I have a service which needs to authenticate against another service using Kerberos. Normal credentials expire rather quickly - can I create a keytab or something for the service to get the ticket without password?
I don't have admin for Kerberos server but I do have local admin for AD member.
I'm setting up a multiboot diskless system which is suppose to boot by ipxe script. I'm exporting the disks by iSCSI from Linux box.
From what I understand I have several options:
Currently I'm doing option no. 2 but is there a reason why I should export only one target?
I've tried to establish connection between two hosts but I cannot get it to work. When I send a ping packet I see that ESP packet is received but no reply is sent. What can be wrong?
conn core-02
type=transport
leftid=@core-01
left=172.17.8.101
leftrsasigkey=<...>
rightid=@core-02
right=172.17.8.102
rightrsasigkey=<...>
authby=rsasig
auto=start
And logs:
pluto[7261]: loading secrets from "/etc/ipsec.secrets"
pluto[7261]: loaded private key for keyid: PPK_RSA:AQPY0vkGg
pluto[7261]: "core-02" #1: initiating Main Mode
pluto[7261]: reapchild failed with errno=10 No child processes
pluto[7261]: "core-02" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
pluto[7261]: "core-02" #1: STATE_MAIN_I2: sent MI2, expecting MR2
pluto[7261]: "core-02" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
pluto[7261]: "core-02" #1: STATE_MAIN_I3: sent MI3, expecting MR3
pluto[7261]: "core-02" #1: Main mode peer ID is ID_FQDN: '@core-02'
pluto[7261]: "core-02" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
pluto[7261]: "core-02" #1: STATE_MAIN_I4: ISAKMP SA established {auth=RSA_SIG cipher=aes_256 integ=sha group=MODP2048}
pluto[7261]: "core-02" #2: initiating Quick Mode RSASIG+ENCRYPT+PFS+UP+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:b77212e6 proposal=defaults pfsgroup=OAKLEY_GROUP_MODP2048}
pluto[7261]: "core-02" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
pluto[7261]: "core-02" #2: STATE_QUICK_I2: sent QI2, IPsec SA established transport mode {ESP=>0xa23882f0 <0x5748fb27 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=passive}
pluto[7261]: "core-02" #3: responding to Main Mode
pluto[7261]: "core-02" #3: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
pluto[7261]: "core-02" #3: STATE_MAIN_R1: sent MR1, expecting MI2
pluto[7261]: "core-02" #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
pluto[7261]: "core-02" #3: STATE_MAIN_R2: sent MR2, expecting MI3
pluto[7261]: "core-02" #3: Main mode peer ID is ID_FQDN: '@core-02'
pluto[7261]: "core-02" #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
pluto[7261]: "core-02" #3: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=RSA_SIG cipher=aes_256 integ=sha group=MODP2048}
pluto[7261]: "core-02" #3: the peer proposed: 172.17.8.101/32:0/0 -> 172.17.8.102/32:0/0
pluto[7261]: "core-02" #4: responding to Quick Mode proposal {msgid:c65e8e64}
pluto[7261]: "core-02" #4: us: 172.17.8.101<172.17.8.101>[@core-01]
pluto[7261]: "core-02" #4: them: 172.17.8.102<172.17.8.102>[@core-02]
pluto[7261]: "core-02" #4: keeping refhim=0 during rekey
pluto[7261]: "core-02" #4: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
pluto[7261]: "core-02" #4: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 transport mode {ESP=>0x6dc4662c <0x2babef51 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=passive}
pluto[7261]: "core-02" #4: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
pluto[7261]: "core-02" #4: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x6dc4662c <0x2babef51 xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=passive}
Possibly relevant:
# cat /proc/net/xfrm_stat
XfrmInError 0
XfrmInBufferError 0
XfrmInHdrError 0
XfrmInNoStates 120
XfrmInStateProtoError 0
XfrmInStateModeError 12
XfrmInStateSeqError 0
XfrmInStateExpired 0
XfrmInStateMismatch 0
XfrmInStateInvalid 0
