.conf file at the bottom.

[twilio-trunk](!)
type=peer
context=from-twilio
canreinvite=no
insecure=port,invite
disallow=all
allow=ulaw
;;;NOTE: ENTER YOUR EXTERNAL IP HERE
externaddr=XXX.XXX.XXX.XXX

[twilio0](twilio-trunk)
;;;NOTE: CHANGE YOUR SIP TRUNK TO WHAT YOU SETUP
host=MYSIPTRUNK.pstn.us1.twilio.com
remotesecret=CHANGE_THIS_PASSWORD
secret=CHANGE_THIS_PASSWORD
defaultuser=MYSIPTRUNK_USERNAME

[twilio1](twilio-trunk)
host=54.172.60.0

[twilio2](twilio-trunk)
host=54.172.60.1

As you can see above, these settings will be custom to your SIP trunk setup. You will set your external IP address here optionally, you will setup your PSTN SIP Trunk URL from Twilio, the username and password credentials (as defaultuser, remotesecret and secret), and lastly set all the individual IP addresses as separate sections.

Twilio provides multiple IP addresses for each region, so I added all the IP addresses one at a time for all the US regions. I ended up with 8 such sections. Twilio says that the calls can be received from any such IP address, so it makes sense to add all of them due to load balancing on Twilio’s side.

You may have noticed the context name from-twilio. This has to be defined in the /etc/asterisk/extensions.conf file.

But first, we add an additional extension too. Taking the configuration from the previous post and adding an extra outgoing extension pattern as below.

[extensions]
exten => 100,1,Goto(call-extension,${EXTEN},1)
; Note the duplication of the hint peername
same => hint,SIP/100,SIP/100
exten => 101,1,Goto(call-extension,${EXTEN},1)
same => hint,SIP/101,SIP/101
exten => 102,1,Goto(call-extension,${EXTEN},1)
same => hint,SIP/102,SIP/102
;;; TWILIO SIP TRUNK OUTGOING
exten => _1NXXXXXXXXX,1,Set(CALLERID(all)="Vikas Kumar" <+18888888888>)
same => n,Dial(SIP/twilio0/+${EXTEN})

[from-twilio]
exten => _+1NXXXXXXXXX,1,Dial(SIP/100)

In the above configuration, from-twilio handles all inbound calls received on the SIP trunk phone number, shown above as +18888888888, and routes it to extension 100. It does not ring all the extensions in a round-robin fashion at the moment, just the 100 one.

The outbound calling is done based on the pattern _1NXXXXXXXXX which requires a 1 (US country code) to be dialed followed by 10 digits, and will then route that call to twilio0 as defined in sip.conf. It sets a caller ID, which shows my name and the phone number +18888888888. You should replace that with whatever caller ID name you want to be displayed along with the phone number you have purchased from your SIP provider.

That’s it. Now restart Asterisk or do a reload using the command line interface:

root$ asterisk -rvvvv
CLI> sip reload
CLI> dialplan reload
CLI> core reload

Now you should be able to make outbound calls and receive inbound calls successfully.

You can also use Twilio’s SIP trunk testing system.

But wait, you are behind a Firewall !! Your inbound calls are not coming in.

SETTING UP FIREWALL RULES

You have to let your firewall allow connections from Twilio’s dedicated IP addresses to connect to your Asterisk server’s SIP port 5060 and 5061.

In my case the Asterisk server runs on 192.168.9.99. So the firewall rule will be like below:

Allow Twilio IP range 54.172.60.0/30 and 54.244.51.0/30 on the WAN address at ports 5060 and 5061 to redirect all those connections to IP 192.168.9.99 on ports 5060 and 5061, respectively.

Also allow UDP ports 10000-20000 for RTP packets to enter the firewall and forward them to 192.168.9.99 which is our Asterisk IP. This is required in case you have an external SIP extension that needs to connect to your internal Asterisk IP. This also is required to run the Twilio tests.

Depending on your router, you will need to set this in their port forward setup screen.

That’s it. Now you should be able to call the Twilio number and see your Cisco® VOIP phone ring.

REFERENCES

I was helped by many references from the internet and I am listing all of them here, so they can be of reference to you too.

SETTING UP AN INTERNAL PHONE SYSTEM WITH OLD CISCO® IP PHONES AND ASTERISK

Tue, 24 Feb 2026 00:00:00 -0500

In 2020, I wrote a post on updating firmware on old Cisco® IP phones, and I got carried away by other projects and this project went on the backburner. This year I decided to complete this project, so that I could use these wired VOIP phones as an internal phone system across multiple rooms, where I could dial a number and speak to a person in a different room. I use this to interact with my family members when I want to ask them something and do not want to walk over for whatever reason.

Asterisk is an open source PBX - Private Branch Exchange software that I used to set this up. The process is a bit involved and is tricky to get right if you miss something in the configuration.

I will describe the process in detail in this post. Note that this post does not describe a setup for making outbound calls or receiving inbound calls on actual landline phone numbers. This is for creating a custom extension per phone, and calling those extensions, similar to what you find in hotels, where you can call one room to another by dialing that room’s number.

1. Setup Linux Server
2. Compiling Asterisk And Patching
3. Setting Up Asterisk Configuration
4. Starting Asterisk
5. Factory Reset With Old Firmware
6. Setting Up Each Phone
7. References

SETUP LINUX SERVER

The best way to build a private setup is to use an old laptop or desktop that can run Linux to do this. You could always do it with a VM on the cloud, but I would not recommend that at this time.

I used an Acer Aspire 250 from 2010 with a 64-bit Intel® Celeron processor, 1GB RAM and a cheap 180GB SSD. This laptop is actually sufficient for this project.

I installed Debian 12 (Bookworm) on this laptop but you can also try it with Debian 13 or Debian Testing or Ubuntu. I needed this system to be lightweight and without a GUI, so I used Debian.

The following packages were needed to be installed as dependencies:

$ su -
root$ apt -y install build-essential make git sox ffmpeg libxml2-utils tftpd-hpa \
    net-tools iptables-persistent rsyslog ghostscript apache2 nmap zip wget vim \
    openssh-server rsync mariadb-server mariadb-client bison flex flite curl mpg123 \
    sqlite3 uuid odbc-mariadb sudo subversion unixodbc ipset iptables fail2ban htop \
    tcpdump lame screen easy-rsa sysstat apt-transport-https pkgconf autotools-dev autoconf \
    dpkg-dev libsnmp-dev liblua5.2-dev libspeexdsp-dev libxml2-dev libssl-dev libsqlite3-dev \
    unixodbc-dev uuid-dev libasound2-dev libogg-dev libvorbis-dev libcurl4-openssl-dev \
    libical-dev libspandsp-dev libjansson-dev libsrtp2-dev libneon27-dev liburiparser-dev \
    libavdevice-dev automake libtool-bin portaudio19-dev libpq-dev libresample1-dev \
    libgmime-3.0-dev libiksemel-dev libncurses-dev libnewt-dev default-libmysqlclient-dev \
    libicu-dev libtiff-tools libtiff-dev screen

There maybe other libraries you may need to install while compiling Asterisk.

COMPILING ASTERISK AND PATCHING

If you followed the previous post, your Cisco® IP phones have now been set to SIP mode. To get Asterisk to work with these nearly 15-20 year old phones in SIP mode, we have to patch Asterisk with the patch that makes the phone use call manager. This patch is available from https://usecallmanager.nz/patching-asterisk.html or from the Git repo at https://github.com/usecallmanagernz/patches/.

I chose to use the Asterisk version 20.18.0 since it was marked as stable, and it is what worked for me.

Download Asterisk source v20.18.0 from their download server. It will be under the old-releases folder.

Untar the package and patch the source code.

root$ tar -zxvf asterisk-20.18.0.tar.gz
root$ cd asterisk-20.18.0/
root$ wget https://raw.githubusercontent.com/usecallmanagernz/patches/master/asterisk/cisco-usecallmanager-20.18.0.patch
root$ patch --strip=1 < ./cisco-usecallmanager-20.18.0.patch

Now compile the source code. You can choose to run make menuselect to select options, but I chose the default options as that was sufficient for this setup.

You will then compile and install the compiled binaries, and the samples which installs the configuration files in /etc/asterisk

root$ CFLAGS="-DENABLE_SRTP_AES_GCM -DENABLE_SRTP_AES_256" ./configure
root$ make
root$ make install
root$ make samples

SETTING UP ASTERISK CONFIGURATION

Now that Asterisk has been installed, we have to setup the SIP configuration files.

Asterisk has deprecated their old chan_sip module in favor of chan_pjsip module. HOWEVER, we are going to setup chan_sip for this task and disable chan_pjsip.

This is only due to the fact that these phones are quite old, the chan_sip module works well, the patch applied for the Cisco call manager is for chan_sip and it is much easier to setup.

No changes need to be made in /etc/asterisk/asterisk.conf.

In /etc/asterisk/modules.conf add or edit the following lines, so that you enable chan_sip and disable chan_pjsip.

;noload=chan_sip.so
noload=chan_pjsip.so

In /etc/asterisk/logger.conf add or edit the following lines, so that you enable some logging.

debug.log => error,warning,notice,verbose,debug
trace.log => trace
security.log => security
console => notice,warning,error
messages.log => notice,warning,error
full.log => notice,warning,error,debug,verbose,dtmf,fax

In /etc/asterisk/extensions.conf add the following lines. I have 3 phones, so 3 extensions were added: 100, 101, 102. You may choose different extension numbers or add more or as many as you need.

Remember we are setting up an internal phone system that cannot do outbound calls or receive inbound calls from external phone numbers for this post. The goal is to just call from one phone to another by dialing the extension code.

The call-extension section below is the context defined for the phones and the extensions section below is individual extensions defined with that context. This was copied verbatim from https://usecallmanager.nz/dialplan-extensions.html and modified as per my needs.

[call-extension]
exten => _X.,1,Set(PEERNAME=${EXTEN})
; By manually checking for call-forwarding, the call can be forwarded even if the phone is unregistered
same => next,Set(CALLFORWARD=${SIPPEER(${PEERNAME},callforward)})
same => next,GotoIf($[${LEN(${CALLFORWARD})} != 0]?callforward,1)
same => next,Set(MAILBOX=${SIPPEER(${PEERNAME},mailbox)})
; Phones can be made to play a different ring using the Alert-Info header, see Ring Tones for examples
same => next,ExecIf($[${LEN(${ALERT_INFO})} != 0]?SIPAddHeader(Alert-Info: <${ALERT_INFO}>))
same => next,Dial(SIP/${PEERNAME},30)
same => next,Goto(${TOLOWER(${DIALSTATUS})},1)

; Check if forwarded to the phone's voicemail extension
exten => callforward,1,GotoIf($[${CALLFORWARD} = ${SIPPEER(${PEERNAME},vmexten)}]?busy,1)
; Cisco SIP phones support displaying diversion information
same => next,Set(REDIRECTING(from-all,i)="${SIPPEER(${PEERNAME},callerid_name)}" <${SIPPEER(${PEERNAME},callerid_num)}>)
same => next,Set(REDIRECTING(reason,i)=cfu)
same => next,Goto(extensions,${CALLFORWARD},1)

; If ${MAILBOX} is empty send congestion, otherwise go to voicemail extension below
exten => congestion,1,ExecIf($[${LEN(${MAILBOX})} = 0]?Congestion(10))
same => next,Set(GREETING=u)
same => next,Goto(voicemail,1)

; If ${MAILBOX} is empty send busy, otherwise go to voicemail extension below
exten => busy,1,ExecIf($[${LEN(${MAILBOX})} = 0]?Busy(10))
same => next,Set(GREETING=b)
same => next,Goto(voicemail,1)

exten => noanswer,1,Goto(congestion,1)
exten => chanunavail,1,Goto(congestion,1)

exten => voicemail,1,Answer()
same => next,Wait(0.5)
same => next,VoiceMail(${MAILBOX},${GREETING})
same => next,Hangup(normal_clearing)

[extensions]
exten => 100,1,Goto(call-extension,${EXTEN},1)
; Note the duplication of the hint peername
same => hint,SIP/100,SIP/100
exten => 101,1,Goto(call-extension,${EXTEN},1)
same => hint,SIP/101,SIP/101
exten => 102,1,Goto(call-extension,${EXTEN},1)
same => hint,SIP/102,SIP/102

Edit the /etc/asterisk/sip_notify.conf to have the following configuration for notifying the phones/extensions directly from the Asterisk command line interface (CLI). This will enable the Asterisk administrator to reboot or reload configurations for every phone peer directly from the Asterisk CLI. This content may already be present in the sip_notify.conf file due to the patch that was compiled into Asterisk. I am writing this here in case you need to verify.

; Cisco

[cisco-check-cfg]
Event=>check-sync

[cisco-restart]
Event=>service-control
Subscription-State=>active
Content-Type=>text/plain
Content=>action=restart
Content=>RegisterCallId={${SIPPEER(${PEERNAME},regcallid)}}
Content=>ConfigVersionStamp={00000000-0000-0000-0000-000000000000}
Content=>DialplanVersionStamp={00000000-0000-0000-0000-000000000000}
Content=>SoftkeyVersionStamp={00000000-0000-0000-0000-000000000000}
Content=>FeatureControlVersionStamp={00000000-0000-0000-0000-000000000000}
Content=>HeadsetVersionStamp={0-0000000000}

[cisco-reset]
Event=>service-control
Subscription-State=>active
Content-Type=>text/plain
Content=>action=reset
Content=>RegisterCallId={${SIPPEER(${PEERNAME},regcallid)}}
Content=>ConfigVersionStamp={00000000-0000-0000-0000-000000000000}
Content=>DialplanVersionStamp={00000000-0000-0000-0000-000000000000}
Content=>SoftkeyVersionStamp={00000000-0000-0000-0000-000000000000}
Content=>FeatureControlVersionStamp={00000000-0000-0000-0000-000000000000}
Content=>HeadsetVersionStamp={0-0000000000}

[cisco-prt-report]
Event=>service-control
Subscription-State=>active
Content-Type=>text/plain
Content=>action=prt-report
Content=>RegisterCallId={${SIPPEER(${PEERNAME},regcallid)}}

Edit the /etc/asterisk/sip.conf file with the following details. NOTE: Cisco® phones will need TCP to be enabled for them to work.

Make sure that TCP is enabled in the general section of the sip.conf file.

[general]
tcp_enable=yes
tcpbindaddr=0.0.0.0

In the same file /etc/asterisk/sip.conf now define the Cisco call manager specific settings as below. The extensions have to match the extension numbers in /etc/asterisk/extensions.conf.

All names have been changed to USER_<extension> for privacy but you can setup your own names here. For simplicity the passwords are the same as the extension number. You can change that to any alphanumeric password if you like.

We are using non-secure mode here, so everything is in clear-text, there is no encryption. That is something for a different post in the future, since encryption setup is a lot more complicated and brittle. A lot of these old phones support outdated encryption methods and I did not have time to test that yet.

I have defined a custom section cisco-7941 for all my phone types. It is a very basic configuration and does not do video calls.

The secret, callerid and description can be changed per device as needed. For example, I used my first name as the callerid and description fields instead of USER 100.

[non-secure-mode](!)
transport=tcp

[extension](!)
type=friend
context=extensions
host=dynamic
trustrpid=no
parkinglot=default
allowsubscribe=yes
notifyhold=no
callcounter=yes
videosupport=no
disallow=all
allow=g722,ulaw,alaw,g729

[cisco-usecallmanager](!,extension)
transport=tcp
nat=no
directmedia=no
sendrpid=rpid
rpid_update=yes
rpid_immediate=yes
send_diversion=yes
dndbusy=yes
cisco_usecallmanager=yes
cisco_pickupnotify_alert=from,to
cisco_pickupnotify_timer=5
cisco_keep_conference=no
cisco_multiadmin_conference=yes
huntgroup_default=no

[cisco-7941](!,cisco-usecallmanager)
; These should match <busyTrigger> and <maxNumCalls> in SEPMAC.cnf.xml
busylevel=4
call-limit=5
; Force huntgroup login so that the prompt does not show the logged out message
huntgroup_default=yes
; 79x1 series only support 32-bit tags
encryption_taglen=32

[101](cisco-7941,non-secure-mode)
;; change this password
secret=101
;; change user name caller ID
callerid="USER 101" <101>
;; change description
description="USER 101"
callgroup=1
pickupgroup=1
mailbox=101@default

[100](cisco-7941,non-secure-mode)
;; change this password
secret=100
;; change user name caller ID
callerid="USER 100" <100>
;; change description
description="USER 100"
callgroup=1
pickupgroup=1
mailbox=100@default

[102](cisco-7941,non-secure-mode)
;; change this password
secret=102
;; change user name caller ID
callerid="USER 102" <102>
;; change description
description="USER 102"
callgroup=1
pickupgroup=1
mailbox=102@default

Now that Asterisk has been configured, let’s start it.

STARTING ASTERISK

You will need to create an asterisk user and group.

root$ addgroup --system asterisk
root$ adduser --system --ingroup asterisk asterisk

If your Asterisk install, installed a systemd file you can run

root$ systemctl start asterisk

In my case, I wanted to view the startup screen, so I launched it in a screen terminal.

root$ screen -
screen$ su -g asterisk -c "/usr/sbin/asterisk -mqf -C /etc/asterisk/asterisk.conf" asterisk

This will start Asterisk in the screen and you can see the process working. You can exit this screen session by pressing Ctrl A Ctrl D.

