lobi's questions

Looking to execute a script on the first Monday of the month, then a different script on the first Wednesday of the month.

The issue is that if a new month starts on a Tuesday, for example, then the "first Wednesday of the month" action will hit first. I'd like to have this configured so that the "first Wednesday of the month" action only occurs if it follows a Monday within that month.

Logic can be used to figure this out from a scripting perspective, but the problem is that I need this in a cron expression since that is the only way I can schedule this in the system I am using (it requires a cron expression for advanced scheduling, and details of this system is not relevant to this question).

Edit: There is no dependency or relationship between the aforementioned scripts being executed by cron. For the sake of simplicity for the question, they would simply be two separate cronjobs in the same crontab.

Looking to port mirror a network firewall interface, connect that interface to a Linux server, and have that Linux server constantly run a tcpdump and storing the output in files.

Specifically, my requirement is to have pcap files saved over and over again as the size of that file reaches a specific number.

For example:

Juniper firewall port 2 mirrors all traffic on port 1. Port 2 connects to eth0 on the Linux server. Linux server has a tcpdump process running constantly on eth0. Linux server is configured to save the traffic to a file named "tcpdump.pcap", but when the pcap file exceeds a specific size, then it will then compress and rename to "tcpdump.pcap.0.gz". As the second file exceeds a specific size, then it will be renamed to "tcpdump.pcap.1.gz", etc.

This will allow me to view network traffic within the past X amount of time (for now, I'm looking to have visibility in the past 72 hours).

The problem here is that I don't know how to accomplish the above. Specifically, how do I get tcpdump to run continously, and automatically save pcaps, and automatically compress and re-name chronologically?

When running service openvpn status, the output states

Status written to /var/log/messages

However, nothing shows up in the file.

When using a TUN (layer 3) OpenVPN server with client-to-client disabled, my clients can still talk to each other.

The client-to-client config should prevent this according to the documentation:

Uncomment out the client-to-client directive if you would like connecting clients to be able to reach each other over the VPN. By default, clients will only be able to reach the server.

Why can the clients continue to communicate to each other when this option is disabled?

Here is my server conf:

port 443
proto tcp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh4096.pem
topology subnet
server 10.10.201.0 255.255.255.128
ifconfig-pool-persist ipp.txt
crl-verify /etc/openvpn/keys/crl.pem
push "route [omitted]"
push "dhcp-option DNS [omitted]"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so login
cipher AES-256-CBC
tls-auth /etc/openvpn/keys/pfs.key 0
verb 4

Set up:

OpenVPN 2.3 on centos server. Multiple clients (windows, osx, linux). Encyrption using certificates PER device (easy-rsa), and added authentication using the openvpn-plugin-auth-pam.so module (username/password). I am also password protecting the private keys.

Problem:

Anyone connecting with any of the valid certificates can authenticate with ANY of the local users. The problem with this is that some clients may end up using a very weak password that is vulnerable to brute force attacks. I know I can simply just restrict the shit out of the client users as a protection to this type of intrusion, however I would rather not be limited to this

What I want:

I would like each local user to be associated/tied to a specific certificate. That way, if Bob's credentials become compromised, and a different user Alice has a very weak password, then the attacker using Bob's credentials cannot brute force via user Alice.

How can this be done?

I fully realize that this is "paranoid" security, however it is a feature I believe should be available. Of course, if associating a cert to a local user is NOT the best and most efficient way, then feel free to suggest an alternative that would accomplish the same goal (i.e. a holder of a specific cert can only authenticate against a specific local user).

Thanks.

Ubuntu 14.x. Using grep to search for all files linuxtest-client2. This includes multiple file extensions (csr, crt, key). When I grep for the middle portion of the filename, "2.", it also returns lines that contain "2" in addition to "2." when using ls -l with it. This causes results to be returned that have a "2" in the file size, date, and time.

