[SLUG] Re: Requesting IPv6 address space

2008-10-09 Thread Jeremy Visser
Thanks for the advice, everyone. It seems the best option is for me to
simply go request a temporary chunk of addresses through a broker.

I managed to get on with AARNet (a single IP, not a /48, just for
testing) using some linux.sh script, which was much easier than setting
up 6to4, which I did about six months ago on one occasion. I was running
Gentoo, so I needed to enable SIT support in the kernel and install the
iproute2 package before their linux.sh script would work correctly.

I'm guessing that ticking the Request a /48 prefix box will give me a
few addresses that I can set up my server to route and advertise the
scheme via radvd...correct?

Additionally, seeing as though I get assigned a dynamic IP from the ISP,
I suppose I'll need to do a new request each time my address changes
when the power goes out.

--
http://jeremy.visser.name/

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] Re: Requesting IPv6 address space

2008-10-09 Thread Christopher Vance
You may find one of the other free brokers can handle a moving IP4 at
your end. Check out sixxs.net.

-- 
Christopher Vance
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] Re: Requesting IPv6 address space

2008-10-09 Thread Alex Samad
On Thu, Oct 09, 2008 at 06:49:06PM +1100, Jeremy Visser wrote:
 Thanks for the advice, everyone. It seems the best option is for me to
 simply go request a temporary chunk of addresses through a broker.
 
 I managed to get on with AARNet (a single IP, not a /48, just for
 testing) using some linux.sh script, which was much easier than setting
 up 6to4, which I did about six months ago on one occasion. I was running
 Gentoo, so I needed to enable SIT support in the kernel and install the
 iproute2 package before their linux.sh script would work correctly.
 
 I'm guessing that ticking the Request a /48 prefix box will give me a
 few addresses that I can set up my server to route and advertise the
 scheme via radvd...correct?
 
 Additionally, seeing as though I get assigned a dynamic IP from the ISP,
 I suppose I'll need to do a new request each time my address changes
 when the power goes out.

why not use the already mapped 6to4 address space, each ipv4 is mapped
into a ipv6 network address for auto routing 

 
 --
 http://jeremy.visser.name/
 
 -- 
 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
 

-- 
Iran would be dangerous if they have a nuclear weapon.

- George W. Bush
06/18/2003
Washington, DC


signature.asc
Description: Digital signature
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: [Fwd: Re: [SLUG] IOWait definition]

2008-10-09 Thread Adrian Chadd
iostat can be a bit special.I -think- under linux its the amount
of time spent waiting for pending disk IO to complete. Now, 
some chipsets and their drivers seem to spend a lot of time in IOWAIT
compared to others. The traditional difference was polled vs dma'ed
disk IO - with polled IO, the driver would submit a request and then
sit there and wait for it to complete. That time spent waiting was
IOWAIT. DMA'ing controllers would spend less time in IOWAIT because
they'd submit a request, kick it off, it'd happen in the background,
and then the kernel would be notified when it completed. Almost no time
was spent in IOWAIT - just the time scheduling the DMA commands and
handling the response.

Now, I've seen some low-ened SATA chipsets on some reasonably speccy
hardware (eg some of the nvidia-driver Sun workstations) with large
amounts of IOWAIT time. I don't know if its a driver thing or a hardware
thing (or both), but there are definitely issues.

Now, you could go groveling through the kernel to try and figure out
whether IOWAIT includes nfs activity (which I believe would be
the disk IO related to NFS, but it could be other things I guess) and
first see if doing userspace disk IO does a lot of IOWAIT. Grab bonnie
or some other hard disk throughput testing thing, run it, and see how
much time is spent in IOWAIT. If you've got almost no IOWAIT time when
doing it locally but IOWAIT time when doing it over NFS, you could be
right. If you have IOWAIT time on both, I'd poke the disk/controller/
driver combo. 

