- luv-main - luv.asn.au

OpenSuse with Btrfs (and limitations), Chris Mason describes Btrfs as "stable"
by Peter Ross 31 Oct '14

31 Oct '14

In an e-mail to Heise Open (a bit like "German slashdot"), Chris Mason describes Btrfs as "stable" http://www.heise.de/open/meldung/Btrfs-Erfinder-stuft-sein-Linux-Dateisyste… (the original e-mail embedded as a picture) According to his e-mail he and others are focusing on RAID5/6 which is not production ready yet. Suse makes Btrfs the default OS filesystem for SLE 12. It uses snapshots when updating the system so you can rollback anytime (As Solaris and PC-BSD do with ZFS, btw. The PC-BSD Grub boat loader is modified to allow to choose ZFS snapshots - I wonder whether the SLE Grub allows the same in Grub as well) Compressions seems to be considered as "not ready yet" either, it is disabled via kernel module defaults. More here: http://kernel.opensuse.org/cgit/kernel-source/tree/patches.suse/btrfs-8888-… Disallow access to filesystem with unsupported features by default but leave a chance to access the filesystem via module parameter override (taints kernel). The status can be toggled during runtime by changing the exported module parameter in /sys/module/btrfs/parameters/allow_unsupported. Current: - mount: inode_cache - deny mount - mount: autodefrag - deny mount - ioctl: fallocate and hole punch - return, warning printed only once - ioctl: receive - completely disallow - ioctl: device replace - disallow - mount: raid56 - remount RO - mount: compression - deny mount - mount: seeding device - deny mount - balance: use of raid56 taints kernel - chattr: +c - disallow, no change Having "receive" disabled removes half of the fun.. Regards Peter

3 3

RT
by Russell Coker 29 Oct '14

29 Oct '14

I have a RT 3.6 installation that I don't know how to operate. The person who was doing the support work left suddenly and I've got to provide access for their replacement. I have an account in RT that I used for test purposes some years ago but I don't remember much about it. How do I create a new account and lock the account of the old support person? If someone has good RT sysadmin skills and wants to tender for the work of configuring this (and maybe upgrading RT to the latest version) then contact me off list. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

2 1

Speakers for November and future meetings
by Andrew Pam 28 Oct '14

28 Oct '14

We are just finalising the programme for the November meeting next week, and if any members have a topic they would like to speak about either on Wednesday 5 November or at a later meeting, or know someone who they would like to hear speak, or would like to suggest a topic they would be interested in hearing about, please do contact the LUV committee and let us know! Thanks, Andrew

1 0

Downloading/Archiving Yahoo! Groups
by Lev Lafayette 27 Oct '14

27 Oct '14

Hi LUVers, One upon a time there were some simple perl scripts (e.g., grabyahoogroup, fetchyahoo) which were quite good at downloading and archiving Yahoo! groups. Now with the new web-interface redesign "neo", these scripts don't really work. Does anyone know of some alternatives that work on Linux? Thanks in advance, -- Lev Lafayette, BA (Hons), GradCertTerAdEd (Murdoch), GradCertPM, MBA (Tech Mngmnt) (Chifley) mobile: 0432 255 208 RFC 1855 Netiquette Guidelines http://www.ietf.org/rfc/rfc1855.txt

