August 2018 - Talk - lists.gtalug.org

war story: power failure makes CentOS system unbootable
by D. Hugh Redelmeier 30 Sep '22

30 Sep '22

tl;dr / spoiler: change fstab so that /boot/efi is not automatically mounted. See the recommendation at the end of this message. My gateway computer is a little PC running CentOS. It does not come back after a power failure. The reason (as best I can tell) is interesting and I think that I have a fix. My system is UEFI. It boots from a UEFI system partition, known as /boot/efi to Linux. If this gets corrupted, it won't boot. It is a VFAT partition. On my gateway (a Zotac Zbox RI321, a cute little box with two ethernet ports), the UEFI firmware apparently won't boot if the dirty bit is set in the system partition. CentOS normally runs with /boot/efi mounted. So when the system isn't shut down cleanly, the dirty bit will be on. Consequence: the system is not going to boot after a power failure. Odd observation 1: if I put a live Fedora 25 USB stick in the system and try to boot in this otherwise-unbootable state, CentOS boots from the main disk. So this really looks like a firmware bug/quirk. Odd observation 2: fsck doesn't seem to automatically fix the system partition. Once CentOS 7 booted, I dismounted /boot/efi and did an fsck on it. $ sudo fsck /dev/sda1 fsck from util-linux 2.23.2 fsck.fat 3.0.20 (12 Jun 2013) 0x25: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt. 1) Remove dirty bit 2) No action ? 1 Leaving filesystem unchanged. /dev/sda1: 16 files, 2420/51145 clusters Googling got me to <https://www.centos.org/forums/viewtopic.php?t=50917> In particular, this advice seemed quite good: ==== recommendation ==== Two other changes I recommend for UEFI systems, to each OS's /etc/fstab. - For the /boot/efi mountpoint, add the mount options x-systemd.automount,noauto - Change fs_passno (last column) to a 1 or 2; the canonical fstab instructions suggest 2, but systemd treats 1 and 2 as the same. The first change means the EFI System partition will not be automatically read-write mounted at boot time; it's a bad idea this is the default because it puts the ESP at risk especially if ther are crashes, FAT has no journal and will therefore always be marked dirty in such a case; no other UEFI OS mounts the ESP by default. Second, if anything tries to access /boot/efi (read or write), systemd will automatically mount it, and because of the fs_passno 1 or 2, it will fsck it first and that fixes and clears the dirty bit in case it's set. Right now without these changes, it's just a matter of having the right number and bad timing of crashes to render the EFI System partition corrupt.

3 9

glittery cheap but useless toy computers
by D. Hugh Redelmeier 30 Sep '18

30 Sep '18

The price of this looks very attractive: <https://www.zapals.com/nexbox-a95x-tv-box-4k-android-7-1-amlogic-s905w-quad…> - US$23.99, with free (very slow) shipping, probably no tax - only FullHD - 1G RAM, 8G eMMC (a little light) - Amlogic S905w: quad core Arm Cortex A53 processor; penta core Mali 450MP GPU. There are a lot of cheap boxes meant for running Kodi and this is one of them. Technically, they run Android and easily hook up to your TV. But they don't run Android TV (a subtle but important difference). Because of "Digital Rights Management", they cannot run Netflix at a good resolution. I don't remember if YouTube also limits them. So what's left? Unauthorized content discovered through Kodi plug-ins. I've never tried this. I understand that there is a large turnover in plug-ins as they get taken down. For TV use, I much prefer a Xiaomi Mi Box with genuine Android TV (US$70 from US Walmart). BUT. The raw hardware for these cheap boxes is interesting. Faster than a Raspberry Pi. And these come with a box, remote control, and power supply. Expandability and openness in general is a lot worse. The worst thing is that all their GPUs are proprietary (and a few other things too) so you cannot drop an ordinary Linux on them. I think that they all use uboot and device tree, but in an idiosyncratic way, adding to the difficulty. I bought a (less) cheap S912 box that I intend to play with. Apparently you can run Linux on these if you don't need video output. I won't give links because I don't know which efforts are the best.

