- luv-main - luv.asn.au

Getting started with IPv6
by Matthew Cengia 12 Jun '13

12 Jun '13

Hi all, I want IPv6 experience. Our main link at work is Internode, so I can get native IPv6. I want an isolated test net that can talk IPv6 to the internet, without leaking IPv6 into my production network. I think I can do this by simply enabling IPv6 in the bastion's kernel, and dropping IPv6 packets that aren't going between the test net and the internet. Is this safe? Can IPv6 leak into my production net? More details follow ------------------- I have a /24 IPv4 network with Internode. My router (known as Alpha) is a full Ubuntu Lucid server with 4 downstream interfaces (each serving a public /26) and 2 upstream ppp connections. (ppp0 is Internode, ppp1 is an irrelevent backup Exetel link.) | cyber@alpha:~$ ip link | 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN | link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 | 2: eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000 | link/ether 1c:6f:65:c6:47:46 brd ff:ff:ff:ff:ff:ff | 3: managed: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 | link/ether 00:1b:21:b6:65:99 brd ff:ff:ff:ff:ff:ff | 4: unmanaged: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 | link/ether 00:1b:21:b6:65:98 brd ff:ff:ff:ff:ff:ff | 5: dmz: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 | link/ether 00:1b:21:b6:65:9b brd ff:ff:ff:ff:ff:ff | 6: scratch: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 | link/ether 00:1b:21:b6:65:9a brd ff:ff:ff:ff:ff:ff | 518: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc pfifo_fast state UNKNOWN qlen 3 | link/ppp | 542: ppp1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc pfifo_fast state UNKNOWN qlen 3 | link/ppp IPv6 is disabled in Alpha's kernel. I want to give Alpha an extra network interface called "ip6test" (or rename eth0 above) and have IPv6 passed through (and completely *isolated*) to the network segment connected to that NIC. The top priority is ensuring that Alpha and the 4 IPv4 subnets (managed, unmanaged, dmz, and scratch) all drop IPv6 packets until I've more IPv6 experience. Here's what I *think* is required, but I'm looking for a second opinion: | #!/usr/sbin/ip6tables-apply | *filter | :OUTPUT ACCEPT # Local users/processes are trusted. | :INPUT DROP # Ingress policy is "default deny". | :FORWARD DROP # Routing policy is "default deny". | :PRELUDE - # Best practices for filtered chains. | | ## Quickly handle the essentials of a "default deny" environment. | ## Anything left after this chain implicitly has --ctstate NEW. | -A INPUT -j PRELUDE | -A FORWARD -j PRELUDE | -A PRELUDE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT | -A PRELUDE -m conntrack ! --ctstate NEW -j DROP -m comment --comment "Same as --ctstate INVALID." | -A PRELUDE -o ip6test -p icmp -j ACCEPT -m comment --comment "For now, only allow ICMP to test network" | -A PRELUDE -i lo -j ACCEPT | | ## YOUR RULES GO HERE | -A FORWARD -o ip6test -p tcp --dport ssh -j ACCEPT -m comment --comment "Allow IPv6 SSH traffic to test network" | | ## Finally, politely reject all other attempts. Omit these to use the | ## chains' default policies (DROP, above) instead. | -A INPUT -j REJECT | -A FORWARD -j REJECT | COMMIT So I expect, having enabled IPv6 in Alpha's kernel, Alpha gets an IPv6 address on ppp0, but due to the above firewall, IPv6 traffic not from/to ip6test will be rejected. Due to the PRELUDE chain, ICMPv6 will be allowed to machines connected to the ip6test interface, all of which I expect toobtain an IPv6 address. The FORWARD chain will allow direct SSH to those machines. Assuming all the above is suitably secure, I then expect to carefully open more IPv6 access up to the ip6test interface for further testing. Further, will I need radvd or similar on Alpha, or will it be good enough to handle that on another box connected to the ip6test interface, or let Internode deal with it? How does this all sound? -- Regards, Matthew Cengia

4 7

restream triplej
by James Harper 09 Jun '13

09 Jun '13

The kids (and me too) are going to listen to triplej hottest 100 today and tomorrow, and I was thinking I should set up something on my server so they can stream it over the lan from a single internet feed rather than all streaming over the internet separately. A regular radio won't work if they are using headphones on their computers playing games etc as well. Time shifting would be neat too but not a requirement. Has anyone done this before? I did years ago but hopefully there is a single tool that is easy to set up these days? Thanks James

