Chris Lercher's questions

This question is similar to the question here, about changing the sshd port on Mac OSX, but instead of changing the port number, I want to change the listen address of my Mac's ssh server. Setting it in /etc/sshd_config doesn't work (just like it doesn't work for port numbers).

According to the man page on SSHD_CONFIG(5):

On Mac OS X, sshd is started on demand by launchd(8). The specification of the address on which sshd will listen is given in the launchd.plist(5) file /System/Library/LaunchDaemons/ssh.plist. The values of ListenAddress and Port are only used when sshd is run from the command line. Use launchctl(1) to unload and load the plist file. The port number on which sshd listens can be set by changing the value of the SockServiceName key in the plist file.

This answer shows how to set SockServiceName to change the port number, but I'm unclear on how to change the listen address.

Deos anyone know how?

I'd like to migrate my old pure iptables firewall configuration to a shorewall setup. I get the basics, but I haven't been able to replicate my existing knockd setup:

• I have a 'tmpknock' chain that opens some ports, e.g. port 22, for 30 seconds (multiple IPs allowed at the same time in the tmpknock chain, if multiple people try to log in simultaneously!).
• I have a 'permknock' chain that opens some ports (e.g. 80) forever, but only to one IP at a time (which gets replaced, when the next one tries to knock from a different IP - this allows me to test some services which are not currently open to the public)

The setup in /etc/knockd.conf is simple:

[tmpAndPermKnock]
    sequence      = 10000,11000,12000
    seq_timeout   = 9
    tcpflags      = syn
    start_command = /sbin/iptables -I tmpknock -s %IP% -j ACCEPT; 
                    /sbin/iptables -F permknock;
                    /sbin/iptables -I permknock -s %IP% -j ACCEPT
    cmd_timeout   = 30
    stop_command  = /sbin/iptables -D tmpknock -s %IP% -j ACCEPT

Now I can easily link from my existing chains to these chains, e.g.:

iptables -A open-in -p tcp --dport 22 -j tmpknock
iptables -A open-in -p tcp --dport 80 -j permknock

How can I integrate this with a simple shorewall setup? I'm really just starting out with shorewall, and don't know how to perform the jump to my chains. I imagine, it would be something like this:

/etc/shorewall/rules (does not work):

#ACTION         SOURCE        DEST      PROTO      DEST
JUMP(tmpknock)  net           fw        tcp        22
JUMP(permknock) net           fw        tcp        80

... but there's no JUMP action in http://shorewall.net/manpages/shorewall-rules.html ...

I have set up a Postfix server with SMTP AUTH (STARTTLS on port 587). All my users are in the domain "example.org". I want to enforce the sender address to be "[email protected]".

I learned that this can be achieved with the main.cf options

smtpd_sender_restrictions = reject_sender_login_mismatch, ...
smtpd_sender_login_maps = hash:/etc/postfix/smtpd_sender_login_maps

with a login_maps file like:

[email protected] a
[email protected] b
[email protected] c
...

(see also Block sender address spoofing with SMPT AUTH), but this would mean I'll have to edit the login_maps file every time I have a new user. I don't need such a flexible mapping: It should always be "[email protected]". Is there an easier option?

I want to set up an "internal only" mail server on a Linux machine. We need it for our integration test environment:

• Our integration test server will send mail (via SMTP) to "[email protected]"
• The mail server must reject mail for all other recipient domains.
• Our testers will fetch the mail via POP/IMAP over SSL. They don't have a unix account on the mail server. Each tester needs about 100 email aliases for their account.

There are lots of tutorials out there, but they usually set up a full Postfix server + a separate MDA (like Courier)? Aren't there easier options, as the server will never have to transfer mail to other mail servers?

(BTW, the server machine already runs a PostgreSQL instance - I could use this to store mails, if this is the easiest option to allow virtual accounts?)