1 1

Lenovo ThinkPad Compact Bluetooth Keyboard with TrackPoint
by Scott Sullivan 23 Sep '18

23 Sep '18

I've had a number of folks express interest after seeing me use mine. So I'm just going to drop the links here for general reference. Lenovo ThinkPad Compact Bluetooth Keyboard with TrackPoint https://www.newegg.ca/Product/Product.aspx?Item=N82E16823218058CVF https://www.lenovo.com/ca/en/accessories-and-monitors/keyboards-and-mice/ke… The also make a USB only version, which I have two of as daily drivers for at home and work. https://www.lenovo.com/ca/en/accessories-and-monitors/keyboards-and-mice/ke… -- Scott Sullivan

6 9

Any Debian User Groups in the GTA?
by Sergio Durigan Junior 06 Sep '18

06 Sep '18

Hi there, Do we have any Debian User Groups in the GTA? I've been living in Toronto for the past 4 years and never even heard of one, which is a bummer. I'd like to do something this weekend to celebrate Debian Day + 25 years of the project. On a side note: any DDs/DMs on this list? Maybe we can start a group ourselves :-). Thanks, -- Sergio GPG key ID: 237A 54B1 0287 28BF 00EF 31F4 D0EB 7628 65FC 5E36 Please send encrypted e-mail if possible http://sergiodj.net/

11 21

fail2ban problem
by Michael Galea 01 Sep '18

01 Sep '18

I am experiencing what I believe is a DNS amplification attack on my bind9 DNS server. I'm seeing very of the following on different IPs 20:11:53.977254 IP 108.234.250.76.62926 > 69.265.222.253.53: 50679+ [1au] ANY? USADF.GOV. (38) My server responds 20:11:53.977776 IP 69.265.222.253.53 > 108.234.250.76.62926: 50679 Refused- 0/0/1 (38) I imagine the IPs are spoofed. I have installed fail2ban in order to address the problem. Various howtos detail how to configure bind to log to /var/log/named/security.log and setup fail2ban. The security.log is filling nicely with lots of "29-Aug-2018 20:23:07.798 client @0x7fa1d013b990 66.69.234.170#29024 (USADF.GOV) query (cache) 'USADF.GOV/ANY/IN' denied" and fail2ban is indicating "Jail 'named-refused' started" but it never actually bans an IP. 2) I used fail2ban-regex to test the security.log line against fail2bans named-refused regex, but its doesn't match! So I have to conclude either debian bind9 changed the log output or fail2ban git it wrong. I'm using the latest fail2ban from debian. Has anyone else got this to work? -- Michael Galea

3 3

Which Distro is Best for Running a ZFS-on-Linux Fileserver.
by right.maple.nut 31 Aug '18

31 Aug '18

Hello All, Like the Subject Line says, I'm setting up a ZFS File Server for my Home Network. Given that I will have to go to the trouble of setting up the Distro and Migrating the Linux Install to ZFS Root, I don't want to have to do this too many times. So, which Distro are the favourite for Running ZFS-on-Linux? Also, is there such a thing as a Linux Distro that is smart enough to give you a choice if you are willing to use non-GPL'ed code in the Installer, so that I can just Install Directly on a ZFS Pool? Thank You in Advance for your Input. Regards, Amos