You can also check if Asterisk is listening on both TCP and UDP port 5060 by running netstat -vnatpul | grep 5060.

$ netstat -vnatpul | grep 5060
tcp        0      0 0.0.0.0:5060            0.0.0.0:*               LISTEN      -
udp        0      0 0.0.0.0:5060            0.0.0.0:*                           - 

Now let’s try the Asterisk CLI tool to connect to the Asterisk service.

root$ asterisk -rvvvv
CLI> help

The help command will show you all the supported commands.

The sip show peers command will show you the connected peers (or the extensions) as configured in sip.conf above. The phones may not be connected yet, but if they are you will see all their details and their IP addresses.

The dialplan show extensions will show all the configured extensions as defined in extensions.conf.

CLI> sip show peers
Name/username             Host                                    Dyn Forcerport Comedia    ACL Port     Status      Description                      
100/100                   192.168.9.100                            D  No         No             25348    Unmonitored USER 100
101/101                   192.168.9.101                            D  No         No             42813    Unmonitored USER 101                         
102/102                   192.168.9.102                            D  No         No             39144    Unmonitored USER 102                            
3 sip peers [Monitored: 0 online, 0 offline Unmonitored: 3 online, 0 offline]

CLI> dialplan show extensions
[ Context 'extensions' created by 'pbx_config' ]
  '100' =>          hint: SIP/100,SIP/100                         [extensions.conf:954]
                    1. Goto(call-extension,${EXTEN},1)            [extensions.conf:952]
  '101' =>          hint: SIP/101,SIP/101                         [extensions.conf:956]
                    1. Goto(call-extension,${EXTEN},1)            [extensions.conf:955]
  '102' =>          hint: SIP/102,SIP/102                         [extensions.conf:958]
                    1. Goto(call-extension,${EXTEN},1)            [extensions.conf:957]

-= 3 extensions (6 priorities) in 1 context. =-

Let’s assume all your phones are online.

To reboot a phone with extension 100 remotely, you can run the following command:

CLI> sip notify cisco-reset 100

To reload a phone’s configuration with extension 100 remotely, you can run the following command:

CLI> sip notify cisco-restart 100

Now let us move on to setting up each phone.

FACTORY RESET WITH OLD FIRMWARE

Please read and follow the previous post to update the firmware for the phones first. I am using Cisco® 7961G and 7975G models, which I procured on eBay for $20 each.

You will need the tftpd-hpa setup as in the post. Your router can be configured to make the default TFTP server be 192.168.9.99, which is the IP address of the Asterisk server we will be using here. Your actual IP address may be different.

You will need the firmware updated and working. The phone will end up saying Unconfigured or Registering.

Now remove the firmware from the TFTP folders and only leave the files ending in .loads in there.

SETTING UP EACH PHONE

Each phone has to be configured with a specific XML file, and some generic XML files that should all be placed in the same folder that serves the TFTP service, which in our case is /srv/tftp on the same Linux server that runs Asterisk.

XMLDefault.cnf.xml

This is a file that every phone reads for the firmware to load, and also specifies the IP address of the SIP server. You can download this file here.

Remember to edit the processNodeName to point to your IP address where you run the Asterisk and TFTP servers.

The loadInformation should hold the SIP firmware if you want to upload that each time the phone reboots. The firmware must be placed in the TFTP folder.

I am not clear on whether this firmware needs loading each time.

<Default>
  <callManagerGroup>
    <members>
      <member priority="0">
        <callManager>
          <ports>
            <ethernetPhonePort>2000</ethernetPhonePort>
            <mgcpPorts>
              <listen>2427</listen>
              <keepAlive>2428</keepAlive>
            </mgcpPorts>
          </ports>
          <processNodeName>192.168.9.99</processNodeName>
        </callManager>
      </member>
    </members>
  </callManagerGroup>
  <loadInformation434 model="Cisco 7961G-GE">SIP41.8-4-2S</loadInformation434>
  <loadInformation300 model="Cisco 7961">SIP41.8-4-2S</loadInformation300>
  <loadInformation437 model="Cisco 7975">SIP75.8-4-2S</loadInformation437>
  <loadInformation457 model="Cisco 7975G">SIP75.8-4-2S</loadInformation457>
  <authenticationURL></authenticationURL>
  <directoryURL></directoryURL>
  <idleURL></idleURL>
  <informationURL></informationURL>
  <messagesURL></messagesURL>
  <servicesURL></servicesURL>
</Default>

Other XML Files

The following XML files are downloaded from other Asterisk setups on Github, and the internet referenced later.

Most of these do not need change, and I used them as-is. The UseCallManager.nz site has details on each file if you want to modify them.

dialplan.xml: This file defines a pattern matching for extensions. I used the default patterns since my extensions are internal. You can download this file here.
AppDialRules.xml: The list of transformation rules applied to numbers dialed through either the phone’s received call history or via the bluetooth address book is specified for newer model phones. I used the default patterns since my extensions are internal. You can download this file here.
DialTemplate.xml: Dial templates control what number patterns are valid and how many seconds to wait for extra digits before dialing. I used the default patterns since my extensions are internal. You can download this file here.
FeaturePolicy.xml: Feature policy controls what features are enabled, mostly for newer model phones. I used the default patterns since my extensions are internal. You can download this file here.
SoftKeys.xml: This file defines the configurable keys and tags on the phone. I used the default patterns since my extensions are internal. You can download this file here.

SEPMAC.cnf.xml

Now we come to the main configuration file for each phone. The SEPMAC.cnf.xml file needs to be unique for each phone, where the MAC part is the MAC address of the phone. This MAC address can be found behind the phone in a sticker or by checking the Network Settings of the phone.

For instance, if your phone has a MAC address of 00:AA:BB:CC:DD:EE the file will be called SEP00AABBCCDDEE.cnf.xml. I have provided a sample here and here.

I will mention the important changes I made to this file for each phone. You must verify that these changes are per your liking.

First check the NTP server information. I use pool.ntp.org and setup my time zone to be Eastern Standard/Daylight Time since I am in that time zone. I also selected M/D/YY for the date display on the phone since I am in the USA. You may prefer D/M/YY instead.

    <dateTimeSetting>
      <dateTemplate>M/D/YY</dateTemplate>
      <timeZone>Eastern Standard/Daylight Time</timeZone>
      <ntps>
        <ntp>
          <name>pool.ntp.org</name>
          <ntpMode>unicast</ntpMode>
        </ntp>
      </ntps>
    </dateTimeSetting>

Next make sure your IP address for the Asterisk service is set correctly, in my case to 192.168.9.99.

    <callManagerGroup>
      <members>
        <member priority="0">
          <callManager>
            <ports>
              <sipPort>5060</sipPort>
              <securedSipPort>5061</securedSipPort>
            </ports>
            <processNodeName>192.168.9.99</processNodeName>
          </callManager>
        </member>
      </members>
    </callManagerGroup>

Now go to the section titled sipLines in the file. We have a single line defined, since the phone system will answer only on one line at this time. If you want to setup multiple lines you can refer to the UseCallManager.nz website for more details.

As you can see below, I have setup the 100 extension in this specific phone and used the same authName and authPassword as defined in the secret in /etc/asterisk/sip.conf file in the earlier section. The displayName is the same as callerid field in the sip.conf file. The name and featureLabel should be the extension name which in our case is 100.

The busyTrigger and maxNumCalls in this file should match busylevel and call-limit in the sip.conf file.

    <sipLines>
      <line button="1" lineIndex="1">
        <featureID>9</featureID>
        <featureLabel>100</featureLabel>
        <proxy>USECALLMANAGER</proxy>
        <port>5060</port>
        <name>100</name>
        <displayName>USER 100</displayName>
        <autoAnswer>
          <autoAnswerEnabled>0</autoAnswerEnabled>
        </autoAnswer>
        <callWaiting>3</callWaiting>
        <authName>100</authName>
        <authPassword>100</authPassword>
        <contact>100</contact>
        <sharedLine>false</sharedLine>
        <messageWaitingLampPolicy>3</messageWaitingLampPolicy>
        <messageWaitingAMWI>0</messageWaitingAMWI>
        <messagesNumber></messagesNumber>
        <ringSettingIdle>4</ringSettingIdle>
        <ringSettingActive>5</ringSettingActive>
        <forwardCallInfoDisplay>
          <callerName>true</callerName>
          <callerNumber>true</callerNumber>
          <redirectedNumber>true</redirectedNumber>
          <dialedNumber>true</dialedNumber>
        </forwardCallInfoDisplay>
        <maxNumCalls>5</maxNumCalls>
        <busyTrigger>4</busyTrigger>
        <recordingOption>enable</recordingOption>
      </line>
    </sipLines>

Also edit the phoneLabel field to show the name of the phone extension.

    <phoneLabel>USER 100</phoneLabel>

The featurePolicyFile, dialTemplate and softKeyFile should point to FeaturePolicy.xml, DialTemplate.xml and SoftKeys.xml which are placed in the /srv/tftp folder. You can also serve these files via HTTP if you like.

    <dialTemplate>DialTemplate.xml</dialTemplate>
    <softKeyFile>SoftKeys.xml</softKeyFile>

    <featurePolicyFile>FeaturePolicy.xml</featurePolicyFile>

The loadInformation for this phone configuration must have the correct .loads filename which also should match the loadInformation fields in the XMLDefault.cnf.xml file described above. For the Cisco® 7961G, the below loadInformation line was used.

  <loadInformation>SIP41.8-4-2S</loadInformation>

To get the phone directories to work, we need to add a directoryURL field pointing to the XML file with the directory contents and also update the phoneServices to add a Contacts section.

  <phoneServices useHTTPS="false">
    <provisioning>2</provisioning>
    <phoneService type="1" category="0">
      <name>Contacts</name>
      <url>http://192.168.9.99/Directory.xml</url>
      <vendor></vendor>
      <version></version>
    </phoneService>
    <phoneService type="1" category="0">
      <name>Missed Calls</name>
      <url>Application:Cisco/MissedCalls</url>
      <vendor></vendor>
      <version></version>
    </phoneService>
    <phoneService type="1" category="0">
      <name>Received Calls</name>
      <url>Application:Cisco/ReceivedCalls</url>
      <vendor></vendor>
      <version></version>
    </phoneService>
    <phoneService type="1" category="0">
      <name>Placed Calls</name>
      <url>Application:Cisco/PlacedCalls</url>
      <vendor></vendor>
      <version></version>
    </phoneService>
    <phoneService type="2" category="0">
      <name>Voicemail</name>
      <url>Application:Cisco/Voicemail</url>
      <vendor></vendor>
      <version></version>
    </phoneService>
  </phoneServices>

  <directoryURL>http://192.168.9.99/Directory.xml</directoryURL>

As you can see we are serving this Directory.xml file from a HTTP port on the same Linux server running Asterisk. We describe hosting this file in the next section.

Lastly, if you want to setup SSH into the phone, which I have not been able to test fully at the moment, you can edit the sshUserId and sshPassword tags.

  <sshUserId>phone100</sshUserId>
  <sshPassword>password100</sshPassword>

NOTE: The phones are so old that they do not support secure SSH encryption protocols. You may have to downgrade the encryption scheme to get it to work.

Directory.xml

We host the Directory.xml file on an Apache2 service on the same Linux server that runs Asterisk. We installed apache2 as a dependency initially.

For my extensions 100, 101 and 102, the Directory.xml looks like the below. You must change the Name and Telephone tags to match your extensions and caller-IDs.

You will need one DirectoryEntry per extension.

You can download this file here.

<CiscoIPPhoneDirectory>
    <Title>Internal PBX</Title>
    <Prompt>Select Contact</Prompt>
    <DirectoryEntry>
        <Name>USER 100</Name>
        <Telephone>100</Telephone>
    </DirectoryEntry>
    <DirectoryEntry>
        <Name>USER 101</Name>
        <Telephone>101</Telephone>
    </DirectoryEntry>
    <DirectoryEntry>
        <Name>USER 102</Name>
        <Telephone>102</Telephone>
    </DirectoryEntry>
</CiscoIPPhoneDirectory>

When setting up Apache2, you need to make sure it returns this file with a header of Content-Type: text/xml, otherwise the phone will not be able to parse it.

Below is a sample Apache2 configuration that will work. Many examples on the internet dynamically generate this XML file but I have a static file.

<VirtualHost *:80>
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        <Files "Directory.xml">
            ForceType text/xml
        </Files>
</VirtualHost>

You can also use nginx instead of Apache2 if you prefer that. The Content-Type header must be text/xml.

ringlist.xml

If you want to add multiple ringtons to the phone, you will need to setup a ringlist.xml file with the ringtone files along with it in the /srv/tftp folder.

I got a lot of my ringtones from this Github repo and I setup my ringlist.xml file which can be downloaded here.

It will have contents that look like below, where the FileName is the path relative to the TFTP server directory.

<CiscoIPPhoneRingList>
    <Ring>
        <DisplayName>Are you there Male?</DisplayName>
        <FileName>AreYouThere.raw</FileName>
    </Ring>
    <Ring>
        <DisplayName>Are you there Female?</DisplayName>
        <FileName>AreYouThereF.raw</FileName>
    </Ring>
    <Ring>
        <DisplayName>Analog 1</DisplayName>
        <FileName>Analog1.raw</FileName>
    </Ring>
    <Ring>
        <DisplayName>Analog 2</DisplayName>
        <FileName>Analog2.raw</FileName>
    </Ring>
    <Ring>
        <DisplayName>Bass</DisplayName>
        <FileName>Bass.raw</FileName>
    </Ring>
    <Ring>
        <DisplayName>CallBack</DisplayName>
        <FileName>CallBack.raw</FileName>
    </Ring>
    <Ring>
        <DisplayName>Chime</DisplayName>
        <FileName>Chime.raw</FileName>
    </Ring>
</CiscoIPPhoneRingList>

Background Images

You can change the background image by creating a Desktop folder with a structure for each phone you want to support.

Details are described in UseCallManager.nz’s description for this feature.

I have placed a sample collection for my 7961G and 7975G phones here. You can run tar -zxvf on the Desktops.tar.gz file and place it in /srv/tftp as is.

As you can see in the below image, I got a Linux penguin icon showing up as my desktop screen. You can see that instead of USER 100 I have used my first name VIKAS in the configurations everywhere, which is visible on the top right corner of the screen.

REFERENCES

I was helped by many references from the internet and I am listing all of them here, so they can be of reference to you too.

Asterisk
Asterisk old releases
FreePBX - I ended up not using the FreePBX software since they wanted me to pay money to get Cisco® phones to work. The whole point of this project is for this to be free.
UseCallManager.nz - There is a ton of information on this site and I have only scratched the surface. Without the hard work that has gone into making this site and the patch, this endeavour would be futile.
Github - usecallmanager
Github - cisco_prov by staskobzar
Github - provision_sccp by dkgroot
Github - chan_sccp by chan-sccp
Github - Cisco7942FreePBX by waynemerricks
Github - Cisco-IP-Phone-Provisioning-Files by NamoDev
Github - Cisco-IP-Phones by PintoBernardo
Github - cisco_voip_phones_xml_generator by MrCirca
Github - old Asterisk configs by jefffall
Cisco Application development notes
Asterisk Pro

WATCHING STREAMING VIA ROKU ON A SUPERSONIC FC9600 CRT TV

Sat, 29 Nov 2025 00:00:00 -0500

On a recent visit to a local hamfest in Parsippany, NJ I ended up purchasing a used portable 5.5” CRT TV with AM/FM radio and a cassette player for $5. I have recently been interested in procuring one of these just to have it, and this was a great opportunity to get one for cheap, in cash. However, I did not know if it worked or not. There was no power cable, and the seller did not have the 10 “C”-size batteries needed for a demo. Yet, I purchased it thinking that if something does not work I will learn to repair it.

This TV did not have any markings besides the word SUPERSONIC on it, so I started doing some research on the web on how to identify and find details on the TV.

POWER RATINGS

First step was to figure out what the electrical requirements for the power supply were. As per Figure 1, there was no labeling so I spent many minutes doing image searches on Google and Duckduckgo to find the best matches.

Figure 1: Underside of the TV with the missing label

And I did, on eBay. Someone had once posted a listing selling the same but unboxed version for $25.

I grabbed all the images from the listing and am reposting them here just in case they disappear from the web.

Figures 2a to 2j are the images from the listing. As you can see that Figure 2i shows the details of the power supply needed: DC 13.5V 1000mA, or 10 1.5V UM-2 “C” Size batteries. But it also worked with a car charger (Figure 2d), which was originally supplied with the TV. Car batteries supply 12V DC, which means that a 12V 1A DC charger would suffice. Figure 2b shows that the DC operation could be anywhere between 12-15V, which works for us.

