- Roundtable - muug.ca

ipsec mystery
by Trevor Cordes 02 Jun '21

02 Jun '21

So I just upgraded to Fedora 33. ipsec-tools rpm is gone. Toast. Ok. But it also takes with it setkey, which I use to setup the odd VPN using integrated Linux ipsec based on my /etc/ipsec.conf file. I've been using that for at least a decade. Ok, fine, so I have to figure out how else to load my VPN rules into the kernel using stock Fedora tools. (Maybe racoon2....) But here's the mystery: after rebooting the box into F33, it's still connected on a VPN to a F32 box. Even though setkey is missing!! What on earth is loading my ipsec.conf rules on boot into the kernel? (Strongswan is also on the box, but it's completely deactivated at the moment. It too looks at ipsec.conf (sometimes). Systemd has it completely ignored (not in any target/wants) and it's not running any daemons. And no, this box doesn't have racoon2 on it (yet).) It's almost as though the kernel itself is reading the file, but that can't be?? Or the kernel saves the pre-reboot ipsec setup then reloads it? But I can't find any file that it could go in? And that doesn't make sense anyhow vis a vis the separation of kernel and userspace. I'm completely stumped. There should be no VPN working, but there it is, with me pinging boxes over the tunnel. Very strange... And I can't see any way to read the ipsec spd entries, since setkey did that also! So it's in there but no way to configure it on the fly and no way to see what's configured? If anyone knows any way to see into the kernel's ipsec setup using /proc or /sys files, let me know! I couldn't find anything relevant in there, not with a filename you'd expect.

1 0

MUUG Online Meeting, Tuesday, June 8, 7:30pm -- Intro to PeerTube
by Gilbert E. Detillieux 01 Jun '21

01 Jun '21

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting online, on Tuesday, June 8th, at 7:30pm: Introduction to PeerTube: A Free and Decentralized Video Hosting Platform The internet continues to trend towards large, corporate owned websites and platforms. No one can deny that large platforms are amazing and convenient! But due to their sheer scale, social networks have difficulty with moderation and preventing abuse. Rules that work well for one set of users might be unacceptable to others, and automated moderation tools perform poorly outside of the culture and language they were developed in. These concerns have encouraged a wave of federated, decentralized social networks, loosely labeled the "fediverse." Similar to how email servers work today, any admin can run an instance of a social network, which then associates with other servers to share content and hosting costs. PeerTube is the most popular federated video hosting platform in this space, with an active community and many instances. Join us this month, as Chris Audet explores a possible future direction for video driven social networks. Chris will discuss why you might want to host a PeerTube instance, the cool underlying tech, and the role of alternative social networks in a world dominated by giants. Join the meeting: https://jitsi.merlin.mb.ca/muug.2021.06 The group holds its meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board, or linking to it on social media: https://muug.ca/meetings/MUUGmeeting.pdf -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.ca> Manitoba UNIX User Group Web: http://muug.ca/

1 0

PSA: be careful with block lists!
by Alberto Abrao 31 May '21

31 May '21

Hello everyone, TL;DR: make sure to whitelist mission-critical IPs when using block lists. I am writing to report on a situation that happened last week, hoping my experience can be of use to others. A few days ago, I noticed that I was not able to send e-mails. No domains were being recognized by the mail server. Weird. We shall check, then. There, I noticed that DNS was not working. I had CloudFlare's 1.1.1.1 set up. Weirder. As some here may know, I use a OpenBSD box as a transparent bridge, with some block lists that aim to filter traffic from botnets and other not-so-desirable sources. Now, my internal network does not use 1.1.1.1, so it was working without issue. After some fizzling around, it ended up being that, at one point, 1.1.1.1 was on a block list, promptly downloaded and blocked by the transparent bridge. Thus, no hosts on my internal network could reach out to it. Whitelist it, done. Or not: this morning, Adam lets me know that MUUG is unable to send me e-mails, which are being promptly spat out by my naughty mail server. Who dares to do that to our most glorious group? Bad, bad server. No donut for you. Now, to the fallout of the DNS issue: my server receives an e-mail, can't resolve source domain. "It must be junk", it thinks. Fail2ban pops in and bans the "offending" IP. I fixed the DNS issue... however, the fail2ban database was already full of legitimate domains it could not resolve because of said issue. No wonder my mailbox was eerily quiet for the last few days... Kind regards, Alberto Abrao

1 0

LibreNMS installation not working as it should
by Gilbert E. Detillieux 12 May '21

12 May '21

Hi all. May the Fourth be with you! :) I've run into a problem with an installation of LibreNMS on a system at work. I've carefully followed the instructions here... https://docs.librenms.org/Installation/Install-LibreNMS/ ... for a Debian 10 system, with the occasional peeking at the Ubuntu 20 installation instructions (since I wanted to use an Apache server already on that host, rather than follow the nginx-based install, which was the only option they showed for Debian 10). When I run the validate.php script from the command line, everything looks fine. When I run the validate under the web interface, it's all fine too, except after a day or more, when it complains under Updates that the install is over 24 hours out of date. The curious thing is I didn't change the default setting for updates, so it should be automatically updating. (That's only the first problem, though...) When I add a device, it does the discovery, but the results seem incomplete. For example, I don't see any of the network ports, and most of the other things that should be auto-discovered aren't. I've tried this discovery on both a Cisco switch stack, and a Linux host, with the same lack of results. (That's problem #2.) I've also manually added in a bunch of the Apps on one Linux host (an RHEL clone), to monitor particular services. I've done all the SNMP setup on that host to have the "extend" scripts run for the Apps I want, following these instructions... https://docs.librenms.org/Extensions/Applications/ ... and I've tested that with snmpbulkwalk, to make sure they're producing output. (In some cases, that took some digging through the scripts, and making sure paths were correct and additional software was set up, since the instructions above weren't always complete.) However, when I try to view the pages for those Apps in LibreNMS, I get either broken image icons, or a place-holder image that says "Error Drawing Graph". (This is problem #3.) I've searched online for this last problem, but the proposed solutions I've found are mostly red herrings, or not applicable in my case. I haven't found anything useful. Anyone else here played around with LibreNMS? (I know Adam has...) If so, any ideas what might be causing any of the problems I've mentioned above? Any tips for better setup documentation to follow than the "official" ones I have? (There were details missing about particular Apps, so maybe the Install instructions also are missing something?) BTW, I have Netdisco running on the same Debian host as LibreNMS, and it has no trouble getting information from the other devices via SNMP. (I've also got MRTG on another host, and it also has been working fine for years, querying the same devices I'm trying under LibreNMS.) Thanks, Gilbert -- Gilbert E. Detillieux E-mail: <gedetil(a)cs.umanitoba.ca> Dept. of Computer Science Web: http://cs.umanitoba.ca/~gedetil/ University of Manitoba Winnipeg MB CANADA R3T 2N2

