- luv-main - luv.asn.au

scsi
by Andrew Greig 12 Jan '19

12 Jan '19

5 8

Many to many VPN
by Russell Coker 11 Jan '19

11 Jan '19

If you have servers in multiple countries and people using those servers in multiple locations what's a good way of setting up a VPN? If you have a VPN server at each DC then performance will be great but users have to setup multiple instances of the VPN software which they will mess up and time will be wasted. If you have a VPN server at one DC then a user who connects to a server in a different DC gets longer ping times. Also an outage in one DC breaks everything. Any ideas? Support is required for Linux servers and Linux, Windows, and OS/X clients. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

4 4

Setting MTU on ethernet bridge with netplan
by Toby Corkindale 04 Dec '18

04 Dec '18

Background: I decided my home Linux server had been through too many LTS upgrades, and did a fresh install of Ubuntu Server 18.04. The old /etc/network/interfaces.d system has been replaced by netplan and networkd. I was able to configure a bridge device and attach ethernet devices, but setting the MTU doesn't work. (I have the MTU configured in netplan for both the ethernet device and the bridge device) I managed to hack in a workaround by making a networkd-dispatcher script (routable.d) that calls `ip link set mtu ...`, but wondered if there's a proper way to make this work on netplan? Cheers Toby

1 0

ethernet failure on local network using debian
by bnis＠fastmail.fm 03 Dec '18

03 Dec '18

Hello everyone, My problem is that I cannot get the ethernet card on the local network to get up. I'm new to debian after many years of red-hat/fedora. The machine: HP Compaq Elite 8300 SFF (Core i5). The system: debian buster (testing) Some information: [ben@til ~]$ systemctl status networking.service networking.service - Raise network interfaces Loaded: loaded (/lib/systemd/system/networking.service; enabled; vendor preset: enabled) Active: active (exited) since Sat 2018-11-24 21:43:38 AEDT; 6min ago Docs: man:interfaces(5) Process: 460 ExecStart=/sbin/ifup -a --read-environment (code=exited, status=0/SUCCESS) Process: 452 ExecStartPre=/bin/sh -c if [ "$CONFIGURE_INTERFACES" != "no" ] && [ -n "$(ifquery --read-environ Main PID: 460 (code=exited, status=0/SUCCESS) [ben@til etc]$ ip addr <snip> 2: enp3s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 30:b5:c2:05:28:70 brd ff:ff:ff:ff:ff:ff 3: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 <snip> [ben@til etc]$ lspci -nnk <snip> 03:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8169 PCI Gigabit Ethernet Controller [10ec:8169] (rev 10) Subsystem: Realtek Semiconductor Co., Ltd. RTL8169/8110 Family PCI Gigabit Ethernet NIC [10ec:8169] Kernel driver in use: r8169 Kernel modules: r8169 The eno1 is onboard, connected to adsl and works fine. If I restart the network with 'systemctl restart networking', or, './etc/init.d/networking restart', the network goes down and fails. The enp3s0 is connected to a switch on a local network which has two other fedora computers on it. With a previous debian box all I did to have it work on this network was write the following config, reboot, and it worked. I was guided by https://www.debian.org/doc/manuals/debian-reference/ch05. That old box went bung, so I acquired the current one and tried the same config, with the appropriate name changes. That config is in /etc/interfaces (which I created on this machine): -------start config----- # This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5). source /etc/network/interfaces.d/* # The loopback network interface auto lo iface lo inet loopback # The primary network interface allow-hotplug eno1 iface eno1 inet dhcp # This is an autoconfigured IPv6 interface iface eno1 inet6 auto # local net allow-hotplug enp3s0 iface enp3s0 inet static address 192.168.0.3 netmask 255.255.255.0 -----------end config----------- There is no /etc/network/interfaces.d/ on this machine. And this particular ethernet card is the same one that worked in previous debian box. Here are the commands I've used, but none has succeeded in getting the card up, though the ip address was assigned and shown in the 'ip addr' output. There were no error messages other than "FAILED" in the systemctl status output. ip addr add 192.168.0.3 dev enp3s0 ip addr add 192.168.0.3/24 dev enp3s0 ip link set enp3s0 up /etc/init.d/networking restart I was hoping for some help to let me know what I need to do to get this ethernet working? ben

3 4

ethernet failure on local network using debian - second post
by bnis＠fastmail.fm 25 Nov '18

25 Nov '18

Hello all again, Further info on my problem, here is a dmesg readout which strikes me as unusual because it names both ethernets in the first place with the same name: eth0, whereas on other dmesg readouts from other machines with multiple ethernets it's always been a different name for each ethernet card, i.e. eth0 and eth1 etc. <snip> [ 0.925002] r8169 Gigabit Ethernet driver 2.3LK-NAPI loaded [ 0.925162] r8169 0000:03:00.0: not PCI Express [ 0.925483] r8169 0000:03:00.0 eth0: RTL8169sb/8110sb, 30:b5:c2:05:28:70, XID 10000000, IRQ 20 [ 0.925605] r8169 0000:03:00.0 eth0: jumbo features [frames: 7152 bytes, tx checksumming: ok] [ 0.925853] ehci-pci 0000:00:1a.0: cache line size of 64 is not supported [ 0.925865] ehci-pci 0000:00:1a.0: irq 16, io mem 0xf7238000 [ 0.929154] r8169 0000:03:00.0 enp3s0: renamed from eth0 <snip> [ 1.005911] e1000e 0000:00:19.0 0000:00:19.0 (uninitialized): registered PHC clock 624 [ 1.109277] e1000e 0000:00:19.0 eth0: (PCI Express:2.5GT/s:Width x1) f0:92:1c:f2:8f:6a 625 [ 1.109378] e1000e 0000:00:19.0 eth0: Intel(R) PRO/1000 Network Connection 626 [ 1.109486] e1000e 0000:00:19.0 eth0: MAC: 10, PHY: 11, PBA No: 0100FF-0FF 627 [ 1.110291] e1000e 0000:00:19.0 eno1: renamed from eth0 <snip> [ben@til ~]$ uname -a Linux til 4.18.0-2-amd64 #1 SMP Debian 4.18.10-2 (2018-11-02) x86_64 GNU/Linux Is this identity oddness part of the problem, and what could I do about it? ben

