- luv-main - luv.asn.au

pxe server
by James Harper 10 Feb '16

10 Feb '16

I'm trying to set up a PXE server under Debian, but can't see any packages that support the DHCP part of the PXE protocol. I already have tftp running, and my router is running DHCP, so I just need the server that can send out the additional boot-related DHCP options alongside what the router is offering. The 'pxe' package under debian appears only able to run on the proxy dhcp port 4011, which I don't want or need because my PXE server is not running on the same server as the DHCP server. I think that's just a permissions issue but I was hoping for something that "just worked" out of the box. Any suggestions? Thanks James

8 7

LCA videos up
by rdbrown＠pacific.net.au 08 Feb '16

08 Feb '16

Under the Youtube channel https://www.youtube.com/channel/UChQOJ44-9PPA7mZ16m3RcPA "Linux.conf.au 2016 -- Geelong, Australia" As webm for download under http://mirror.linux.org.au/linux.conf.au/2016/

1 0

Gnome / Debian testing / Login slow
by Brian May 07 Feb '16

07 Feb '16

Hello All, For some reason ever since I upgraded my box to Debian testing, when I try to log into Gnome with gdm, the system "freezes" with a grey background until I push escape, then the system boots normally. Or If I wait long enough it will eventually finish whatever it was doing and continue normally. Had the same problem with awesome window manager, so I think the problem is before it starts the user session. top shows gnome-shell is the only process using CPU, 8%. In fact this process goes up to about 10% after the login completes. Run by the debian-gdm user. Any ideas on how to debug? Thanks -- Brian May <brian(a)linuxpenguins.xyz> https://linuxpenguins.xyz/brian/

1 0

SSL configuration
by Russell Coker 05 Feb '16

05 Feb '16

https://www.decadent.org.uk/ben/blog/securing-wwwdecadentorguk.html I read the above blog post. https://www.ssllabs.com/ssltest/ I tested the LUV web site with the above URL and got A-. https://blog.qualys.com/ssllabs/2013/08/05/configuring-apache-nginx-and- openssl-for-forward-secrecy I followed the advice at the above URL and got B! https://blog.qualys.com/ssllabs/2013/03/19/rc4-in-tls-is-broken-now-what From the comments on the above blog post it seems that the only way to have PFS and not be vulnerable to other issues is to require TLS 1.2. The browser that is built in to Android (which is going to be a long-term issue as some people will use it until their phone breaks) only supports TLS 1.2 in Android 5.0 and above. The Samsung Galaxy Note 2 is currently not supported for Android 5.0 while the Galaxy Note 3 is. The Note 2 is still quite a decent phone. https://en.wikipedia.org/wiki/Template:TLS/SSL_support_history_of_web_brows… The above page has TLS/SSL support of various browsers. If we require TLS 1.2 we exclude: The default Android browser before Android 5.0. Admittedly that browser always sucked badly and probably has lots of other security issues. Chrome versions before 30 didn't support it. But version 30 was released in 2013 and Google does a good job of forcing upgrades. A Debian/Wheezy system I run is now displaying warnings from the google-chrome package saying that Wheezy is too old and won't be supported for long! Firefox before version 27 didn't support it (the Wikipedia page is unclear about versions 27-31). 27 was released in 2014. Debian/Wheezy has version 38, Debian/Squeeze has Iceweasel 3.5.16 which doesn't support it. Would it be reasonable to assume that anyone who's still using Squeeze is using it for a server? IE version 11 supports it and runs on Windows 7+ (all supported versions of Windows). IE 10 doesn't support it and runs on Windows 7 and Windows 8. Are the free upgrades from Windows 7 to Windows 10 going to solve this problem? Windows mobile doesn't have enough users to care about. Opera supports it from version 17. This is noteworthy because Opera used to be good for devices running older versions of Android that aren't supported by Chrome. Safari supported it from iOS version 5, I think that's a solved problem there. Is breaking support for Debian/Squeeze, the built in Android browser on Android <5.0, and Windows 7 and 8 systems that haven't upgraded IE as a web browsing platform a reasonable trade-off for implementing the best SSL security features? For the LUV server as a stand-alone issue the answer would be no as the only really secret data there is accessed via ssh. For a general web infrastructure issue it seems that the answer might be yes. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

