May 2021 - Talk - lists.gtalug.org

Raspberry Pi 4 Starter Kit - Ubiquiti Unifi controller software
by James Knott 10 May '21

10 May '21

I've been considering (because I have way too much time on my hands these days) getting a Raspberry Pi to run my Unifi access point controller software on. I would be doing this with Ubuntu or Raspian Linux. I currently run the controller on my desktop system (openSUSE). I assume a kit like this would be suitable. https://www.canakit.com/raspberry-pi-4-starter-kit.html

4 5

War Story: Fedora 33 update silently broke Dovecot (IMAP / POP3 server)
by D. Hugh Redelmeier 10 May '21

10 May '21

Only one of us uses IMAP / POP3. She stopped being able to pick up mail. The message was obscure: Thunderbird reported getting resets from the server. Detective work (leaving out the blind alleys): Look for funny messages in the server log. The right command is arcane: $ journalctl -b _SYSTEMD_UNIT=dovecot.service - -b means "since last boot". Very handy because the log can go back a long time. - _SYSTEMD_UNIT=dovecot.service: only messages about dovecot. Such an intuitive form. It won't work without the .service. It turns out that there is a shortform, -u or --unit=. May 04 14:07:12 redhop-mimosa-com dovecot[977]: config: Warning: please set ssl_dh=</etc/dovecot/dh.pem May 04 14:07:12 redhop-mimosa-com dovecot[977]: config: Warning: You can generate it with: dd if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dhparam -inform der > /etc/dovecot/dh.pem May 04 14:07:12 redhop-mimosa-com dovecot[977]: pop3-login: Error: Failed to initialize SSL server context: Can't load DH parameters (ssl_dh setting): error:1408518A:SSL routines:ssl3_ctx_ctrl:dh key too small: user=<>, rip=192.139.70.95, lip=192.139.70.82, session=<jkGQ8oTBnIDAi0Zf> May 04 15:30:28 redhop-mimosa-com dovecot[977]: pop3-login: Error: Failed to initialize SSL server context: Can't load DH parameters (ssl_dh setting): error:1408518A:SSL routines:ssl3_ctx_ctrl:dh key too small: user=<>, rip=192.139.70.95, lip=192.139.70.82, session=<SWRMHIbBmILAi0Zf> The first two messages were almost impossible to read because the were in yellow. It turns out that the first means that you have to edit /etc/dovecot/conf.d/10-ssl.conf and change #ssl_dh = </etc/dovecot/dh.pem to ssl_dh = </etc/dovecot/dh.pem /etc/dovecot/dh.pem was already there. OPTIONAL: /etc/dovecot/dh.pem specified a really weak Diffie-Hellman group. Your should probably strengthen it. I chose ffdhe2048, a weak one (2048 bits) that is still "OK". See: <https://wiki.mozilla.org/Security/Server_Side_TLS#Pre-defined_DHE_groups> You need it in PEM format. First save the old one. Then grab a new one: curl https://ssl-config.mozilla.org/ffdhe2048.txt > /etc/dovecot/dh.pem Then adjust ownership and permissions.

3 4

Re: [GTALUG] "DNS Wars"
by D. Hugh Redelmeier 10 May '21

10 May '21

| From: ac via talk <talk(a)gtalug.org> | And, there are additional dimensions to some of the issues raised in | the above post. I'm sure. It is both condensed and long-ish (at least for my web-tuned attention span). The blog entry contains an embedded YouTube video of a talk by Vixie that I'm only part way through. | Political changes to BIND, is one of the reasons I left | almost a decade ago. The general support for enabling walled gardens | and "custom" responses in open source communities by actually adding | code to a project, is, imnsho, simply wrong. I understand the vague idea but I'm not sure of the specific. And don't know about choices that have subtle consequences. I certainly don't know what issues are particularly concerning to you. | There are many other DNS issues not raised in this post, one obvious | example is that the overwhelming and vast majority of normal users | simply "searches" on GOOGLE for https://example.com - and | depending on "GOOGLE policy of that day" (as this changes) - users are | either directly redirtected to https://example.com - or users are shown | "search" results...(as, of course the user is "searching" because the | software vendors, a lot of the time the search engine itself, has | designed their software in this fashion as they want to control and own | every bit traveling on the wire. | | The "new" path Firefox is on, is so wrong. Actually that is mentioned. In Episode 2 and 3. | I can write a LOT more about this, but it is upsetting and emotional | for myself. I'm curious but powerless (as far as I know). I once attended an IETF meeting about DNSSec but that was long ago. Earlier our project had a fight about standardizing key distribution throught the reverse domain.

2 1

"DNS Wars"
by D. Hugh Redelmeier 09 May '21

09 May '21

This blog post is more than a year old, but well worth the read. It may require too much background, but it shows how crucial DNS is to the internet and how it is evolving in scary ways. It opened my eyes. <https://blog.apnic.net/2019/11/04/dns-wars/> APNIC is the Asia-Pacific Network Information Centre. It it the organization that assigns IP addresses for the Asia-Pacific region. <https://en.wikipedia.org/wiki/APNIC>

2 1

Video of Evan's talk from the last meeting
by Alex Volkov 01 May '21

01 May '21

Hello everyone, The recording of the talk -- I've ditched my Linux desktops for Windows .... sorta with Evan Leibovitch Is available here -- https://youtu.be/HfranDwTZOU Alex.

6 7