1 0

Does anyone know of a Linux equivalent to tableau?
by h 14 Nov '18

14 Nov '18

Hi, I'm a linux hobbyist who has tinkered with postgis and apache to manipulate data for display in QGis and as tables and charts using apache. - I like to think I have a reasonable knowledge of databases but don't do it all day every day ;) I have recently been introduced to Tableau (https://www.tableau.com) which operates on Windows and on Mac clients. It seems to me to be a GUI for what I do with Postgis and apache (with a bit of R functionality added - Learning R is on my 'to do' list) Does anyone know about tableau, and whether there is a FOSS equivalent? I am on and off line at the moment, so may be slow to respond to comments. With thanks

5 7

Noscript warning
by Lindsay W 10 Nov '18

10 Nov '18

I belong to an historic radio club and I get there newsletter as an attachment to to an email. The most recent arrived today. On trying either to download or view Firefox's Noscript attachment gives a warning and on the browsers current page an error message something like "web page not availible" is displayed. I have never struck this behaviour on downloading an email attachment before. I know little about web page security but this I do regard as suspicious. Lindsay

2 2

SSL improvements
by Russell Coker 04 Nov '18

04 Nov '18

https://www.ssllabs.com/ssltest/analyze.html?d=www.luv.asn.au&s=46.4.124.163 Based on the above (and some other reading) I made some changes to the LUV configuration. SSLProtocol all -SSLv3 -TLSv1 I used the above to remove support for TLSv1. That prevents Android versions below 4.3 from connecting as well as ancient versions of IE on Windows. I'm pretty sure that every Windows system that still has MS support can run a browser that supports TLS version 1.1. As for the tiny minority of devices running Android 4.3 and earlier, that's going to be a problem for them if they aren't using Chrome. I believe that the main purpose of LUV is education. If someone has a problem with a LUV web site then they can talk to us and get some help with that. While if they encounter the same issue on some corporate site they probably won't. # from https://mozilla.github.io/server-side-tls/ssl-config-generator/ # HSTS (mod_headers is required) (15768000 seconds = 6 months) Header always set Strict-Transport-Security "max-age=15768000" I've had the above in the LUV configuration for some time. That means that browsers will cache the fact that they should use HTTPS so if you manually type in a URL the browser will use HTTPS instead. IN CAA 0 issue "letsencrypt.org" IN CAA 0 issuewild ";" IN CAA 0 iodef "mailto:russell@coker.com.au" I've also added the above DNS entries to lock the luv.asn.au domain to only certificates from letsencrypt.org. I don't think that this is going to give us a significant benefit as letsencrypt gives out certificates based on connecting to the name in question. So the task of fooling letsencrypt is probably easier than fooling a regular HTTP session. This also means that the Strict-Transport-Security also probably provides minimal benefit. Also the LUV web site doesn't need a lot of security, we aren't going online banking or anything. But again we are about education, so if LUV doing this helps others learn about configuration options and promote them for other organisations with greater security needs then that's a good thing. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

1 0

LAN-only chat?
by Craig Sanders 03 Nov '18

03 Nov '18

Anyone know of a decent local-LAN chat program? I've tried the Bonjour (i.e. avahi) module for pidin but it's just unreliable. I don't know whether it's pidgin that's the problem or whether it's because avahi is more half-arsed Poettering garbage, but I've spent hours fucking around with it on multiple occasions, think i've got it working OK, and then the next time either I or my partner try to use it to send notes to each other, it just doesn't fucking work. I suspect, but am not sure, that either pidgin or avahi gets confused because all machines on my LAN have multiple addresses on different subnets - this is too useful for VMs and docker images and other stuff to even consider changing just for a chat program. If I had to, I could set up an irc or xmpp server or something but that seems like overkill for this. So, can anyone recommend a no-frills, no-fuss LAN chat that just works? Even tips on making pidgin + bonjour work reliably would be great. Preferably something better than the ancient ytalk. craig -- craig sanders <cas(a)taz.net.au>

6 7

IBM Acquires Red Hat
by Lev Lafayette 30 Oct '18

30 Oct '18

This is fairly big deal.. https://www.cnbc.com/2018/10/28/ibm-is-reportedly-nearing-deal-to-acquire-r… Prior to the acquisition, Red Hat's market capitalization stood at approximately $20.5 billion. The acquisition is by far IBM's largest deal ever, and the third-biggest in the history of U.S. tech. -- Lev Lafayette, BA (Hons), GradCertTerAdEd (Murdoch), GradCertPM, MBA (Tech Mngmnt) (Chifley) mobile: 0432 255 208 RFC 1855 Netiquette Guidelines http://www.ietf.org/rfc/rfc1855.txt

3 2