Why are the file sizes being trigger by this grep when there is no period after them?:

root@ip-10-198-0-205:/etc/easy-rsa# ls -ltr keys/ | grep -E '*2.*'
total 228
-rw------- 1 root root 3272 Oct 15 18:28 ca.key
-rw-r--r-- 1 root root 2451 Oct 15 18:28 ca.crt
-rw------- 1 root root 3268 Oct 15 18:31 server.key
-rw-r--r-- 1 root root  769 Oct 15 18:42 dh4096.pem
-rw-r--r-- 1 root root 8244 Oct 19 15:36 02.pem
-rw-r--r-- 1 root root 8250 Oct 19 19:21 03.pem
-rw------- 1 root root 3394 Oct 23 19:48 removemetest.key
-rw-r--r-- 1 root root 1785 Oct 23 19:48 removemetest.csr
-rw-r--r-- 1 root root 8264 Oct 23 19:48 removemetest.crt
-rw-r--r-- 1 root root 8264 Oct 23 19:48 04.pem
-rw------- 1 root root 3394 Oct 23 20:50 revoketest449.key
-rw-r--r-- 1 root root 1789 Oct 23 20:50 revoketest449.csr
-rw-r--r-- 1 root root 8270 Oct 23 20:50 revoketest449.crt
-rw-r--r-- 1 root root 8270 Oct 23 20:50 05.pem
-rw-r--r-- 1 root root 3633 Oct 23 20:50 revoke-test.pem
-rw-r--r-- 1 root root 1182 Oct 23 20:50 crl.pem
-rw------- 1 root root 3394 Oct 23 20:54 linuxtest-client1.key
-rw-r--r-- 1 root root 1793 Oct 23 20:54 linuxtest-client1.csr
-rw-r--r-- 1 root root    3 Oct 23 20:54 serial.old
-rw-r--r-- 1 root root 8287 Oct 23 20:54 linuxtest-client1.crt
-rw-r--r-- 1 root root  909 Oct 23 20:54 index.txt.old
-rw-r--r-- 1 root root   21 Oct 23 20:54 index.txt.attr.old
-rw-r--r-- 1 root root 8287 Oct 23 20:54 06.pem
-rw------- 1 root root 3394 Oct 26 17:57 linuxtest-client2.key
-rw-r--r-- 1 root root 1793 Oct 26 17:57 linuxtest-client2.csr
-rw-r--r-- 1 root root    3 Oct 26 17:57 serial
-rw-r--r-- 1 root root 8287 Oct 26 17:57 linuxtest-client2.crt
-rw-r--r-- 1 root root   21 Oct 26 17:57 index.txt.attr
-rw-r--r-- 1 root root 1058 Oct 26 17:57 index.txt
-rw-r--r-- 1 root root 8287 Oct 26 17:57 07.pem

But if I do not use -l on ls, then it returns the proper results that I am looking for, so clearly my regex is correct:

root@ip-10-198-0-205:/etc/easy-rsa# ls keys/ | grep -E '*2.*'
02.pem
linuxtest-client2.crt
linuxtest-client2.csr
linuxtest-client2.key

OpenVPN server on Ubuntu 14.04. Easy-rsa on the certificate authority server on Ubuntu 14.04. Done this way because I want the ca.key file to be separate from the machine that acts as the openvpn server for security reasons.

I start up a client, use easy-rsa to generate a key and csr file, then scp the csr file to the CA server and run either <>./sign-req keys/linuxclient2.csr or ./pkitool --sign keys/linuxclient2.csr.

I get the following error:

Using configuration from /usr/share/easy-rsa/openssl-1.0.0.cnf
keys/linuxclient2.csr.crt: No such file or directory
139779055732384:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('keys/linuxclient2.csr.crt','w')
139779055732384:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:

It generates a file called linuxclient2.csr.crt, which is not a valid cert. I then delete the file and try again and get the same exact error message, only this time the .csr.crt file is not present.

Unable to sign certificate signing requests, which means I am now forced to sign them at the CA and distribute them over a not-exactly-the-most-secure channel :(

I am currently setting up OpenVPN to provide company access to multiple clients. Our requirement is to use certificates, password protect the client keys, as well as using dual factor (MFA) authentication per client.

I have a bunch of Fortinet FortiToken 200 tokens laying around that I would like to use, but I can't find any information that shows how to use these tokens with something like OpenVPN. After looking around some more, I can't find any information that shows how one can use a physical token with OpenVPN either.

So my question is, how can I use a physical token with OpenVPN? I can't use something like Google Authenticator since we plan to have clients VPN in via their smartphones also. The OpenVPN PKCS#11 how-to documentation is very poorly written.

I'm starting to believe that if MFA is a requirement, OpenVPN is simply not a viable option at this point in time.

Thanks for your help.

