- Talk - lists.gtalug.org

Re: [GTALUG] Swappiness
by Evan Leibovitch 05 Sep '18

05 Sep '18

On Tue, Sep 4, 2018, 10:40 PM John Weintraub, <johnweintraub(a)gmail.com> wrote: > Is your swap equal to twice the amount of RAM? That's the default; I am > not sure where you came up with the number "60"; > I was referring to this: https://en.m.wikipedia.org/wiki/Swappiness

4 3

[GTALUG-Announce] GTALUG Meeting on Tuesday 11 September at 7:30pm
by hi＠gtalug.org 04 Sep '18

04 Sep '18

<http://gtalug.org/meeting/2018-09/> # How Open Source Destroyed the Past, Created the Present, and Will One Day, Save the Future. with Marcel Gagne We are living in a world built on, and by, Open Source. Every Web page we visit, every message we send, every video we watch, every second of our connected lives owes its existence to an idea that's part technology, part ideology, and part philosophy. That idea would eventually infect millions, tearing down old business models, cultures, and even livelihoods, as it went. It's an idea that would redefine the meaning of 'free' and 'freedom'. But it would also create the world we live in, a world that is still struggling to adapt to the changes, a world where the idea that is "free and open" will, in time, define the future. ## Location George Vari Engineering and Computing Centre 245 Church Street, Room 203 Ryerson University <http://goo.gl/maps/16oJ2> <http://www.openstreetmap.org/way/23447525> ## Schedule * 6:00 pm - Please discuss on the general mailing list (i.e. <talk(a)gtalug.org>) where you want to go for dinner. * 7:30 pm - Meeting and presentation. * 9:00 pm - After each meeting, a group of GTALUGers move to The Imperial Pub (54 Dundas St East) for refreshments and more socialising. # Code of Conduct We want a productive happy community that can welcome new ideas, improve every process every year, and foster collaboration between individuals with differing needs, interests and skills. We gain strength from diversity, and actively seek participation from those who enhance it. This code of conduct exists to ensure that diverse groups collaborate to mutual advantage and enjoyment. We will challenge prejudice that could jeopardise the participation of any person in the community. The Code of Conduct governs how we behave in public or in private whenever the Linux community will be judged by our actions. We expect it to be honoured by everyone who represents the community officially or informally, claims affiliation or participates directly. It applies to activities online or offline. We invite anybody to participate. Our community is open. Please read more about the GTALUG Code of Conduct here: <http://gtalug.org/about/code-of-conduct/>. If you have any questions, comments, or concerns about the GTALUG Code of Conduct please contact the GTALUG Board @ <board(a)gtalug.org>. --- GTALUG Announce mailing list announce(a)gtalug.org https://gtalug.org/mailman/listinfo/announce

1 0

fail2ban problem
by Michael Galea 01 Sep '18

01 Sep '18

I am experiencing what I believe is a DNS amplification attack on my bind9 DNS server. I'm seeing very of the following on different IPs 20:11:53.977254 IP 108.234.250.76.62926 > 69.265.222.253.53: 50679+ [1au] ANY? USADF.GOV. (38) My server responds 20:11:53.977776 IP 69.265.222.253.53 > 108.234.250.76.62926: 50679 Refused- 0/0/1 (38) I imagine the IPs are spoofed. I have installed fail2ban in order to address the problem. Various howtos detail how to configure bind to log to /var/log/named/security.log and setup fail2ban. The security.log is filling nicely with lots of "29-Aug-2018 20:23:07.798 client @0x7fa1d013b990 66.69.234.170#29024 (USADF.GOV) query (cache) 'USADF.GOV/ANY/IN' denied" and fail2ban is indicating "Jail 'named-refused' started" but it never actually bans an IP. 2) I used fail2ban-regex to test the security.log line against fail2bans named-refused regex, but its doesn't match! So I have to conclude either debian bind9 changed the log output or fail2ban git it wrong. I'm using the latest fail2ban from debian. Has anyone else got this to work? -- Michael Galea

3 3

Which Distro is Best for Running a ZFS-on-Linux Fileserver.
by right.maple.nut 31 Aug '18