3 2

Re: MS PPTP problem between Windows 7 and poptop daemon
by Peter Ross 24 Oct '14

24 Oct '14

Peter Ross wrote: > Hi Jeremy, > >> It can be cracked in under a day with a 100% success rate. >> >> <https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/> > > I am aware of it. Sorry, it may have sounded a bit harsh. I considered a "please refrain from flogging MS PPTP" before I wrote it. As said, it is access to a particular service only. The VPN is used to connect to one VM via RDP to run a particular Windows app. This VM is quarantined. Otherwise I do not use "full-featured VPNs". I do not like BYOD in the network (at least not fully embedded in the LAN), and I do not like VPNs opening up the network to places which are not controlled. May sound a bit authoritarian - but I am the one who has to clean up the mess when things go wrong. Agreed, that there are other ways to encrypt the VPN. But I have to make it easy (e.g. OpenVPN needs an install first) so I do not have to visit everybody's home to get it work. IPSEC is the other choice but the "real deal" is with certificates and I cannot really trust files given out and stored on Windows computers which can be infected (and this happens still a lot, unfortunately) IMHO this cancels out the advantage it seems to have in the first place. If somebody has good experiences with VPN employee setups I am interested to hear it. Regards Peter

1 0

Re: MS PPTP problem between Windows 7 and poptop daemon
by Peter Ross 24 Oct '14

24 Oct '14

Hi Jeremy, > It can be cracked in under a day with a 100% success rate. > > <https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/> I am aware of it. The access is to a small separated area with no "real value" for any attacker. Medieval technology written in COBOL ensures this. It is, for a start, so obscure that the attacker may think of a virus on his display;-) As the article above shows, IPSEC has issues itself. Keys are not a solution either if you put it on a Windows desktop in amateurish hands. In fact, you cannot consider any Windows system in the wild a system safe enough to read any valuable data. Regards Peter

1 0

MS PPTP problem between Windows 7 and poptop daemon
by Peter Ross 24 Oct '14

24 Oct '14

Hi all, I am having a MS PPTP "login server" running poptop. It works for a a few Windows 7 clients bare one which seems to fail in the LCP part. The obvious difference is: The one that failed is a member of a Samba 4 AD domain. (the others standalone work group clients) But I did not enable domain authentication in the VPN connection Windows setup dialogue. In fact the setups look the same for all desktops (working or not working) as far as I can tell. Does anyone understands LCP? I have two conversations to compare (see below). I did not find an exhausting description of LCP packets yet (but keep trying, just look through RFCs etc.) But maybe someone knows it by heart so can help me out? Thank you Peter Version 1 - It works: Phase: deflink: carrier -> lcp LCP: FSM: Using "deflink" as a transport LCP: deflink: State change Initial --> Closed LCP: deflink: State change Closed --> Stopped LCP: deflink: RecvConfigReq(0) state = Stopped LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x4f3126cd LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigReq(1) state = Stopped LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x35e41cf7 LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: SendConfigRej(0) state = Stopped LCP: CALLBACK[3] CBCP LCP: deflink: LayerStart LCP: deflink: State change Stopped --> Req-Sent LCP: deflink: RecvConfigAck(1) state = Req-Sent LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x35e41cf7 LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: State change Req-Sent --> Ack-Rcvd LCP: deflink: RecvConfigReq(1) state = Ack-Rcvd LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x4f3126cd LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: deflink: SendConfigAck(1) state = Ack-Rcvd LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x4f3126cd LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: deflink: State change Ack-Rcvd --> Opened LCP: deflink: LayerUp Phase: bundle: Authenticate The one that fails: Phase: deflink: carrier -> lcp LCP: FSM: Using "deflink" as a transport LCP: deflink: State change Initial --> Closed LCP: deflink: State change Closed --> Stopped LCP: deflink: RecvConfigReq(0) state = Stopped LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x10e21d38 LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigReq(1) state = Stopped LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x69226efe LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: SendConfigRej(0) state = Stopped LCP: CALLBACK[3] CBCP LCP: deflink: LayerStart LCP: deflink: State change Stopped --> Req-Sent LCP: deflink: RecvConfigReq(1) state = Req-Sent LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x10e21d38 LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigRej(1) state = Req-Sent LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigReq(1) state = Req-Sent LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x69226efe LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: RecvConfigReq(2) state = Req-Sent LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x10e21d38 LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigRej(2) state = Req-Sent LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigReq(1) state = Req-Sent LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x69226efe LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: SendConfigReq(1) state = Req-Sent LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x69226efe LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: RecvConfigReq(3) state = Req-Sent LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x10e21d38 LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigRej(3) state = Req-Sent LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigReq(1) state = Req-Sent LCP: ACFCOMP[2] LCP: PROTOCOMP[2] LCP: ACCMAP[6] 0x00000000 LCP: MRU[4] 1500 LCP: MAGICNUM[6] 0x69226efe LCP: AUTHPROTO[5] 0xc223 (CHAP 0x81) LCP: deflink: RecvConfigReq(4) state = Req-Sent LCP: MRU[4] 1400 LCP: MAGICNUM[6] 0x10e21d38 LCP: PROTOCOMP[2] LCP: ACFCOMP[2] LCP: CALLBACK[3] CBCP LCP: deflink: SendConfigRej(4) state = Req-Sent LCP: CALLBACK[3] CBCP LCP: deflink: LayerFinish LCP: deflink: State change Req-Sent --> Stopped LCP: deflink: State change Stopped --> Closed LCP: deflink: State change Closed --> Initial Phase: deflink: Disconnected!