Figure 2a. Supersonic FC9600 box - front view

Figure 2b. Supersonic FC9600 - side view

Figure 2c. Supersonic FC9600 - power adapter covered in plastic

Figure 2d. Supersonic FC9600 - car charger covered in plastic

Figure 2e. Supersonic FC9600 - unboxed TV covered in plastic - front view

Figure 2f. Supersonic FC9600 - unboxed TV covered in plastic - side view of the power switch

Figure 2g. Supersonic FC9600 - unboxed TV covered in plastic - rear view of the antenna

Figure 2h. Supersonic FC9600 - unboxed TV covered in plastic - side view of the volume control

Figure 2i. Supersonic FC9600 - unboxed TV covered in plastic - bottom view of the factory sticker

Figure 2j. Supersonic FC9600 - image of the user manual

Ok, now I needed to procure a power supply.

STREAMING REQUIREMENTS

Analog over-the-air (OTA) transmission has stopped in the USA, so the only way to use the existing antenna was for AM/FM radio which worked fine. For TV reception through other means, such as a digital antenna, there was a 3.5mm jack labeled EXT ANT which stands for external antenna. I needed a 3.5mm jack to a coaxial convertor or an HDMI convertor or an RCA convertor.

I had a working old Roku LT 2700X from my parents, which currently is over 10 years old now, but still works. It has a 3-pin RCA connector with video and audio outputs.

So technically, I could connect the Roku LT 2700X to the TV with a RCA convertor that would convert to the 3.5mm antenna jack. However, the 3-pin RCA to single-pin 3.5mm cable that I had did not work or transmit correctly. Seemed like I need an RF modulator in the middle.

I needed to procure an RCA-to-coaxial RF modulator, a pre-crimped small coaxial cable, a coaxial cable to 3.5mm jack converter and I would be in business. Start shopping at Amazon!

PARTS NEEDED

Please note these are affiliate links and they are solid products in my experience.

Universal 12V 2A 1A Power Supply AC Adapter with 11 Changeable DC Plug Tips AC to DC12V Power Cord for LED Strip Light CCTV Camera BT Speaker GPS Webcam Router DC12V Wall Plug Charger 6FT
Duracell C Batteries - optional if you want to power the TV with batteries
Fancasee 2 Pack F Type Female to 1/8” 3.5mm Male Mono Plug Jack Adapter Coupler Converter Connector for Coax Coaxial Cable Cord Antenna and More
THE CIMPLE CO - RF Modulator, RCA Composite to RF Coaxial Adapter, Converts Standard Definition Signals to Coax, Watch DVD, VHS, Game Consoles on TV, Includes A/V Cable, Does Not Work in Reverse
Coaxial cable 1ft
a used Roku LT 2700X with remote from eBay, Facebook or someone who has it

STREAMING SETUP

Step 1: Power your TV up with the power supply and test all its switches and the volume. Set it to channel 3 by setting the Band switch to the VHF-L setting as shown in Figure 3. And do not forget to the set the Function switch to TV.

Figure 3. “Channel 3” or VHF-L setting

Step 2: Now let’s connect the coaxial cable end of the 3.5mm Mono Plug Jack Adapter to the coaxial cable first. Then plug in the 3.5mm end into the port labeled EXT ANT on the rear TV panel. See Figure 4 for both the power cable and the coaxial cable with the 3.5mm connector in place.

Figure 4. Connect the coaxial cable via the 3.5mm Mono Plug Jack Adapter to the TV

Step 3: Connect the open end of the coaxial cable to the IN input of the Cimple RCA to Coax RF Modulator, as seen in Figure 5.

Figure 5. RCA-to-Coaxial RF Modulator by The Cimple Co

Step 4: Connect one end of the 3-pin RCA cable to the RF modulator as in Figure 5 and the other end to the Roku LT 2700x as seen in Figure 6.

Figure 6. RCA cable connected to the Roku LT 2700x

Step 5: Power on the TV, RF modulator and the Roku in that order, preferably. If everything has been connected correctly, you will see the Roku boot screen as in Figure 7.

Figure 7. Roku boot screen visible on the Supersonic FC9600 CRT TV

Step 6: Using the Roku remote (not pictured), you can configure the Roku and connect it to WiFi. The Roku LT 2700x does not have an ethernet RJ-45 port to connect it to ethernet, so WiFi is the only option. It will need a 2.4GHz access point.

Step 7: Once your Roku is configured, you can use the Roku remote to navigate their menu and watch Live channels on the Roku UI. Since the Roku is quite old and unsupported, many new apps may not work, but some apps like The Roku Channel continue to work. Figure 8 shows some live news channel I was able to stream on the Supersonic FC9600 using a Roku LT 2700X with an RF modulator.

Figure 8. NYC Mayor-elect Zohran Mamdani on the news giving a speech as seen on TV

The TV works, the radio works but the cassette player does not work. Next thing to fix in the future.

BUILD A MULTI-GPU CLUSTER FOR HASHCAT WITH LINUX AND NVIDIA

Sun, 14 Jan 2024 00:00:00 -0500

Building a multi-GPU Hashcat password cracking cluster can be very economical if you choose a combination of budget GPUs with a reasonable hash rate.

Nowadays, due to the AI craze and before that due to the cryptocurrency craze, there has been a serious price inflation and price gouging by GPU vendors, such as NVIDIA, for graphics cards that can perform a lot of password cracking at scale.

In this post, I show you how to build a multi-GPU cluster and achieve a better price/performance ratio with several budget GPUs as compared to buying one expensive one.

The goal for my use case is to optimize on both price and risk. There is a risk that if you run a lot of password hash cracking on a GPU, that it may wear out earlier. When you use budget GPUs, you may wear them out but they are cheaper to replace, and hence, cost effective.

Except for the GPUs, and their PCI-E risers, everything else I bought pre-owned on online marketplaces, since you don’t need some parts to be new.

I used 5 GPUs for this cluster, and a 6th one can be added to it. This is a self-contained cluster and you do not need a monitor as I use an HDMI screen as part of it.

NOTE: This cluster can be used for machine learning and other CUDA programming too!

REQUIREMENTS

5-6 GPUs NVIDIA GeForce 1650 GTX - Amazon Link, Best Buy Link. I purchased these on sale each for $139.99 during Labor Day and Thanksgiving sales in the USA. So my total cost was less than $900 including taxes, which is cheaper than a new RTX 4090 GPU which can be over $1600. Although the RTX 4090 can provide insane performance, if you can afford it.
Refurbished HP Z840 with 128GB RAM and 1 TB SSD hard drives from eBay for about $460. You can use any other barebones PC, but it does help to have at least 32 GB RAM and 6+ GPU slots. Cryptocurrency miners use motherboards that have 12 GPU slots but you do not get enough RAM or powerful CPUs in those, so the multipurpose nature of your cluster to run machine learning and/or password cracking may not be possible.
Kali Linux or Ubuntu 22.04 LTS
NVIDIA drivers. I am running NVIDIA-Linux-x86_64-535.146.02.run from NVIDIA for Linux.
6 GPU Risers. These are needed to allow the variety of PCI-E slots to be used with the PCI-E x16 GPUs.
Crypto mining rig hardware or a pre-owned rig from Facebook Marketplace. I bought mine for $30 along with all the fans, which I did not use.
EVGA 1500W Power Supply or a pre-owned one that works. I bought mine pre-owned for $40.
Extruded Aluminum if you want to DIY the whole structure from scratch.
Aluminum rail accessories. You will need this for attaching some of the rig parts together, if your rig is like mine.
Brass Standoff screws for attaching the GPUs to the rails.
Tap and Die Set for threading the small holes required for your standoff screws
Drill and drill bits. I already had these and do not count this towards the budget. You can procure the drill on Facebook Marketplace for cheap, and buy new drill bits.
HDMI 7” screen for using as a touch screen monitor.
Metric Allen wrench set
Phillips Screwdriver, Pliers

All in all, with the mix of new and pre-owned equipment, I spent about $1550. If you were to buy everything new, you may end up paying about $500 more, which could be instead leveraged to buy more GPUs. Or you can buy an RTX 4090 and not need anything above!

SETUP

In Figure 1, you see a typical cryptocurrency miner rig. It has 7 large fans, a big 1500W+ power supply, a space to mount the motherboard (shown highlighted by the yellow rectangle) and a wide beam to screw the GPUs onto. You can see my pre-owned frame has some screws still there near the bottom edge of the yellow rectangle on the beam.

Figure 1. A typical cryptocurrency miner rig

But before you do anything to the frame, you want to test your hardware out so that you can make sure that you have all the right parts, your risers work and your GPUs work. Figure 2 shows me testing my hardware out. Testing is described in the section here.

Figure 2. Testing out all the hardware first

I disassemble the whole rig into its parts and find the best matching aluminum legs and corresponding screws to create a flat structure like in Figure 3. If you are not using a pre-designed frame, you can use the Extruded Aluminum to DIY the whole structure. You will need to drill holes and use the tap-and-die set to thread the holes for screws, both standoff screws and any other screws that allow you to put the legs together. You can also use the aluminum rail accessories to attach legs to each other.

I also drilled small 1/8” holes for the M3 screws to hold the GPU risers as shown in Figure 3. You can see my brass standoff screws there waiting to hold GPU risers. NOTE: Make sure your measurements are perfect. I used a painters tape on the aluminum legs, marked and then drilled to make sure I did not get positioning wrong.

Figure 3. Create a new base for the GPU risers

I then installed all the risers, and screwed them in. Then I installed a GPU in each riser. In my frame, as seen in Figure 4, I am using only 4 GPUs. I could have added a fifth GPU riser space but then if I were to upgrade the GPUs to bigger ones, there would be no space for airflow. However, you could design yours better than what I did.

Now follow the documentation of the EVGA power supply and the GPU risers, or Youtube videos, and connect the power cables correctly to the GPU cards, the GPU risers and to the rest of the system.

Figure 4. Top view after the GPUs have been installed

Now connect the riser end to the PCI-E slot of the HP Z840 server as shown in Figure 5. Here I installed my fifth GPU in one of the PCI-E x16 slots so that the computer could display something. In general, GPU risers do not work well with displays. The risers I chose were not being recognized by the BIOS/UEFI for display purposes.

Figure 5. Inside view of the server where the PCI-E connections are made

Everything is connected now. I then built a small front-facing tower so that I could attach the 7” HDMI screen to the front of the GPU rack as shown in Figure 6. The HDMI cable from this screen connects to the GPU that is inside the computer. The screen also has a touchscreen-and-power USB-C cable, which I connected to a USB-3 port on the computer.

Figure 6. HDMI screen installed

LINUX AND DRIVERS

I used Kali Linux on the HP Z840 as it works out of the box, but you can also use Ubuntu 22.04 LTS, if your purpose is something else besides password cracking. Installing Kali Linux follows standard procedure as described here.

Once you have installed Kali Linux, download the appropriate NVIDIA Drivers from https://www.nvidia.com/Download/index.aspx?lang=en-us. Select the correct combination in the form and download the driver file on to the computer. You will need a modern browser like Firefox or Google Chrome to do this. I recommend doing this directly on the computer you are setting up.

The form fields for the GTX 1650 are shown in Figure 7. Once you hit the Search button on the form you will get a file that is most recent from NVIDIA. As of this document, I got the file NVIDIA-Linux-x86_64-535.146.02.run, which means that the NVIDIA driver version is 535.146.02. I then run this file as root as below, and follow the prompts to install everything. Then I install CUDA SDK from here

root$ ./NVIDIA-Linux-x86_64-535.146.02.run
## once completed, install CUDA
root$ wget https://developer.download.nvidia.com/compute/cuda/12.3.2/local_installers/cuda_12.3.2_545.23.08_linux.runsudo sh cuda_12.3.2_545.23.08_linux.run
root$ sh cuda_12.3.2_545.23.08_linux.run

Figure 7. NVIDIA Driver form fields for GTX 1650

Once everything is installed, reboot the system and make sure it boots up so that you can view the HDMI screen showing the Kali Linux desktop as seen in Figure 8. You can also play some Youtube videos or videos using the VLC media player to see if everything is working as seen in Figure 9.

Figure 8. Kali Linux setup completed

Figure 9. Video rendering test from Youtube

DEVICEQUERY

Next we run deviceQuery from the CUDA SDK to make sure that the GPUs are detected and we see the output showing 5 GPUs detected.

$ /usr/local/cuda/extras/demo_suite/deviceQuery
./deviceQuery Starting...

 CUDA Device Query (Runtime API) version (CUDART static linking)

Detected 5 CUDA Capable device(s)

Device 0: "NVIDIA GeForce GTX 1650"
  CUDA Driver Version / Runtime Version          12.2 / 12.2
  CUDA Capability Major/Minor version number:    7.5
  Total amount of global memory:                 3904 MBytes (4093509632 bytes)
  (14) Multiprocessors, ( 64) CUDA Cores/MP:     896 CUDA Cores
  GPU Max Clock rate:                            1590 MHz (1.59 GHz)
  Memory Clock rate:                             6001 Mhz
  Memory Bus Width:                              128-bit
  L2 Cache Size:                                 1048576 bytes
  Maximum Texture Dimension Size (x,y,z)         1D=(131072), 2D=(131072, 65536), 3D=(16384, 16384, 16384)
  Maximum Layered 1D Texture Size, (num) layers  1D=(32768), 2048 layers
  Maximum Layered 2D Texture Size, (num) layers  2D=(32768, 32768), 2048 layers
  Total amount of constant memory:               65536 bytes
  Total amount of shared memory per block:       49152 bytes
  Total number of registers available per block: 65536
  Warp size:                                     32
  Maximum number of threads per multiprocessor:  1024
  Maximum number of threads per block:           1024
  Max dimension size of a thread block (x,y,z): (1024, 1024, 64)
  Max dimension size of a grid size    (x,y,z): (2147483647, 65535, 65535)
  Maximum memory pitch:                          2147483647 bytes
  Texture alignment:                             512 bytes
  Concurrent copy and kernel execution:          Yes with 3 copy engine(s)
  Run time limit on kernels:                     Yes
  Integrated GPU sharing Host Memory:            No
  Support host page-locked memory mapping:       Yes
  Alignment requirement for Surfaces:            Yes
  Device has ECC support:                        Disabled
  Device supports Unified Addressing (UVA):      Yes
  Device supports Compute Preemption:            Yes
  Supports Cooperative Kernel Launch:            Yes
  Supports MultiDevice Co-op Kernel Launch:      Yes
  Device PCI Domain ID / Bus ID / location ID:   0 / 2 / 0
  Compute Mode:
     < Default (multiple host threads can use ::cudaSetDevice() with device simultaneously) >

Device 1: "NVIDIA GeForce GTX 1650"
  CUDA Driver Version / Runtime Version          12.2 / 12.2
  CUDA Capability Major/Minor version number:    7.5
  Total amount of global memory:                 3902 MBytes (4091150336 bytes)
  (14) Multiprocessors, ( 64) CUDA Cores/MP:     896 CUDA Cores
  GPU Max Clock rate:                            1590 MHz (1.59 GHz)
  Memory Clock rate:                             6001 Mhz
  Memory Bus Width:                              128-bit
  L2 Cache Size:                                 1048576 bytes
  Maximum Texture Dimension Size (x,y,z)         1D=(131072), 2D=(131072, 65536), 3D=(16384, 16384, 16384)
  Maximum Layered 1D Texture Size, (num) layers  1D=(32768), 2048 layers
  Maximum Layered 2D Texture Size, (num) layers  2D=(32768, 32768), 2048 layers
  Total amount of constant memory:               65536 bytes
  Total amount of shared memory per block:       49152 bytes
  Total number of registers available per block: 65536
  Warp size:                                     32
  Maximum number of threads per multiprocessor:  1024
  Maximum number of threads per block:           1024
  Max dimension size of a thread block (x,y,z): (1024, 1024, 64)
  Max dimension size of a grid size    (x,y,z): (2147483647, 65535, 65535)
  Maximum memory pitch:                          2147483647 bytes
  Texture alignment:                             512 bytes
  Concurrent copy and kernel execution:          Yes with 3 copy engine(s)
  Run time limit on kernels:                     Yes
  Integrated GPU sharing Host Memory:            No
  Support host page-locked memory mapping:       Yes
  Alignment requirement for Surfaces:            Yes
  Device has ECC support:                        Disabled
  Device supports Unified Addressing (UVA):      Yes
  Device supports Compute Preemption:            Yes
  Supports Cooperative Kernel Launch:            Yes
  Supports MultiDevice Co-op Kernel Launch:      Yes
  Device PCI Domain ID / Bus ID / location ID:   0 / 3 / 0
  Compute Mode:
     < Default (multiple host threads can use ::cudaSetDevice() with device simultaneously) >