2d,



Adrian


On Thu, Oct 09, 2008, David Kempe wrote:
 Grant Street wrote:
 
 
 I have a machine with a good proportion of IOWait 20-30%. It does have
 local disks and it performs operations on NFS mounts. I just wanted to
 be sure if IOWait includes NFS activity or not. I also want a way if it
 is NFS to be able to say for sure if it is a bottleneck on the nfs 
 client or server. NFS is not a linux machine so visibility is not 
 allways the best.
 
 dstat might help you correlate stuff.
 http://dag.wieers.com/home-made/dstat/
 
 dave
 -- 
 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

-- 
- Xenion - http://www.xenion.com.au/ - VPS Hosting - Commercial Squid Support -
- $25/pm entry-level VPSes w/ capped bandwidth charges available in WA -
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [Fwd: Re: [SLUG] IOWait definition]

2008-10-09 Thread Adrian Chadd
On Fri, Oct 10, 2008, Adrian Chadd wrote:
 

 Now, you could go groveling through the kernel to try and figure out
 whether IOWAIT includes nfs activity (which I believe would be
 the disk IO related to NFS, but it could be other things I guess) and
 first see if doing userspace disk IO does a lot of IOWAIT. Grab bonnie
 or some other hard disk throughput testing thing, run it, and see how
 much time is spent in IOWAIT. If you've got almost no IOWAIT time when
 doing it locally but IOWAIT time when doing it over NFS, you could be
 right. If you have IOWAIT time on both, I'd poke the disk/controller/
 driver combo. 
 

I just re-re-read the OP and stuff and realise my assumptions don't match
your request. I assumed you wanted to know if IOWAIT included disk IO
time -and- nfs server time. But you're asking if IOWAIT include NFS
client time (ie, time spent on your box talking to the NFS server.)

Anyway, doing a bonnie++ or such test will still tell you. Run it locally
and run it over NFS. See if you get IOWAIT increases for both. That
should give you some hint as to whats going on. I've never seen IOWAIT
for NFS client traffic (ie, traffic from an NFS client talking to an NFS
server) but who knows, this is linux..



adrian

 2d,
 
 
 
 Adrian
 
 
 On Thu, Oct 09, 2008, David Kempe wrote:
  Grant Street wrote:
  
  
  I have a machine with a good proportion of IOWait 20-30%. It does have
  local disks and it performs operations on NFS mounts. I just wanted to
  be sure if IOWait includes NFS activity or not. I also want a way if it
  is NFS to be able to say for sure if it is a bottleneck on the nfs 
  client or server. NFS is not a linux machine so visibility is not 
  allways the best.
  
  dstat might help you correlate stuff.
  http://dag.wieers.com/home-made/dstat/
  
  dave
  -- 
  SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
  Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
 
 -- 
 - Xenion - http://www.xenion.com.au/ - VPS Hosting - Commercial Squid Support 
 -
 - $25/pm entry-level VPSes w/ capped bandwidth charges available in WA -
 -- 
 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

-- 
- Xenion - http://www.xenion.com.au/ - VPS Hosting - Commercial Squid Support -
- $25/pm entry-level VPSes w/ capped bandwidth charges available in WA -
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] ssh certificate logins

2008-10-09 Thread Phill O'Flynn


Hi everyone 
I am running a fedora server and currently using hosts.allow to
only allow ssh accesses from specific ip addresses. I did this because I was 
getting
a lot of idiots from eastern Europe and Russia tring to crack my server.

This has been ok  but now is prooving to be too restrictive. Can I get the
server to force certificate based logins only?? If so how do I do it?? Is this 
the
best approach anyway??