4 4

Missing service files for samba on FC18
by Allan Duncan 08 Jun '13

08 Jun '13

I've been able to fudge my way around SysV init.d for years, but I've just run into a systemd brick wall. Googling hasn't been successfull in finding a likely solution. I installed Fedora 18 a while back, and then added samba, but when I tried to activate it via the sytem/services gui winbond, nmb and smb do not appear on the list. The files winbind.service, nmb.service and smb.service appear in /usr/lib/systemd/system In fact, those are the only files that refer to them anywhere. If I try to manually start them: > sudo systemctl start /usr/lib/systemd/system/winbind.service Failed to issue method call: Unit usr-lib-systemd-system-winbind.service.mount failed to load: No such file or directory. See system logs and 'systemctl status usr-lib-systemd-system-winbind.service.mount' for details. > sudo systemctl status usr-lib-systemd-system-winbind.service.mount usr-lib-systemd-system-winbind.service.mount Loaded: error (Reason: No such file or directory) Active: inactive (dead) > cat winbind [Unit] Description=Samba Winbind Daemon After=syslog.target network.target nmb.service [Service] Type=forking Environment=KRB5CCNAME=/run/samba/krb5cc_samba PIDFile=/run/winbindd.pid EnvironmentFile=-/etc/sysconfig/samba ExecStart=/usr/sbin/winbindd "$WINBINDOPTIONS" ExecReload=/usr/bin/kill -HUP $MAINPID [Install] WantedBy=multi-user.target I know the basic samba install is good as I could invoke the three using SysV scripts from FC14, but setting up all the rcx.d links as well as the scripts didn't make them appear in the services list like it was suggested in the systemd writeup I looked at. Looking at the initial install log (courtesy of anaconda) samba and samba-client were installed then, but winbind was not. An FC17 set up the same way has the same fault. Does anyone have suggestions? Given two separate installs have gone the same way there must be something wrong with what I'm doing.

1 1

finding executable files in a debian package
by Andrew Spiers 07 Jun '13

07 Jun '13

Is this the best way? dpkg -L python-docutils | xargs ls -dF | grep \* I used to do dpkg -L python-docutils | grep bin but it seems this doesn't catch them all. Also, should all executable files be in bin/ directories according to the Debian packaging guidelines or the filesystem hierarchy standard? I couldn't find an answer to that with a quick look.

12 36

Korean before the LUV meeting tonight?
by Chris Samuel 04 Jun '13

04 Jun '13

Hi folks, If anyone is interested I plan to meet Brian and a couple of other VPAC folks for Korean at "Big Mamas" on Swanston St (just opposite the old CUB building site) at 5:45pm this evening. Please let me know if you're thinking of coming! All the best, Chris -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC

3 2

Re: [luv-announce] LUV Main June 2013 Meeting: GNU Screen and DRM in HTML5
by Toby Corkindale 04 Jun '13

04 Jun '13

On 29/05/13 09:10, Lev Lafayette wrote: > * Malcolm Herbert, Introduction to GNU Screen > > Malcolm has been hacking and playing with a range of Unix systems of > different flavours since 1991 in a variety of environments. Over time he's > encountered tools that manage to get the job done with a minimum of fuss > and have incorporated these into the set that he use on a daily basis; > screen is one such tool and is sometimes referred to as the Swiss Army > chainsaw of the Unix world. > > In a nutshell, screen is a terminal multiplexing tool. Rather than run > multiple individual terminals on your local host (ie, PuTTY windows, > Konsole tabs) for various tasks, screen allows a single local window to > manage multiple instances of shells on the remote host. Configuration > options allow maintenance of remote session state despite network > interruption; multiple active heads; session logging; cut and paste; plus > many others. By the way, I encourage Malcolm and others to investigate "tmux". It's similar to screen, but offers extra features such as: * multiple clients/sessions can exist and be transferred between each other (ie. you can open a new window in one session; then attach a new client and simultaneously view that window, then even remove it from the first client) * free-form splitting of the virtual console * easier configuration and shortcuts, interactive menus * easier scripting of actions from the shell * multiple paste buffers * automatically renames window titles * selectable vi or emacs controls More details about how it differs at: http://sourceforge.net/p/tmux/tmux-code/ci/master/tree/FAQ

