Jed Daniels's questions

I know that hosts.allow and host.deny only affect things that are tcpwrappered, but what does this mean in practice? It seems that most people use hosts.allow to handle ssh and nfs blocking, but what other services are typically handled there? And what services AREN'T typically handled there?

Edit: ok, I realize I did a terrible job of explaining what I was after. No, I'm not interested in knowing if a particular service can be handled by hosts.allow, I want to know if a service will be handled. For example, if I do an lsof -i, I get a nice list of things that are listening for connections to my box. I want to know which ones will be affected if I go stick an entry into hosts.allow (well, I really want to know which ones won't be affected).

I'm looking for a list of CIDR blocks for "The Internet", i.e. everything from 0.0.0.0 to 223.255.255.255, excluding RFC1918 address space of 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 (yes, I know there are lots of little nets in there that are special, like 192.0.0.0/24, but I really don't care about them). I figure this list must exist somewhere on the Internet, but my google-fu is failing me, so I figured I'd ask here before generating the range myself.

Edit: I forgot a really important part of this question: I need it in the fewest possible number of entries.

And if you want to know what I'm doing with this, we are entering static flow-mods to work around some nasty issues in an OpenFlow controlled network that currently has a significant amount of badness happening, and we need to reduce the number of flow entries temporarily so we don't exceed the available space in the flow tables and cause everything to come crashing down for a few minutes while it reestablishes a connection to the controller.

Or, more generally, is it required to specify the broadcast address that a client should use when a DHCP server is assigning an address?

Is there are a way to connect to dom0 using VNC without running X? I don't want an X server, I just want to see what is on the console.

EDIT: Adding some background, since people seem to be really annoyed that I would ask such a question and that ssh isn't an acceptable solution in this case for getting to dom0:

The reason I want to VNC to the console is NOT for the purpose of managing this system (actually 600 laptops running Debian Squeeze with Xen and multiple VMs for 4 days at a conference in August). SSH works great for that, and I wouldn't dream of using anything else for management. But, there are two major things that I want to be able to do:

1) See EXACTLY what is on the actual /dev/console while talking to someone who is sitting in front of the machine. A small team of people are responsible for preparing these systems for the conference, and we aren't all geographically located in the same place. In this case, these systems are 3000 miles from me, 5000 miles from another member of the team, and ~100 miles from a third. Being able to see what is on the screen is of tremendous importance when working with "remote hands" who are sitting in front of a system trying to figure out why some particular task isn't working properly.

2) See any error messages that were sent to /dev/console and no-where else (which happens WAY more often than I would have guessed prior to starting this project). I've determined there are two primary reasons that this occurs: 1) sometimes lazy developers log errors or debug output to /dev/console by way of a redirect, without bothering to use the system's logger or other functionality that causes the error to get recorded in a file; and 2) when your IO subsystem has collapsed because of something bad happening, but network and cpu are still fine, error messages won't get recorded in a log file immediately prior to the system crashing and burning. At least if I had been working in /dev/console, I'd be able to see the error message instead of having to call someone and ask them to take a picture of the screen for the 20 or 30 seconds that it is on the console before the system reboots.

It would also be pretty freaking cool to bring up little tiny windows on all 600 machines on a giant display (well, lots of displays), during the conference, and see what is happening on each one.

Is there a way to enable multiple vnc clients to connect to the same DomU using the Xen 4.0 built-in vnc server?

VNC to my DomU VMs works great. The only problem is that I can only have one vnc client at a time connected, and if someone leaves a session logged in, or if I am disconnected suddenly, I have to wait for it to time out before I can connect again. Is it possible to reset a vnc connection from the command line in Dom0 so I can reconnect immediately? Note that I'm using the built-in vnc in Xen 4.0, not vncserver running in dom0.