Regards
Phill O'Flynn


-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] Re: Atom cpu mobos

2008-10-09 Thread billb
  BODY { font-family:Arial, Helvetica, sans-serif;font-size:12px; }Ken
and Dion 
 today I bought an Intel D945GCLF2 mini-itx mobo with a dual-core
Intel Atom processor for 10180 Yen (on sale).
 Last night found reviews for Atom CPU mini boards
 http://www.mini-itx.com/reviews/atoms/
 and this board came out on top.
 Will buy ram and case, and naturally a 240V power supply when  I get
home.
 With current exchange rate probably cheaper there.
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] ssh certificate logins

2008-10-09 Thread Owen Townend
2008/10/9 Phill O'Flynn [EMAIL PROTECTED]:


 Hi everyone
 I am running a fedora server and currently using hosts.allow to
 only allow ssh accesses from specific ip addresses. I did this because I was 
 getting
 a lot of idiots from eastern Europe and Russia tring to crack my server.

 This has been ok  but now is prooving to be too restrictive. Can I get the
 server to force certificate based logins only?? If so how do I do it?? Is 
 this the
 best approach anyway??

In debian based systems it's done by editing /etc/ssh/sshd_config to
disable password auth
I imagine that Fedora would be very similar... see:
http://www.debuntu.org/ssh-key-based-authentication-p3

There was a good thread arguing ssh protection measures a few months
back on debian-security:
http://www.nabble.com/What-to-do-about-SSH-brute-force-attempts--tt19090071.html#a19090071

cheers,
Owen.
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] ssh certificate logins

2008-10-09 Thread Erik de Castro Lopo
Phill O'Flynn wrote:

 I am running a fedora server and currently using hosts.allow to
 only allow ssh accesses from specific ip addresses. I did this because I was 
 getting
 a lot of idiots from eastern Europe and Russia tring to crack my server.
 
 This has been ok  but now is prooving to be too restrictive. Can I get the
 server to force certificate based logins only?? If so how do I do it?? Is 
 this the
 best approach anyway??

Also have a look at pam_abl:

http://www.hexten.net/wiki/index.php/Pam_abl

Erik
-- 
-
Erik de Castro Lopo
-
Anyone who says you can have a lot of widely dispersed people hack
away on a complicated piece of code and avoid total anarchy has never
managed a software project. - Andy Tanenbaum in 1992 on comp.os.minix
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [Fwd: Re: [SLUG] IOWait definition]

2008-10-09 Thread Ian Wienand
On Fri, Oct 10, 2008 at 05:50:52AM +0800, Adrian Chadd wrote:
 I've never seen IOWAIT for NFS client traffic (ie, traffic from an
 NFS client talking to an NFS server) but who knows, this is linux..

I would say this doesn't count to iowait either; see
fs/nfs/pagelist.c:nfs_wait_on_request() -- it appears to put itself
out of action without doing anything required to update iowait times
(see kernel/sched.c:io_schedule()).

I rekon Shehjar would know though... :)

-i
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] ssh certificate logins

2008-10-09 Thread Dean Hamstead

you can configured your sshd's configuration in /etc/ssh/sshd_config

however in your case you might want to look at denyhosts 
http://denyhosts.sourceforge.net/



Dean

Phill O'Flynn wrote:


Hi everyone 
I am running a fedora server and currently using hosts.allow to

only allow ssh accesses from specific ip addresses. I did this because I was 
getting
a lot of idiots from eastern Europe and Russia tring to crack my server.

This has been ok  but now is prooving to be too restrictive. Can I get the
server to force certificate based logins only?? If so how do I do it?? Is this 
the
best approach anyway??


Regards
Phill O'Flynn




--
http://fragfest.com.au
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] ssh certificate logins

2008-10-09 Thread jam
On Friday 10 October 2008 07:29:25 [EMAIL PROTECTED] wrote:
 I am running a fedora server and currently using hosts.allow to
 only allow ssh accesses from specific ip addresses. I did this because I
 was getting a lot of idiots from eastern Europe and Russia tring to crack
 my server.

 This has been ok  but now is prooving to be too restrictive. Can I get the
 server to force certificate based logins only?? If so how do I do it?? Is
 this the best approach anyway??

