Dom's questions

On my new Debian Bookworm, the file /usr/share/perl5/Net/Server/Fork.pm generates an error in logs each time Munin calls it. The error logged is

"Use of uninitialized value in numeric eq (==) at /usr/share/perl5/Net/Server/Fork.pm line 168."

In Debian Bullseye, there is no error.

By the way, here are the differences between the two versions :

5c5
< #  Copyright (C) 2001-2017
---
> #  Copyright (C) 2001-2022
146a147
>         $self->register_child($pid, 'fork');
167c168
<     if (SOCK_DGRAM == $sock->getsockopt(SOL_SOCKET,SO_TYPE)) {
---
>     if (SOCK_DGRAM == unpack('i', $sock->getsockopt(SOL_SOCKET, SO_TYPE))) {

The line 168 is the last diff, where the problem occurs.

I don't know the Perl, so how can I solve this and report the error to Perl package owner ?

I try to use Wireguard on a firewall with VRRP (based on Keepalived). The firewall blocks all the communications except to the VRRP address on port 51820 and the valid established connections.

Wireguard works well if I don't use VRRP.

When I try to use VRRP, the packet from client go to VRRP address as attended. But Wireguard try to reply from the physical IP address (and not the VRRP one), which is blocked on OUTPUT by the firewall as the IP change.

Do you know how Wireguard should be configured to reply by the VRRP address and not the physical one ?

I would not allow to answer by the physical IP address as clients firewall may block the connection if they do connection tracking too.

I try to see if a SNAT can help, to rewrite the physical IP to VRRP one, but it is not allowed put it in OUTPUT or PREROUTING nat rules.

Some logs : on the client (IP 10.3.3.2) :

11:41:09.011209 IP 10.3.3.2.47755 > 10.3.3.254.51820: UDP, length 148
11:41:14.131337 IP 10.3.3.2.47755 > 10.3.3.254.51820: UDP, length 148

on the firewall (10.3.3.252 physical, 10.3.3.254 VRRP) :

Jan 12 11:41:09 FW-DEV1 kernel: [ 3950.406083] OUTPUT: IN= OUT=enp0s9 SRC=10.3.3.252 DST=10.3.3.2 LEN=120 TOS=0x08 PREC=0x80 TTL=64 ID=7125 PROTO=UDP SPT=51820 DPT=47755 LEN=100
Jan 12 11:41:14 FW-DEV1 kernel: [ 3955.526617] OUTPUT: IN= OUT=enp0s9 SRC=10.3.3.252 DST=10.3.3.2 LEN=120 TOS=0x08 PREC=0x80 TTL=64 ID=7878 PROTO=UDP SPT=51820 DPT=47755 LEN=100

Edit: Add NAT

I put a NAT on VRRP interface and it almost solve the issue.

iptables -t nat -A PREROUTING -d WGIP/32 -p udp -m udp --dport 51820 -j DNAT --to-destination PHYSICALIP

But I need to open the filter rule with the PhysicalIP address. It means that the VRRP and the PHYSICALIP are open from outside. I cannot put a DROP rule before the nat rule to forbid the connection except to VRRPIP

I have saslauthd with save the logs in LOG_AUTH in our rsyslogd server. It can't be changed without recompiling, and I don't want to do that. I would like to see all the LOG_AUTH in LOG_MAIL, because I do an export to an external machine, and I would like to see all the saslauthd logs in LOG_MAIL in the distant server. Of course, in local I can add "auth.* " in the mail.log file section, but the export will not be in the right file because I filter in export by syslog Facility/Priority.

How can I export all the AUTH logs into MAIL logs ?

Thanks

I am looking for a tool which sniff all the traffic on an interface and produce a syslog like Cisco log in real time. Example :

Feb 16 10:19:05 tcp S.S.S.S(6083) -> D.D.D.D(80), 1 packet
Feb 16 10:19:07 tcp S.S.S.S(80) -> D.D.D.D(4662), 1  packet
Feb 16 10:19:11 igmp S.S.S.S -> 224.0.0.1, 1 packet
Feb 16 10:19:13 udp S.S.S.S(53) -> D.D.D.D(13341), 1 packet
Feb 16 10:19:13 icmpv6 FE80::660:2408:2:2 -> FF02::1 (134/0), 2 packets

In the example S.S.S.S are source IP address, D.D.D.D are destination IP address.

I try with tshark, but I can't do all the possibilities with the filters, because some times there is ports (for TCP or UDP), and sometimes not. It would be cool if we can have the L2 addresses too.

Do you have such tool in your box ? It should work on Debian Linux. It will be a daemon to capture all the traffic to text.

Thanks !

I want to reject our standard password in pam for the services until the user change it. It is a fixed password, well known by our users, but I don't know how I can configure pam to refuse it. I check cracklib, but it works only on password change, not on auth. I can't use pam_succeed_if as it doesn't check the password.

Any idea how reject this password ?

The postfix server puts sometimes mails in corrupt queue. These mails are never checked because there is an error in the file (I see "bad record type: 43 in message content"). In the documentation, I can see "Unreadable or damaged queue files are moved here for inspection".

OK. I can read them with postcat, but after that, what should I do ? Can I remove them without error ? What should I do to put them back in send queue ? I found somewhere to move the files to maildrop but nothing happens.

Thanks !

Dom