2 1

Fwd: [luv-ctte] FW: Seeking short term consultant embedded Linux security
by Andrew Pam 24 Oct '14

24 Oct '14

Can anyone help Robert? Thanks, Andrew -------- Forwarded Message -------- Subject: FW: Seeking short term consultant embedded Linux security Date: Thu, 16 Oct 2014 21:20:25 +0000 From: Robert Smyth <robert.smyth(a)servelec-semaphore.com> Hi, I wonder if the wider LUV group can assist me. See below. Rob Smyth *From:*Robert Smyth *Sent:* Thursday, 16 October 2014 2:59 PM *Subject:* Seeking short term consultant embedded Linux security Hi, We are in need to a Linux expert to assist us in making some decisions on implementing security in our embedded product. I wonder if there is LUV / Security SIG can help us get a message out to people who may be able to assist. We have a need to reuse password hashes between Linux and Windows, so we are looking at the algorithms and formats found in the /etc/shadow file. There is interest in using PBKDF2 or SHA512crypt, but we do not know if the crypt supported algorithms can be extended (e.g. PBKDF2). Can you assist? Robert Smyth Senior Software Developer P +61 (03) 8544 8544 A Unit 8 / 3-5 Gilda Crt, Mulgrave, Victoria 3170, Australia E Robert.Smyth(a)servelec-semaphore.com W www.servelec-semaphore.com This email including any attachments is for the named person or persons use only. It may contain confidential or legally privileged information. No confidentiality or privilege is waived or lost by any mis-transmission. If you receive this email in error, please notify the sender, delete the email immediately, and remove all copies from your system. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. All opinions expressed in this message are that of the individual sender, except where the message states otherwise and the sender is so authorized. Any liability (in negligence or otherwise) arising from any third party relying on this email is excluded. The company reserves the right to monitor all email communication for compliance purposes and to protect our business. Please consider the environment and do not print this email unless absolutely necessary. Servelec Group encourages environmental awareness.

3 2

FTP Mirror
by Russell Coker 23 Oct '14

23 Oct '14

Many years ago I used a program named "mirror" that would copy the contents of a FTP server. I think it screen-scraped the output of the "dir" command and used that to recurse through a directory tree. Now I need such a program and can't find one. My Google searches turn up many hits about things such as creating a mirror of a server with rsync (EG a Debian mirror site). But nothing about what I want. Does anyone have any ideas? Failing that, what's a good way of recursively transferring files from one Android phone to another? While I'm sure that there are better ways of transferring files than a recursive FTP the fact that both phones already have FTP servers installed means that FTP might be the easiest option. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

7 8

Fwd: Event Invitation: Simplified Linux Systems Management with Red Hat Satellite 6
by Russell Coker 22 Oct '14

22 Oct '14

This should be a good event. I'm attending. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

1 0