Device 2: "NVIDIA GeForce GTX 1650"
  CUDA Driver Version / Runtime Version          12.2 / 12.2
  CUDA Capability Major/Minor version number:    7.5
  Total amount of global memory:                 3904 MBytes (4093509632 bytes)
  (14) Multiprocessors, ( 64) CUDA Cores/MP:     896 CUDA Cores
  GPU Max Clock rate:                            1590 MHz (1.59 GHz)
  Memory Clock rate:                             6001 Mhz
  Memory Bus Width:                              128-bit
  L2 Cache Size:                                 1048576 bytes
  Maximum Texture Dimension Size (x,y,z)         1D=(131072), 2D=(131072, 65536), 3D=(16384, 16384, 16384)
  Maximum Layered 1D Texture Size, (num) layers  1D=(32768), 2048 layers
  Maximum Layered 2D Texture Size, (num) layers  2D=(32768, 32768), 2048 layers
  Total amount of constant memory:               65536 bytes
  Total amount of shared memory per block:       49152 bytes
  Total number of registers available per block: 65536
  Warp size:                                     32
  Maximum number of threads per multiprocessor:  1024
  Maximum number of threads per block:           1024
  Max dimension size of a thread block (x,y,z): (1024, 1024, 64)
  Max dimension size of a grid size    (x,y,z): (2147483647, 65535, 65535)
  Maximum memory pitch:                          2147483647 bytes
  Texture alignment:                             512 bytes
  Concurrent copy and kernel execution:          Yes with 3 copy engine(s)
  Run time limit on kernels:                     Yes
  Integrated GPU sharing Host Memory:            No
  Support host page-locked memory mapping:       Yes
  Alignment requirement for Surfaces:            Yes
  Device has ECC support:                        Disabled
  Device supports Unified Addressing (UVA):      Yes
  Device supports Compute Preemption:            Yes
  Supports Cooperative Kernel Launch:            Yes
  Supports MultiDevice Co-op Kernel Launch:      Yes
  Device PCI Domain ID / Bus ID / location ID:   0 / 4 / 0
  Compute Mode:
     < Default (multiple host threads can use ::cudaSetDevice() with device simultaneously) >

Device 3: "NVIDIA GeForce GTX 1650"
  CUDA Driver Version / Runtime Version          12.2 / 12.2
  CUDA Capability Major/Minor version number:    7.5
  Total amount of global memory:                 3904 MBytes (4093509632 bytes)
  (14) Multiprocessors, ( 64) CUDA Cores/MP:     896 CUDA Cores
  GPU Max Clock rate:                            1590 MHz (1.59 GHz)
  Memory Clock rate:                             6001 Mhz
  Memory Bus Width:                              128-bit
  L2 Cache Size:                                 1048576 bytes
  Maximum Texture Dimension Size (x,y,z)         1D=(131072), 2D=(131072, 65536), 3D=(16384, 16384, 16384)
  Maximum Layered 1D Texture Size, (num) layers  1D=(32768), 2048 layers
  Maximum Layered 2D Texture Size, (num) layers  2D=(32768, 32768), 2048 layers
  Total amount of constant memory:               65536 bytes
  Total amount of shared memory per block:       49152 bytes
  Total number of registers available per block: 65536
  Warp size:                                     32
  Maximum number of threads per multiprocessor:  1024
  Maximum number of threads per block:           1024
  Max dimension size of a thread block (x,y,z): (1024, 1024, 64)
  Max dimension size of a grid size    (x,y,z): (2147483647, 65535, 65535)
  Maximum memory pitch:                          2147483647 bytes
  Texture alignment:                             512 bytes
  Concurrent copy and kernel execution:          Yes with 3 copy engine(s)
  Run time limit on kernels:                     Yes
  Integrated GPU sharing Host Memory:            No
  Support host page-locked memory mapping:       Yes
  Alignment requirement for Surfaces:            Yes
  Device has ECC support:                        Disabled
  Device supports Unified Addressing (UVA):      Yes
  Device supports Compute Preemption:            Yes
  Supports Cooperative Kernel Launch:            Yes
  Supports MultiDevice Co-op Kernel Launch:      Yes
  Device PCI Domain ID / Bus ID / location ID:   0 / 132 / 0
  Compute Mode:
     < Default (multiple host threads can use ::cudaSetDevice() with device simultaneously) >

Device 4: "NVIDIA GeForce GTX 1650"
  CUDA Driver Version / Runtime Version          12.2 / 12.2
  CUDA Capability Major/Minor version number:    7.5
  Total amount of global memory:                 3904 MBytes (4093509632 bytes)
  (14) Multiprocessors, ( 64) CUDA Cores/MP:     896 CUDA Cores
  GPU Max Clock rate:                            1590 MHz (1.59 GHz)
  Memory Clock rate:                             6001 Mhz
  Memory Bus Width:                              128-bit
  L2 Cache Size:                                 1048576 bytes
  Maximum Texture Dimension Size (x,y,z)         1D=(131072), 2D=(131072, 65536), 3D=(16384, 16384, 16384)
  Maximum Layered 1D Texture Size, (num) layers  1D=(32768), 2048 layers
  Maximum Layered 2D Texture Size, (num) layers  2D=(32768, 32768), 2048 layers
  Total amount of constant memory:               65536 bytes
  Total amount of shared memory per block:       49152 bytes
  Total number of registers available per block: 65536
  Warp size:                                     32
  Maximum number of threads per multiprocessor:  1024
  Maximum number of threads per block:           1024
  Max dimension size of a thread block (x,y,z): (1024, 1024, 64)
  Max dimension size of a grid size    (x,y,z): (2147483647, 65535, 65535)
  Maximum memory pitch:                          2147483647 bytes
  Texture alignment:                             512 bytes
  Concurrent copy and kernel execution:          Yes with 3 copy engine(s)
  Run time limit on kernels:                     Yes
  Integrated GPU sharing Host Memory:            No
  Support host page-locked memory mapping:       Yes
  Alignment requirement for Surfaces:            Yes
  Device has ECC support:                        Disabled
  Device supports Unified Addressing (UVA):      Yes
  Device supports Compute Preemption:            Yes
  Supports Cooperative Kernel Launch:            Yes
  Supports MultiDevice Co-op Kernel Launch:      Yes
  Device PCI Domain ID / Bus ID / location ID:   0 / 133 / 0
  Compute Mode:

deviceQuery, CUDA Driver = CUDART, CUDA Driver Version = 12.2, CUDA Runtime Version = 12.2, NumDevs = 5, Device0 = NVIDIA GeForce GTX 1650, Device1 = NVIDIA GeForce GTX 1650, Device2 = NVIDIA GeForce GTX 1650, Device3 = NVIDIA GeForce GTX 1650, Device4 = NVIDIA GeForce GTX 1650
Result = PASS

NVTOP

I also installed NVTOP which is available on Kali Linux as the package nvtop or you can install the latest from Github. Running this shows the usage of the GPUs when you run the hashcat benchmark below.

HASHCAT

Install the package hashcat and run the benchmark as below, and you can view my system’s performance in the attached logs.

$ hashcat -b
hashcat (v6.2.6) starting in benchmark mode

Benchmarking uses hand-optimized kernel code by default.
You can use it in your cracking session by setting the -O option.
Note: Using optimized kernel code limits the maximum supported password length.
To disable the optimized kernel code in benchmark mode, use the -w option.

* Device #1: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #2: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #3: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #4: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #5: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #6: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #7: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #8: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #9: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #10: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
CUDA API (CUDA 12.2)
====================
* Device #1: NVIDIA GeForce GTX 1650, 3845/3903 MB, 14MCU
* Device #2: NVIDIA GeForce GTX 1650, 3813/3901 MB, 14MCU
* Device #3: NVIDIA GeForce GTX 1650, 3845/3903 MB, 14MCU
* Device #4: NVIDIA GeForce GTX 1650, 3845/3903 MB, 14MCU
* Device #5: NVIDIA GeForce GTX 1650, 3845/3903 MB, 14MCU

OpenCL API (OpenCL 3.0 CUDA 12.2.135) - Platform #1 [NVIDIA Corporation]
========================================================================
* Device #6: NVIDIA GeForce GTX 1650, skipped
* Device #7: NVIDIA GeForce GTX 1650, skipped
* Device #8: NVIDIA GeForce GTX 1650, skipped
* Device #9: NVIDIA GeForce GTX 1650, skipped
* Device #10: NVIDIA GeForce GTX 1650, skipped

OpenCL API (OpenCL 3.0 PoCL 4.0+debian  Linux, None+Asserts, RELOC, SPIR, LLVM 15.0.7, SLEEF, DISTRO, POCL_DEBUG) - Platform #2 [The pocl project]
==================================================================================================================================================
* Device #11: cpu-haswell-Intel(R) Xeon(R) CPU E5-2680 v4 @ 2.40GHz, skipped

Benchmark relevant options:
===========================
* --optimized-kernel-enable

-------------------
* Hash-Mode 0 (MD5)
-------------------

Speed.#1.........: 11808.7 MH/s (78.33ms) @ Accel:1024 Loops:1024 Thr:64 Vec:8
Speed.#2.........: 11813.5 MH/s (78.31ms) @ Accel:1024 Loops:1024 Thr:64 Vec:8
Speed.#3.........: 11552.1 MH/s (80.09ms) @ Accel:1024 Loops:1024 Thr:64 Vec:8
Speed.#4.........: 11421.3 MH/s (80.83ms) @ Accel:1024 Loops:1024 Thr:64 Vec:8
Speed.#5.........: 11804.3 MH/s (78.38ms) @ Accel:1024 Loops:1024 Thr:64 Vec:8
Speed.#*.........: 58399.9 MH/s

----------------------
* Hash-Mode 100 (SHA1)
----------------------

Speed.#1.........:  3749.9 MH/s (62.10ms) @ Accel:512 Loops:1024 Thr:32 Vec:1
Speed.#2.........:  3751.1 MH/s (62.12ms) @ Accel:512 Loops:1024 Thr:32 Vec:1
Speed.#3.........:  3681.0 MH/s (63.25ms) @ Accel:512 Loops:1024 Thr:32 Vec:1
Speed.#4.........:  3633.8 MH/s (63.93ms) @ Accel:512 Loops:1024 Thr:32 Vec:1
Speed.#5.........:  3739.0 MH/s (62.21ms) @ Accel:512 Loops:1024 Thr:32 Vec:1
Speed.#*.........: 18554.8 MH/s

---------------------------
* Hash-Mode 1400 (SHA2-256)
---------------------------

Speed.#1.........:  1614.7 MH/s (72.23ms) @ Accel:16 Loops:1024 Thr:512 Vec:1
Speed.#2.........:  1610.3 MH/s (72.33ms) @ Accel:16 Loops:1024 Thr:512 Vec:1
Speed.#3.........:  1583.4 MH/s (73.66ms) @ Accel:16 Loops:1024 Thr:512 Vec:1
Speed.#4.........:  1570.4 MH/s (74.30ms) @ Accel:16 Loops:1024 Thr:512 Vec:1
Speed.#5.........:  1611.5 MH/s (72.38ms) @ Accel:16 Loops:1024 Thr:512 Vec:1
Speed.#*.........:  7990.3 MH/s

---------------------------
* Hash-Mode 1700 (SHA2-512)
---------------------------

Speed.#1.........:   538.1 MH/s (54.10ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#2.........:   537.2 MH/s (54.13ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#3.........:   527.9 MH/s (55.21ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#4.........:   523.7 MH/s (55.62ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#5.........:   537.5 MH/s (54.21ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#*.........:  2664.3 MH/s

-------------------------------------------------------------
* Hash-Mode 22000 (WPA-PBKDF2-PMKID+EAPOL) [Iterations: 4095]
-------------------------------------------------------------

Speed.#1.........:   189.2 kH/s (74.58ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#2.........:   189.0 kH/s (74.63ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#3.........:   185.9 kH/s (75.92ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#4.........:   177.1 kH/s (77.81ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#5.........:   188.4 kH/s (74.92ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#*.........:   929.6 kH/s

-----------------------
* Hash-Mode 1000 (NTLM)
-----------------------

Speed.#1.........: 20800.7 MH/s (87.84ms) @ Accel:512 Loops:1024 Thr:256 Vec:8
Speed.#2.........: 20805.9 MH/s (87.82ms) @ Accel:512 Loops:1024 Thr:256 Vec:8
Speed.#3.........: 20382.5 MH/s (89.59ms) @ Accel:512 Loops:1024 Thr:256 Vec:8
Speed.#4.........: 20180.9 MH/s (90.34ms) @ Accel:512 Loops:1024 Thr:256 Vec:8
Speed.#5.........: 20803.1 MH/s (87.82ms) @ Accel:512 Loops:1024 Thr:256 Vec:8
Speed.#*.........:   103.0 GH/s

---------------------
* Hash-Mode 3000 (LM)
---------------------

Speed.#1.........: 10825.9 MH/s (85.43ms) @ Accel:512 Loops:1024 Thr:128 Vec:1
Speed.#2.........: 10823.1 MH/s (85.46ms) @ Accel:512 Loops:1024 Thr:128 Vec:1
Speed.#3.........: 10616.0 MH/s (86.96ms) @ Accel:512 Loops:1024 Thr:128 Vec:1
Speed.#4.........: 10510.2 MH/s (87.80ms) @ Accel:512 Loops:1024 Thr:128 Vec:1
Speed.#5.........: 10826.2 MH/s (85.42ms) @ Accel:512 Loops:1024 Thr:128 Vec:1
Speed.#*.........: 53601.4 MH/s

--------------------------------------------
* Hash-Mode 5500 (NetNTLMv1 / NetNTLMv1+ESS)
--------------------------------------------

Speed.#1.........: 11111.5 MH/s (82.20ms) @ Accel:512 Loops:512 Thr:256 Vec:2
Speed.#2.........: 11116.5 MH/s (82.14ms) @ Accel:512 Loops:512 Thr:256 Vec:2
Speed.#3.........: 10913.1 MH/s (83.61ms) @ Accel:512 Loops:512 Thr:256 Vec:2
Speed.#4.........: 10768.1 MH/s (84.59ms) @ Accel:512 Loops:512 Thr:256 Vec:2
Speed.#5.........: 11112.8 MH/s (82.20ms) @ Accel:512 Loops:512 Thr:256 Vec:2
Speed.#*.........: 55022.1 MH/s

----------------------------
* Hash-Mode 5600 (NetNTLMv2)
----------------------------

Speed.#1.........:   828.3 MH/s (70.45ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#2.........:   828.0 MH/s (70.49ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#3.........:   813.1 MH/s (71.75ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#4.........:   804.0 MH/s (72.44ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#5.........:   825.2 MH/s (70.69ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#*.........:  4098.5 MH/s

--------------------------------------------------------
* Hash-Mode 1500 (descrypt, DES (Unix), Traditional DES)
--------------------------------------------------------

Speed.#1.........:   440.7 MH/s (66.17ms) @ Accel:16 Loops:1024 Thr:128 Vec:1
Speed.#2.........:   440.4 MH/s (66.23ms) @ Accel:16 Loops:1024 Thr:128 Vec:1
Speed.#3.........:   432.9 MH/s (67.35ms) @ Accel:16 Loops:1024 Thr:128 Vec:1
Speed.#4.........:   428.1 MH/s (67.97ms) @ Accel:16 Loops:1024 Thr:128 Vec:1
Speed.#5.........:   439.6 MH/s (66.35ms) @ Accel:16 Loops:1024 Thr:128 Vec:1
Speed.#*.........:  2181.7 MH/s

------------------------------------------------------------------------------
* Hash-Mode 500 (md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5)) [Iterations: 1000]
------------------------------------------------------------------------------

Speed.#1.........:  4093.2 kH/s (87.68ms) @ Accel:32 Loops:1000 Thr:1024 Vec:1
Speed.#2.........:  3910.5 kH/s (87.44ms) @ Accel:32 Loops:1000 Thr:1024 Vec:1
Speed.#3.........:  4043.0 kH/s (88.95ms) @ Accel:32 Loops:1000 Thr:1024 Vec:1
Speed.#4.........:  3997.3 kH/s (90.13ms) @ Accel:32 Loops:1000 Thr:1024 Vec:1
Speed.#5.........:  4089.5 kH/s (87.87ms) @ Accel:32 Loops:1000 Thr:1024 Vec:1
Speed.#*.........: 20133.4 kH/s

----------------------------------------------------------------
* Hash-Mode 3200 (bcrypt $2*$, Blowfish (Unix)) [Iterations: 32]
----------------------------------------------------------------

Speed.#1.........:    12829 H/s (67.59ms) @ Accel:4 Loops:32 Thr:16 Vec:1
Speed.#2.........:    12891 H/s (67.11ms) @ Accel:4 Loops:32 Thr:16 Vec:1
Speed.#3.........:    11677 H/s (69.25ms) @ Accel:4 Loops:32 Thr:16 Vec:1
Speed.#4.........:    12521 H/s (69.24ms) @ Accel:4 Loops:32 Thr:16 Vec:1
Speed.#5.........:    12810 H/s (67.59ms) @ Accel:4 Loops:32 Thr:16 Vec:1
Speed.#*.........:    62728 H/s

--------------------------------------------------------------------
* Hash-Mode 1800 (sha512crypt $6$, SHA512 (Unix)) [Iterations: 5000]
--------------------------------------------------------------------

Speed.#1.........:    85690 H/s (75.06ms) @ Accel:4096 Loops:128 Thr:64 Vec:1
Speed.#2.........:    85606 H/s (75.29ms) @ Accel:4096 Loops:128 Thr:64 Vec:1
Speed.#3.........:    84640 H/s (76.16ms) @ Accel:4096 Loops:128 Thr:64 Vec:1
Speed.#4.........:    83321 H/s (77.38ms) @ Accel:4096 Loops:128 Thr:64 Vec:1
Speed.#5.........:    85921 H/s (75.00ms) @ Accel:4096 Loops:128 Thr:64 Vec:1
Speed.#*.........:   425.2 kH/s

--------------------------------------------------------
* Hash-Mode 7500 (Kerberos 5, etype 23, AS-REQ Pre-Auth)
--------------------------------------------------------