2 1

texinfo question
by Brian May 04 Jun '13

04 Jun '13

Hello, Any texinfo experts here? Trying to build Heimdal in Debian unstable, but for some reason it doesn't like one of the texi files any more. It use to work.... ./whatis.texi:39: unknown command `def' ./whatis.texi:39: unknown command `xsub' ./whatis.texi:40: unknown command `global' ./whatis.texi:40: unknown command `let' ./whatis.texi:40: unknown command `xsub' (possibly involving @sub) The relevant lines are: @tex @def@xsub#1{$_{#1}$} @global@let@sub=@xsub @end tex What does @tex do? I tried searching the documentation at http://www.gnu.org/software/texinfo/manual/texinfo/texinfo.html but with no luck. There is @TeX{} but that appears to be different. Doesn't look like anything to do with TeX to me. Can anyone see why this use to work? Debian wheezy seems fine but Debian sid is not. Thanks -- Brian May <brian(a)microcomaustralia.com.au>

2 2

Re: Postfix "trickle" list delivery
by Petros 04 Jun '13

04 Jun '13

Quoting "Kevin" <kevin(a)fuber.org> > For an announce feature i would farm that out to something like > mailchimp or similar. Probably. It was my first thought. > EC2 is distrusted thanks to the fairly frequent spam coming out of it. It looks as Amazon is working with Spamhaus and others to whitelist if you use an Elastic IP. An Elastic IP costs nothing as it runs but 1 cent per hour if you do not use it ($7.20 a month), if I understand correctly. That seems to be the cost of my switched-off system then. Part of this is trying Amazon. Until now I could not see a case (for me) that I really save costs compared to other solutions (in-house, hosting etc). This one looked like it - but as I find out it has costs that were not obvious to me when I started. Upside: I am not locked in. I can walk away from it when I want. Anyway, bulk e-mail is a dodgy business so I understand why Amazon wants to restrict it. (BTW: I don't want to send spam - in case you wonder) Regards Peter

1 0

Re: Postfix "trickle" list delivery
by Petros 04 Jun '13

04 Jun '13

Quoting "Peter Ross" <petros(a)fdrive.com.au>: > From: "Russell Coker" <russell(a)coker.com.au> >> On Mon, 3 Jun 2013, Petros <Petros.Listig(a)fdrive.com.au> wrote: >>> BTW: The server is in the Amazon EC2 cloud but I don't think it >>> matters. Still, if I try a telnet on port 25, the connection opens >>> faster from my office (ADSL) than from the Amazon VM. >> EC2 should be fast enough. How many users are on the list? > > Ca. 500 users. It is an announcement lists only. .. > I am surprised by the slowness. I wonder whether Amazon is throttling > SMTP traffic. Yes: Dear EC2 Customer, You recently reached a limit on the volume of email you were able to send out of SMTP port 25 on your instance: Instance ID: .. In order to maintain the quality of EC2 addresses for sending email, we enforce default limits on the amount of email that can be sent from EC2 accounts. If you wish to send larger amounts of email from EC2, you can apply to have these limits removed from your account by filling out our online request form. Okay, will see, how it goes. Maybe Amazon isn't the right place for it. Regards Peter

4 4

Re: Fwd: Postfix "trickle" list delivery
by Petros 03 Jun '13

03 Jun '13

From "Russell Coker" <russell(a)coker.com.au> > http://aws.amazon.com/ec2/#pricing > > A "small" EC2 instance costs 6 cents per hour or $43.80 per average month. > Plus costs for bandwidth and storage. A "micro" instance costs 2 cents per > hour or $14.60 per average month. .. > EC2 is really good for dynamically scalable systems and for situations where > you need bulk computing off-peak (as demonstrated in a LUV talk some > time ago). > It's not particularly good for running a single server. As said, it is an announcement server which is "fed" by us maybe once a month. The idea was to let it run only when needed. I wasn't aware of SMTP traffic restrictions. I actually looked out for it but could not find it mentioned anywhere. Besides, for me it was a trial to figure out how to deal with Amazon EC2. Well, actually, fears confirmed: you never know exactly what you get, you cannot rely on it and you don't get what you want;-) Thanks for the other ideas as Linode or Hetzner. I have a think about it. Regards Peter

2 1