Hannes's questions

I googled and tried for over 30 minutes, but I didn't find this usecase and thus didn't manage to get it working. Probably I used the wrong keywords.

Using ssh -i privkey user@jumphost.org works. ssh asks for password of privkey. After entering password for privkey, connection is established.

Using ssh -i privkey user2@targethost.org -J user@jumphost.org ssh prompts for password of user@jumphost.org. After entering password for user@jumphost.org password for privkey is asked and connection is established.

I'd like to enter the password for privkey when establishing the connection once and then using it for both servers. What am I doing wrong?

using -v option for ssh it looks like ssh is ignoring the -i option for jumphost.org

debug1: Offering public key: /home/user3/.ssh/id_rsa RSA SHA256:XXXXXXX
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/user3/.ssh/id_dsa
debug1: Trying private key: /home/user3/.ssh/id_ecdsa
debug1: Trying private key: /home/user3/.ssh/id_ed25519
debug1: Trying private key: /home/user3/.ssh/id_xmss
debug1: Next authentication method: password
user@jumphost.org's password:

Fail2ban is used to block users on certain patterns via reject command. Sometimes, especially when users are behind a NAT with a lot of users they get blocked unintendely. The user then writes an E-Mail and then I ask for his IP-Address to unblock (often E-Mail is forwarded to me, so I don't have the Mail header with his IP address).

To make this step easier, I'd like to redirect him to a special dynamic webpage that displays its IP-address and contact E-Mail. An example is here:

I'd like to have a similar webpage. An easy solution would be php, but that requires php to be installed and some webserver configuration. So simplest solution would be a small webserver that just serves a small text an IP address.

I've considered using python, because Python is already installed. I've found this article https://www.anycodings.com/1questions/2464569/how-do-i-get-the-client-ip-address-on-a-python-server but that prints the IP-Address only on stdout and serves files.

To use python as simple as with php it would require Flask or Django as far as I found out. However these are big frameworks and much oversized for this simple usecase. Also they probably can mean some security issue. This info page should also be secure by design so not creating any possible security issues compared to reject method. I know DOS is more likely because of more data transmitted than using reject, but size of this page is very small so this would be OK.

So what is an easy solution for this task? Python? If so could you hint some keywords I can search for to achieve this task? Are there other solutions? Maybe these fit even better than the python idea.

I've installed Debian Bullseye on a usb thumbdrive. When I plug the thumbdrive notebook bootet from it, because there was an entry in UEFI "debian". After removing it with sudo efibootmgr -b <boot entry number> -B thumbdrive didn't boot anymore after selecting it from UEFI bootmanager. It wasn't bootable anymore because UEFI used then default Windows Bootmanager boot entry.

After that I've used a Ubuntu Live system and issued

sudo mount /dev/sdXY /mnt
sudo mount /dev/sdXX /mnt/boot/efi
for i in /dev /dev/pts /proc /sys /run; do sudo mount -B $i /mnt$i; done
sudo chroot /mnt
grub-install --no-nvram --removable /dev/sdX
update-grub  

like described here https://askubuntu.com/a/831241 and adding options --no-nvram --removable, see https://www.systutorials.com/docs/linux/man/8-grub-install/ .

When selecting thumb drive now from EFI bootmanager it boots, but a message is displayed, "Boot option restauration", which can be canceled within about 6 seconds. After that system reboots and then grub is loaded and system boots. However now there is again debian in the UEFI system.

Using --no-nvram or not, makes no difference. To boot from this thumb drive there is an entry in the UEFI. How can this be prevented? When booting from Acronis Media or the Ubuntu Live media from usb thumbdrive it boots without modifying UEFI boot entry table of system. So this should be possible.

Update: You can press any key and then select to continue boot without resetting the system and to always continue boot. Then "Boot option restauration" windows isn't shown anymore, instead grub is shown immediate, but still OS is written to UEFI boot order.

I'm aware of this question https://stackoverflow.com/questions/41224738/how-to-calculate-system-memory-usage-from-proc-meminfo-like-htop Answer seems outdated regarding memory usage and this question seems more complex.

htop definitely now doesn't calculate total memory via MemTotal - MemFree anymore. There https://access.redhat.com/solutions/406773 I found a soluation that could fit. According to that it would be calculated via MemTotal - MemFree - Buffers - Cached - Slab but that leads to a too low memory usage compared to htop.

Memory usage in htop seems to be quite related as free -m shows in cell Mem: used

But if you create a ramdisk, things change a lot:

mkdir mnt
sudo mount -t tmpfs none mnt
cd mnt 
sudo dd if=/dev/urandom of=test bs=32M status=progress

Above will create a RAM disk 50 % size of installed memory and fill this ramdisk.

htop now shows a bit more than half of the physical RAM used, in test case 3.82 GB of 7.44 GB used. However free -m shows still only 104 MB used compared to 102 MB before creating and filling the RAM disk. So 104 MB used is definitely wrong, because half of the physical system memory can't be available anymore since it is used by RAM disk.

