August 2018 - Talk - lists.gtalug.org

Re: [GTALUG] fail2ban problem
by o1bigtenor 30 Aug '18

30 Aug '18

On Thu, Aug 30, 2018 at 4:13 AM, ac via talk <talk(a)gtalug.org> wrote: > > yeah, this is the reason why I do not usually respond to this type of > post... security is a wide and varying topic. and opinions are held by > all and sundry. > > just for the record though: what i said was: fail2ban is not the right tool > > not that it cannot do it... > Greetings As someone who is trying to learn about security and feeling that the curve is moving far faster than I can I hope it is not inappropriate that I as - - - what would be the 'right' tool for this job? Regards Dee

2 1

Re: [GTALUG] fail2ban problem
by Michael Galea 30 Aug '18

30 Aug '18

Hi, Well, named is pretty smart and knew the requests were bogus, as indicated by the "denied". My named is still resolving valid requests for my domain. And fail2ban does support this very circumstance. I had to edit fail2ban's built in regex for named before it would work. I am guessing that bind added a field into the security.log message that broke the regex. For any that care, since I use shorewall as my firewall, I also had to modify the fail2ban banaction to use shorewall instead of iptables, and modify shorewall to dynamic blacklist ALL connections. After all this is done, my ppp connection sees the bogus requests but silently ignores them. On 08/29/18 23:29, ac via talk wrote: > Hi, > > normally, i would not respond to a post like yours :) > > when people ask your dns server a question, they are not logging into > your system. - so fail2ban is not the correct tool > > the correct answer is any of the below: > you need to write a program or a script > for example on a small single system - one that checks your logs and > then adds an iptables rule to your firewall - larger > systems/clusters simply customize bind or maybe rate limit > connections (check your named.conf - rate limit) and/or a > combination of these things - there are also many other ways to stop > this (for example forward write to your routers (if you have > routers) etc. > > hth > > Andre > > On Wed, 29 Aug 2018 20:40:16 -0400 > Michael Galea via talk <talk(a)gtalug.org> wrote: > >> I am experiencing what I believe is a DNS amplification attack on my >> bind9 DNS server. >> >> I'm seeing very of the following on different IPs >> 20:11:53.977254 IP 108.234.250.76.62926 > 69.265.222.253.53: 50679+ >> [1au] ANY? USADF.GOV. (38) >> >> My server responds >> 20:11:53.977776 IP 69.265.222.253.53 > 108.234.250.76.62926: 50679 >> Refused- 0/0/1 (38) >> >> I imagine the IPs are spoofed. >> I have installed fail2ban in order to address the problem. Various >> howtos detail how to configure bind to log to >> /var/log/named/security.log and setup fail2ban. >> >> The security.log is filling nicely with lots of "29-Aug-2018 >> 20:23:07.798 client @0x7fa1d013b990 66.69.234.170#29024 (USADF.GOV) >> query (cache) 'USADF.GOV/ANY/IN' denied" and fail2ban is indicating >> "Jail 'named-refused' started" but it never actually bans an IP. >> >> 2) I used fail2ban-regex to test the security.log line against >> fail2bans named-refused regex, but its doesn't match! So I have to >> conclude either debian bind9 changed the log output or fail2ban git >> it wrong. >> >> I'm using the latest fail2ban from debian. Has anyone else got this >> to work? >> > > --- > Talk Mailing List > talk(a)gtalug.org > https://gtalug.org/mailman/listinfo/talk > -- Michael Galea

2 1

Any good analog phone?
by William Park 29 Aug '18

29 Aug '18

Hi all, Do you know where I can buy a good quality analog phone, with - corded (no battery) - caller id - voicemail not required CanadaComputers has only VTech brand, which is what I have now and what I want to replace. I'm not too keen on Panasonic brand, from past experience. -- William Park <opengeometry(a)yahoo.ca>