Is there a list of NIC models that I should use with various HVM guests in Xen 4.0? Is there even a list of possible choices for the model=field? I'm planning on running both Windows and FreeBSD guests on the particular Xen box that I'm configuring now, and ideally I'd like a setting that can work on both of them and get me gigabit speeds without a lot of extra hassle loading special drivers (similar to VMware's e1000 NIC option). Any suggestions?

The vif line I'm currently using in my config is:

vif = [ 'type=ioemu,bridge=eth0,model=ne2k_pci,script=vif-ovs' ]

This works in my Windows XP SP3 VM, but is only recognized as a 10Mbit interface. Changing to model=e1000 or model=i82557b resulted in Windows not being able to find a driver for the NIC.

Is it possible to set a domain id for a vm in xen at all? I'd imagine that changing it while it is running would be problematic, but if I can even set it in the config file or when xm create foo is run that would be helpful.

To summarize the rambling below: How do I connect (using Remote Desktop Connection) from Windows XP SP3 to Windows Server 2008 R2 (or Windows 7) without clicking the checkbox on the server that says Allow connections from computers running any version of Remote Desktop (less secure)?

So, I've discovered that newer versions of Windows have "more secure" versions of remote desktop on them, that requires network level authentication to work securely. Unfortunately, Windows XP RDC doesn't support NLA, and the the intertubes have surprisingly little to say about actually making it work without clicking the checkbox that says Allow connections from computers running any version of Remote Desktop (less secure). Now I don't really consider "use the less secure version" to be an acceptable answer ("What's that, can't make ssh work? Yea, I solved that by just using telnet instead."). Upgrading to Windows 7 is not an acceptable answer either, cause while I agree that Windows 7 is "pretty darn cool", it isn't all that practical to tell other people in my organization "just go upgrade" when they want to connect securely via RDC to a particular system.

Even Server Fault seems to come up with very little to say on the topic, which really surprised me (the closest I could find was this question, which was almost there, but not really). It amazes me how many admins are perfectly willing to click the "less secure means it will work" button, so I went on a hard target search of every hen house, dog house, and out house on the intarwebs to find the answer. After days of searching I came up blank (ok, maybe it was more like 20 minutes, but it felt like days). So I started drafting this question on SF, got distracted, and never posted it.

Today I came to finish the question, applied a little more google-fu before doing so, and stumbled upon the answer, which I'm recording here for posterity (although I'll wait like 20 minutes before posting the answer in case one of you out there already knows it, so you can have the credit and gain the rep for a correct answer).

Is it possible to run a "startup" script when booting into single user mode? I need to be able to boot into single user mode, run my script, then reboot into multiuser mode without any human interaction.

I've done a bunch of research and can't find anything that is clear on the topic, although of course I could replace something else that does run with a wrapper that also launches my script, but I'd prefer to do it in some official way. Ideally, the solution will work in FreeBSD 6 and up, but I'm willing to accept only new versions if it just doesn't exist in the older revs.

EDIT: In response to comments, I'm actually looking to do two things, both of which are probably possible without single user mode, but it is much easier to control all the variables in single user mode if that is at all a possibility:

1. Grow the filesystem in a vmware installation (I've successfully used these instructions manually).

2. Zero the free space in all file systems (in this case it is to prepare the VM for export). Again, I don't really need single user mode for this, but it would make things easier.

Of course, these aren't really VM issues, but stuff that I'd like to be able to do in general. The fact that these systems happen to be in VMware is not particularly relevant, and I didn't want to throw people off by confusing them with the fact (some people seem to go a little nutty when virtualization is mentioned, but in most cases it doesn't make a difference).

EDIT2: Regardless of my current reasons, if anyone has any suggestions on how to do this (even hacks if there are no official ways), please post them as an answer.

I'm looking for some multicast file transfer software. Do you have any suggestions? Must be "quickly implementable", i.e. no Tivoli or other stuff that requires a massive infrastructure. Must run on Linux. Note that I'm not looking for cloning software, I'm looking to move a bunch of large files around to a bunch of systems on the same LAN.