On a non-standard port I've had ZERO login attempts over the last 3+ years, 
compared (like you) to 10s and 100s per day. This is trivial to implement 
even has the advantage of multiple servers/virtual servers behind a DSL 
router (different non standard for each)

James
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] ssh certificate logins

2008-10-09 Thread Daniel Pittman
Erik de Castro Lopo [EMAIL PROTECTED] writes:
 Phill O'Flynn wrote:

 I am running a fedora server and currently using hosts.allow to
 only allow ssh accesses from specific ip addresses. I did this because I was 
 getting
 a lot of idiots from eastern Europe and Russia tring to crack my server.
 
 This has been ok  but now is prooving to be too restrictive. Can I get the
 server to force certificate based logins only?? If so how do I do it?? Is 
 this the
 best approach anyway??

 Also have a look at pam_abl:
 http://www.hexten.net/wiki/index.php/Pam_abl

Oh, nice tool.  It is a pity that it isn't maintained upstream any
longer, or packaged for Debian / Ubuntu.  Being a PAM module is
especially nice, since it means that this would work for *any* PAM
integrated application, not just SSH.


Personally, I use fail2ban[1] which uses the cruder, but still
effective, technique of reading your logs and blocking people who try to
guess passwords via iptables.

I like it better than most of the alternatives because, unlike many
tools, it ships with configuration for a range of services in addition
to the basic ssh stuff.

So, you can detect the same brute-force attacks via IMAP, POP, FTP, or
any of the other common sources of this.[2]

Regards,
Daniel

Footnotes: 
[1]  http://fail2ban.sf.net/

[2]  I am still amazed, in fact, that more of the brute forcing is not
 targetted at POP/IMAP accounts and passwords, since the mapping is
 frequently trivial to real accounts, and they are monitored so much
 less effectively.

--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] ssh certificate logins

2008-10-09 Thread Mary Gardiner
On Fri, Oct 10, 2008, jam wrote:
 On a non-standard port I've had ZERO login attempts over the last 3+ years, 
 compared (like you) to 10s and 100s per day. This is trivial to implement 
 even has the advantage of multiple servers/virtual servers behind a DSL 
 router (different non standard for each)

There is one potential disadvantage of non-standard ports: there are a
few networks with a default-deny outgoing connection policy who open
port 22, but do not open most ports. (I find 443 the most useful
alternative port to run SSH on, outgoing to 443/HTTPS is very often
open!)

-Mary
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] ssh certificate logins

2008-10-09 Thread Brian Sydney Jathanna
I guess the best approach would be to consider using Port Knock
http://www.portknocking.org/

Cheers,
Brian


On 10/9/08, Phill O'Flynn [EMAIL PROTECTED] wrote:



 Hi everyone
 I am running a fedora server and currently using hosts.allow to
 only allow ssh accesses from specific ip addresses. I did this because I
 was getting
 a lot of idiots from eastern Europe and Russia tring to crack my server.

 This has been ok  but now is prooving to be too restrictive. Can I get the
 server to force certificate based logins only?? If so how do I do it?? Is
 this the
 best approach anyway??


 Regards
 Phill O'Flynn


 --
 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] Changing default ownership of /dev device in Ubuntu Hardy

2008-10-09 Thread Erik de Castro Lopo
Hi all,

I currenty have a device with the following permissions and ownership:

crw-rw 1 root dialout 4, 64 Oct 10 11:05 /dev/ttyS0

Where and how do I fiddle to changes this so it sticks across reboots?

TIA,
Erik
-- 
-
Erik de Castro Lopo
-
Men who use terrorism as a means to power, rule by terror
once they are in power.
-- Helen Macinnes
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] Changing default ownership of /dev device in Ubuntu Hardy

2008-10-09 Thread Scott Finneran
 Hi all,
 
 I currenty have a device with the following permissions and ownership:
 
 crw-rw 1 root dialout 4, 64 Oct 10 11:05 /dev/ttyS0
 
 Where and how do I fiddle to changes this so it sticks across reboots?
 