I'd like to put stunnel in front of haproxy 1.4 to handle HTTPS traffic. I also need stunnel to add the X-Forwarded-For header. This can be achieved by the "stunnel-4.xx-xforwarded-for.diff" patches from the haproxy website.

However, the description mentions:

Note that this patch does not work with keep-alive, ...

My question is: What will this mean in practice for me? I'm unsure,

1. if this is about the keep-alive between
   • client and stunnel
   • stunnel and haproxy
   • or haproxy and backend server?
2. what this means for performance: If I have 100 icons on a web page, will the browser have to negotiate 100 full SSL connections, or can it re-use the SSL connection, just creating new TCP connections?

According to Wikipedia, 'S' is supposed to be a standard runlevel: "Single-User Mode". But if I'm not mistaken, the Single-User mode on Debian is Runlevel 1. One Debian article I found claims, that 'S' is a runlevel "that the system uses on it's way to another runlevel". Interesting...

Actually, I had always pretty much ignored this runlevel so far, but today I played around with Firestarter (yes, really, an end-user firewall) just because I was curious, which firewall rules it would generate. But then I noticed, that it creates a startup hook in /etc/rcS.d, and I wondered, if my firewall script should maybe have that, too?

Update

Now I'm even more interested in knowing what it actually is on Debian/Ubuntu, because the Shorewall package (which is a strongly "Debianized" package) also creates its (only!) startup hook in rcS.d!

On my intranet server, I have a 100.00 GiB partition /dev/sda5, which I use as a physical volume for lvm2.

• It's the only physical volume in my volume group vg01.
• vg01 currently contains one logical volume lv01, using the full 100.00 GiB - well, actually 99.99 GiB due to some rounding (that's where the problem starts).
• lv01 contains an ext3 file system, using the entire space.

I want to reduce lv01 to approximately 97 GiB, so I can create lv02 with approx. 3 GiB (I need it to take lvm snapshots).

What I did so far:

e2fsck -f /dev/mapper/vg01-lv01
resize2fs /dev/mapper/vg01-lv01 97G

This has worked well. But now I'll have to run

lvreduce --size ? /dev/mapper/vg01-lv01

And I'm not sure, which exact value I'll have to specify. The lvreduce man page warns explicitly, that the resulting size must not be smaller than the file system. I also don't want to make it larger than it has to be. But now I have different numbers:

• I specified 97G in resize2fs.
• df -h says, it's 96 G.
• df says, it's 100115936 1K-blocks.
• lvdisplay (of course) still reports 99.99 GiB for the logical volume.

What will I have to specify for lvreduce?

Edit:

The currently accepted answer provides a nice workaround. However, in order to integrate such things in solid scripts etc., I would generally prefer to use precise measurements instead. Or maybe there's already a reliable (!) script or tool which performs the entire resize procedure in one step?

Is it possible to create differential backups based on LVM snapshots (or maybe a similar technique)?

I'd like to perform backups of my intranet server, which hosts multiple services, and their databases (currently using Postgres 8, Postgres 9 and MySQL). So I thought about setting up log shipping based backups (in addition to backing up the file system), but the whole thing is getting a little bit complex.

As an alternative, I'm considering LVM snapshots - but the databases are not small, and I'll need to save backup space...

It's also important, that LVM snapshots are highly safe to use while a database is constantly writing files.

I've seen this with so many consoles (on Linux, Mac, ...), and with lots of different machines in many different networks. I can never pinpoint the exact reason, why this happens: All you have to do is log in to a machine via SSH. If the connection breaks for some reason (for simplicity, let's say the network cable was pulled), then sometimes the console just hangs forever - at other times, it just exits fine to the parent shell.

It's so annoying when this happens (e.g. you lose the command history.) Is there maybe a secret keyboard shortcut which can force an exit (Ctrl-C or Ctrl-D don't work)? And what's the reason for this random "bug" across all the implementations anyway?