31 Aug '18

Hello All, Like the Subject Line says, I'm setting up a ZFS File Server for my Home Network. Given that I will have to go to the trouble of setting up the Distro and Migrating the Linux Install to ZFS Root, I don't want to have to do this too many times. So, which Distro are the favourite for Running ZFS-on-Linux? Also, is there such a thing as a Linux Distro that is smart enough to give you a choice if you are willing to use non-GPL'ed code in the Installer, so that I can just Install Directly on a ZFS Pool? Thank You in Advance for your Input. Regards, Amos

10 18

inexpensive external portable 4T drive
by D. Hugh Redelmeier 31 Aug '18

31 Aug '18

I like the 4T Seagate "portable" (i.e. 2.5") external 4T disk drives. They are good for backups. - 2.5" drives are physically small - 2.5" external drives only have one (USB3) cable. No separate power cable and wall-wart (3.5" externals require these). - If you don't have USB 3 on your computer I'm not sure that the drive will get enough power to run. Even if it works, filling a 4T drive at USB 2 "Full Speed" is going to take a very long time. - shuckable (i.e. you can pry off the case and use the raw drive). This is good if something goes wrong. It isn't true of Western Digital drives. - unfortunate: if I remember correctly, the physical raw drive is a little thicker than most 2.5" drive bays allow. So shucking to get a raw drive to install inside a notebook may not work. The Seagate 2T portable externals do work. - 2.5" drives seem to handle mechanical shock better than 3.5" drives - 2.5" drives are a lot easier to store than 3.5" drives (a lot smaller, lighter, and fewer bits) - cheap. Usually $125 is possible. Last I looked, cheaper than the internal drive. Right now Staples is selling these for $99.92 + a little environmental stewardship fee. And there are a lot of $15 off $100 Staples coupons floating about. I even had (and used) a $25 off $75 coupon. <http://forums.redflagdeals.com/staples-staples-seagate-expansion-stea400040…> (For most internal applications these days, SSDs make more sense than HDDs. SSD prices seem to be starting to fall. For a number of our notebooks we actually have both.) There are drives with larger capacity but they are generally more expensive per byte, shingled, or 3.5". I don't yet trust shingled drives but a natural application for them would be backing up because that doesn't require random access writing, their weak point.

2 1

Checking for DNSSEC
by Gordon Chillcott 30 Aug '18

30 Aug '18

I got asked, off-line, by a couple of people if ICANN had any tools for testing for DNSSEC. There are so I went in, dug them out and tried them. The question, by the way, was prompted by the news that the DNSSEC Key Signing Key rollover will take place on or about October 11 – this has been delayed twice. Now. To get to the DNSSEC tests, you can go to: https://www.icann.org/resources/pages//tools-2012-02-25-en This will bring up a list of four tests: - a DNS Visualization test - a “DNS Check” - a DNSSEC Analyzer - an SIDN DNSSEC Test All but the last take a domain as an argument (entered in a text window on the page). The last one performs the test to where you're connected. I recommend you try each one to see which is right for you. Read the results carefully, though. The “DNS Check” Seems to think it's OK if DNSSEC is not there for the zone, as long as everything else is fine. The last one gives you a link to a more comprehensive test at: http://en.conn.internet.nl/connection/ That test covers things like IPV6 connectivity as well as DNSSEC. Cheers, Gordon

3 2

Ubuntu -- Disabling Ping
by Howard Gibson 30 Aug '18

30 Aug '18

I am playing with my hack Ubuntu machine, and I am sorting out security. I want to disable ping. This is a laptop, and I want to document the application of aluminium foil. The standard ping disabler is the following line... # echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all This works fine on my Fedora laptop. On Ubuntu, I get... $ sudo echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all -bash: /proc/sys/net/ipv4/icmp_echo_ignore_all: Permission denied The file exists. I can print it with "cat" (it prints "0". Why can I not change it? -- Howard Gibson hgibson(a)eol.ca jhowardgibson(a)gmail.com http://home.eol.ca/~hgibson