10 18

inexpensive external portable 4T drive
by D. Hugh Redelmeier 31 Aug '18

31 Aug '18

I like the 4T Seagate "portable" (i.e. 2.5") external 4T disk drives. They are good for backups. - 2.5" drives are physically small - 2.5" external drives only have one (USB3) cable. No separate power cable and wall-wart (3.5" externals require these). - If you don't have USB 3 on your computer I'm not sure that the drive will get enough power to run. Even if it works, filling a 4T drive at USB 2 "Full Speed" is going to take a very long time. - shuckable (i.e. you can pry off the case and use the raw drive). This is good if something goes wrong. It isn't true of Western Digital drives. - unfortunate: if I remember correctly, the physical raw drive is a little thicker than most 2.5" drive bays allow. So shucking to get a raw drive to install inside a notebook may not work. The Seagate 2T portable externals do work. - 2.5" drives seem to handle mechanical shock better than 3.5" drives - 2.5" drives are a lot easier to store than 3.5" drives (a lot smaller, lighter, and fewer bits) - cheap. Usually $125 is possible. Last I looked, cheaper than the internal drive. Right now Staples is selling these for $99.92 + a little environmental stewardship fee. And there are a lot of $15 off $100 Staples coupons floating about. I even had (and used) a $25 off $75 coupon. <http://forums.redflagdeals.com/staples-staples-seagate-expansion-stea400040…> (For most internal applications these days, SSDs make more sense than HDDs. SSD prices seem to be starting to fall. For a number of our notebooks we actually have both.) There are drives with larger capacity but they are generally more expensive per byte, shingled, or 3.5". I don't yet trust shingled drives but a natural application for them would be backing up because that doesn't require random access writing, their weak point.

2 1

Checking for DNSSEC
by Gordon Chillcott 30 Aug '18

30 Aug '18

I got asked, off-line, by a couple of people if ICANN had any tools for testing for DNSSEC. There are so I went in, dug them out and tried them. The question, by the way, was prompted by the news that the DNSSEC Key Signing Key rollover will take place on or about October 11 – this has been delayed twice. Now. To get to the DNSSEC tests, you can go to: https://www.icann.org/resources/pages//tools-2012-02-25-en This will bring up a list of four tests: - a DNS Visualization test - a “DNS Check” - a DNSSEC Analyzer - an SIDN DNSSEC Test All but the last take a domain as an argument (entered in a text window on the page). The last one performs the test to where you're connected. I recommend you try each one to see which is right for you. Read the results carefully, though. The “DNS Check” Seems to think it's OK if DNSSEC is not there for the zone, as long as everything else is fine. The last one gives you a link to a more comprehensive test at: http://en.conn.internet.nl/connection/ That test covers things like IPV6 connectivity as well as DNSSEC. Cheers, Gordon

3 2

Ubuntu -- Disabling Ping
by Howard Gibson 30 Aug '18

30 Aug '18

I am playing with my hack Ubuntu machine, and I am sorting out security. I want to disable ping. This is a laptop, and I want to document the application of aluminium foil. The standard ping disabler is the following line... # echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all This works fine on my Fedora laptop. On Ubuntu, I get... $ sudo echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all -bash: /proc/sys/net/ipv4/icmp_echo_ignore_all: Permission denied The file exists. I can print it with "cat" (it prints "0". Why can I not change it? -- Howard Gibson hgibson(a)eol.ca jhowardgibson(a)gmail.com http://home.eol.ca/~hgibson

10 32

Re: [GTALUG] fail2ban problem
by o1bigtenor 30 Aug '18

30 Aug '18

On Thu, Aug 30, 2018 at 6:05 AM, ac via talk <talk(a)gtalug.org> wrote: > On Thu, 30 Aug 2018 05:49:58 -0500 > o1bigtenor <o1bigtenor(a)gmail.com> wrote: >> On Thu, Aug 30, 2018 at 4:13 AM, ac via talk <talk(a)gtalug.org> wrote: >> > yeah, this is the reason why I do not usually respond to this type >> > of post... security is a wide and varying topic. and opinions are >> > held by all and sundry. >> > just for the record though: what i said was: fail2ban is not the >> > right tool >> > not that it cannot do it... >> Greetings >> As someone who is trying to learn about security and feeling that the >> curve is moving far faster than I can I hope it is not inappropriate >> that I as - - - what would be the 'right' tool for this job? >> > the op originally mentioned an amplification, it also depends on > ingress/egress (hijacked AS / routing qos / etc etc) and any number of > other issues. running name servers is also a whole topic on its own > as there is never one answer, but on ppp i would just use rate limit in > bind.conf - i guess on a single name servers and with no load / > production / other value based issue, it does not really matter if you > do use anything. > Thanks very much!! Dee

1 0