Speed.#1.........:   208.8 MH/s (69.80ms) @ Accel:256 Loops:128 Thr:32 Vec:1
Speed.#2.........:   209.7 MH/s (69.49ms) @ Accel:256 Loops:128 Thr:32 Vec:1
Speed.#3.........:   204.2 MH/s (71.37ms) @ Accel:256 Loops:128 Thr:32 Vec:1
Speed.#4.........:   204.0 MH/s (71.49ms) @ Accel:256 Loops:128 Thr:32 Vec:1
Speed.#5.........:   209.4 MH/s (69.60ms) @ Accel:256 Loops:128 Thr:32 Vec:1
Speed.#*.........:  1036.2 MH/s

-------------------------------------------------
* Hash-Mode 13100 (Kerberos 5, etype 23, TGS-REP)
-------------------------------------------------

Speed.#1.........:   202.1 MH/s (72.17ms) @ Accel:256 Loops:128 Thr:32 Vec:1
Speed.#2.........:   202.4 MH/s (72.08ms) @ Accel:256 Loops:128 Thr:32 Vec:1
Speed.#3.........:   197.1 MH/s (73.99ms) @ Accel:256 Loops:128 Thr:32 Vec:1
Speed.#4.........:   197.2 MH/s (73.94ms) @ Accel:256 Loops:128 Thr:32 Vec:1
Speed.#5.........:   201.8 MH/s (72.25ms) @ Accel:256 Loops:128 Thr:32 Vec:1
Speed.#*.........:  1000.6 MH/s

---------------------------------------------------------------------------------
* Hash-Mode 15300 (DPAPI masterkey file v1 (context 1 and 2)) [Iterations: 23999]
---------------------------------------------------------------------------------

Speed.#1.........:    31835 H/s (74.54ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#2.........:    31408 H/s (75.23ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#3.........:    31288 H/s (75.85ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#4.........:    30821 H/s (77.01ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#5.........:    31726 H/s (74.81ms) @ Accel:8 Loops:1024 Thr:512 Vec:1
Speed.#*.........:   157.1 kH/s

---------------------------------------------------------------------------------
* Hash-Mode 15900 (DPAPI masterkey file v2 (context 1 and 2)) [Iterations: 12899]
---------------------------------------------------------------------------------

Speed.#1.........:    17781 H/s (61.59ms) @ Accel:64 Loops:512 Thr:32 Vec:1
Speed.#2.........:    17709 H/s (61.85ms) @ Accel:64 Loops:512 Thr:32 Vec:1
Speed.#3.........:    17372 H/s (62.83ms) @ Accel:64 Loops:512 Thr:32 Vec:1
Speed.#4.........:    17105 H/s (63.62ms) @ Accel:64 Loops:512 Thr:32 Vec:1
Speed.#5.........:    17745 H/s (61.74ms) @ Accel:64 Loops:512 Thr:32 Vec:1
Speed.#*.........:    87712 H/s

------------------------------------------------------------------
* Hash-Mode 7100 (macOS v10.8+ (PBKDF2-SHA512)) [Iterations: 1023]
------------------------------------------------------------------

Speed.#1.........:   221.8 kH/s (42.15ms) @ Accel:8 Loops:511 Thr:256 Vec:1
Speed.#2.........:   222.2 kH/s (41.96ms) @ Accel:8 Loops:511 Thr:256 Vec:1
Speed.#3.........:   219.4 kH/s (42.59ms) @ Accel:8 Loops:511 Thr:256 Vec:1
Speed.#4.........:   216.0 kH/s (43.27ms) @ Accel:8 Loops:511 Thr:256 Vec:1
Speed.#5.........:   204.1 kH/s (42.29ms) @ Accel:8 Loops:511 Thr:256 Vec:1
Speed.#*.........:  1083.5 kH/s

---------------------------------------------
* Hash-Mode 11600 (7-Zip) [Iterations: 16384]
---------------------------------------------

Speed.#1.........:   191.8 kH/s (70.55ms) @ Accel:32 Loops:4096 Thr:128 Vec:1
Speed.#2.........:   194.5 kH/s (70.53ms) @ Accel:32 Loops:4096 Thr:128 Vec:1
Speed.#3.........:   190.2 kH/s (71.31ms) @ Accel:32 Loops:4096 Thr:128 Vec:1
Speed.#4.........:   184.1 kH/s (72.41ms) @ Accel:32 Loops:4096 Thr:128 Vec:1
Speed.#5.........:   191.8 kH/s (70.52ms) @ Accel:32 Loops:4096 Thr:128 Vec:1
Speed.#*.........:   952.4 kH/s

------------------------------------------------
* Hash-Mode 12500 (RAR3-hp) [Iterations: 262144]
------------------------------------------------

Speed.#1.........:    26507 H/s (67.10ms) @ Accel:8 Loops:16384 Thr:256 Vec:1
Speed.#2.........:    26506 H/s (67.10ms) @ Accel:8 Loops:16384 Thr:256 Vec:1
Speed.#3.........:    26034 H/s (67.97ms) @ Accel:8 Loops:16384 Thr:256 Vec:1
Speed.#4.........:    25599 H/s (68.89ms) @ Accel:8 Loops:16384 Thr:256 Vec:1
Speed.#5.........:    26429 H/s (67.35ms) @ Accel:8 Loops:16384 Thr:256 Vec:1
Speed.#*.........:   131.1 kH/s

--------------------------------------------
* Hash-Mode 13000 (RAR5) [Iterations: 32799]
--------------------------------------------

Speed.#1.........:    19486 H/s (45.24ms) @ Accel:128 Loops:64 Thr:256 Vec:1
Speed.#2.........:    19522 H/s (45.22ms) @ Accel:128 Loops:64 Thr:256 Vec:1
Speed.#3.........:    19314 H/s (45.68ms) @ Accel:128 Loops:64 Thr:256 Vec:1
Speed.#4.........:    19022 H/s (46.29ms) @ Accel:128 Loops:64 Thr:256 Vec:1
Speed.#5.........:    19463 H/s (45.36ms) @ Accel:128 Loops:64 Thr:256 Vec:1
Speed.#*.........:    96805 H/s

--------------------------------------------------------------------------------
* Hash-Mode 6211 (TrueCrypt RIPEMD160 + XTS 512 bit (legacy)) [Iterations: 1999]
--------------------------------------------------------------------------------

Speed.#1.........:   141.0 kH/s (46.38ms) @ Accel:16 Loops:128 Thr:512 Vec:1
Speed.#2.........:   137.7 kH/s (46.81ms) @ Accel:16 Loops:128 Thr:512 Vec:1
Speed.#3.........:   138.7 kH/s (47.16ms) @ Accel:16 Loops:128 Thr:512 Vec:1
Speed.#4.........:   138.0 kH/s (47.43ms) @ Accel:16 Loops:128 Thr:512 Vec:1
Speed.#5.........:   140.6 kH/s (46.47ms) @ Accel:16 Loops:128 Thr:512 Vec:1
Speed.#*.........:   695.9 kH/s

-----------------------------------------------------------------------------------
* Hash-Mode 13400 (KeePass 1 (AES/Twofish) and KeePass 2 (AES)) [Iterations: 24569]
-----------------------------------------------------------------------------------

Speed.#1.........:    12017 H/s (49.40ms) @ Accel:2 Loops:1024 Thr:512 Vec:1
Speed.#2.........:    12113 H/s (49.00ms) @ Accel:2 Loops:1024 Thr:512 Vec:1
Speed.#3.........:    11750 H/s (50.25ms) @ Accel:2 Loops:1024 Thr:512 Vec:1
Speed.#4.........:    11827 H/s (50.20ms) @ Accel:2 Loops:1024 Thr:512 Vec:1
Speed.#5.........:    12016 H/s (49.41ms) @ Accel:2 Loops:1024 Thr:512 Vec:1
Speed.#*.........:    59723 H/s

----------------------------------------------------------------
* Hash-Mode 6800 (LastPass + LastPass sniffed) [Iterations: 499]
----------------------------------------------------------------

Speed.#1.........:  1214.1 kH/s (42.63ms) @ Accel:16 Loops:499 Thr:256 Vec:1
Speed.#2.........:  1202.6 kH/s (42.94ms) @ Accel:16 Loops:499 Thr:256 Vec:1
Speed.#3.........:  1195.4 kH/s (43.31ms) @ Accel:16 Loops:499 Thr:256 Vec:1
Speed.#4.........:  1014.7 kH/s (43.91ms) @ Accel:16 Loops:499 Thr:256 Vec:1
Speed.#5.........:  1207.9 kH/s (42.88ms) @ Accel:16 Loops:499 Thr:256 Vec:1
Speed.#*.........:  5834.8 kH/s

--------------------------------------------------------------------
* Hash-Mode 11300 (Bitcoin/Litecoin wallet.dat) [Iterations: 200459]
--------------------------------------------------------------------

Speed.#1.........:     2417 H/s (60.33ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#2.........:     2404 H/s (60.66ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#3.........:     2377 H/s (61.33ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#4.........:     2340 H/s (62.18ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#5.........:     2410 H/s (60.52ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.#*.........:    11947 H/s

Started: Sun Jan 14 19:46:24 2024
Stopped: Sun Jan 14 19:51:23 2024

As you can see that the hashcat benchmark for MD5 is pretty good for a budget GPU cluster. We get about 58000 MH/s for this cluster and for a similar but more modern GPU you get about 57000 MH/s - 67000 MH/s but for several hundreds of dollars more in expenses. Anyway, the way I see it for my use case, the budget way using multi-GPUs is the way to go.

An RTX 3080 benchmarks around 54000 MH/s for MD5. An RTX 3090 benchmarks around 65000 MH/s for MD5. An RTX 4090 benchmarks around 164.1 GH/s for MD5, which is just phenomenal and can be probably worth buying if you can afford it.

NOTE: I have not run any benchmarks on the more expensive GPUs myself, they are all referencing benchmarks run by others on the internet, who may have different server hardware or different OSes or NVIDIA driver versions.

UPGRADE SSD AND INSTALL LINUX ON INTEL MACBOOK AIR (mid-2011)

Sat, 08 Jul 2023 00:00:00 -0400

I purchased a MacBook Air in 2011, and it is the model A1370 with a 11-inch screen, Intel 64-bit i5 CPU 1.6GHz, 64GB NVMe solid state drive (SSD) and 2GB RAM.

Apple has stopped supporting older Intel-based laptops with newer versions of Mac OSX for a few years now. However, soon browsers like Firefox will also stop supporting such old systems. You have two choices, either dispose of the device or install Linux on it.

Since my device is working really well so far and is still a really thin laptop, it can continue to be a great travel companion. But it is old, so one of the options is to install Linux on it.

The EFI support has come a long way that you can completely replace the old OSX with a Linux that supports EFI install out of the box. I chose Kali Linux but you may choose Ubuntu and the process is the same.

But 64GB seems small and fills up quickly with today’s Linux operating systems, so I decided to upgrade the NVMe SSD to 250GB. This post describes how to perform the upgrade of the SSD and install Linux on the MacBook Air. This upgrade process will work on any Intel-based MacBook Airs that are from the 2010-2012 era, as far as I know.

This can also be a way to create a burner laptop for traveling to various hacker conferences like DEFCON, although nothing beats a Live CD Linux in that scenario, sometimes you just want something that does not require a USB drive sticking out of the laptop.

REQUIREMENTS

2010-2012 MacBook Air in bootable condition. You can buy several of these on eBay for less than $100 nowadays.
Pentalobe screwdriver set and trim tool for Apple devices
256GB New SSD for 2010-2011 MacBook Air. You can buy an appropriate model SSD for your version of MacBook Air if it is 2012 or 2013 model.
4GB or larger USB Stick
Compressed Air Can
Alfa AWUS036ACS USB WiFi card. This is optional, but recommended since Broadcom drivers on Linux are bad.
TPLink USB-to-ethernet dongle. This is optional if you want to use ethernet, and do not have ethernet (RJ45) ports.

CHECKING YOUR MACBOOK AIR

Make sure you backup your data.
If you have setup a firmware lock or firmware password on the MacBook Air, you need to either know that password or reset it or change it as described in one of the sections here.

REPLACING THE SSD

Our first task is to replace the 64GB SSD with a 256GB SSD (Figure 1) so that we have more space available.

Figure 1. 256GB NVMe SSD for MacBook Air 2010-2011

Step 1: Shutdown the MacBook Air, disconnect power from the laptop, and turn it upside down. Using the correct pentalobe screwdriver bit from the kit locate the 10 screws that need to be opened, circled in red in Figure 2a. Carefully open each screw and keep it safely.

Figure 2a. Locate the 10 screws under the laptop

There will be 2 long screws (circled in red) and 8 small ones as seen in Figure 2b.

Figure 2b. Screws have been removed

Step 2: Now pull the cover off the base of the laptop exposing the motherboard, the solid state drive (SSD) and battery pack as seen in Figure 3a. Circled in Figure 3a and with a closeup in Figure 3b, we can see the connector for the battery pack, which will be disconnected in the next step. Figure 3c shows the connector for the SSD from which we will be disconnecting the SSD in a later step.

Figure 3a. Locate the battery pack connector and SSD

Figure 3b. Battery pack connector closeup

Figure 3c. SSD connector

Step 3: Using a trim tool from the pentalobe screwdriver set, lift the battery connector delicately up from both the sides marked + and - and it will pop up. Make sure the whole connector is popped up. It should not be touching the motherboard. Be gentle. Figures 4a and 4b show the trim tool being used to lift the battery connector and also a closeup of the connector lifted up.

Figure 4a. Battery disconnected using trim tool

Figure 4b. Closeup of the battery disconnected

Step 4: Now we need to locate the screw in Figure 3a, and using the T5 torx screw bit from the pentalobe screwdriver kit, take out that screw. You should see it look like Figure 5a.

Figure 5a. Remove screw holding SSD in place

This screw holds the SSD in place and once it has been removed, delicately lift up the SSD and pull it out slowly from the connector. You should see it come out like in Figure 5b.

Figure 5b. SSD unplugged

NOTE: Using compressed air you can clean up all the dust from the connectors and the rest of the motherboard.

Step 5: Now it is time to install the new SSD (Figure 6a). Insert the pins of the SSD in the right direction and push it in till it fits (Figure 6b) and is tight. Then tighten the screw that you had removed in the previous step.

Figure 6a. View of the new SSD

Figure 6b. New SSD installed along with the screw

Step 6: Now push the battery connector back in place as seen in Figure 7.

Figure 7. Battery connected and new SSD visible

Step 7: Now place the cover back on, and screw in the 10 screws that you took out in Step 2. Make sure the 2 long screws go in the right spot near the edge of the screen.

This completes the SSD replacement.

NOTE: Do not throw the old SSD away. Keep it as you may want to copy the contents back to this drive if you just wanted to expand the disk space and not install Linux, or if you wanted to dual boot Linux with Mac OSX. Describing backing up and restoring the SSD is out of scope for this post, and you can find various blog posts on the internet for this.

INSTALLING LINUX

Step 8: Download the 64-bit Linux version that you want to install that supports booting from EFI, such as Kali Linux or Ubuntu Linux. I chose to install Kali Linux and they have a good documentation on how to do this which I followed.

You can install the netinst (or network install) ISO and burn it to a USB stick as described here or here.

Then plugin the USB stick into the USB port of the MacBook Air as shown in Figure 8.

Figure 8. Plugin the USB stick with the Linux installer image

Step 9: Now we need the laptop to boot from the USB drive, so we press and hold the Alt/Option button, and then hit the power button. Keep holding the Alt/Option button until you see the Linux Grub boot menu as seein in Figure 9. This is the installer booting from the plugged in USB drive. Here is a link from Apple describing the various boot keys that you can press, if you are curious.

NOTE: If you had setup a firmware password on the MacBook Air, then you will need it here.

Figure 9. Kali Linux installer booting on the MacBook Air

Step 10: Start the installation and follow instructions as desired, or refer to the installation manual for your choice of Linux. Shown below in Figure 10 is the SSD being detected by the installer.

Figure 10. New SSD is detected by the Linux installer

NOTE:

During the install I did receive a few error messages saying that the partitions could not be written or they were written but the kernel could not detect them. I rebooted and tried twice and the partitions were detected, but the main thing I think worked was making sure that the EFI partition had the Name field set. I was able to do this by changing the partition type to FAT32 and then changing it back to EFI.
If you have ethernet available via a USB-to-ethernet adapter, I would use that to perform the install since the WiFi drivers may not work as expected or cause hangs/freezes.

Step 11: Once you complete the installation reboot the laptop and see if it works. Shown in Figure 11 is the login screen.

Figure 11. Kali Linux installed on the MacBook Air

Step 12: If your MacBook Air has low RAM, like mine has 2GB, then you will see a lot of freezes/hangs since it runs out of memory quickly. So there are two things you can do:

Install the Broadcom firmware for your WiFi since it is not installed by default and reboot.

$ sudo apt -y install firmware-b43-installer
$ sudo reboot

If you are still seeing random hangs, it is due to the Broadcom drivers and your best bet is to use an Alfa AWUS036AC or similar ethernet card supported by Kali Linux. In that case, you will need to blacklist the Broadcom drivers on the Macbook Air, so that they do not load up and crash the system randomly. Place a file with the below content in the below path and reboot the system. Remember to make sure you have a WiFi dongle available to connect to the internet.