We all know that ping is the most common way to establish layer 3 connectivity. Layer 1 connectivity is established by link light. Layer 2 connectivity is establish by checking if link protocol shows as up (or you see the MAC address), but how about non-ethernet layer 2 connectivity? How about layers 4, 5, 6, and 7?

So, the question is: What are common ways to unequivocally establish connectivity at layers 2, 4, 5, 6, and 7?

Some ideas that pop into my head:

1) telnet to port 80/443 for layer 7 connectivity

2) use netcat (how?)

Ubuntu 14.04 (Amazon's Ubuntu AMI). Installed strongswan 5.3.2 from source (latest version in repo is too old and doesn't work). 1 question:

1) Noticed that the /init.d/ipsec (or /init/) script is missing. I'm a linux newb, so I assume this is the case because I installed from source and I'm expected to build this script myself somehow? Because the script is missing, I can't configure the OS to auto start the ipsec service upon boot. My question is How do I get the ipsec init script?

Your help is appreciated.

I am trying to set up a VPN tunnel using StrongSwan 5.1.2 between two Amazon AWS EC2 instances running Ubuntu 14.04.2 LTS. Prior to using StrongSwan, I used open(libre)swan on an Amazon RedHat AMI, which worked fine. For some reason I can't even get IKE to work here for StrongSwan. I triple checked my AWS configurations, and it all looks good, so it must be a problem with StrongSwan configuration.

As you will see below, the error I am getting is "Error writing to socket: Invalid argument". I have looked online and really can't find the solution to this. I am convinced my strongswan ipsec.conf is improperly configured.

Here is what I am working with:

Instance #1: N.Virginia - 10.198.0.164 with public EIP 54.X.X.X
Instance #2: Oregon - 10.194.0.176 with public EIP 52.Y.Y.Y

The (simple) topology is as follows:

[ Instance #1 within N.Virginia VPC <-> Public internet <-> Instance #2 within Oregon VPC ]

I verified that the following AWS configs are correct:

Security groups permit all
IP information is correct
Src/Dest disabled on both instances
ACLs permit all
routes are present and correct (route to 10.x will point to that local instance in order to be routed out to the VPN tunnel)

Below is the /etc/ipsec.conf (this is from Oregon, however it is the same on the N.Virginia instance except the left|right values are reversed):

config setup
        charondebug="dmn 2, mgr 2, ike 2, chd 2, job 2, cfg 2, knl 2, net 2, enc 2, lib 2"
conn aws1oexternal-aws1nvexternal
        left=52.Y.Y.Y (EIP)
        leftsubnet=10.194.0.0/16
        right=54.X.X.X (EIP)
        rightsubnet=10.198.0.0/16
        auto=start
        authby=secret
        type=tunnel
        mobike=no
        dpdaction=restart

Below is the /etc/ipsec.secrets *(reversed for other instance, obviously):

54.X.X.X 52.Y.Y.Y : PSK "Key_inserted_here"

Below is the /etc/strongswan.conf:

charon {
        load_modular = yes
        plugins {
                include strongswan.d/charon/*.conf
        }
}

Below is the /etc/sysctl.conf:

net.ipv4.ip_forward=1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

Here is the debug output from /var/log/syslog It seems the problem here is "error writing to socket: Invalid argument; after everything I tried, I continue to get this same error:

Jun 17 17:34:48 ip-10-198-0-164 charon: 13[IKE] retransmit 5 of request with message ID 0
Jun 17 17:34:48 ip-10-198-0-164 charon: 13[NET] sending packet: from 54.X.X.X[500] to 52.Y.Y.Y[500] (1212 bytes)
Jun 17 17:34:48 ip-10-198-0-164 charon: 03[JOB] next event in 75s 581ms, waiting]
Jun 17 17:34:48 ip-10-198-0-164 charon: 16[NET] sending packet: from 54.X.X.X[500] to 52.Y.Y.Y[500]
Jun 17 17:34:48 ip-10-198-0-164 charon: 13[MGR] checkin IKE_SA aws1vexternal-aws1oexternal[1]
Jun 17 17:34:48 ip-10-198-0-164 charon: 13[MGR] check-in of IKE_SA successful.
Jun 17 17:34:48 ip-10-198-0-164 charon: 16[NET] error writing to socket: Invalid argument
Jun 17 17:36:04 ip-10-198-0-164 charon: 03[JOB] got event, queuing job for execution
Jun 17 17:36:04 ip-10-198-0-164 charon: 03[JOB] no events, waiting
Jun 17 17:36:04 ip-10-198-0-164 charon: 08[MGR] checkout IKE_SA
Jun 17 17:36:04 ip-10-198-0-164 charon: 08[MGR] IKE_SA aws1vexternal-aws1oexternal[1] successfully checked out
Jun 17 17:36:04 ip-10-198-0-164 charon: 08[IKE] giving up after 5 retransmits
Jun 17 17:36:04 ip-10-198-0-164 charon: 08[IKE] establishing IKE_SA failed, peer not responding
Jun 17 17:36:04 ip-10-198-0-164 charon: 08[MGR] checkin and destroy IKE_SA aws1vexternal-aws1oexternal[1]
Jun 17 17:36:04 ip-10-198-0-164 charon: 08[IKE] IKE_SA aws1vexternal-aws1oexternal[1] state change: CONNECTING => DESTROYING
Jun 17 17:36:04 ip-10-198-0-164 charon: 08[MGR] check-in and destroy of IKE_SA successful

