M. Schmidt's questions

Network setup

• 10.0.1.0/28 (VLAN 1)
• 10.0.1.32/28 (VLAN 1)

ISC-DHCPd setup

subnet 10.0.1.0 netmask 255.255.255.240 {
  option routers 10.0.1.1;
}

subnet 10.0.1.32 netmask 255.255.255.240 {
  option routers 10.0.1.33;
}

host {
  fixed-address 10.0.1.34;
  hardware ethernet 00:11:22:33:44:55:66;
}

The networks are using a DHCP relay, that can only be configured on a per-VLAN basis.

The source of the relayed/proxied DHCPDISCOVER will, in both cases, be the router of the first subnet. Therefore ISC-DHCPd sends no DHCPOFFER and logs "no free leases" for any host that has a statically configured IP of the second subnet (10.0.1.32/28).

dhcpd.conf manual states

When dhcpd tries to find a host declaration for a client, it first looks for a host declaration which has a fixed-address declaration that lists an IP address that is valid for the subnet or shared network on which the client is booting.

Question

How can I configure the ISC-DHCPd in a way that it will accept relayed requests for all subnets, and assign a lease that is for a different subnet than where the request originated from?

For migrating from the de-factor closed source glftpd 2.01 to proftpd I need to migrate password hashes of the user accounts from glftpd to proftpd. Reading about the topic I figured mod_sql_passwd should do the trick.

I therefore set up my proftpd server like this:

<global>
    SQLBackend              mysql
    SQLAuthTypes            Crypt
    SQLAuthenticate         users groups

    SQLConnectInfo  testdbuser@testdbhost testdb

    SQLUserInfo     ftpuser userid passwd uid gid homedir shell
    SQLGroupInfo    ftpgroup groupname gid members
    SQLMinID        500
    CreateHome on

[...]

    RootLogin off
    RequireValidShell off
    DefaultRoot ~
</global>

DefaultServer                   off
ServerType                      standalone

<VirtualHost 0.0.0.0>
    Port 21
    PassivePorts 10000 10250
    MasqueradeAddress 123.123.123.123

    SQLAuthTypes pbkdf2
    SQLPasswordPBKDF2 sha1 100 40

    SQLNamedQuery get-user-salt SELECT "salt FROM ftpuser WHERE userid = '%{0}'"
    SQLPasswordUserSalt sql:/get-user-salt Prepend
</VirtualHost>

The hashes in the glftpd passwd look like this:

$7e8ab0c7$bf044082ab83875eeb3a2158cd6253f8e88f40cf

The database looks like this (CSV representation):

"id","userid","passwd","salt","uid","gid","homedir","shell","count","accessed","modified"
"1","test","bf044082ab83875eeb3a2158cd6253f8e88f40cf","7e8ab0c7","5500","5500","/data/test","/sbin/nologin","20","2020-03-31 20:02:45","2020-03-25 16:30:49"

All configurations so far result in:

USER test (Login failed): No such user found

While in fact the user exists and by changing the hash to a Crypt() Bcrypt-style hash, a login succeeds.

Questions/problems:

• it is unclear how many iterations are used for glftpd's hashes from the little source available of glftpd, an iteration value of 100 can be derived
• it is unclear if the dollar sign should be prepended to the salt and the hash values or not
• proftpd with DebugLevel 10 yields no other information than "USER test (Login failed): No such user found", though, with a normal Crypt() Bcrypt-type hash it works flawlessly (see the top of the config)
• it is unclear how the glftpd 2.01 hashes are constructed, I tried SQLPasswordOptions HashPassword HashSalt which seemed the most logical, without success [²]

It would be great to hear from someone how had a similar task and made some experience with this kind of migration. Additional clues that help solving this topic are also welcome.

[¹] https://glftpd.io/files/glftpd-LNX_2.01.tgz (bin/sources/PassChk/passhk.c) glftpd 2.01 "passchk.c":

    PKCS5_PBKDF2_HMAC_SHA1(pwd, strlen(pwd), real_salt, SHA_SALT_LEN, 100,
               mdlen, md);

[²] http://www.proftpd.org/docs/contrib/mod_sql_passwd.html#Transformations

For playing and learning purpose i set up an OpenVPN-server. Im currently attached to a network without IPv6. Because of that, I would like to route all IPv6-traffic via the VPN. With IPv4 and iptables-Masquerading this already works perfectly well.

Now to IPv6: I set up IPv6 inside the network. Im able to establish connections and pings (ping6) between the client and the server inside the network.

The forwarding of the kernel of the server is activated. The server has IPv6 connectivity to the outside.

I tried this setting:

push "route-ipv6 2000::/3"

and

push "route-ipv6 <my IPv6>"

If I want to ping some address on the "outside":

ping6 ipv6.google.com
connect: Network is unreachable

Even, if I set the correct interface with "-I tun2". (Just to make sure its not trying to use some other interface)

Now my configs and settings:

IP of the client:

inet6 addr: fdee:dead:b0b::1000/64

IP of the server:

inet6 addr: fdee:dead:b0b::1/64

The servers config:

port 443
proto udp
proto udp6
dev tun
tun-ipv6
ca ca.crt
cert server.crt
key server.key
dh dh4096.pem
auth SHA512
server 10.0.0.0 255.255.255.0
server-ipv6 fdee:dead:b0b::/64
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.0.0.1"
client-to-client
keepalive 10 60
tls-auth ta.key 0
cipher AES-256-CBC
comp-lzo
max-clients 3
user nobody
group nogroup
persist-key
persist-tun
log-append  openvpn.log
verb 4
nice -19

Thats my kernel settings regarding the forwarding:

net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.venet0.forwarding = 1
net.ipv4.conf.venet0.mc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.all.mc_forwarding = 0
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.default.mc_forwarding = 0
net.ipv6.conf.lo.forwarding = 1
net.ipv6.conf.lo.mc_forwarding = 0
net.ipv6.conf.venet0.forwarding = 1
net.ipv6.conf.venet0.mc_forwarding = 0
net.ipv6.conf.tun0.forwarding = 1
net.ipv6.conf.tun0.mc_forwarding = 0

I would really appreciate if someone could lead me in the right direction.