4 9

Reminder: MUUG Online Meeting, Tonight, May 11, 7:30pm -- Raspberry Pi Stratum 1 NTP Server
by Gilbert E. Detillieux 11 May '21

11 May '21

A reminder that the MUUG online meeting will be on Jitsi this evening... The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting online, on Tuesday, May 11th, at 7:30pm: Raspberry Pi Stratum 1 NTP Server GPS uses extremely accurate atomic clocks to triangulate your position on the earth. Wyatt Zacharias will demonstrate how to harness these signals using a Raspberry Pi and GPS receiver to provide extremely accurate Stratum 1 time via NTP to other devices on your network. Join the meeting: https://jitsi.merlin.mb.ca/muug.2021.05 The group holds its meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board, or linking to it on social media: https://muug.ca/meetings/MUUGmeeting.pdf -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.ca> Manitoba UNIX User Group Web: http://muug.ca/

1 0

NASDAQ has bit-limit bug
by Trevor Cordes 09 May '21

09 May '21

Kind of funny. Computer nerds will instantly spot the (bit) reason for the limitation in $$ amount. https://www.zerohedge.com/markets/buffetts-refusal-split-berkshire-stock-cr… What's interesting is they are still allowing 4 "cents" digits. I guess it's a holdover from the fraction days where stocks were "10 1/8". I'm pretty sure no broker lets you trade in anything less than a cent these days. I wonder if their fix is to switch to 2 digit cents, or move to 64-bit systems and storage. My guess is the former would be infinitely easier, though you may lose some historical precision if you make the change retroactive. If they go 2-digit cents, Buffett can grow to $42M a share... which should take a decade at least (depending on inflation levels). :-)

2 2

MUUG Online Meeting, Tuesday, May 11, 7:30pm -- Raspberry Pi Stratum 1 NTP Server
by Gilbert E. Detillieux 04 May '21

04 May '21

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting online, on Tuesday, May 11th, at 7:30pm: Raspberry Pi Stratum 1 NTP Server GPS uses extremely accurate atomic clocks to triangulate your position on the earth. Wyatt Zacharias will demonstrate how to harness these signals using a Raspberry Pi and GPS receiver to provide extremely accurate Stratum 1 time via NTP to other devices on your network. Join the meeting: https://jitsi.merlin.mb.ca/muug.2021.05 The group holds its meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board, or linking to it on social media: https://muug.ca/meetings/MUUGmeeting.pdf -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.ca> Manitoba UNIX User Group Web: http://muug.ca/

1 0

OpenBSD 6.9 is now available
by Alberto Abrao 01 May '21

01 May '21

The newest OpenBSD is fresh out of the oven! Help yourself at https://www.openbsd.org Kind regards, Alberto Abrao

1 0

BBS list - neat!
by Trevor Cordes 30 Apr '21

30 Apr '21

Look what I stumbled on... http://bbslist.textfiles.com/204/ Cool. A walk down memory lane. Unfortunately this seems to be mainly focussed on the 90's, and most of my BBSing was in the late 80's. However, they do list a few I recognize/used: Ariel Cobalt's Ursa Minor Atari ST User Group But they miss most of my old favorites, including the one that changed my life forever... And, look closely at some of the names: we find Les (of .net) and our own Adam Thompson. Makes me want to dig up my old Atari ST file archives and see if I still have all my faves saved in my terminal software... but I can't seem to find the file, so it might be on tape... and I recently discontinued my SCSI setup. Well, time to haul out the Adaptec 19160 and DAT :-) Looks like if I can find the info I could submit the data! Ah, BBSs, those were the days...

2 2

email-receive blacklist?
by Trevor Cordes 29 Apr '21

29 Apr '21

So there are tons of "email-sending" blacklists out there. Are there "email-receiving" blacklists? Is that a thing? We're trying to get emails from Hilton Honors to our @tecnopolis.ca email address(es) and they just refuse to send to us. Even on the phone with support to triple confirm the email address it refuses to send to us. When I say refuses to send to us, I mean it won't even connect to port 25 on our server. Just nothing, nada. It's not a greylisting or RBL problem on our side because it's not even opening a socket. I can tell, I have full access to the verbose mail logs and tcpdump. All other vendors seem to have no trouble sending to us. Just Hilton. The big email providers like gmail send to us perfectly fine. I've never seen anything like this. Now, I do have trouble sometimes with Akamai's *web* hit blacklist, though I'm mostly "good" with them now. People don't use Akamai *web* RBLs for outgoing mail servers, do they? Is that a thing? I don't see that as an Akamai product offering...

6 11