XfrmInTmplMismatch 17677
XfrmInNoPols 10
XfrmInPolBlock 0
XfrmInPolError 0
XfrmOutError 0
XfrmOutBundleGenError 0
XfrmOutBundleCheckError 0
XfrmOutNoStates 55358
XfrmOutStateProtoError 0
XfrmOutStateModeError 0
XfrmOutStateSeqError 0
XfrmOutStateExpired 0
XfrmOutPolBlock 0
XfrmOutPolDead 0
XfrmOutPolError 0
XfrmFwdHdrError 0
XfrmOutStateInvalid 9
XfrmAcquireError 0
# ipsec verify --nocolour 2>&1 | sed 's:^: :g;'
Verifying installed system and configuration files
Version check and ipsec on-path [OK]
Libreswan 3.18 (netkey) on 4.7.0-coreos
Checking for IPsec support in kernel [OK]
NETKEY: Testing XFRM related proc values
ICMP default/send_redirects [OK]
ICMP default/accept_redirects [OK]
XFRM larval drop [OK]
Pluto ipsec.conf syntax [OK]
Hardware random device [N/A]
Two or more interfaces found, checking IP forwarding [OK]
Checking rp_filter [OK]
Checking that pluto is running [OK]
Pluto listening for IKE on udp 500 [OK]
Pluto listening for IKE/NAT-T on udp 4500 [OK]
Pluto ipsec.secret syntax Traceback (most recent call last):
File "/usr/libexec/ipsec/verify", line 477, in <module>
main()
File "/usr/libexec/ipsec/verify", line 466, in main
plutocheck()
File "/usr/libexec/ipsec/verify", line 121, in plutocheck
ipsecsecretcheck()
File "/usr/libexec/ipsec/verify", line 375, in ipsecsecretcheck
output = output.decode(prefencoding)
AttributeError: 'str' object has no attribute 'decode'
EDIT Example of receiving ping packets from core-02 (tcpdump executed on core-01) - note lack of decrypted packages:
19:16:41.387778 IP 172.17.8.102 > core-01: ESP(spi=0xd6c60341,seq=0x1), length 100
19:16:42.387542 IP 172.17.8.102 > core-01: ESP(spi=0xd6c60341,seq=0x2), length 100
19:16:43.388239 IP 172.17.8.102 > core-01: ESP(spi=0xd6c60341,seq=0x3), length 100
19:16:44.388052 IP 172.17.8.102 > core-01: ESP(spi=0xd6c60341,seq=0x4), length 100
And policy corresponding to it (note that algorithm does not match config above but this doesn't matter):
# sudo ip xfrm policy
src 172.17.8.101/32 dst 172.17.8.102/32
dir out priority 2080 ptype main
tmpl src 0.0.0.0 dst 0.0.0.0
proto esp reqid 16389 mode transport
src 172.17.8.102/32 dst 172.17.8.101/32
dir in priority 2080 ptype main
tmpl src 0.0.0.0 dst 0.0.0.0
proto esp reqid 16389 mode transport
src ::/0 dst ::/0 proto ipv6-icmp type 135
dir fwd priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 135
dir in priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
dir out priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
dir fwd priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
dir in priority 1 ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 135
dir out priority 1 ptype main
src ::/0 dst ::/0
socket out priority 0 ptype main
src ::/0 dst ::/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket out priority 0 ptype main
src 0.0.0.0/0 dst 0.0.0.0/0
socket in priority 0 ptype main
# ip xfrm state
src 172.17.8.102 dst 172.17.8.101
proto esp spi 0xd6c60341 reqid 16389 mode transport
replay-window 32
aead rfc4106(gcm(aes)) 0x22f23f67917af5384d4ce84ec77b2c0ad7ab8ead3f2c704263c54953273613becf08b744 128
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
sel src 172.17.8.102/32 dst 172.17.8.101/32
src 172.17.8.101 dst 172.17.8.102
proto esp spi 0x0e6d238f reqid 16389 mode transport
replay-window 32
aead rfc4106(gcm(aes)) 0x380b1914db9a87df053f239d219becef070b45149f1902a05798e7c6dae286161314905d 128
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
sel src 172.17.8.101/32 dst 172.17.8.102/32
src 172.17.8.102 dst 172.17.8.101
proto esp spi 0xafe1a0e7 reqid 16389 mode transport
replay-window 32
aead rfc4106(gcm(aes)) 0x81502cdd71de6ad1ca8fee932fc988ebdad935ef5e00afff85ca72b908f33675b2d9c849 128
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
sel src 172.17.8.102/32 dst 172.17.8.101/32
src 172.17.8.101 dst 172.17.8.102