Below is what I have tried so far:

1) Verified layer 3

2) rebooted machines

3) Tried adding in leftid=

4) Tried doing ipsec update then ipsec restart

5) Tried adding nat_traversal=yes under confif setup (note that this shouldn't matter since ipsec statusall verified using IKEv2, which according to documentation automatically uses nat_traversal)

6) Tried omitting virtual_private <-- Was used according to AWS openswan documentation so I included it in strongswan config.

7) Tried disabling net.ipv4.conf.all.send_redirects = 0 and net.ipv4.conf.all.accept_redirects = 0 in /etc/sysctl.conf

8) Tried using private IP instead of EIPs. I no longer get the socket error, however obviously the two IPs can't communicate to each other to peer...

9) Tried adding this to strongswan.conf: load = aes des sha1 sha2 md5 gmp random nonce hmac stroke kernel-netlink socket-default updown

10) Tried using leftfirewall=yes, didn't work

Please help! Thanks!

EDIT #1:

Michael's response cleared the original problem, however I have a new problem related to routing. Both VPN instances are unable to ping each other. Furthermore, when I try to ping from a random instance in either subnet, to either another random instance or the far end VPN instance, I get the following ping response:

root@ip-10-194-0-80:~# ping 10.198.0.164
PING 10.198.0.164 (10.198.0.164) 56(84) bytes of data.
From 10.194.0.176: icmp_seq=1 Redirect Host(New nexthop: 10.194.0.176)
From 10.194.0.176: icmp_seq=2 Redirect Host(New nexthop: 10.194.0.176)
From 10.194.0.176: icmp_seq=3 Redirect Host(New nexthop: 10.194.0.176)
From 10.194.0.176: icmp_seq=4 Redirect Host(New nexthop: 10.194.0.176)

Obviously this must be a routing issue between the two VPN instances (most likely due to strongswan config or instance routing table) since the 10.194.0.80 host in the Oregon subnet is able to receive a response from the Oregon VPN instance. Route table + traceroute on instance:

root@ip-10-194-0-80:~# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.194.0.1      0.0.0.0         UG        0 0          0 eth0
10.194.0.0      0.0.0.0         255.255.255.0   U         0 0          0 eth0

root@ip-10-194-0-80:~# traceroute 10.198.0.164
traceroute to 10.198.0.164 (10.198.0.164), 30 hops max, 60 byte packets
 1  10.194.0.176 (10.194.0.176)  0.441 ms  0.425 ms  0.409 ms^C

When I was using openswan, it did not require me to make any manual modifications to each instance's routing table.

Here is the Oregon VPN instance's routing table:

root@ip-10-194-0-176:~# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         10.194.0.1      0.0.0.0         UG        0 0          0 eth0
10.194.0.0      0.0.0.0         255.255.255.0   U         0 0          0 eth0

I'm a bit stumped.