In /proc/meminfo size of RAM disk seems to be included in Cached, so for calculating used memory cached shouldn't be substracted.

So why does free -m report such a wrong free memory value? By default there are various tmpfs on distributions like Debian or Ubuntu which then means free -m gives wrong impression of free memory.

Memory calculation of htop seems quite reasonable. So how can the htop value be calculated from /proc/meminfo?

According to https://nlnetlabs.nl/documentation/unbound/unbound.conf/ multiple forwarders can be configured with forward-addr

For the forward zone this list of nameservers is used to forward the queries to. The servers listed as forward-host: and forward-addr: have to handle further recursion for the query.

However there is no statement how these servers are used. Is only the first server queried? Are all simultaniously queried and fastes answer will be sent? Or are they queried in a round robin style? Or another option?

I have a quite old software which doesn't support TLS 1.2. However SMTP Server only supports TLS 1.2.

Now I wanted to use stunnel to connect to SMTP server and and also listening for smtp access. I have already a valid certificate for this server. Before configuring different TLS versions I only wanted to test if this "stunnel proxy" works in general. I use Thunderbird to connect to :587 In [TLS_proxy_connector] and [TLS_proxy_listener] I have protocol = smtp. I've tried to comment them out in one or both sections. However I get an immediate error or some kind of timeout and Thunderbird can't sent the E-Mail.

Here is the stunnel config:

setuid = stunnel4
setgid = stunnel4

foreground = yes
;don't write pid
pid =


[TLS_proxy_connector]
client = yes
accept = 127.0.0.1:53681
protocol = smtp
connect = <mailserver>:587
verify = 2
CApath = /etc/ssl/certs/
checkHost = <mailserver>
;OCSPaia = yes

[TLS_proxy_listener]
accept = 587
protocol = smtp
key = /etc/ssl/private/key.pem
cert = /etc/ssl/certs/cert_.pem
CAfile = /etc/ssl/certs/chain_.pem
connect = 53681

What am I doing wrong? Is there another tool which fits better here? I know I could setup an own mailserver which accepts TLS 1.0 and 1.1 and uses as smarthost, but that would be too much, because then I have to care about security. Currently checks security because you're only allowed to send with valid credentials. Thanks for your help.

Update: It works with above configuration when both entrys have protocol = smtp. I'll add more info when further tests have been done regarding TLS versions.

Here https://security.stackexchange.com/a/52564 you can read that newer OpenSSH versions use bcrypt for protecting the keyfile. Security of bcrypt depends on the costfactor see https://security.stackexchange.com/questions/139721/estimate-the-time-to-crack-passwords-using-bcrypt/201965#201965

According to https://crypto.stackexchange.com/questions/58536/how-does-openssh-use-bcrypt-to-set-ivs/58543#58543 the default bcrypt round number would be 16. This would be a good security. But how to get the round count / cost factor?

What I've done so far: Key looks like (to make it shorter here only a weak 1024 bit key)

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABBLF8sO2Q
hcLXI43z96e1hiAAAAEAAAAAEAAACXAAAAB3NzaC1yc2EAAAADAQABAAAAgQC0gBWeZpej
9ILT/59bEb0/lSvXx0WfZqP2lXRDbuY+gluuWyT+REQcVTR2BxSx9F/P20mLTnupzY+XE3
xEu+SIJlwKIAH3fed62+QBzDrPsl9kyfoIGIvi/28ZftqVN/kg0GSOaAqu4Px+vNVX1VKn
PNV5VVCZWL4ZPlGQZ48UJwAAAhCwDkueKT9oq8E0qtD92/4DSAD2eTI7bd6jBGUxugEw85
6xWbRYnFQZdwO2ZCNV0aTHViD1FRKlC9cBHDoSORKcM/9dY9Msy6lZj7Tp5s8r7x2pOrJi
TVRbv5/cI732I+l/vYvssJEhZpeSw4JKh9tyPpifVmzBxqtqwkBrTuLCMqkwLmrcxReFUq
aA/RIZy3L616CJsAvx2ezEc49D6SbJ9i9OlKuv73a1baS4RpMvFzWGLE2NBvvtQpEnJFoL
Kyjz+two4doT6SZ7UtiVGyCtO5WQEoeAgjhkbZzOPtM2AvoV+hNLRIX2/52jOB5A1bNQ0v
qW64aj2YNe8vWfj5xtA/8BlyEG7gwhu+0HgbgMDxw7o/0qVkHM/Hv3YgBTRygsH+8h4wsR
kxA292NOKKaD18tv1j3atR80q0XQVcQH20uX8tSqXtKfDtkUc/EPbFCNp3xQJG/F81USKh
YAmjxEeDkZZ/LkEOEJKvFRCL3gFlH4rqF5/pRk6HmB99xceD4irbazm+BWfPAf5Q0zdB5L
/yei3sqA4G48yRXIkaELtYNEeTYHMp3PGz1b3CP3l+ZGZp6XNaM+sMfdICbI3Zae5bnxKg
VXEE2UMdi7DEXbqEzSlfcIf5QzXHMQJm0ZL+iLoaEmakamAxCKk6jJ+QzHzGADZEIRXrj3
5Nhhd0jsToEMsXmmawt2qxy0cIHET1M=
-----END OPENSSH PRIVATE KEY-----

PW is test

Then lets decode the base64. Therefore first and last line beginning with '-----' have to be removed

cat key | tail -n +2 | head -n -1 | base64 -d > text.txt

Now open text.txt e.g. in Notepad++ This shows

but now I have no idea how to read the roundcount from there. Can you assist?