3 2

Home Partitions
by Howard Gibson 27 Aug '18

27 Aug '18

I have some time on my hands. :( I am doing some website updates, including some Linux install instructions I have posted. I have an old 32_bit laptop here which is now a playtoy upon which I can install anything I want. I have just installed Ubuntu, minus all the customization I normally do. Ubuntu's default install is to place root and /home all on the same partition. My default behaviour is to separate them. I want to be able to blow away the operating system and install something else, without disturbing /home. I want to post notes to non-technical new users, and make things as simple as possible. What do all of you out there think of separate /home partions. Necessary? Not necessary? Installing a new OS on a Ubuntu box means backing up and recovering /home. How reliably upgradable is Ubuntu? -- Howard Gibson hgibson(a)eol.ca jhowardgibson(a)gmail.com http://home.eol.ca/~hgibson

2 1

knotty problem
by o1bigtenor 26 Aug '18

26 Aug '18

Greetings Had some issues with my system and although I didn't need to, in retrospect, re-install - - - well I did. Running, as previously, on Debian testing (10 or buster) with a pile of ram and and and , with what may be more unusual is 2 graphics cards and 4 monitors set up as 2 x-screens. (Would love to condense that into 1 screen if someone has the know how and can describe it but 2 works well enough even if 1 would be very slick (and quite 'interesting').) So on this new install I have been working to install the interesting (?) programs that I have had previously. This morning in reading emails I noticed that I was unable to copy and past using ctrl-c and ctrl-v. Have been looking at key bindings and the clipboard. Have reinstalled x11-apps and lxsession as both are liked to clipboard use. Still no joy. Have been also looking at key bindings and keyboard shortcuts but I don't know how, and can't find real information, as to what controls such and if those are possible culprits for the missing keyboard shortcuts. Any ideas or suggestions as to the culprit (or the recalcitrant directories/files whatever) would be gratefully accepted. Regards Dee

1 0

Re: [GTALUG] Which Distro is Best for Running a ZFS-on-Linux Fileserver.
by Jose A. Dias 25 Aug '18

25 Aug '18

Something like this: https://www.canadacomputers.com/search/product.php?cPath=14_679 <https://www.canadacomputers.com/search/product.php?cPath=14_679&item_id=069…> &item_id=069771 External USB, preferable 3.0 over 2, or eSata if you have the port. If you doint' need two drive capacity then pick a single. Add the current the drive you need and let it copy. I tend to use ext4 for externals so to minimize complexity on attaching to other systems, but YMMV. [Jose A. Dias] -----Original Message----- From: talk [mailto:talk-bounces@gtalug.org]On Behalf Of David Mason via talk Sent: Saturday, August 25, 2018 10:21 AM To: GTALUG Talk Subject: Re: [GTALUG] Which Distro is Best for Running a ZFS-on-Linux Fileserver. On Aug 25, 2018, 6:21 AM -0400, D. Hugh Redelmeier via talk <talk(a)gtalug.org>, wrote: | From: David Mason via talk <talk(a)gtalug.org> | I am interested in this question too. I currently am running on Debian | 7.7 but I’m not sure I can upgrade to a more current version, which is | frustrating because I want to install Java (to run a Minecraft server) | and (when I tried, so while back) I couldn’t get it to install because I | had such an old version of Debian. Back in 2017 March 12 you mentioned a problem "Updating Wheezy to Jessie". Did you try Stewart's and Lennart's suggestions? I put a little time into it, but didn’t get to success. Unfortunately, life intervened. It’s still important, but as you say, as you fall behind, it becomes more difficult to leap-frog into the present. This is exactly the kind of problem that a debian local users group might address. Recently I suggested that GTALUG could function as a debian LUG. I guess that here we have a test of this idea. I think it already does. What did you have in mind beyond the mailing list? Even for the debian upgrade attempt it might be good to have a backup. Yes, I know. :-) After enough time, the old hardware becomes obsolete too and it makes total system rebuild more sensible than update. In my most recent example, I jumped about 15 years ahead in hardware. This system is <5 years old, and at the time was kind-of leading edge. so I’m not worried about that. It’s a 4.4Tb raidz2 at 64% and has performed flawlessly. Unfortunately I don’t really have the time to do any serious digging right now, either. How do others backup their ZFS systems? Getting a 4T external drive doesn’t seem like the best plan, but maybe there isn’t any other choice. ../Dave