The short answer is udev (or at least that is the approach I have taken in the 
past). There are some good pointers here: 

http://www.debianhelp.org/node/5003#comment-36703

Scott



  Make the switch to the world#39;s best email. Get Yahoo!7 Mail! 
http://au.yahoo.com/y7mail
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] Changing default ownership of /dev device in Ubuntu Hardy

2008-10-09 Thread Erik de Castro Lopo
Erik de Castro Lopo wrote:

 Where and how do I fiddle to changes this so it sticks across reboots?

Here we go:

http://www.debianhelp.org/node/5003#comment-36703

A file in /etc/udev/rules.d/ containing:

SUBSYSTEM==tty, KERNEL==ttyS0, OWNER=lp, GROUP=lp 

Erik
-- 
-
Erik de Castro Lopo
-
Windows was created to keep stupid people away from UNIX.
  -- Tom Christiansen
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] Requesting IPv6 address space

2008-10-09 Thread Mick Pollard
On Wed, 8 Oct 2008 23:38:33 +1100
Jeremy Visser [EMAIL PROTECTED] wrote:

 G'day SLUG,
 
Hi Jeremy,
 
 I'd actually like to get my hands on a small chunk of address space
 that I could play with and make my own. Unfortunately, according to
 the APNIC website:

Enjoy playing with IPv6 but don't forget an IPv6 capable firewall is
needed. ( ip6tables )

 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


-- 
Regards
Mick Pollard ( lunix )

BOFH Excuse of the day:
Inherent Encryption Dump




pgpIi55RixpnC.pgp
Description: PGP signature
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: [SLUG] ssh certificate logins

2008-10-09 Thread Daniel Pittman
Brian Sydney Jathanna [EMAIL PROTECTED] writes:
 On 10/9/08, Phill O'Flynn [EMAIL PROTECTED] wrote:

 Hi everyone
 I am running a fedora server and currently using hosts.allow to
 only allow ssh accesses from specific ip addresses. I did this because I
 was getting
 a lot of idiots from eastern Europe and Russia tring to crack my server.

 This has been ok  but now is prooving to be too restrictive. Can I get the
 server to force certificate based logins only?? If so how do I do it?? Is
 this the
 best approach anyway??

 I guess the best approach would be to consider using Port Knock
 http://www.portknocking.org/

Why would you consider that the best approach?

Port knocking is an additional password specified through a non-standard
mechanism, plus the added security of doing strange IP related things.

You gain *exactly* as much protection by providing yourself a CGI script
where you can enter a password and have the firewall modify your
firewall dynamically, without the added complexity or debugging of
having to find out why your IP based knock was delivered out of order,
or any of the other potential issues.

Regards,
Daniel
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] Re: Requesting IPv6 address space

2008-10-09 Thread peter
 Jeremy == Jeremy Visser [EMAIL PROTECTED] writes:


Jeremy I'm guessing that ticking the Request a /48 prefix box will
Jeremy give me a few addresses that I can set up my server to route
Jeremy and advertise the scheme via radvd...correct?

Yup, except they're no longer handing out /48s --- you'll get a /56.

Jeremy Additionally, seeing as though I get assigned a dynamic IP
Jeremy from the ISP, I suppose I'll need to do a new request each
Jeremy time my address changes when the power goes out.

No, because the tunnel broker always assigned the same IP6 address
range in response tot eh same TSPC login.


Peter C
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] ssh certificate logins

2008-10-09 Thread Michael Chesterton


On 10/10/2008, at 10:58 AM, Daniel Pittman wrote:



Personally, I use fail2ban[1] which uses the cruder, but still
effective, technique of reading your logs and blocking people who  
try to

guess passwords via iptables.



I use with great success an iptables rule to limit new ssh connections  
to
2 or 3 a minute, brute forcers will get a few attempts, then timeout  
and move

on.