EDIT #2:

Looks like routing between the VPN instances might not be the problem: /var/log/syslog shows packets being received from one VPN instance public IP to the other VPN instance

Jun 23 19:57:49 ip-10-194-0-176 charon: 10[NET] received packet: from 54.X.X.X[4500] to 10.194.0.176[4500] (76 bytes)

Looks like it is an issue related to Child Security Associations:

aws1oexternal-aws1nvexternal:   child:  10.194.0.0/16 === 10.198.0.0/16 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 **connecting**):

/var/log/syslog:

Jun 23 19:52:19 ip-10-194-0-176 charon: 02[IKE] failed to establish CHILD_SA, keeping IKE_SA
Jun 23 19:52:48 ip-10-194-0-176 charon: 11[IKE] queueing CHILD_CREATE task
Jun 23 19:52:48 ip-10-194-0-176 charon: 11[IKE]   activating CHILD_CREATE task
Jun 23 19:52:48 ip-10-194-0-176 charon: 06[IKE] establishing CHILD_SA aws1oexternal-aws1nvexternal
Jun 23 19:52:48 ip-10-194-0-176 charon: 10[IKE] received FAILED_CP_REQUIRED notify, no CHILD_SA built
Jun 23 19:52:48 ip-10-194-0-176 charon: 10[IKE] failed to establish CHILD_SA, keeping IKE_SA
Jun 23 19:52:49 ip-10-194-0-176 charon: 14[CFG] looking for a child config for 10.194.0.0/16 === 10.198.0.0/16 
Jun 23 19:52:49 ip-10-194-0-176 charon: 14[CFG] found matching child config "aws1oexternal-aws1nvexternal" with prio 10
Jun 23 19:52:49 ip-10-194-0-176 charon: 14[IKE] configuration payload negotiation failed, no CHILD_SA built
Jun 23 19:52:49 ip-10-194-0-176 charon: 14[IKE] failed to establish CHILD_SA, keeping IKE_SA

***EDIT #3: Problem solved (uhh, actually see EDIT #4 below...)****

Problem fixed.

1) I did not properly follow Michael's config directions. I also configured a rightsourceip and leftsourceip together, thereby causing both instances to believe they were both initiators. I ensured that one was an initiator and one was a requestor; this fixed the IKE problem.

2) I figured out that I also had to explicitly set the esp parameter. Even though there is already a default (aes128-sha1,3des-sha1), the esp parameter still has to be set in order for the instance to know to use esp OR ah (but not both). I ended up using aes128-sha1-modp2048.

Hope this posting helps the next linux newbie set this up!!

Cheers!

EDIT #4: Problem (not really) solved

While troubleshooting a separate issue related to strongswan, I changed the "leftfirewall" parameter, tested, didn't fix my separate issue, then reverted back to the orig config beforehand (commented out leftfirewall). I then noticed that I now couldn't ping across the tunnel. After going crazy for hours trying to figure out what happened, I commented out the esp parameter to see what would happen: I CAN NOW PING ACROSS THE TUNNEL AGAIN! <- so, there is a possibility there are some ipsec ghosts running around playing tricks on me and that the esp parameter isn't really the fix for the TS_UNACCEPTABLE errors (although other resources online state the esp parameter is the fix...)

EDIT #5: Problem fully solved

I ended up moving everything into a test environment and starting from scratch. I installed from source using the latest version (5.3.2) rather than the older version that was in the Ubuntu repo (5.1.2). This cleared the problem I was having above, and verified layer 7 connectivity using netcat (great tool!!) between multiple subnets over the VPN tunnel.

Also: It is NOT required to enable DNS hostnames for the VPC (as I was incorrectly led to believe by Amazon), FYI>

Hope this all helps!!!!!!

Additional edit 2/11/2017:

As per JustEngland's request, copying the working configuration below (leaving out certain details in order to prevent identification in any way):

Side A:

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration
config setup
# Add connections here.
conn %default
 ikelifetime= You choose; must match other side
 keylife= You choose; must match other side
 rekeymargin= You choose; must match other side
 keyingtries=1
 keyexchange= You choose; must match other side
 authby=secret
 mobike=no

conn side-a
 left=10.198.0.124
 leftsubnet=10.198.0.0/16
 leftid=54.y.y.y
 leftsourceip=10.198.0.124
 right=52.x.x.x
 rightsubnet=10.194.0.0/16
 auto=start
 type=tunnel
# Add connections here.


root@x:~# cat /etc/ipsec.secrets 
A.A.A.A B.B.B.B : PSK "Your Password"

Side B:

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration
config setup

conn %default
 ikelifetime= You choose; must match other side
 keylife= You choose; must match other side
 rekeymargin= You choose; must match other side
 keyingtries=1
 keyexchange= You choose; must match other side
 authby=secret
 mobike=no

conn side-b
 left=10.194.0.129
 leftsubnet=10.194.0.0/16
 leftid=52.x.x.x
 right=54.y.y.y
 rightsubnet=10.198.0.0/16
 rightsourceip=10.198.0.124
 auto=start
 type=tunnel

root@x:~# cat /etc/ipsec.secrets 
B.B.B.B A.A.A.A : PSK "Your Password"

Using Centos. Situation: I have multiple drives off of two RAID controllers. I also have multiple entries in the fstab, such as /dev/sdb, /dev/sdc, etc. What I need to know is how I can identify which drives or set of drives (in the case of RAID) correspond to an entry in the /etc/fstab file.

In other words, I want to be able to look at /etc/fstab, see an entry as /dev/sda, and find that specific disk drive' slot/bay/port/whatever on the actual server.

Seems like this should be a very very simple thing to do, but even my manager who is a sys admin can't really answer this, nor can I find any concrete answers on stackexchange.

Really appreciate the help, and I am happy to elaborate if needed.

EDIT: I imagine this might be able to be done using the hardware RAID controller, however since there are situations where one would have a bunch of single drives, I would instead prefer to know how I identify by using a standard and widely available linux tool, like gparted or something.

Looked all over google and stackoverflow; can't find an answer to this "simple" problem.

Background: I have a Supermicro server running centos 6.5 kernal 2.6.32-431.29.2.el6.x86_64. I have been trying to configure IPMI, and after much troubleshooting, I realize that the problem is likely due to the ipmi_si (and ipmi_msghandler) module not being present. I believe that the only way to obtain these modules is by upgrading the kernel:

[blah@localhost]$ yum provides "*/ipmi_msg*.ko"
Loaded plugins: fastestmirror, refresh-packagekit, security
Loading mirror speeds from cached hostfile
 * base: centos.mirror.constant.com
 * epel: ftp.osuosl.org
 * extras: linux.cc.lehigh.edu
 * updates: mirror.metrocast.net
kernel-debug-2.6.32-504.el6.x86_64 : The Linux kernel compiled with extra debugging enabled
Repo        : base
Matched from:
Filename    : /lib/modules/2.6.32-    504.el6.x86_64.debug/kernel/drivers/char/ipmi/ipmi_msghandler.ko

kernel-2.6.32-504.el6.x86_64 : The Linux kernel
Repo        : base
Matched from:
Filename    : /lib/modules/2.6.32-       504.el6.x86_64/kernel/drivers/char/ipmi/ipmi_msghandler.ko

...etc

Agreed? I'd rather obtain these modules without upgrading the kernel. Furthermore, assuming that I must upgrade the kernel, can someone confirm that the reason for this is simply that those modules are not "compatible" with the current kernel?

Thanks.

The MAC address listed under ipmitool lan print seems to be incorrect, since there is no entry in the arp cache for the set ip address, 10.224.242.121:

# arp 10.224.242.121 10.224.242.121 (10.224.242.121) -- no entry

Obviously the ipmi interface cannot establish layer 2 connectivty because of this. After a good amount of googling, I can't figure out how to find the correct IPMI mac address....

I am running centos6.5 on a supermicro server. Any help would be greatly appreciated.

Troubleshooting an IPMI issue on a centos 6.5 server. Specifically, I am not able to set up IPMI web management due to errors when trying to work with IPMI LAN settings.

I get the following error when I type ipmitool lan print:

[root@]# ipmitool lan print
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Get Channel Info command failed
Invalid Channel 255

Almost all google/stackexchange answers to these problems result in the answer found here ipmitool - can't find /dev/ipmi0 or /dev/ipmidev/0, however this supermicro server has the same exact ipmi kernel modules loaded as my other supermicro server as shown below:

[root@SERVER_WITHOUT_WORKING_IPMI]# modprobe --showconfig | grep ipmi
alias platform:ipmi_si ipmi_devintf
[root@SERVER_WITH_WORKING_IPMI]# modprobe --showconfig | grep ipmi
alias platform:ipmi_si ipmi_devintf

Therefore, I suspect this is not a problem related to kernel modules...

Any assistance on this is greatly appreciated. Note that this device is in production, so I have to be careful with "trying things out". Also note that I am relatively new to linux (network engineer here).

Thanks everyone...(this is my first post!)