Some time in the future, I may need to build a dedicated SSL farm (as described in Making applications scalable with Load Balancing) or something similar to handle lots of SSL traffic. While it's not an immediate issue for me, I'd like to plan a little bit ahead. So my question is:

Is it more cost effective to use dedicated hardware for this, or can I reuse application servers, maybe with a hardware add-on card? Or is it better to have this integrated in load balancers (contrary to what the above-mentioned article stated in 2006)?

A few links to specific hardware would be nice, too - I currently don't really know where to start looking.

I have a web app that is going to run on multiple servers. I'd like to make sure, that requests using the same session (HTTP cookie header with value JSESSIONID=x) always communicate with the same server. That is, until the session "moves" to a different server in certain circumstances (not only when the server fails, but also due to some server side caching and performance strategies).

My web app works well with that scenario, but what kind of load balancer should I use? Obviously, I could load balance on application level, but I'm looking for something more efficient. Maybe specialized hardware (maybe not)? I can't spend a lot of money...

Update

Thanks for your answers so far: I found out now, that Pound and HAProxy can be configured to look for certain cookies. I couldn't find out yet, if they also allow to update the mapping dynamically (when the session "moves" to a different app server)?

And are there (inexpensive) hardware solutions, which can do that, too? (Would that cost less than an extra load balancing server?)

Note: This question is still unresolved - the answer was auto-accepted.

I have a Debian Lenny VPS, that's running virtualized by Parallels/Virtuozzo. Currently, the network interface doesn't have an IPv6 address - and that's good, because I don't have an ip6tables configuration.

But I assume, that I could wake up one day, and ifconfig will show me an ipv6 address for the interface - because I have no control over the kernel or its modules - they're under the control of the hosting company. That would leave the server completely vulnerable to attacks from IPv6 addresses.

What would be the best way to disable IPv6 (for the interface or maybe for the entire host)? Usually I would simply disable the kernel module, but that's not possible in this case.

Update

Maybe I should add, that I can use iptables and everything normally (I'm root on the VPS), but I can't make changes to the kernel or load kernel modules because of the way Virtuozzo works (shared kernel).

lsmod always returns nothing.

I can't call ip6tables -L (it says that I need to insmod, or that the kernel would have to be upgraded).

I don't think, that changes to /etc/modprobe.d/aliases would have any effect, or do they?

Networking Config?

I thought, that maybe I can turn IPv6 off from /etc/network/... Is that possible?

This is a follow-up to my Encrypting absolutely everything... question.

Important: This is not about the more usual IPSec setup, where you want to encrypt traffic between two LANs.

My basic goal is to encrypt all traffic within a small company's LAN. One solution could be IPSec. I have just started to learn about IPSec, and before I decide on using it and dive in more deeply, I'd like to get an overview of how this could look like.

• Is there good cross-platform support? It must work on Linux, MacOS X and Windows clients, Linux servers, and it shouldn't require expensive network hardware.

• Can I enable IPSec for an entire machine (so there can be no other traffic incoming/outgoing), or for a network interface, or is it determined by firewall settings for individual ports/...?

• Can I easily ban non-IPSec IP packets? And also "Mallory's evil" IPSec traffic that is signed by some key, but not ours? My ideal conception is to make it impossible to have any such IP traffic on the LAN.

• For LAN-internal traffic: I would choose "ESP with authentication (no AH)", AES-256, in "Transport mode". Is this a reasonable decision?

• For LAN-Internet traffic: How would it work with the internet gateway? Would I use

  • "Tunnel mode" to create an IPSec tunnel from each machine to the gateway? Or could I also use
  • "Transport mode" to the gateway? The reason I ask is, that the gateway would have to be able to decrypt packages coming from the LAN, so it will need the keys to do that. Is that possible, if the destination address isn't the gateway's address? Or would I have to use a proxy in this case?

• Is there anything else I should consider?

I really just need a quick overview of these things, not very detailed instructions.

