Setup PrivateGPT on a Fresh Ubuntu 22.04

TLDR; We'll set up PrivateGPT on a brand new Ubuntu 22.04 Install. 

I want to preface and warn you, that I am not a savvy user, much less an expert in Artificial Intelligence (AI) or Large Language Models ( LLMs). I am pretty sure I am going to say/type some wrong things :). 

I warned you, here's my write-up:

With all of the hype around AI and ChatGPT, I figured I'd join the bandwagon. A co-worker of sorts pointed out an interesting Github project 'PrivateGPT' that he has been using. His work is private in nature and while he could benefit from the advantages that a toolset like ChatGPT brings it is not feasible/permissible/frowned upon to give OpenAI or any other company the data you are working with( which is usually your clients' data.

That's where PrivateGPT comes to the rescue. The GitHub Repo "PrivateGPT is a production-ready AI project that allows you to ask questions about your documents using the power of Large Language Models (LLMs), even in scenarios without an Internet connection. 100% private, no data leaves your execution environment at any point." Please visit and support the repo located here: https://github.com/imartinez/privateGPT. The readme mentions that for the latest info, we should visit https://docs.privategpt.dev/.

What are my motivations? 

• I briefly tried to set it up and failed, I gave up. Now I am back and forcing myself to get it working. 
• AI is here to stay and what better way to learn than to play around with it. 
• You never know if your business might be able to use it. 

Use Cases:

• Well, I'll leave that up to your imagination. Think of PrivateGPT as a ChatGPT alternative that you can feed your documents( DOCS, TXT, PDF) and interact with them, 
• We'll go over some test scenarios. 

We'll be using the installation instructions here: https://docs.privategpt.dev/installation. If the instructions are there, why do you need to read this? Because I failed once, I'll probably fail again as I am writing this as I go through the steps. I failed so you can learn from my mistakes, the idea is to give you a better starting point. With all of that being said let's get into the installation.

• We'll start with a VM with a fresh install of Ubuntu 22.04. I had the Desktop Edition handy which will do the job and allow us to run a browser within the machine. 
• I won't bore you with screenshots of this process. 
• Make sure you update and upgrade your box. 
• Take Snapshot before we begin, that way you can revert back to a clean slate.
• I ran into some issues with dependencies, let's get these out of the way before we get started:
• sudo apt install git curl gcc g++ pkg-config
• sudo apt install build-essential libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev
  libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev
• Let's create a directory, then Clone the Repo
• mkdir /home/MYUSER/PrivateGPT
• cd /home/MYUSER/PrivateGPT
• git clone https://github.com/imartinez/privateGPT 

Install pyenv and Python 3.11

• Now we have to install Python 3.11 using a Python version manager.
• We'll install pyenv
• Let's use this writeup: https://medium.com/@therazmatrix/how-to-install-and-use-pyenv-in-ubuntu-22-04-fa7c28ca0b67
• curl https://pyenv.run | bash
• Then I added this to my /home/MYUSER/.bashrc file

• # Pyenv
  export PYENV_ROOT="$HOME/.pyenv"
  command -v pyenv >/dev/null || export PATH="$PYENV_ROOT/bin:$PATH"
  eval "$(pyenv init -)"
  eval "$(pyenv virtualenv-init -)"

• You'll need to restart the shell.( just close it and re-open it)
• pyenv install 3.11
• It worked :) 
• Now Install Poetry
• https://python-poetry.org/docs/#installing-with-the-official-installer
• curl -sSL https://install.python-poetry.org | python3 -
• That worked fine the first time, were on a roll. 
• So I did not put the PATH for poetry in my .bashrc, because reasons but I can run it calling /home/MYUSER/.local/bin/poetry 
• We need to create a virtual environment for our project to use the 3.11.7 Python install
• in /home/MYUSER
•  pyenv virtualenv 3.11.7 privategpt
• then go to /home/MYUSER/privateGPT
• pyenv local privategpt
• pip install llama-cpp-python
• poetry install --with ui
• This will take a while
• poetry install --with local
• This will take another while
• poetry run python scripts/setup
• Finally
• /home/MYUSER/.local/bin/poetry run python -m private_gpt
• 
• You'll see a message similar to:
• 
• You can now browse to https://127.0.0.1:8001
• 
• Upload a File, and ask it some questions. 
  
  

DNS: Why Can't I have a TXT Record ( Or any other record) alongside my CNAME record?

TLDR; Because that's how DNS works. https://www.ietf.org/rfc/rfc1912.txt

I've run across this issue various times in the last...we'll I won't tell you how long, but it's been a long time. Every time that I see this issue pop up I scramble and learn the same thing, in hopes that the lessons learned will stick I have decided to create a blog post. 

We are all accustomed to nice domain names (i.e. google.com, facebook.com), and as an end-user the backend inner workings are abstracted. What we do know is when I type in my domain on the browser, some magic happens. While I don't understand the complete magic I will do my best to explain why you can't have any other record alongside a CNAME record. 

What's a CNAME record, that's true let's take a step back. Let's take store.mydomain.com as an example, a DNS server is responsible for telling browsers how to traverse the internet and locate the server that is hosting your desired store. Other types of services that have dedicated records are Mail (email) servers they get their own MX record. There are various other records in the DNS scheme, we won't go through all of them but I've selected a sample to go over:

• A Record
• This record points store.mysite.com to an IP Address 5.5.5.5, this means that all traffic destined to your store will get forwarded to the IP address. 
• TXT Record
• Think of this as a text file that you can use to confirm ownership or management of a domain. This file is readable by the internet, in essence, if you can write to this file we can construe that you own the domain. 
• CNAME Record
• This stands for Canonical Name, the easiest way to think of this is an alias or a nickname. www.store.mysite.com can be a nickname for store.mysite.com. But let's take it a step further store.mysite.com can be a nickname to store.BIGCompany.server.hosted.com. That big company server can be Google, AWS, Oracle, or any company offering you a hosted service.
   