--

http://chesterton.id.au/blog/
http://barrang.com.au/


--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


Re: [SLUG] ssh certificate logins

2008-10-09 Thread Alex Samad
On Fri, Oct 10, 2008 at 03:41:57PM +1100, Michael Chesterton wrote:

 On 10/10/2008, at 10:58 AM, Daniel Pittman wrote:

 Personally, I use fail2ban[1] which uses the cruder, but still
 effective, technique of reading your logs and blocking people who try 
 to
 guess passwords via iptables.


 I use with great success an iptables rule to limit new ssh connections  
 to
 2 or 3 a minute, brute forcers will get a few attempts, then timeout and 
 move
 on.

thats what I have found as well.

for example the rules I am using now are

iptables -A INPUT -i internet interface -p tcp --dport 22 -j SSH

iptables -t filter -A SSH -m recent --set --name SSH 
iptables -t filter -A SSH -m recent --name SSH ! --rcheck --seconds 300 
--hitcount 4 -j RETURN
# Well, the NEW connection has been seen so let's update the SSH
# recent list.
iptables -t filter -A SSH -m recent --name SSH --update
# I like to log on a line by it's self so I don't have to remember
# to do it on my last line prior to the end of my script.
iptables -t filter -A SSH --jump ULOG $ULOG_OPTIONS --ulog-prefix sydrt01 
(SSH)
iptables -t filter -A SSH -j DROP



 -- 

 http://chesterton.id.au/blog/
 http://barrang.com.au/


 -- 
 SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
 Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


-- 
The truth of that matter is, if you listen carefully, Saddam would still be in 
power if he were the president of the United States, and the world would be a 
lot better off.

- George W. Bush
10/08/2004
St. Louis, MO
Second presidential debate


signature.asc
Description: Digital signature
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

[SLUG] managing a adaptec 1430sa

2008-10-09 Thread Alex Samad
Hi

I was wondering if any one out there uses one of these to do hardware
raid.

I thought I might set it up in raid10 with 4 1Tb drives.

My questions on this is what software do I use to alert me if there any
problems and will it show up as 1 scsi device (or is it a silly software
raid solution and I have to use dmraid )

Alex


signature.asc
Description: Digital signature
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html

Re: [SLUG] ssh certificate logins

2008-10-09 Thread Kyle

Well, Michael and Alex beat me to it.

That's what I was going to say; use iptables. Though Alex's rules are 
somewhat more complex than mine, I think mine do the same.


After setting up the chain, my salient rule is just;

-A INBOUND_FILTER -i eth0 -p tcp -m tcp --dport 22 -m limit --limit 
2/minute --limit-burst 2 -m state --state NEW -j ACCEPT





Kind Regards

Kyle



Alex Samad wrote:

On Fri, Oct 10, 2008 at 03:41:57PM +1100, Michael Chesterton wrote:
  
I use with great success an iptables rule to limit new ssh connections  
to
2 or 3 a minute, brute forcers will get a few attempts, then timeout and 
move

on.



thats what I have found as well.

for example the rules I am using now are

iptables -A INPUT -i internet interface -p tcp --dport 22 -j SSH

iptables -t filter -A SSH -m recent --set --name SSH 
iptables -t filter -A SSH -m recent --name SSH ! --rcheck --seconds 300 --hitcount 4 -j RETURN

# Well, the NEW connection has been seen so let's update the SSH
# recent list.
iptables -t filter -A SSH -m recent --name SSH --update
# I like to log on a line by it's self so I don't have to remember
# to do it on my last line prior to the end of my script.
iptables -t filter -A SSH --jump ULOG $ULOG_OPTIONS --ulog-prefix sydrt01 
(SSH)
iptables -t filter -A SSH -j DROP


  

--

http://chesterton.id.au/blog/
http://barrang.com.au/


--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html




  

--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html


[SLUG] ssh logins (ctd)

2008-10-09 Thread Jim Donovan
122.116.243.233 has been hitting me today, apparently from Taiwan. I blackholed 
him by hand.

Jim Donovan
-- 
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html