$ cat /etc/modprobe.d/broadcom-blacklist.conf
#### blacklisting broadcom drivers for wifi
blacklist bcma
blacklist brcmsmac
blacklist b43

A USB-to-ethernet dongle can also be used if you want to use ethernet instead of WiFi.
Set the login mode to not boot up a GUI by default, and instead boot into commandline. This is what I have done.

### get the default startup setting
$ sudo systemctl get-default
graphical.target
### change the startup setting to be commandline
$ sudo systemctl set-default multi-user.target
### verify the setting
$ sudo systemctl get-default
multi-user.target
### reboot and test
$ sudo reboot

Increase the swap space from 1 GB to 8 GB, which is also what I did. This will move a lot of the memory to swap. This may not be recommended for SSDs but is a necessity for your old device with low RAM.

### show the existing swap space
$ sudo swapon --show

### check the free space being used
$ free -h

### create a large enough swapfile
$ sudo fallocate -l 6G /swapfile

### check it is 7GB in size
$ ls -lh /swapfile

### change the swap file permissions
$ sudo chmod 0600 /swapfile

### make the filesystem on it
$ sudo mkswap /swapfile

### enable the swap file
$ sudo swapon /swapfile

### verify that it worked
$ sudo swapon --show
$ free -h

### add it to /etc/fstab to enable this on boot everytime
$ sudo cp /etc/fstab /etc/fstab.bak
$ echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

### reboot and test
$ sudo reboot

The above commands were taken from here.

SETUP SQUID WEB PROXY SERVER ON LINUX

Thu, 22 Sep 2022 00:00:00 -0400

Sometimes you need to setup a proxy server so that you can mask your IP address for making web requests using your browser. In some situations, you may want to intercept every web request and reject some requests such as rejecting social media websites at work. Sometimes you want only authorized users to access the internet at your workplace and want to monitor their web access. One may also need to cache web requests to build their own content delivery network. In such scenarios, you can install a web proxy like Squid on Linux.

Setting it up on a Debian or Ubuntu system is very easy and this post will show you how. However, this post is limited to setting up the Squid proxy server only as a HTTP/FTP proxy and not for caching. That would be a different post for the future.

+================+                                        +==============+                           
|                |                                        |              |                           
|    BROWSER     |<=====>|||| HTTP/FTP PACKETS ||||<=====>| PROXY SERVER |<=====>|||| INTERNET WEBSITE
|                |                                        |              |                           
+================+                                        +==============+                             

INSTALLATION

If you want to run a web proxy, you need a server that is publicly visible on the internet. So for this example, you can use a Linode nanode which is $5 per month or a DigitalOcean VM.

Once you have setup the latest Debian (Buster as of this writing) or Ubuntu (2022.01 as of this writing) you can install the squid software. Once it installs it starts up, but we need to configure it so we shut it down.

$ sudo su - root
root$ apt update && apt upgrade && apt -y install squid
root$ systemctl stop squid

CONFIGURATION

Now let’s configure the software. Edit the /etc/squid/squid.conf file that has been setup by the operating system during installation. Most of the defaults are fine. In our case we only want to support HTTP, HTTPS and FTP protocols so the ports that we want to allow are 80, 443 and 21, respectively.

So your access control list (acl) should look like below, where you comment out every other port that you do not want to support.

acl SSL_ports port 443
acl Safe_ports port 80      # http
acl Safe_ports port 21      # ftp
acl Safe_ports port 443     # https
#acl Safe_ports port 70     # gopher
#acl Safe_ports port 210        # wais
#acl Safe_ports port 1025-65535 # unregistered ports
#acl Safe_ports port 280        # http-mgmt
#acl Safe_ports port 488        # gss-http
#acl Safe_ports port 591        # filemaker
#acl Safe_ports port 777        # multiling http

Now let’s create a custom file for our usage and place it in /etc/squid/conf.d/ and let’s call it local.conf and add the following to it. Below is the content of /etc/squid/conf.d/local.conf. Replace the MY_EXTERNAL_IP_ADDRESS with your network’s external IP address, if you want to restrict access to Squid to just your network. This is important for security. If you want to add several IP addresses, you must create one new line for each IP address and have the same acl name so that the http_access allow will work on that name.

## digest authentication - dumb but password is encrypted
auth_param digest program /usr/lib/squid/digest_file_auth -c /etc/squid/private/digest_authentication
auth_param digest children 32 startup=0 idle=1
## use any realm name here but it will be needed to generate the authentication token
auth_param digest realm MySquid Digest Authentication
auth_param digest nonce_garbage_interval 5 minutes
auth_param digest nonce_max_duration 30 minutes
auth_param digest nonce_max_count 50
acl authenticatedusers proxy_auth REQUIRED
# deny anyone who has not authenticated
http_access deny !authenticatedusers
### setup IP based access
http_access allow localhost
acl mybrowser src MY_EXTERNAL_IP_ADDRESS
http_access allow mybrowser

## change this to the hostname you want to use in the error messages
visible_hostname squid01
via off
forwarded_for off
request_header_access Allow allow all 
request_header_access Authorization allow all 
request_header_access WWW-Authenticate allow all 
request_header_access Proxy-Authorization allow all 
request_header_access Proxy-Authenticate allow all 
request_header_access Cache-Control allow all 
request_header_access Content-Encoding allow all 
request_header_access Content-Length allow all 
request_header_access Content-Type allow all 
request_header_access Date allow all 
request_header_access Expires allow all 
request_header_access Host allow all 
request_header_access If-Modified-Since allow all 
request_header_access Last-Modified allow all 
request_header_access Location allow all 
request_header_access Pragma allow all 
request_header_access Accept allow all 
request_header_access Accept-Charset allow all 
request_header_access Accept-Encoding allow all 
request_header_access Accept-Language allow all 
request_header_access Content-Language allow all 
request_header_access Mime-Version allow all 
request_header_access Retry-After allow all 
request_header_access Title allow all 
request_header_access Connection allow all 
request_header_access Proxy-Connection allow all 
request_header_access User-Agent allow all 
request_header_access Cookie allow all 
request_header_access All deny all
cache deny all

Now that you have saved this file as /etc/squid/conf.d/local.conf we need to create the authentication file /etc/squid/private/digest_authentication for Squid to use as a list of username and passwords.

root$ mkdir -p /etc/squid/private/
## setup the password and choose a username
root$ htdigest -c /etc/squid/private/digest_authentication 'MySquid Digest Authentication' <username>
Adding password for <username> in realm MySquid Digest Authentication
New password:
Re-type new password:
root$ chown -R proxy:proxy /etc/squid/private/
root$ chmod go-rwx /etc/squid/private/

Now you can restart the server:

root$ systemctl start squid
root$ netstat -vnatp | grep squid | grep LISTEN
tcp6       0      0 :::3128                 :::*                    LISTEN      11111/(squid-1)

SECURITY

To secure the connection, it makes sense to setup a firewall such as ufw or use Linode’s cloud firewall setup to allow only connections from known IP addresses. If you want to allow global access, you must use a very strong password and keep your server up to date since you will see bot attacks. In my case, I have restricted access to the Squid server to my home IP and manually adjust the firewall when the IP changes.
You can also add the IP address to the acl in the local.conf file and let Squid reject other IP addresses.
Using username/password authentication you can allow multiple users to access Squid and restrict access.
You can look at the logs present in /var/log/squid/access.log to see which websites were accessed by which user and from which IP address.

CONNECTING TO THE WEB PROXY

We can use curl to test the proxy access first.

$ curl -v --proxy-digest -U <username>:<password> -x http://<IP ADDRESS>:3128 https://www.vikaskumar.org/

Here the username and password are the ones you had setup using the htdigest command above.

The IP address is the external IP address of the server on which you are running the Squid proxy and 3128 is the default port.

You can then try to reach a website like https://www.ipinfo.io to verify that you are pretending to send your request from the Squid proxy server’s IP address.

BROWSER SETTINGS

On Firefox you must setup the proxy settings by following instructions.

You can select the Manual Proxy Configuration and setup the same IP address for the HTTP(s) and FTP fields, and port 3128 for the port. Then when you try to access a website it will prompt you for a username and password, and you can enter the credentials you had setup earlier.

CONCLUSION

With this we come to the end of setting up an external web proxy server that allows you to have applications hide their IP address when they make HTTP(s) requests.

SETUP SOCKS PROXY SERVER ON LINUX

Wed, 21 Sep 2022 00:00:00 -0400

A SOCKS proxy server is useful to mask your IP address especially when you want to connect to TCP/UDP ports that are not running on ports 80 and 443, such as IRC or SSH or a cryptocurrency node such as Bitcoin, Ethereum or Dogecoin node.

Setting it up on a Debian or Ubuntu system is very easy and this post will show you how.

+================+       +===============+                                       +==============+ 
|                |       |               |                                       |              |
|  APPLICATION   |<=====>|  SOCKS CLIENT |<=====> || ENCRYPTED PACKETS || <=====>| SOCKS SERVER |<=====>|||| INTERNET
|                |       |               |                                       |              |
+================+       +===============+                                       +==============+

INSTALLATION

If you want to run a SOCKS proxy, you need a server that is publicly visible on the internet. So for this example, you can use a Linode nanode which is $5 per month or a DigitalOcean VM.

Once you have setup the latest Debian (Buster as of this writing) or Ubuntu (2022.01 as of this writing) you can install the shadowsocks-libev software. Once it installs it starts up, but we need to configure it so we shut it down.

$ sudo su - root
root$ apt update && apt upgrade && apt -y install shadowsocks-libev
root$ systemctl stop shadowsocks-libev.service

CONFIGURATION

Now let’s configure the software. Edit the /etc/shadowsocks-libev/config.json file that has been auto-generated:

{
    "server":["0.0.0.0", "::", "127.0.0.1", "::1"],
    "mode":"tcp_and_udp",
    "server_port":8388,
    "local_port":1080,
    "password":"ENTER_LONG_PASSWORD_HERE",
    "timeout":86400,
    "fast_open": true,
    "method":"chacha20-ietf-poly1305"
}

The server_port is the port that the proxy server is listening on for inbound external connections for applications connecting to the proxy server from different networks.

The local_port is the port that the proxy server is listening on for inbound connections for applications running on the same server that need to use the proxy server. This is for the ss-local program that will be described later.

The password should be something long and difficult to crack, so that external connections can authenticate against it and only allowed applications that have the password can connect to the server.

The server is the list of interfaces, IPv4 and IPv6, that the proxy server should be listening on for external connections on the server_port.

The rest of the configuration is selected as the best possible defaults as described in the documentation.

Once you are done configuring the JSON file, change the permissions. We make the file read-write by root user and read-only by the shadowsocks-libev user under which Debian/Ubuntu run the server.

root$ chmod 0640 /etc/shadowsocks-libev/config.json
root$ chown root:shadowsocks-libev /etc/shadowsocks-libev/config.json

On Debian and Ubuntu servers, there is another configuration file that systemd uses which is /etc/default/shadowsocks-libev. The only change I suggest is to add -v to the DAEMON_ARGS so that you can see the connections come and go in the /var/log/syslog file.

$ cat /etc/default/shadowsocks-libev
# Defaults for shadowsocks initscript
# sourced by /etc/init.d/shadowsocks-libev
# installed at /etc/default/shadowsocks-libev by the maintainer scripts

#
# This is a POSIX shell fragment
#
# Note: `START', `GROUP' and `MAXFD' options are not recognized by systemd.
# Please change those settings in the corresponding systemd unit file.

# Configuration file
CONFFILE="/etc/shadowsocks-libev/config.json"

# Extra command line arguments
DAEMON_ARGS=-v

# User and group to run the server as
USER=nobody
GROUP=nogroup

# Number of maximum file descriptors
MAXFD=32768

Now we need to enable fast_open in the kernel network stack using sysctl as described here.

Add the following lines to /etc/sysctl.conf.

fs.file-max = 51200
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
net.core.netdev_max_backlog = 250000
net.core.somaxconn = 4096
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.ip_local_port_range = 10000 65000
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_mem = 25600 51200 102400
net.ipv4.tcp_rmem = 4096 87380 67108864
net.ipv4.tcp_wmem = 4096 65536 67108864
net.ipv4.tcp_mtu_probing = 1
net.ipv4.tcp_congestion_control = hybla

Add the following lines to /etc/security/limits.conf.

* soft nofile 51200
* hard nofile 51200

# for server running in root:
root soft nofile 51200
root hard nofile 51200

Once that is done run the following to get the kernel to reload the configuration:

root$ sysctl -p
root$ ulimit -n 51200

Now you can restart the server:

root$ systemctl start shadowsocks-libev.service
root$ netstat -vnatp | grep ss-server | grep LISTEN
tcp        0      0 0.0.0.0:8388            0.0.0.0:*               LISTEN      11111/ss-server
tcp6       0      0 :::8388                 :::*                    LISTEN      11111/ss-server

CONNECTING TO THE SOCKS PROXY

Now we have the SOCKS server running on a Linode VM. Let’s note its IP address and let’s call it $IP_EXTERNAL.

Let’s say we are now in our personal LAN in our home, and are running a Bitcoin node that needs to connect to the rest of the network, but you do not want to reveal your home IP address.

You then use the SOCKS server running on $IP_EXTERNAL and get the Bitcoin daemon to connect to that SOCKS proxy.

For that to work, let’s assume your Bitcoin node is also running on Debian/Ubuntu system. You need to install the shadowsocks-libev package and shutdown the service, and also disable it.

We do not need the server module on this system, which is the client system, and only need to use the client application ss-local.

$ sudo su - root
root$ apt update && apt upgrade && apt -y install shadowsocks-libev
root$ systemctl stop shadowsocks-libev.service
root$ systemctl disable shadowsocks-libev.service

Run the local client application that now will connect to your SOCKS server using the password that was setup above. This can be run as your regular user and does not need root privileges.

$ nohup /usr/bin/ss-local -s $IP_EXTERNAL -p 8388 -l 1080 -b 127.0.0.1 -k 'ENTER_LONG_PASSWORD_HERE' -m 'chacha20-ietf-poly1305' --reuse-port --fast-open -v > /tmp/shadowsocks.log 2>&1 &
$ netstat -vnat | grep 1080 | grep LISTEN
tcp        0      0 127.0.0.1:1080          0.0.0.0:*               LISTEN      -

You can see the ss-local application listening on port 1080 on the localhost IP address 127.0.0.1.

NOTE:If you do not want to use the commandline you can setup the config.json above in the client machine as well and follow the CONFIG SECTION in the man shadowsocks-libev page.

Now we can run the Bitcoin node and make it connect via the SOCKS proxy to the broader worldwide network.

$ bitcoind -proxy='127.0.0.1:1080' -datadir=${HOME}/.bitcoin -server -daemon -par=-1

Or if you are running a Dogecoin node you can do the following:

$ dogecoind -proxy='127.0.0.1:1080' -par=-1 -server -daemon

If you want to use the SOCKS server to make web requests, you can do the following:

$ curl -v --socks5 127.0.0.1:1080 https://www.vikaskumar.org/

SECURITY

To secure the connection, it makes sense to setup a firewall such as ufw or use Linode’s cloud firewall setup to allow only connections from known IP addresses. If you want to allow global access, you must use a very strong password and keep your server up to date since you will see bot attacks. In my case, I have restricted access to the SOCKS server to my home IP and manually adjust the firewall when the IP changes.

CONCLUSION

With this we come to the end of setting up an external SOCKS proxy server that allows you to have applications hide their IP address.

SCREEN REPAIR OF SAMSUNG GALAXY S4

Tue, 21 Dec 2021 00:00:00 -0500

A Samsung Galaxy S4 (and also S5) is a fantastic device to use as a cheap burner phone for one simple reason — a removable battery. It is also well supported with a LineageOS port. Someone gave me an old Samsung Galaxy S4 a few years back that had a damaged display, and I kept it thinking that one day I may need it. A few days ago I decided I wanted to fix that display so I could build a burner phone from scratch with a single messenger app like Session, which has a custom APK file that you can download on to your Android without a Google Play Store or even an F-Droid store. This can be very useful if you do not want Google apps or any other app besides a default browser on your device.

This post outlines how I went about repairing the screen of the S4 first, so that I can have a device that works which is step 1. These devices are really cheap to procure on eBay but nothing is cheaper than free. I will also demonstrate how to disable or remove the selfie camera.

NOTE: Almost all these steps are available on iFixit but nothing beats having your own custom manual.

Step 1: Procure a Samsung Galaxy S4 that has a cracked display. Figure 0. Phone with cracked screen

Step 2: Procure the tools you will need for this process. I used the base electronics kit from iFixit or you can use a cheaper Amazon version of the same. The main thing to have is the spudger, a screwdriver with #PH-00 bit, tweezers and the trim opening tool.

You must use an anti-static wrist strap (Figure 2) if you have carpeted flooring or if you are wearing woollen clothing.

You will also need the correct model for the replacement display LCD screen. My model number of the device was SCH-I545 and I purchased a screen for that from eBay, or you can get it on Amazon. This model is also called the jfltevzw if you have a Verizon phone or jflte if generic.

Figure 1. Tools required for this job Figure 2. An anti-static wrist strap

Step 3: Remove the back cover of the device to expose the battery. Remove any micro-SD card and SIM cards that may be present in the device and take out the battery.