That's all great but why use CNAME vs A records if they both point to the same place? As an administrator, I can change records for mydomain.com at will without waiting for anyone else, on the flip side the administrators for the BIGComapny can update their records whenever they feel like it. In the A record above let's say that 5.5.5.5 needs to be updated to 7.7.7.7, if CNAMES were in use that change would be transparent to mydomain.com. Since we are using A records BIGComapny needs to let MyDomain.com know of the change and plan accordingly. For small mom-and-pop shops, it would be fine to coordinate and schedule time, but when dealing with thousands and possibly millions of domains and/or DNS Records it does not scale well. 

I figure giving a rundown on various types of records and why they are used is important to lay down the foundation. Don't get upset, but the reason you can't have CNAME records mixed with any others is that you can't :). DNS was built with this constraint in mind, why? That goes beyond the scope of this article. Taking an excerpt from https://www.ietf.org/rfc/rfc1912.txt, section 2.4 states "A CNAME record is not allowed to coexist with any other data.". 

Email Security (SPF, DKIM, DMARC)

Electronic mail (email) has been around for a very long time since 1971 according to some trusted sources. Not only is email used in our personal lives, but businesses also use it to conduct daily activities. Emails may contain a plethora of sensitive information from Financial Records, Secret Formulas, and Health Records. You name it if the data exists there is a possibility of flowing through email. Five decades ago the existence of Spam, Phishing, Whaling, or any of the myriad of cybersecurity attacks was not even conceived of. The security email protocols were not considered. It's been a long time since then and now it seems that cybersecurity is at the forefront of everyone's mind. 

There have been iterations of security mechanisms that aid in securing email. Here we provide an overview of  the major security protocols:

SPF stands for Sender Policy Framework. SPF uses DNS records to verify that an email was sent from an authorized IP address. Email administrators publish these DNS records which receiving parties use to discern if emails are coming from trusted and/or allowed IP addresses. If emails do not pass this test they are flagged as not having passed SPF. It is up to the receiving party how to deal with these emails. 

DKIM or DomainKeys Identified Mail uses a digital signature to verify that an email wasn't modified prior to arriving at the recipient's mailbox. DKIM also uses DNS records in order to publish its Public Key which is required for hashing to take place. In short, the sender hashes the email contents and provides the hash, the receiving party then computes to the same hash on the received email. If the hashes match then we can verify that the message has not changed and therefore pass DKIM. If the hashes differ the email will fail DKIM. It is up to the receiving party how to deal with these emails.

Up until now, we are just checking whether SPF or DKIM passes, but we are not telling anyone what to do with non-compliant emails. (emails that don't pass DKIM or SPF checks. This is where DMARC or Domain-based Message Authentication, Reporting, and Conformance steps in. You guessed it DMARC also uses DNS records. These DNS records instruct the receiving party on how to address emails that fail checks. The three basic options that you can request from the receiving end are:

• Do Nothing
• Quarantine The Emails
• Reject the emails. 

The end goal should be to ask for emails to be rejected though there are use cases where the other two options are used. 

These protocols help protect against business email compromises by helping prevent spam, phishing, and other cyber security threats impacting emails. Large email providers such as Google and Microsoft have already adopted these protocols. There is no reason why you shouldn't implement these tools if you are running email services. While there are many SPF/DKIM/DMARC online tools, I would start with your email provider it may be that they can do the heavy lifting. 

Email is a critical communication tool, it's used daily. Implementing these security mechanisms isn't difficult and it helps prevent cyber security threats.  I encourage all of you to implement these protocols in order to improve the security of your email communications.

Road to OSCP Part1

I've been busy as always, busy enough not to post anything in the last two+ years. I'll give you the TLDR I have obtained some certifications along the way:

• CISSP 
• CASP+
• Security+
• AWS Solutions Architect Associates
• CCENT

That's not why I am here, I wanted to let you all know that I have found another avenue of mind absorption which is Ethical Hacking/ Pentesting. I will be getting the OSCP certification, I don't know when yet but I would say within a year. After getting my CISSP I really wanted the Certified Ethical Hacker( CEH) title, while I still do and more than likely I will come back to get it I feel that my time is better spent on something that is hands-on and fun. 

I was going to say that I've used Kali Linux since it was BackTrack, but that would be an overstatement. For pentesting use cases, it is definitely. I am going to consider myself a newbie when it comes to this, I have concepts, knowledge, training, and ideas that will help me in this journey but never have I jumped into this topic as I have others.  

There are other resources that I will take advantage of during this marathon. Certifications :

• Certifications: 
• PNPT (Practical Networking Penetration Tester)
• eJPT
• CEH Practical
• Services
• VulnHub
• HackTheBox
• Proving Grounds
• TryHackMe
• Training
• Youtube
• TCM-Security
• eJPT
• Udemy

Where am I starting?

I have chosen to start with the PNPT using the accompanying training courses, more information can be found here: https://certifications.tcm-sec.com/pnpt/. Heath Adams CEO and his team over at tcm-security have a great program gaining some momentum over the last couple of years. I have not decided but before the end of the year I will be PNPT certified. 

What else?

I am going to try and not lie to myself, they say the best way to learn is to teach. I am going to try and create writeups for machines that I successfully pentest. There are a ton of walkthroughs for machines out there. What I have found out is that videos are either edited, or content is curated carefully to only show successes. I don't want to do that I want to submit my failures, I want to show where I failed, where I didn't understand, where I asked for help. More of a realistic approach