proto esp spi 0x17074ed6 reqid 16389 mode transport
replay-window 32
aead rfc4106(gcm(aes)) 0xbf29e49cb147c9887f8d9321cb08db6aa01248a06cb0444ca70cb71e9df2d1d60a9d25f2 128
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
sel src 172.17.8.101/32 dst 172.17.8.102/32
EDIT: Requested ipsec auto --status
# ipsec auto --status
000 using kernel interface: netkey
000 interface lo/lo ::1@500
000 interface lo/lo 127.0.0.1@4500
000 interface lo/lo 127.0.0.1@500
000 interface eth0/eth0 10.0.2.15@4500
000 interface eth0/eth0 10.0.2.15@500
000 interface eth1/eth1 172.17.8.101@4500
000 interface eth1/eth1 172.17.8.101@500
000 interface flannel0/flannel0 10.1.73.0@4500
000 interface flannel0/flannel0 10.1.73.0@500
000
000
000 fips mode=disabled;
000 SElinux=disabled
000
000 config setup options:
000
000 configdir=/etc, configfile=/etc/ipsec.conf, secrets=/etc/ipsec.secrets, ipsecdir=/etc/ipsec.d, dumpdir=/var/run/pluto/, statsbin=unset
000 sbindir=/usr/sbin, libexecdir=/usr/libexec/ipsec
000 pluto_version=3.15, pluto_vendorid=OE-Libreswan-3.15
000 nhelpers=-1, uniqueids=yes, perpeerlog=no, shuntlifetime=900s, xfrmlifetime=300s
000 ddos-cookies-treshold=50000, ddos-max-halfopen=25000, ddos-mode=auto
000 ikeport=500, strictcrlpolicy=no, crlcheckinterval=0, listen=<any>, nflog-all=0
000 secctx-attr-type=32001
000 myid = (none)
000 debug none
000
000 nat-traversal=yes, keep-alive=20, nat-ikeport=4500
000 virtual-private (%priv):
000 - allowed subnets: 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 25.0.0.0/8, 100.64.0.0/10, fd00::/8, fe80::/10
000
000 ESP algorithms supported:
000
000 algorithm ESP encrypt: id=3, name=ESP_3DES, ivlen=8, keysizemin=192, keysizemax=192
000 algorithm ESP encrypt: id=11, name=ESP_NULL, ivlen=0, keysizemin=0, keysizemax=0
000 algorithm ESP encrypt: id=12, name=ESP_AES, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=13, name=ESP_AES_CTR, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=14, name=ESP_AES_CCM_A, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=15, name=ESP_AES_CCM_B, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=16, name=ESP_AES_CCM_C, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=18, name=ESP_AES_GCM_A, ivlen=8, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=19, name=ESP_AES_GCM_B, ivlen=12, keysizemin=128, keysizemax=256
000 algorithm ESP encrypt: id=20, name=ESP_AES_GCM_C, ivlen=16, keysizemin=128, keysizemax=256
000 algorithm AH/ESP auth: id=1, name=AUTH_ALGORITHM_HMAC_MD5, keysizemin=128, keysizemax=128
000 algorithm AH/ESP auth: id=2, name=AUTH_ALGORITHM_HMAC_SHA1, keysizemin=160, keysizemax=160
000 algorithm AH/ESP auth: id=5, name=AUTH_ALGORITHM_HMAC_SHA2_256, keysizemin=256, keysizemax=256
000 algorithm AH/ESP auth: id=251, name=AUTH_ALGORITHM_NULL_KAME, keysizemin=0, keysizemax=0
000
000 IKE algorithms supported:
000
000 algorithm IKE encrypt: v1id=0, v1name=0??, v2id=16, v2name=AES_CCM_C, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=0, v1name=0??, v2id=15, v2name=AES_CCM_B, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=0, v1name=0??, v2id=14, v2name=AES_CCM_A, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=5, v1name=OAKLEY_3DES_CBC, v2id=3, v2name=3DES, blocksize=8, keydeflen=192
000 algorithm IKE encrypt: v1id=24, v1name=OAKLEY_CAMELLIA_CTR, v2id=24, v2name=CAMELLIA_CTR, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=8, v1name=OAKLEY_CAMELLIA_CBC, v2id=23, v2name=CAMELLIA_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=20, v1name=OAKLEY_AES_GCM_C, v2id=20, v2name=AES_GCM_C, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=19, v1name=OAKLEY_AES_GCM_B, v2id=19, v2name=AES_GCM_B, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=18, v1name=OAKLEY_AES_GCM_A, v2id=18, v2name=AES_GCM_A, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=13, v1name=OAKLEY_AES_CTR, v2id=13, v2name=AES_CTR, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=7, v1name=OAKLEY_AES_CBC, v2id=12, v2name=AES_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=65004, v1name=OAKLEY_SERPENT_CBC, v2id=65004, v2name=SERPENT_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=65005, v1name=OAKLEY_TWOFISH_CBC, v2id=65005, v2name=TWOFISH_CBC, blocksize=16, keydeflen=128