Figure 3. Remove the back cover of the device to expose the battery

Step 4: Using a #PH-00 screwdriver open the 8 screws and keep them aside.

Figure 4. Remove the 8 screws circled in red

Figure 5. Screws have been removed

Step 5: Now using the blue trim opening tool, start loosening the clips on the greyish white trim by separating it from the front of the device as shown in Figure 6. Figure 7 shows the trim has been removed. Carefully open the trim without breaking any clips. Patience is a virtue !

Figure 6. Open the rear trim with the blue trim opening tool Figure 7. The trim has been removed

Step 6: As seen in Figure 8 with the red circles, using the plastic black spudger or tweezers, detach the various clips from the motherboard. You will be detaching the clips for the USB charging module, selfie camera, speaker, headphone jack, the display LCD (yellow circle), the mobile antenna and home button μSMA connectors, and two other screws that hold the headphone jack and motherboard to the display LCD. Figure 9 shows the result of the clips being detached.

Figure 8. Open the clips and remove the screws to free up the motherboard

Figure 9. Clips have been detached from the motherboard

Step 7: Carefully lift up the motherboard out of the device and keep it aside. Now you need to open the screw shown by the red circle in Figure 10. This will enable you to remove the selfie camera and speaker.

Figure 10. Motherboard has been removed. Notice the screw that needs to be taken out

Step 8: Once the screw has been removed, using the spudger or a tweezer lift the metallic (or plastic) boot out of its position as shown in Figure 11.

Figure 11. Remove the protective boot or cover off the speaker and selfie camera

Step 9: Now take out the selfie camera with a tweezer. If you are serious about making a burner phone, you would not install a selfie camera back in place. In my case, the camera was already damaged as the ribbon was slit. So it was a non-functioning camera anyway, which is why I put it back in place but after cutting out the ribbon completely as shown in Figure 12b.

Figure 12a. Damaged selfie or front facing camera

Figure 12b. Camera connection Ribbon has been cut

Step 10: Now remove the speaker assembly as shown in figure 13. If you want your burner phone to only have text messaging capabilities, I would not put the speaker back in place either, since you will never need to listen to anything unless you are expecting audio/video messages. You can detect the arrival of messages just by keeping the device in vibrate mode, if all you want is text messages. Even then, you could technically listen to audio/video messages using the headphone jack.

Figure 13. Remove the speaker assembly

Step 11: Using a heat gun heat the vibrate motor (black circular piece in Figure 14) till the spudger can delicately move it out of position as seen in Figure 15. This can take about 1 or 2 minutes on low heat. Lift it out while maintaining the adhesive on the motor itself, so that it can be reused later (Figure 16).

Figure 14. Using a heat gun heat the vibrate motor

Figure 15. Lift the motor out of its position

Figure 16. Vibrate motor has been removed. Notice the adhesive on the motor is intact

Step 12: Next we remove the home button cable connecting the motherboard to the USB charging module. We had removed the μSMA connector earlier from the motherboard in Step 6. Now we remove a μSMA connector from the USB charging module too and pull it out safely without breaking it. If you break it, you have to replace the whole cable! You cannot solder your way out of it unless you have a μSMA crimping tool.

Figure 17. Remove the home button cable

Step 13: We need to remove the USB charging module which is glued on to the base of the display. To do this first remove the USB charging port cover using a spudger. It may require some effort but be gentle. We need to reuse all of these parts, so try not to break them.

Figure 18. Remove the USB charging port cover using a spudger

Step 14: Since our device is a Verizon CDMA version of the Samsung Galaxy S4, it has a pink μSMA connector cable connecting the antenna to the USB charging module as shown by the red circle in Figure 19. Unfortunately, the other end of the cable got damaged while removing it so in my case the phone feature will not work on this burner phone and may be a good thing. However, that means the device will need to rely on WiFi for internet access. That has its own disadvantages in rural areas with poor free WiFi availability, but may be great for cities. It is even better for use in protests since you will not be caught up in dragnets setup by law enforcement or other adversaries, where they use cell site simulators and force your device to connect to their malicious network. However, you will need to connect to a WiFi network at that point which is easier to do in cities due to free coffee shop WiFi availability.

Figure 19. Detach antenna cable connector

Step 15: Using a heat gun again lightly heat up the whole USB charging module and start lifting it out of its place using a spudger. Start from the left of the charging module (Figure 20) and you should find success as you can see in Figure 21. If your USB charging port is damaged, this would be the time to replace it with a new USB charging module.

Figure 20. Using a heat gun start heating the left of the USB charging module

Figure 21. USB charging module removed

Step 16: Now take out the new display module you procured from eBay in Step 1 from its packaging. It should look like Figure 22. Note that the display module includes both the LCD module and the glass that protects the module.

Figure 22. New display module

NOTE: This is where we document the rest of the process of installing the display and bringing the device back to near new condition, which the iFixit modules don’t always describe.

Step 17: Install the USB charging module back in place and using a heat gun melt the adhesive and lightly press the module in place.

Figure 23. USB charging module installed

Step 18: Install the USB charging port clip back into place (Figure 24) and using a spudger make sure that the clip fits tightly enough. In my case, it was loose but good enough.

Figure 24. Install the USB charging port clip

Step 19: Place the speaker back in place (Figure 25) and optionally place the selfie camera back in place (Figure 26). In my case, since I had cut out the selfie camera ribbon connector (Figure 12b), I placed it back in place to allow for the device to close nicely and also to appear to have a camera.

Figure 25. Place speaker back in position

Figure 26. Place selfie camera back in position

Step 20: Screw the protective boot back into place that you had removed in Step 11.

Figure 27. Screw the protective boot back in place

Step 21: Place the vibrate motor back in position and using a heat gun melt the adhesive and push it down so it sticks.

Figure 28. Place the vibrate motor in position and heat the adhesive

Step 22: Now install the headphone jack back in place along with its screw.

Figure 29. Screw the headphone jack back in place

Step 23: Connect the μSMA connector of one end of the home button cable, removed in Step 12, to the USB charging module first. Run the rest of the cable along the side of the display carefully.

Figure 30. Connect home button cable to USB charging module

Step 24: Install the motherboard in place (Figure 31) and make sure all the clips and μSMA connectors are above the motherboard. Then clip them in place as shown in Figure 32. Do not forget to install the black screw to hold the motherboard to the display frame. I do not recommend removing the rear facing camera since that can be useful for a burner phone, unlike a front facing or selfie camera which can leak info of the device user, if turned on remotely by a malicious entity. For my broken selfie camera, I installed the broken clip into its socket even though it is not attached to the camera itself.

Figure 31. Install the motherboard and screw it to the display frame using the black screw

Figure 32. Clip all the accessories back into their sockets

Step 25: Now connect the battery to the device as shown in Figure 33 and test that it boots up by pressing the power button to turn on the device. As seen in Figure 34, I can now see the Samsung logo when the device starts. So at least we now know that the motherboard has been connected correctly.

Figure 33. Connect the battery

Figure 34. Phone boots up

Step 26: Now take out the battery again. Re-install the back trim cover that you had removed in Step 5. Remember to screw it back to the rest of the device body using the 8 screws that were removed earlier. Install the battery back in place as shown in Figure 35.

Figure 35. Re-install the back trim cover

Step 27: Press the power button and boot the phone all the way until it starts loading the operating system. Figure 36 shows us that the phone has the Verizon splash screen and Figure 37 shows the Android operating system boot up. Next to it is the damaged display module.

Figure 36. Boot the phone into the operating system

Figure 37. Working phone with new display module. Also seen is the damaged display module

Step 28: Now connect the device to your computer using a USB cable. Turn on Android USB debugging by following instructions. You should then be able to see this device listed under the Android Debug Bridge (adb).

Figure 38. USB debugging is enabled

Next step would be to root the phone by installing a custom bootloader called TWRP, by compiling it from scratch, which is going to be described in a future blog post. Once the phone is rooted, you can then install a LineageOS ROM on to the device without Google tracking. Following that you can install the Session App.

DELL PERC 6/i VIRTUAL DISK SETUP FOR RAID

Wed, 20 Oct 2021 00:00:00 -0400

There are almost zero manuals online on how to setup the Dell PowerEdge Expandable RAID Controller version 6/i (PERC 6/i) to add additional virtual disks to an existing configuration, so I decided to write a quick instruction manual here. Even Dell’s website either has dead links or does not have enough information on the steps. These steps are identical if this is the first time you are setting up the RAID on the server, and not just for adding a new set of drives.

In my scenario, I have several Dell R710 PowerEdge servers that required additional disk drives. I am running RAID-1 on the existing server with 4 physical drives (Samsung EVO SSDs) pretending to be 2 virtual drives to the operating system. I wanted to add 2 more SSDs and hence create another virtual drive for the Linux operating system to be able to access it.

The process is very simple and takes about 5 to 10 minutes. Read below for the instructions described using images.

Step 1: Shutdown your server, if running. It is advisable to do a cold start rather than a reboot. Wait for the BIOS to boot up fully. If your BIOS is old and not the latest version, first update the BIOS by following the instructions on Dell’s website for your server.

NOTE:Remember to first add the new physical drives into their respective slots before booting the server up.

Figure 1. Perform a cold boot on the server

Step 2: Wait for the controller prompt to show up as in Figure 2a and press the Ctrl R keys. The PERC controller will now go into configuration mode as shown in Figure 2b and 2c. This may take about 10-30 seconds, so be patient. The configuration utility will detect the current number of virtual disks first and that’s why it takes a slight amount of time.

Once the utility has loaded you can navigate to the controller screen shown in Figure 2d to compare settings as in the image.

Figure 2a. Press Ctrl R when prompted

Figure 2b. The configuration utility detects the number of virtual disks Figure 2c. Finally the configuration utility is loading

Figure 2d. Configuration utility controller screen

Step 3: Navigate to the VD Mgmt option in the configuration utility. In our server, we have one PERC Controller, denoted by Controller 0 in Figure 3a. Since we already have two virtual drives setup, we can see two disk groups each with their own virtual disks as in Figure 3b and 3c. In our configuration, each virtual drive has 2 500GB SSDs in a RAID-1 configuration working effectively as a single 500GB, which is shown as 465.250GiB (Gibibyte not Gigabyte) in the images.

You must use the keyboard arrow keys to navigate the tree view. I do not recommend using a mouse even if the mouse works.

Figure 3a. Controller 0 Figure 3b. Virtual Disk 0 Figure 3c. Virtual Disk 1

Step 4: In Step 1, we reminded you to add the new physical drives that you want to add to the existing controller. Navigate to the PD Mgmt (physical disk management) screen. We assume you have done that as shown in Figure 4, where you can see additional two disks that do not have a DG (disk group) column value. This means they have not been setup yet and that’s what we are going to do next. This is also a positive sign that you have installed the physical disks correctly in the server.

Figure 4. Check the physical disks in the PD Mgmt view

Step 5a: Navigate back to the VD Mgmt (virtual disk management) screen, highlight Controller 0 and hit F2 to get the Create New VD menu option as shown in Figure 5a. Press the Enter key.

Figure 5a. Create New VD menu option

Step 5b: When you press the Enter key a new screen appears. This screen lists the physical drives that are not part of any disk group and allows you to select the RAID configuration you want. In my case I wanted the RAID-1 configuration as shown in Figure 5b. However, maybe you just want to use RAID-0 to maximize the disk space available to you. If that’s the case, you should select RAID-0.

Figure 5b. Select RAID-1 Option

Step 5c: If you are using RAID-1, select two physical disks to be part of this virtual disk that you are creating. If you are using RAID-0 select one physical disk. You may use the Tab key to navigate and press the Enter key to select a disk.

Figure 5c. Select physical disks

Step 5d: Now that you have selected your physical disks, navigate to the OK button on the far right of the screen (as shown in Figure 5d) and press Enter. You will then see a prompt as in Figure 5e and you must press Enter again. That will bring you back to the VD Mgmt screen and you should see a new virtual disk created. In our case, in Figure 5f, you can see Virtual Disk 2 has been created. You can see the properties of the disk on the right hand side column.

Figure 5d. Navigate to the OK button

Figure 5e. Press Enter when prompted

Figure 5f. New virtual disk has been created

Step 6a: Now we need to initialize the virtual disk. Press F2 and access the initialization menu as shown in Figure 6a.

Figure 6a. Initialization menu for the new virtual disk

Step 6b: You can choose to perform slow initialization, but since these are new drives a fast initialization is good enough. You can then update the file system from within the operating system of the server directly and that will save time. Fast initialization takes a few seconds whereas slow initialization can take hours. We select the Fast Init. option as shown in Figure 6b.

Figure 6b. Select Fast Init. option

Step 6c: The utility then displays a prompt as shown in Figure 6c, and you should select Yes and press Enter. Figures 6d and 6e show the progress of the initialization till it completes. Once completed, press Enter on the prompt and you should arrive at Figure 6f.

Figure 6c. Select Yes on the prompt

Figure 6d. Initialization is in progress

Figure 6e. Initialization has completed

Figure 6f. Back to VD Mgmt menu

Step 7: Press Esc or F12 to exit the configuration utility and press Enter on the OK prompt as shown in Figure 7. Figure 7. Exit the configuration utility

Step 8: Once you exit the configuration utility, you are presented with the screen in Figure 8 asking you to press Ctrl Alt Del to reboot the server.

Figure 8. Press Ctrl Alt Del to reboot

Step 9: Once your server boots up into your operating system you must add the newly created virtual drive to the OS for use. If you are using Windows, you are on your own. If you are using a form of Debian/Ubuntu Linux, below are some helpful instructions. The output of each instruction is not shown here, but it is assumed you will RTFM. This assumes you are running LVM which if you are not, then ask yourself why.

### login as root ###
$ sudo su - root
### scan for disks to verify that newly created disks show up###
### a virtual drive will appear as a single physical disk ###
$ pvscan
### find the new drive device number ###
$ fdisk -l
### let us assume the new virtual drive is /dev/sdc since we already have 2 others installed before ###
### create a new physical volume ###
$ pvcreate -v /dev/sdc
### scan for LVM virtual drive groups and find the virtual group name ###
$ vgscan
### add the physical volume to the existing virtual group named "server-vg" in our case. ###
$ vgextend server-vg /dev/sdc
### verify that the physical volume got added to the virtual group ###
$ vgscan
### note the current size of disk drives in the logical volume ###
$ lvscan
### now extend the logical volume to the newly added physical drive ###
### in your case the logical volume path must be taken from the output of lvscan or vgscan ###
$ lvextend -l +100%FREE /dev/server-vg/root
### verify that the logical volume has the correct size of disk ###
$ lvscan
### resize the file system to the newly added disk space ###
### the name of the device here could be found in the output of lvscan or df ###
$ resize2fs -p /dev/mapper/server--vg-root
### verify the sizes
$ df -h
### you are done, and can optionally reboot ###
$ reboot

Once your server boots into the operating system that is installed, follow instructions for your operating system of choice to add the newly created virtual drive to your system and start using it.

MINIMIZING RISK WHEN CHOOSING A RESEARCH LAB FOR PhD

Thu, 07 Oct 2021 00:00:00 -0400

Applying to universities with good PhD programs is only a third of the application process. Most students end up ignoring what is considered a “good” advisor and assume their achievements (GPA, publications, winning your March Madness bracket, blah blah blah, what have you) will automatically garner them that baller PhD advisor. As PhD Comics often states, selecting the right advisor is like being in a long-term relationship. If you ask me, it is more like arranged marriage – find the word on the block about your future spouse’s family, and then meet and question your future spouse.

Ending up with a well-funded advisor is not a draw of luck but about doing your homework smartly on the advisor and the PhD program. How do you end up with a good advisor (I didn’t want to be stuck taking care of their dog while they are in Magens Bay for some conference. True Story.) and in a good research lab (Not doing support/maintenance/code-monkey IT work but doing actual research, the entire reason I am there for)?

When I decided to pursue a PhD while working as a software engineer for a year at a major corporation, I didn’t want to get off on the wrong foot in my PhD program, be in a bad situation, and end up bitching (nicely, of course) about my disastrous PhD experience on some forum or blog. Instead, I opted to do research – research on the programs I was interested in – the professors, their peers, their funding, their citations, and their graduate students. I wanted to minimize risk and avoid bad situations that plague some PhD students. I have split this blog post into two sections (like an engineering publication).

The first section details the process involved in finding the rich advisor. The second section is about interviewing your prospective advisor when they invite you for a campus visit at their university. A lot of these thoughts and questions are logical but I have come across too many prospective PhD students who fail to do their research and homework on their advisor, their funding situation, and the PhD program. Then, they complain about how life is hard because they didn’t do their due diligence and got duped.

WORD ON THE BLOCK

Finding a university program and a professor whose interest matched mine wasn’t difficult, US News College Rankings list is a decent place to start, though some schools are known for X field more than A-Z fields and this doesn’t get reflected in those rankings. I will go over my process of finding a good professor (with funding) in my field and contacting them. Funding was the top priority for me as a PhD student (should be everyone’s). My process might be skewed towards the engineering discipline.

CITATIONS

This is obvious, I quickly searched a professor’s name on Google Scholar to see how well they have been cited and what they are known for. I stayed away from advisors that published in mediocre to bad journals and conferences or are one hit wonders. If they are well cited and publish in top peer-reviewed journals/conferences frequently, they are more likely to have some kind of funding.