10 32

Re: [GTALUG] fail2ban problem
by o1bigtenor 30 Aug '18

30 Aug '18

On Thu, Aug 30, 2018 at 6:05 AM, ac via talk <talk(a)gtalug.org> wrote: > On Thu, 30 Aug 2018 05:49:58 -0500 > o1bigtenor <o1bigtenor(a)gmail.com> wrote: >> On Thu, Aug 30, 2018 at 4:13 AM, ac via talk <talk(a)gtalug.org> wrote: >> > yeah, this is the reason why I do not usually respond to this type >> > of post... security is a wide and varying topic. and opinions are >> > held by all and sundry. >> > just for the record though: what i said was: fail2ban is not the >> > right tool >> > not that it cannot do it... >> Greetings >> As someone who is trying to learn about security and feeling that the >> curve is moving far faster than I can I hope it is not inappropriate >> that I as - - - what would be the 'right' tool for this job? >> > the op originally mentioned an amplification, it also depends on > ingress/egress (hijacked AS / routing qos / etc etc) and any number of > other issues. running name servers is also a whole topic on its own > as there is never one answer, but on ppp i would just use rate limit in > bind.conf - i guess on a single name servers and with no load / > production / other value based issue, it does not really matter if you > do use anything. > Thanks very much!! Dee

1 0

Re: [GTALUG] fail2ban problem
by o1bigtenor 30 Aug '18

30 Aug '18

On Thu, Aug 30, 2018 at 4:13 AM, ac via talk <talk(a)gtalug.org> wrote: > > yeah, this is the reason why I do not usually respond to this type of > post... security is a wide and varying topic. and opinions are held by > all and sundry. > > just for the record though: what i said was: fail2ban is not the right tool > > not that it cannot do it... > Greetings As someone who is trying to learn about security and feeling that the curve is moving far faster than I can I hope it is not inappropriate that I as - - - what would be the 'right' tool for this job? Regards Dee

2 1

Re: [GTALUG] fail2ban problem
by Michael Galea 30 Aug '18

30 Aug '18

Hi, Well, named is pretty smart and knew the requests were bogus, as indicated by the "denied". My named is still resolving valid requests for my domain. And fail2ban does support this very circumstance. I had to edit fail2ban's built in regex for named before it would work. I am guessing that bind added a field into the security.log message that broke the regex. For any that care, since I use shorewall as my firewall, I also had to modify the fail2ban banaction to use shorewall instead of iptables, and modify shorewall to dynamic blacklist ALL connections. After all this is done, my ppp connection sees the bogus requests but silently ignores them. On 08/29/18 23:29, ac via talk wrote: > Hi, > > normally, i would not respond to a post like yours :) > > when people ask your dns server a question, they are not logging into > your system. - so fail2ban is not the correct tool > > the correct answer is any of the below: > you need to write a program or a script > for example on a small single system - one that checks your logs and > then adds an iptables rule to your firewall - larger > systems/clusters simply customize bind or maybe rate limit > connections (check your named.conf - rate limit) and/or a > combination of these things - there are also many other ways to stop > this (for example forward write to your routers (if you have > routers) etc. > > hth > > Andre > > On Wed, 29 Aug 2018 20:40:16 -0400 > Michael Galea via talk <talk(a)gtalug.org> wrote: > >> I am experiencing what I believe is a DNS amplification attack on my >> bind9 DNS server. >> >> I'm seeing very of the following on different IPs >> 20:11:53.977254 IP 108.234.250.76.62926 > 69.265.222.253.53: 50679+ >> [1au] ANY? USADF.GOV. (38) >> >> My server responds >> 20:11:53.977776 IP 69.265.222.253.53 > 108.234.250.76.62926: 50679 >> Refused- 0/0/1 (38) >> >> I imagine the IPs are spoofed. >> I have installed fail2ban in order to address the problem. Various >> howtos detail how to configure bind to log to >> /var/log/named/security.log and setup fail2ban. >> >> The security.log is filling nicely with lots of "29-Aug-2018 >> 20:23:07.798 client @0x7fa1d013b990 66.69.234.170#29024 (USADF.GOV) >> query (cache) 'USADF.GOV/ANY/IN' denied" and fail2ban is indicating >> "Jail 'named-refused' started" but it never actually bans an IP. >> >> 2) I used fail2ban-regex to test the security.log line against >> fail2bans named-refused regex, but its doesn't match! So I have to >> conclude either debian bind9 changed the log output or fail2ban git >> it wrong. >> >> I'm using the latest fail2ban from debian. Has anyone else got this >> to work? >> > > --- > Talk Mailing List > talk(a)gtalug.org > https://gtalug.org/mailman/listinfo/talk > -- Michael Galea

2 1