Has anybody tried that approach already? I'm really considering it: Instead of relying on network based IDS etc., every packet must use encryption which was initiated by a certificate issued by my own CA.

• Every client gets a unique client certificate
• Every server gets a unique server certificate
• Every service additionally requires to login.

Both SSL and SSH would be ok. Access to the internet would be done via an SSL tunnel to the gateway.

Is it feasible? Does it create practical problems? How could it be done and enforced? What do you think?

More details

My goal is to simplify the LAN's security concept - I'm not yet sure, if that's a crazy idea! But I feel, that securing a HTTPS or SSH server from internet threats (if using mutual authentication) is sometimes easier than monitoring everything that can happen in the wild world of a LAN.

On a non-encrypted LAN, I feel it's really hard to be a good step ahead of a potential attacker, because of threats like:

• Low level attacks like ARP spoofing, Port stealing, ...
• WLAN access (e.g. every developer will be allowed to access the SVN server from the (W)LAN - I don't think it will be through a VPN...)

=> For simplicity, isn't it easier to make the assumption, that there is always an attacker in the LAN?

=> Could I end up simplifying a (small company's) LAN security concept by treating it like a WAN? Or would I rather complicate it?

IPSec and alternatives

IPSec sounds very promising, but I'd be interested in alternatives to IPSec, too - Using SSL/SSH individually per service and creating an Stunnel to the Gateway? Using Kerberos maybe? ... What are the advantages of IPSec or the others?

If you can help me with getting a better grasp on IPSec, please see my follow-up question specifically on IPSec.

I'd like to parse logfiles. Is the logfile format of syslogd the same for all systems? On my system (Debian Lenny), it's:

Mar  7 04:22:40 my-host-name ...

(I'm not much interested in the ... part)

Can I rely on this? And is there maybe some more-or-less official description? The manpage of syslogd describes the config format, but not the logfile format.

Ideally, the description would give the fields official names like (date, time, host, entry) or (datetime, hostname, message). Maybe additionally some regular expressions. I'd like to use the names and regexes in my script, to avoid an unnecessary deviation from the standard, and to make sure, that the script runs everywhere.

Thanks

Chris

I'd like to run Glassfish v3 as a non-privileged user on Linux (Debian), but make it available on port 80. I'm currently doing this with iptables:

iptables -t nat -I PREROUTING -p tcp -d x.x.x.x --dport 80 -j REDIRECT --to-port 8080

This works, but I wonder:

1. If this has any significant performance impact compared to binding directly to port 80
2. If I could make a similar setup also work for HTTPS (or if that must run on 443)
3. If there's a way to avoid other users from binding to port 8080 (in case my server crashes) - maybe block that port permanently to other users somehow?

...or if I should use authbind/privbind instead? Problem: I couldn't make it work with authbind or privbind so far.

For authbind, I edited asadmin's last line to:

exec authbind --deep "$JAVA" -Djava.net.preferIPv4Stack=true -jar ...

For privbind:

exec privbind -u glassfish "$JAVA" -Djava.net.preferIPv4Stack=true -jar ...

(Only) with these settings, I can successfully perform a create-domain --domainport 80. This proves, that authbind and privbind actually work (the authbind version of the script is called by the glassfish user; the privbind version is called by root of course). However, in both cases I get the following exception, when starting the domain (start-domain):

[#|2010-03-20T13:25:21.925+0100|SEVERE|glassfishv3.0|javax.enterprise.system.core.com.sun.enterprise.v3.server|_ThreadID=11;_ThreadName=FelixStartLevel;|Shutting down v3 due to startup exception : Permission denied: 80=com.sun.enterprise.v3.services.impl.monitor.MonitorableSelectorHandler@1fc25e5|#]

I haven't found a solution for that yet (after searching the web, it seems, that this isn't so easy?) But maybe, the solution with iptables is good enough - what do you think?