000 algorithm IKE encrypt: v1id=65289, v1name=OAKLEY_TWOFISH_CBC_SSH, v2id=65289, v2name=TWOFISH_CBC_SSH, blocksize=16, keydeflen=128
000 algorithm IKE hash: id=1, name=OAKLEY_MD5, hashlen=16
000 algorithm IKE hash: id=2, name=OAKLEY_SHA1, hashlen=20
000 algorithm IKE hash: id=4, name=OAKLEY_SHA2_256, hashlen=32
000 algorithm IKE hash: id=5, name=OAKLEY_SHA2_384, hashlen=48
000 algorithm IKE hash: id=6, name=OAKLEY_SHA2_512, hashlen=64
000 algorithm IKE hash: id=9, name=DISABLED-OAKLEY_AES_XCBC, hashlen=16
000 algorithm IKE dh group: id=2, name=OAKLEY_GROUP_MODP1024, bits=1024
000 algorithm IKE dh group: id=5, name=OAKLEY_GROUP_MODP1536, bits=1536
000 algorithm IKE dh group: id=14, name=OAKLEY_GROUP_MODP2048, bits=2048
000 algorithm IKE dh group: id=15, name=OAKLEY_GROUP_MODP3072, bits=3072
000 algorithm IKE dh group: id=16, name=OAKLEY_GROUP_MODP4096, bits=4096
000 algorithm IKE dh group: id=17, name=OAKLEY_GROUP_MODP6144, bits=6144
000 algorithm IKE dh group: id=18, name=OAKLEY_GROUP_MODP8192, bits=8192
000 algorithm IKE dh group: id=22, name=OAKLEY_GROUP_DH22, bits=1024
000 algorithm IKE dh group: id=23, name=OAKLEY_GROUP_DH23, bits=2048
000 algorithm IKE dh group: id=24, name=OAKLEY_GROUP_DH24, bits=2048
000
000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}
000
000 Connection list:
000
000 "core-02": 172.17.8.101<172.17.8.101>[@core-01]...172.17.8.102<172.17.8.102>[@core-02]; erouted; eroute owner: #2
000 "core-02": oriented; my_ip=unset; their_ip=unset
000 "core-02": xauth info: us:none, them:none, my_xauthuser=[any]; their_xauthuser=[any]
000 "core-02": modecfg info: us:none, them:none, modecfg policy:push, dns1:unset, dns2:unset, domain:unset, banner:unset;
000 "core-02": labeled_ipsec:no;
000 "core-02": policy_label:unset;
000 "core-02": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
000 "core-02": retransmit-interval: 500ms; retransmit-timeout: 60s;
000 "core-02": sha2_truncbug:no; initial_contact:no; cisco_unity:no; send_vendorid:no;
000 "core-02": policy: RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW;
000 "core-02": conn_prio: 32,32; interface: eth1; metric: 0; mtu: unset; sa_prio:auto; nflog-group: unset;
000 "core-02": newest ISAKMP SA: #1; newest IPsec SA: #2;
000 "core-02": IKE algorithm newest: AES_CBC_256-SHA1-MODP2048
000 "core-02": ESP algorithm newest: AES_128-HMAC_SHA1; pfsgroup=<Phase1>
000 "v6neighbor-hole-in": ::/0===::1<::1>:58/34560...%any:58/34816===::/0; prospective erouted; eroute owner: #0
000 "v6neighbor-hole-in": oriented; my_ip=unset; their_ip=unset
000 "v6neighbor-hole-in": xauth info: us:none, them:none, my_xauthuser=[any]; their_xauthuser=[any]
000 "v6neighbor-hole-in": modecfg info: us:none, them:none, modecfg policy:push, dns1:unset, dns2:unset, domain:unset, banner:unset;
000 "v6neighbor-hole-in": labeled_ipsec:no;
000 "v6neighbor-hole-in": policy_label:unset;
000 "v6neighbor-hole-in": ike_life: 0s; ipsec_life: 0s; rekey_margin: 0s; rekey_fuzz: 0%; keyingtries: 0;
000 "v6neighbor-hole-in": retransmit-interval: 0ms; retransmit-timeout: 0s;
000 "v6neighbor-hole-in": sha2_truncbug:no; initial_contact:no; cisco_unity:no; send_vendorid:no;
000 "v6neighbor-hole-in": policy: PFS+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+PASS+NEVER_NEGOTIATE;
000 "v6neighbor-hole-in": conn_prio: 0,0; interface: lo; metric: 0; mtu: unset; sa_prio:1; nflog-group: unset;
000 "v6neighbor-hole-in": newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "v6neighbor-hole-out": ::/0===::1<::1>:58/34816...%any:58/34560===::/0; prospective erouted; eroute owner: #0
