Linux – Mount partition from a raw disk image : dd and mount

In this post, I will share how you can mount a raw disk image such as an image generated with dd. Raw disk image or RAW Image Format is a bit-for-bit copy of disk data, without any metadata information on files. In Linux, dd is a popular tool for data transfer by duplicating entire disk for instance. Let us create a disk image of a mount with an EXT3 file system –

[root@kauai src]# dd if=/dev/sdb of=disk.img 

7233761+0 records in
7233760+0 records out
3703685120 bytes (3.7 GB) copied, 236.166 s, 15.7 MB/s

[root@kauai src]# ls -alh disk.img 
-rw-r--r--. 1 root root 3.5G Jan 15 18:44 disk.img

We have copied a mount with multiple files into a single disk.img file which we can copy to another system. Now let us examine the raw disk layout, that we can use to mount as a file system –

[root@kauai src]# fdisk -lu disk.img 
You must set cylinders.
You can do this from the extra functions menu.

Disk disk.img: 0 MB, 0 bytes
124 heads, 62 sectors/track, 0 cylinders, total 0 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xdebbbd93

   Device Boot      Start         End      Blocks   Id  System
disk.img          630416      945623      157604   83  Linux

As we can see the raw disk has 512 byte size sectors and it starts at offset 630416, given this information we can use mount command to mount the disk image –

[root@kauai src]# mount -o loop,offset=$((630416*512)) disk.img /mnt/hdisk/
[root@kauai src]# ls -al /mnt/hdisk/
total 37
drwxr-xr-x. 3 root root  1024 Jan 15 18:39 .
drwxr-xr-x. 4 root root  4096 Nov 17 20:04 ..
-rw-r--r--. 1 root root    15 Jan 15 18:39 file21
-rw-r--r--. 1 root root    15 Jan 15 18:39 file22
-rw-r--r--. 1 root root    15 Jan 15 18:39 file23
-rw-r--r--. 1 root root    15 Jan 15 18:39 file24
-rw-r--r--. 1 root root    15 Jan 15 18:39 file25
-rw-r--r--. 1 root root    15 Jan 15 18:39 file26
-rw-r--r--. 1 root root    15 Jan 15 18:39 file27
-rw-r--r--. 1 root root    15 Jan 15 18:39 file28
-rw-r--r--. 1 root root    15 Jan 15 18:39 file29
-rw-r--r--. 1 root root    15 Jan 15 18:39 file30
drwx------. 2 root root 12288 Jan 15 18:37 lost+found

[root@kauai src]# cat /mnt/hdisk/file26 
File number 26

Here we were able to mount the disk image and be able to read the content of one of the text files.

References –

https://en.wikipedia.org/wiki/Dd_(Unix)

https://linux.die.net/man/8/mount

How to copy to a clipboard in Linux

Problem statement – You have a file with hundreds or thousands of lines and you want to copy the contents of this file and paste it to an external application, for instance to a browser.

Solution – The first attempt is to try to cat the file and scroll down with your mouse to select each line. This is time consuming or in some cases might not work if there are too many lines as some of the lines will ‘scroll out of the terminal’. One way of getting around this is to use “xclip” – a command line interface to X selections (clipboard).

In my case I wanted to copy the contents of ‘/tmp/ipaddresses.txt’ file to a browser for blogging. The file had 10000 lines. I used the following commands, first to install xclip and then to copy the file contents to a clipboard –

apt-get -y install xclip
xclip -sel cli < /tmp/ipaddresses.txt

The xclip command basically does a selection (-sel) from the file into the clipboard(-cli), where you can copy paste to any other external application.

References
https://linux.die.net/man/1/xclip

https://stackoverflow.com/questions/5130968/how-can-i-copy-the-output-of-a-command-directly-into-my-clipboard

How to fake or spoof x-forwarded-for header

The x-forwarded-for header is a way of identifying the IP address of the original client when a web server is sitting behind a proxy or load-balancer. The load-balancer does get the actual client IP as it directly sets up the TCP session with the load-balancer. But the x-forwarded-for address might contain a list of comma separated IP addresses in addition to the immediate client IP. It is these extra IPs that we can spoof and the procedure is similar to modifying any HTTP header such as user agent.

import requests
headers={'X-Forwarded-For':'1.1.1.1'}
r = requests.get('http://web.home.net/index.html', headers=headers)
if r.ok:
    print('Success.')

How the log likes like on an nginx access log –

1.1.1.1, 192.168.10.206 - - [19/Mar/2017:16:43:55 -0700] "GET /index.html HTTP/1.0" 200 1311 "-" "python-requests/2.2.1 CPython/2.7.6 Linux/3.13.0-121-generic"
1.1.1.1, 192.168.10.206 - - [19/Mar/2017:16:53:55 -0700] "GET /index.html HTTP/1.0" 200 1311 "-" "python-requests/2.2.1 CPython/2.7.6 Linux/3.13.0-121-generic"
1.1.1.1, 192.168.10.206 - - [19/Mar/2017:16:58:55 -0700] "GET /index.html HTTP/1.0" 200 1311 "-" "python-requests/2.2.1 CPython/2.7.6 Linux/3.13.0-121-generic"

The take away is not to trust any IPs in the x-forwarded-for list apart from the load balancer IP and the immediate client IP which made a direct call to the load balancer. If we trust our load balancer, we can also reliably identify the immediate client IP. The rest of the IPs in the x-forwarded-for list can be ignored.

References –

https://en.wikipedia.org/wiki/X-Forwarded-For