Thanks,

Chris

Note:

Putting an Apache in front isn't a good solution in my case - I plan on using Comet, and Comet works better without proxies.

let's look at these two iptables rules which are often used to allow outgoing DNS:

iptables -A OUTPUT -p udp --sport 1024:65535 --dport 53 
   -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A INPUT -p udp --sport 53 --dport 1024:65535
   -m state --state ESTABLISHED -j ACCEPT

My question is: How exactly should I understand the ESTABLISHED state in UDP? UDP is stateless.

Here is my intuition - I'd like to know, if or where this is incorrect:

The man page tells me this:

state

This module, when combined with connection tracking, allows access to the
connection tracking state for this packet.

  --state ...

So, iptables basically remembers the port number that was used for the outgoing packet (what else could it remember for a UDP packet?), and then allows the first incoming packet that is sent back within a short timeframe? An attacker would have to guess the port number (would that really be too hard?)

About avoiding conflicts:

The kernel keeps track of which ports are blocked (either by other services, or by previous outgoing UDP packets), so that these ports will not be used for new outgoing DNS packets within the timeframe? (What would happen, if I accidentally tried to start a service on that port within the timeframe - would that attempt be denied/blocked?)

Please find all errors in the above text :-) Thanks,

Chris

I'm considering to rent a virtual server (for me personally). The product I'm currently looking at offers IMO fair pricing, very good hardware etc. The only problem is, that I won't be able to do an upgrade to a newer kernel than 2.6.9 (running Debian Etch). Also, I can't install my own kernel modules. (The server runs with Virtuozzo, so as far as I understand it, it just does some chroot instead of a real virtualization (?))

I want to run GlassFish, Postgres, Subversion, Trac and maybe some other things on it. It will also have to employ a firewall, and provide OpenSSL for https. Ideally, it would also be able to do AIO (asynchronous IO), which could speed up some server I/O.

Should I expect problems with that old kernel version, in conjunction with the software I want to install (I'd like to use current versions of the software)? One thing I already found out, is that you can't do everything with iptables, since some kernel modules are missing/things are not build into the kernel. GlassFish v3 appears to run fine at first glance.

I was able to test the server for a few hours. Installing my whole setup wasn't feasible in that time, but what I can say is, that it's amazingly fast for an entry-level vserver, especially hard disk and network performance (averaging at ca. 400MBit/s). So if the kernel won't be a problem, I'd really like to take it.

Thanks, Chris

PS Exact kernel version: 2.6.9-023stab051.3-smp

Edit:

Can I expect, that important security patches are backported to that kernel version?

I'm looking for an easy way to follow a packet through the iptables rules. This is not so much about logging, because I don't want to log all traffic (and I only want to have LOG targets for very few rules).

Something like Wireshark for Iptables. Or maybe even something similar to a debugger for a programming language.

Thanks Chris

Note: It doesn't have to be a fancy GUI tool. But it must do more than just showing a package counter or so.

Update: It almost looks as if we can't find anything that provides the functionality that is asked for. In that case: Let's at least find a good technique that's based on iptables logging - which can be easily turned on and off, and doesn't require to write iptables rules redundantly (having to write the same rule for -j LOG and -j ...)

I personally like the default sudo behavior of Ubuntu: - Root login impossible - "admin" group granted "ALL=(ALL) ALL" - users in the "admin" group are asked for their user password (not a root password) when using sudo.

[I like it, because this way, there's no root password to be shared among several people. There may be good reasons for other opinions, too - but that shouldn't be the topic of this question.]

Now I'm trying to re-create this behavior in Debian Etch. It basically works, but there's one important difference: Debian doesn't ask for a password. It should ask for the user's password.

I edited the sudoers file to be exactly the same as in Ubuntu, and I added a user to the newly created "admin" group. What else do I have to do to get the Ubuntu behavior in Debian (and other Linuxes)?

Thanks Chris