000 "v6neighbor-hole-out": oriented; my_ip=unset; their_ip=unset
000 "v6neighbor-hole-out": xauth info: us:none, them:none, my_xauthuser=[any]; their_xauthuser=[any]
000 "v6neighbor-hole-out": modecfg info: us:none, them:none, modecfg policy:push, dns1:unset, dns2:unset, domain:unset, banner:unset;
000 "v6neighbor-hole-out": labeled_ipsec:no;
000 "v6neighbor-hole-out": policy_label:unset;
000 "v6neighbor-hole-out": ike_life: 0s; ipsec_life: 0s; rekey_margin: 0s; rekey_fuzz: 0%; keyingtries: 0;
000 "v6neighbor-hole-out": retransmit-interval: 0ms; retransmit-timeout: 0s;
000 "v6neighbor-hole-out": sha2_truncbug:no; initial_contact:no; cisco_unity:no; send_vendorid:no;
000 "v6neighbor-hole-out": policy: PFS+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+PASS+NEVER_NEGOTIATE;
000 "v6neighbor-hole-out": conn_prio: 0,0; interface: lo; metric: 0; mtu: unset; sa_prio:1; nflog-group: unset;
000 "v6neighbor-hole-out": newest ISAKMP SA: #0; newest IPsec SA: #0;
000
000 Total IPsec connections: loaded 3, active 1
000
000 State Information: DDoS cookies not required, Accepting new IKE connections
000 IKE SAs: total(1), half-open(0), open(0), authenticated(1), anonymous(0)
000 IPsec SAs: total(1), authenticated(1), anonymous(0)
000
000 #2: "core-02":500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 25818s; newest IPSEC; eroute owner; isakmp#1; idle; import:admin initiate
000 #2: "core-02" [email protected] [email protected] [email protected] [email protected] ref=0 refhim=4294901761 Traffic: ESPout=603KB ESPin=579KB! ESPmax=4194303B
000 #1: "core-02":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 377s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate
000
000 Bare Shunt list:
000
What are the differences between OpenSwan and StrongSwan? All I found is this comparison between the outdated FreeSwan and testing version of OpenSwan - i.e. current stable of OpenSwan is 2.6 (3.0 in comparison) and current stable for StrongSwan is 4.4 (4.1.7 in comparison) which seems grossly unfair (there is no point in comparing Windows 98 with Ubuntu 10.10 or Mac OS X 10.7 with Slackware 8.0).
After reading some websites, StrongSwan seems to be better maintained while OpenSwan seems to be more popular.
LVM 2 snapshots works as COW. However the block may change even if it is not used anymore. As SSD disks may need marking of free/used blocks to better manage blocks, the API was introduced into Linux to mark free/used blocks.
My question is - does LVM use this API? I.e. are blocks are copied on every change or only if filesystem cares about contents?
I set up cups and avahi on FreeBSD 8.0. However cups printer does not shows in avahi-browse -a on client (other things like ssh server are shown). Additionally if I try to run avahi-browse -a on server it does not succeed:
# avahi-browse -a
Failed to create client object: Daemon not running
CUPS is built with avahi support. Dbus is running. Cups have sharing enabled in web interface.
I need to perform given action when specific message (matching for example regexp) arrives at the UDP port (syslog format). How to do this (i.e. by using already avaible softwere as opposed to writing one by hand)?
I need to send a request to CUPS server with the specific request-user parameter - remote_user instead of local_user. How should I set the local CUPS server?
I need a tool which allows to take controll of user keyboard and/or mouse with support of Linux client (preferably on FLOSS license). It should ask the user about permission (I don't want to give a free troyan crackers). The NAT is not a problem - I have VPN. It should be able to work with lower resolution on client.
Windows is Vista (both 32 and 64 bit editions).
Does anyone know such client?
(By client I mean the connecting computer and by server I mean the Windows machine).