FUNDING

NIH and NSF make it easy to find out the funding situation of a professor. NIH’s Project Reporter reveals how much funding a professor has and the duration of their project. NSF has a similar tool called Award Search. I used these tools exhaustively to find out funding track records of the professor I was interested in. I didn’t want to be a TA forever because my advisor had no money, which would be indicative that they aren’t producing anything novel in their research field.

Another great way to find out about a professor’s funding is to read the Acknowledgements section in their most recent publication. Not only it helped me skim through a professor’s most-recent publication but it also hinted at their funding sources, and then I used Google (I’ve learned a lot by using Google and Wikipedia, and stopped assuming how the world works). It is amazing how many prospective students I meet that do not research their future advisors and are choosing to do research in their prime (Research Fail).

The offer letters I received, generally after being admitted into a PhD program and before the university visit, told me precisely if funding for all my PhD years were guaranteed as a combination of Research Assistantship or Teacher’s Assistantship (TA). One school asked me to pay tuition for the first semester so I could “settle in” and then find a research group to fund me (What a joke, no one in the right mind should even consider this trap).

PhD dissertations available on ProQuest or other free library sources from the professor’s lab can be helpful in understanding the direction of their research lab and possibly, what will be the next set of funding related to.

COLLABORATORS

When looking at research labs, I put an emphasis on finding that research lab’s professor’s collaborators. The more collaborators an advisor has, the more outgoing, organized, courteous, and respected they are amongst their colleagues. Outgoing is very important as holding editorial positions, getting funding (someone who you networked with might review your grant submission or critique your publication), and recognition works purely on networking. Also, if the advisor runs out of funding or can’t fund me, then I could piggyback on their collaborator’s projects and still get a stipend. (Wow, this is how it exactly happened and I ended up with two advisors). I searched a professor’s name in social-networking sites such as Biomed Experts (Research Gate, Academia.edu, Zotero, and Mendeley are the newer ones) to get an idea of whom they are collaborating with. Google Scholar also helped me find a professor’s co-authors/collaborators.

ACCLAIMS

Advisors that are renowned tend to have funding as well. An easy way to find out if the professor is well regarded in their respective fields is to look for their title in societies such as IEEE and ACM. The title is indicative of how their peers view the professor’s work. This may not be valid for young professors. Professor’s CV (found on their website or Google) also discloses their funding and if they are reviewers/editors of prominent journals and conferences. This means they are acclaimed.

I searched for the titles of professors in societies such as IEEE and ACM to figure out if they are well regarded in their field. The title indicated how their peers viewed their work. Though, I did realize that this might not be valid for young professors who are not tenured yet.

CONTACT

After doing my homework on a prospective advisor, I had to email them to find out if they are looking for any students to join their research labs. I didn’t want to join a PhD program just to find out that the advisor I want to work with has a full lab or is going on sabbatical or even worse, has no funding next year. I threaded a polite and succinct email that could be read on a smartphone i.e. all text, no random PDFs of my CV attached to the email or zip files of my project (lol, who does that?).

My email to an advisor was simple:

quick introduction of myself including my name, my degree at the university I attended, and my interest in their university’s program,
my goal for PhD such as “specialize in computer vision techniques,”
a listing of two my most relevant projects and courses,
mention that I was seeking admission into their program and asked if they were accepting new PhD students in their group,
a link to my website showcasing all my projects in undergrad/Masters,
signed off the email sincerely and inserted a 10-line text form of my concise CV, which ended with a link to my website.

With this type of email format, I got a 65% response rate from all the professors I contacted at different universities and I had two phone interviews before I applied to their programs, despite having no publications to my name.

(There could be a better format).

In my statement of purpose for a university’s application, I mentioned all the professors that were taking new students (Obviously, I wouldn’t apply to Prof. Cuervo’s lab at University of Margaritaville if he isn’t taking any students this year. Applications are expensive. GRE scores are sent to a university on a disc by the ETS. Each disc contains 100s of student scores and yet, they charge $20 per student for sending their scores to 1 university. It’s a rip-off.). Once I applied to their PhD program, I wrote another concise email asking them to follow up on my application.

CASUAL WATERBOARDING

I treated this as the most important part of the process of selecting my advisor. Once I got invited to visit a university, the chances are I was already admitted. Some schools had already sent me my admissions/offer letter for PhD. During these visits, I met with several possible professors and they all tried recruiting me into their research labs (yay!).

Well, there were a couple of professors who ignored me, and I ignored them too. (Mutual ignorance breeds mutual distrust – Andrew Carnegie, Wealth, 1889). Contrary to popular belief, the ball was in my court and not in the professor’s. I didn’t have to impress them (I am already visiting!), but they had to impress me. It was time to find out the word on the block about these professors and question their operations. It’s always surprising to meet prospective PhD students who do not ask these seemingly logical questions (because they are nervous or scared to ask their future advisor and start their PhD by being a goat) and risk getting screwed over in their PhD.

During my visit, I interrogated the professors with these questions listed below (by no means this list is exhaustive). I figured professors who are disciplined will answer all my questions really well and this is a great sign of the ideal advisor. It is evident that research requires discipline – solving a problem for years, publishing, collaborating, writing grants, networking, logistics, and managing graduate students. Any professor that tried to circle around my question I became skeptical of (and believe me, there were a few of them).

QUESTIONS TO ASK YOUR FUTURE ADVISOR

I asked these questions casually with a smile on my face, while I interspersed them with related questions about the professor’s research. It has to be salt-and-pepper, can’t just outright interrogate your future advisor (not pulling nails – insert clip of best movie interrogation scene – Syriana). Professors I met gave me a little glimpse into their research and current projects, which helped me ask more questions about their research. This helped me with the salt-and-pepper process. Professors are not going to eat me for asking these questions. Actually, they are genuinely nice.

What is the attrition rate? How many graduate students join this university’s PhD program and how many leave with a PhD degree? Almost most professors I talked with gave me different answers but I understood if the PhD program is survivable.
What journals and conferences do you publish in? Look out for top names and match them with Google Scholar. One of the professors I met with lied.
What is the publication rate for PhD students? A good/disciplined advisor will say something to the effect of “I’d like it if they could publish at least once a year, but sometimes they end up publishing 2 in one year and nothing in another. It’s logistics at times.”
Is there funding for your PhD students to attend national/international conferences if they get a paper accepted in? Can they still go to the conference if they don’t submit anything to it? This question told me if the advisor likes sending their students to attend conferences regardless if they had papers or not. If they send their students to conferences who don’t have any papers, then they care about their student’s research development. Jackpot.
Does this PhD program hold any seminar series or does your group hold any journal clubs? If the program I am looking at holds seminar series and has professors from other schools giving talks, then the program is well regarded. If the research lab holds a journal club, then the professor has enough time to be up to date on new research breakthroughs. I didn’t want to end up with a professor who uses techniques from the 80s-90s, its bad for developing novel techniques – the entire point of doing research in the first place.
What is the time-to-degree for a PhD student in your research lab? This was the most important question I asked, and I carefully watched the professor’s reaction to it. Some professors gave me a straight answer, “usually my students take 4-5 years.” This means the professor is disciplined making sure you graduate with all your requirements in time, and will not make you solve something practically impossible like invent a pokéball. One of the professors I met with answered with “it depends on the student and their research.” Surely this is true, but it also means that this professor will never be happy with you even if you do catch ‘em all. Tsk, tsk, bad sign.
Have any of your students left your research lab without a PhD? This is a killer question and professors hate it, probably because it brings back irreconcilable differences with one (or many) of their students. It’s a behavioral question. Look out for sighs or an angry/nervous face for asking that question. One of the professors sighed, “this is a good question… sometimes I have funding issues.” Bam!
What are the major grants you received? I wanted to know if the professor is applying for new grants or renewing old ones. I already know if they have money based on NSF/NIH grant search tools. This question also gave me an idea of what I could possible be working on for my dissertation.
How many students do you advise? How are they financed? Do your advisees get the TA if you don’t have funding? I asked this question to find out if I would still get a stipend when research funding ran out. One professor said that the department assigned the TA for their class – bad sign. I didn’t want to starve or behave like this (Simpsons gif). If the professor has too many students, they will be super-busy – I would most likely be on my own when solving research problems and the advisor won’t care for obstacles/limitations of my solution. They might only care to publish. After all, I am entering a “publish or perish” world.
Where do students go after getting their PhD from your research lab? How do they find this job placement? I wanted to know if the professor had any industry connections. If the professor says that most of their students end up doing post-doc, then either they have no connections or their students really want to be in academia. A quality research lab will have students placed in all types of industries.
How do I join your research lab? Do I have to take your class or do an independent project? I got a variety of different answers from professors because they all do things differently. I tried to minimize risk here. Here are some answers I got and my skeptical thoughts on them. “You need to get an A in my class” – what if you are a bad professor or hate my guts and give me an A-, can I still join because I have research potential? “You need to do an independent project with me” – so I work for you for free and then you can reject me unless I get you a publication out of this independent project (International students fall prey to this one). “You can start out as a TA, work on an independent project that we can decide on, and then based on your interest you can sign onto a research project” – what a brilliant answer, gives me hope that this advisor is willing to reconcile any differences with me.

CROSS CHECKING WITH OTHER GRADUATE STUDENTS

This was an eye opening process for me. Asking similar questions to the graduate students of a professor’s lab brought out inconsistencies in the professor’s answers. Obviously, I believed the graduate students more so than the professor – how can you ever beat first-hand experience? I always met with the graduate students of the professor that I was interested in, typically, over lunch or dinner. They also told me about how the department is run, which can be important sometimes. I am surprised how much the administrative assistant helps me with my paperwork for conferences or the PhD program. Looking back, I can see that a department was disorganized based on how they organized the visit for prospective PhD students to their program. The graduate students that I met during my visit were always candid about their answers.

What is this city/town (_where the university is located) like? Do you socialize with other graduate students?_ I asked this question to find out if these graduate students of the professor that I am interested in stay in lab all day and night. If they know places around the city/town, they are more likely to do other things on the weekend besides research work. I’ve had blank responses and enthusiastic responses such as “downtown is lively, rock climbing is fun on the weekends, and we go to happy hours sometimes.” Happy hours are during the weekdays – most of the graduate students in that lab leave at a good time such as 6pm.
If you hit roadblocks in your research, who rescues you? Presumably, it will be your advisor but I got answers similar to “sometimes the professor will help you.” This gave me an idea how closely the professor works with their graduate students. One graduate student complained about how their advisor didn’t have any advice for them because they are too busy trying to grab funding and/or build their networks or they seem out of touch with newer techniques.
What is the worst part about this department and the research lab? Which professors should I stay away from? I processed any answer I got from the graduate students. A few of them complained about lack of socials. Surprisingly, a couple of graduate students said that the professor I was interested in was kind of a jerk. Obviously, I didn’t join that lab.
Does your advisor prefer you to figure out solutions and then present to them? Or do they want you to discuss possible approaches with them first and then come up with a solution? Or do they just want you to follow their idea and solution? Working with different professors in undergrad and during my Masters, I wanted to know the working style of the professor and find out if it matched my style. Also, I didn’t want to be in a lab where the professor made me follow his solution and wasn’t open to any new suggestions. I experienced this in my Masters, where the professor’s solution failed and he had no way to backtrack on it, and I ended up wasting 4 months on something that didn’t work (Hurray!).
Would you have picked a different school or a different advisor? Most graduate students said they wouldn’t pick a different school and highlighted the strengths of the program or their advisor’s research. Some students had mentioned how they switched advisors and this was good for me to know that it was possible.
How often do you publish? Do you go to conferences even if you don’t have a paper submitted? I asked this question to figure out if the professor’s answer was consistent with what their graduate students said.
Has anyone quit PhD out of your research lab? Again, trying to figure out inconsistencies with the professor’s answer, plus, the graduate students gave me more information as to why someone left their lab.
What is the funding like? How many times did you have to be a TA so far? For one program, the graduate students gave me different answers than what their professor gave me – “I’ve been a TA 3 times in 4 semesters because the professor’s grant application was rejected.” Usually, their answers matched.
Is your advisor up to date on techniques in their field? I figured all graduate students would unanimously say “yes.” On the contrary, almost everyone said “no.” Most advisors tend to be busy and they rely on their graduate students to keep up to date. In my experience, young advisors are up to date with new techniques. This is important because publishing in top -journals requires some novelty factor to the methods.
How did you join your research lab? Did you take your advisor’s class or do an independent project to prove to them that you wanted to be part of their lab? Again, looking for consistencies and possible cover-ups.
Where do students go after getting their PhD from this research lab? I wanted to see if the alumni of the research lab do post-doc because they have no industry offers (speaks poorly of the program and the advisor’s industry connections) or if they are genuinely interested in academia.
How long, on average, does it take for a graduate student to graduate from your research lab? There were a lot of inconsistent answers here. Some graduate students said that it took a few students 7 years to graduate, while their professor told me 5 years (probably quoting the minimum number of years, lol).
Do you co-author any papers? I think if you co-author papers, you do have more papers but they are still not first-author, which is worth more for your PhD success. Co-authoring papers could take up unnecessary time and prolonging graduation time. If the graduate students all were required to co-author papers, I correlated that with their lab’s time-to-degree statistic.
How long do advisors take to review your manuscript for a conference/journal or does it collect dust on their desk? I wish I asked this question because this scenario bit me in the ass. I wrote a journal paper that collected dust for 10 months, it finally got published after a lot of pestering (my advisor’s name wasn’t on that project’s grant so he didn’t care for the manuscript). Also, if an advisor replies with their comments for a conference paper that has a deadline the next day, then I’d be pulling all-nighters. All-nighters are unhealthy, totally doable, and give a fake sense of progress.
Do they respond to your email? I have worked with some professors who did not understand the concept of replying to emails. What a waste of time working for them, not replying to work-related emails is negative productivity for all parties involved. I have had professors say to me “I got your email” (and, that’s it? I don’t need an acknowledgement from you telling me that Gmail worked). It was easy for me to know which professor was on top of their inbox based on their response to my initial contact email prior to applying to their PhD program (see Section). Responding to emails can set up meetings in which progress can be made!
How often do you have status meetings? I wanted to work with a professor who had regular status meetings. These meetings would allow active discussions about research solutions, show them that I am not slacking off (gain their trust), keeps the advisor in the loop, and above all, help with my PhD progress.

DISCUSSION & CONCLUSIONS

Every publication has an end discussing possible limitations of the presented methods and future research directions. Doing my research when selecting a PhD research group helped me avoid some bad situations in my PhD experience that could’ve dried out all my enthusiasm for research.

Hope this has been useful to the reader in figuring out how to select a good advisor for their PhD and good luck!

Vikas N Kumar's Website

SETTING UP INBOUND AND OUTBOUND CALLING ON PHONE SYSTEM WITH ASTERISK

TABLE OF CONTENTS

SIP TRUNKING WITH TWILIO

SETTING UP ASTERISK CONFIGURATION

SETTING UP FIREWALL RULES

REFERENCES

SETTING UP AN INTERNAL PHONE SYSTEM WITH OLD CISCO® IP PHONES AND ASTERISK

TABLE OF CONTENTS

SETUP LINUX SERVER

COMPILING ASTERISK AND PATCHING

SETTING UP ASTERISK CONFIGURATION

STARTING ASTERISK

FACTORY RESET WITH OLD FIRMWARE

SETTING UP EACH PHONE

XMLDefault.cnf.xml

Other XML Files

SEPMAC.cnf.xml

Directory.xml

ringlist.xml

Background Images

REFERENCES

WATCHING STREAMING VIA ROKU ON A SUPERSONIC FC9600 CRT TV

POWER RATINGS

STREAMING REQUIREMENTS

PARTS NEEDED

STREAMING SETUP

BUILD A MULTI-GPU CLUSTER FOR HASHCAT WITH LINUX AND NVIDIA

REQUIREMENTS

SETUP

LINUX AND DRIVERS

DEVICEQUERY

NVTOP

HASHCAT

UPGRADE SSD AND INSTALL LINUX ON INTEL MACBOOK AIR (mid-2011)

REQUIREMENTS

CHECKING YOUR MACBOOK AIR

REPLACING THE SSD

INSTALLING LINUX

SETUP SQUID WEB PROXY SERVER ON LINUX

INSTALLATION

CONFIGURATION

SECURITY

CONNECTING TO THE WEB PROXY

BROWSER SETTINGS

CONCLUSION

SETUP SOCKS PROXY SERVER ON LINUX

INSTALLATION

CONFIGURATION

CONNECTING TO THE SOCKS PROXY

SECURITY

CONCLUSION

SCREEN REPAIR OF SAMSUNG GALAXY S4

DELL PERC 6/i VIRTUAL DISK SETUP FOR RAID

MINIMIZING RISK WHEN CHOOSING A RESEARCH LAB FOR PhD

WORD ON THE BLOCK

CITATIONS

FUNDING

COLLABORATORS

ACCLAIMS

CONTACT

CASUAL WATERBOARDING

QUESTIONS TO ASK YOUR FUTURE ADVISOR

CROSS CHECKING WITH OTHER GRADUATE STUDENTS

DISCUSSION & CONCLUSIONS