11 22

firmware malware: DVD; ?motherboard?
by Douglas Ray 03 Feb '16

03 Feb '16

We have a PC with firmware malware on - at least - both DVDs. I don't know if it's worth recovering the system, but I definitely want to find diagnostics for identifying infections and vectors on the rest of the LAN. Booting a DVD live-image of ubuntu, invocations of firefox are intercepted and come up as "JON recovery system" or some such. The attack vector may have been the old XP system on the harddrive, but equally it may have been one of the ubuntu images. It is a medion PC, article number 10002328, and there are firmware updates at the manufacturer. I'm unsure how to securely install, given that the DVDs are compromised, and I have no way to verify the cardreader or motherboard BIOS or harddrive. (I could map/update the bootsector of the harddrive, but I haven't checked what may be available to work with the firmware.) Would putting the infected DVD drives on another system, sans media, risk infecting the new system? Conversely, let's say I swap in a new DVD drive and boot a putatively clean DVD - if the BIOS is corrupted do I risk just re-infecting the new DVD drive? Merry Christmas to all Douglas Ray

6 8

10GigE
by Russell Coker 02 Feb '16

02 Feb '16

What's a minimum cost for 10GigE on Linux? We're talking something like 3*PCIe network cards that work with Linux (and cards for a few Macs), cables that aren't particularly long, and a small switch (maybe 6 ports 10GigE and 4 ports GigE). Also is there a vendor that sells cheap servers with 10GigE cards built in? One of the Linux servers in question has an old CPU and can do with being replaced. Thanks. PS If you work for a company and want to sell this gear to my client then reply by private mail. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

2 1

mark btrfs device as failed
by James Harper 02 Feb '16

02 Feb '16

Is there a way that I can, on a running system, mark a btrfs disk as having failed, so that it will now be "missing" and the array will be in a degraded state? I can obviously do it by using fdisk to delete the partition, then rebooting and mounting with the degraded option, but I want to do it without a reboot, and without having to tinker with the boot process remotely. I can also delete the device (move all the data off the device), then delete it, then add the new device, then rebalance to move all the data back, and that would be safer, but would be terribly slow. Also I'm not sure I have enough free space to allow this (maybe I do, but it would be tight enough that I can't be sure there wouldn't be some overhead I haven't taken into account) Thanks James

2 1

Interesting talk on open source being essential to the
by Andrew Worsley 01 Feb '16

01 Feb '16

Found this talk on open source use in Sierra Leone pretty interesting. Sounds like it saved many lives. Andrew How Open Source Software, second hand laptops and hackers helped stop Ebola [32c3] "In the dark days of October 2014 an unprecedented Ebola epidemic wrecked havoc across Sierra Leone, Liberia and Guinea. In Sierra Leone, the health system was only weeks away from total collapse due to an inability to manage or pay health workers across the country and the world braced for the unchecked spread of the disease throughout west Africa. In the face of apocalyptic scenario, a company made up of local hackers took on the unprecedented challenge of building, implementing and running a huge Management Information System and Mobile payments system to keep the health system from collapsing. This talk will show how this was achieved with Open Source Software, second hand laptops, hacked voter registration machines, second hand smartphones and some very smart and determined young people used to achieving great things with none of the resources we take for granted. .." https://www.youtube.com/watch?v=hZ29t_6TS8w

1 0

Thunderbolt
by Russell Coker 31 Jan '16

31 Jan '16

https://en.wikipedia.org/wiki/Thunderbolt_(interface) Apple's Thunderbolt uses the same connectors as MiniDisplayPort and USB-C. Is that going to matter to us? Are there going to be situations in which things can physically connect but not be able to talk to each other? -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

2 1

Lets Encrypt
by Russell Coker 31 Jan '16

31 Jan '16

I've just installed a new free SSL from letsencrypt. We have paid for a SSL key but seem to have lost the private key. http://etbe.coker.com.au/2016/01/27/using-letsencrypt/ Above is a blog post I wrote about Lets Encrypt. Now I have configured the luv server to redirect all web traffic to https (let me know if that breaks anything) and to use a valid key for SMTP TLS. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

5 9