1 0

System Monitor / sysmon
by D. Hugh Redelmeier 22 Aug '18

22 Aug '18

I have sysmon on my Linux systems. It is a nice graphical tool to show CPU, memory, and network loads. It produces strip charts. (It also does other things, but that's not my current concern.) When I want to figure out what's taking so long, sysmon is a handy tool. But I think that my system's bottleneck is often disk I/O. sysmon has no strip chart for that. I don't even know how it should be done: - each device should probably have a different trace, just like each processor core does - percentage would be ideal but I don't know what that would mean. Do you count I/O ops? Queue length? Processes waiting? + sequential I/O is much faster than random I/O (at least on a real disk). + Large operations are somewhat slower than small ones (generally speaking). + output is generally non-blocking (roughly: the write goes into the kernel's memory, queued for writing to the device, and the process proceeds without waiting to the write to actually complete) + input usually blocks: the process issues a read and waits until the read finishes before it proceeds + Perhaps the simplest metric might be the number of processes waiting for disk I/O completion. But that leaves writes unaccounted for. Do you have any suggestions for a simple (possibly simplistic) tool to show disk bottlenecks in real time? PS: On the system I'm looking at, in the sysmon pane for "Processes", there is a column for "Disk read total" and another for "Disk write total". After a day of running the Libreswan test suite, gnome-terminal server wins with 3.4GiB of read and 3.9GiB of write. I wonder what that's all about. I would not expect Gnome Terminal to do disk I/O. As it happens, essentially all the output to the terminal is being captured by a script(1) command (run within the gnome terminal session). It shows 11.4MiB of disk output for one complete run, which should be half or a third of all that has gone to Gnome Terminal because I've run the suite two or three times since logging in. But it is more like a 11.4/3400 or roughly 1/300. Guess: gnome terminal reads and writes to X count as disk I/O. That's pretty messed up.

5 5

August talk is available on youtube
by Alex Volkov 22 Aug '18

22 Aug '18

Hello everyone, The talk Beyond and Behind Maker Festival with Eric Boyd is available on youtube. It's in two parts: Main talk and Q&A and can be found here -- https://www.youtube.com/embed/videoseries?list=PLUgE6dqIXiEsDT3DzqwXMtqndPT… I've also had a chance to visit Toronto Makerfest this year and I've made a few short videos talking to several people at the booths there, including one with Stewart Russell. Here's the playlist with the videos -- https://www.youtube.com/embed/videoseries?list=PLUgE6dqIXiEunBfXKRNLhPj7bFd… Alex.

1 0

Re: [GTALUG] Peter Hiscocks
by Kevin Cozens 19 Aug '18

19 Aug '18

On 2018-08-15 11:12 PM, David Mason via talk wrote: > I regret to say that Peter died a week or so ago. He was always curious > and willing to experiment with all sorts of things. Thank you for the sad news. I met Peter on several occasions while I was a student in an electronics program at Ryerson. -- Cheers! Kevin. http://www.ve3syb.ca/ | "Nerds make the shiny things that https://www.patreon.com/KevinCozens | distract the mouth-breathers, and | that's why we're powerful" Owner of Elecraft K2 #2172 | #include <disclaimer/favourite> | --Chris Hardwick

1 0

Dan Kaminsky Bugs aren't random ...
by Russell Reiter 17 Aug '18

17 Aug '18

Nice talk on the physics of power management in the most recent shared cache exploits. Defcon 26 was held in China this year. https://www.youtube.com/watch?v=f3cyCg7itOI Dan says; It can take looking at a few thousand bugs, but eventually hacking feels like getting really good at telling the same joke, over and over again. It's OK, the computer still laughs, but why isn't software engineering delivering the reliability and predictability of other engineering disciplines? That's a question with an answer. It's not an easy answer, like "devs are lazy" or "tools are bad". Who are hackers to complain about either? But it's an answer I intend to explore, in true hacker fashion, by seeing traditional boundaries as mostly false, but useful for identifying what to fuzz. Why should we separate the humans that write bugs, from the tools the tools they use? Humans write tools. Why these tools in particular? Why would we separate forward and reverse engineering, dev from test? Wait, are those the same thing? Does any other field isolate the creator from the consequences of their creation? Is this going to be just some fluffy exploratory keynote? No, this is way too long a flight for that. We're going to talk about where I think software and hardware architecture is going to go, with actual code you're welcome to try to break. I'll tell you exactly where to look.

5 4