Setup: SSD encrypted with luks aes-xts 512 bits (256 bits AES key), ext4 filesystem

dd write performance of 138 MB/s, CPU usage 97-100 %

dd if=/dev/zero of=testfile status=progress bs=32M count=128
4294967296 bytes (4,3 GB, 4,0 GiB) copied, 31 s, 138 MB/s
128+0 Datensätze ein
128+0 Datensätze aus
4294967296 bytes (4,3 GB, 4,0 GiB) copied, 31,0463 s, 138 MB/s

dd read performance 110 MB/s, CPU usage starts with > 90 %, then falls to about 50-60 % and then at the end of file reading goes up to > 90 % again.

#crop cache before
sudo sh -c "echo 1 > /proc/sys/vm/drop_caches"

Now do the test:

dd if=testfile of=/dev/null status=progress bs=32M
4261412864 bytes (4,3 GB, 4,0 GiB) copied, 39 s, 109 MB/s
128+0 Datensätze ein
128+0 Datensätze aus
4294967296 bytes (4,3 GB, 4,0 GiB) copied, 39,1345 s, 110 MB/s

Now lets take a closer look at samba:

Writing a 1 GB file to a samba share at disk benchmarked above gives about 73 MB/s, CPU usage is only about 70 %.

Reading a 1 GB file from samba share gives only about 64 MB/s, CPU usage is about 55 %. Also watch this graph: It starts slowly and then speed goes up and down, generating some kind of wave form.

Copying this file immediately again, when it is in cache, then it is copied with 112 MB/s, so full GigabitEthernet speed as it should.

Compare to unencrypted drive:

dd write speed 133 MB/s

dd read speed 207 MB/s

Samba write: 112 MB/s

Samba read: 112 MB/s

So LUKS encryption alone gives sufficient speed, Samba alone also has sufficient speed. In combination there is a huge performance drop while there are still plenty of CPU ressources available which are used when solely dd is used.

What is wrong here? Why isn't CPU fully used when doing operations for samba while it is with dd? What can be done to have also full performance / CPU usage with smb and luks encryption?

So what do we have: Windows Server 2019 as file server in a non-domain setup. Users should be able to change their password remotely from their client PCs without requiring the IT-support. What we've found but is no soultion for us:

• Login per RDP and change password: We don't want them to login via RDP on the Server.

• Pspasswd https://docs.microsoft.com/en-us/sysinternals/downloads/pspasswd As far as I understand this allows this only with admin credentials. Plus you have to set LocalAccountTokenFilterPolicy to 1 https://support.microsoft.com/en-us/help/947232/error-message-when-you-try-to-access-an-administrative-share-on-a-wind As far as I understand this weakens security, which is also not intended

• Then we've found "Remote Desktop Webaccess" https://www.youtube.com/watch?v=0GZAPGwD81I This enables a Website where users can change their password. However this is the totally overkill, since we don't want user access via RDP and in addition this requires additional licenses.

So are there other solutions that allows users to change their password on the FileServer?

Update: According to my collegues they've managed it in the past by enterging the name of the Server in the password change dialog on the client machine. This worked with Windows Server 2008 R2 but doesn't work with Server 2019. There after some seconds of waiting an "access denied" messaged is displayed.

So perhaps this needs just a setting on Server 2019.

just for getting some experience with mdadm I've put some HDD together and try a bit. I have 2 250 GB and one 500 GB HDD. I know thats not optimal for RAID5 and I'll only get 500 GB capacity in total. 250 GB of 500 GB HDD is wasted. But as I said, I'm just playing around a bit.

First lets see the disk sizes:

lsblk /dev/sdb /dev/sdc /dev/sdd
NAME MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sdb    8:16   0 232.9G  0 disk
sdc    8:32   0 465.8G  0 disk
sdd    8:48   0 232.9G  0 disk

Create the RAID5:

sudo mdadm --create --verbose /dev/md0 --level=5 --raid-devices=3 /dev/sdb /dev/sdc /dev/sdd -c 4 --auto md

Show info for created Raid5:

cat /proc/mdstat                                     Personalities : [raid6] [raid5] [raid4]
md0 : active raid5 sdd[3] sdc[1] sdb[0]
      488132976 blocks super 1.2 level 5, 4k chunk, algorithm 2 [3/2] [UU_]
      [>....................]  recovery =  0.5% (1354384/244066488) finish=59.7min speed=67719K/sec
      bitmap: 0/2 pages [0KB], 65536KB chunk

unused devices: <none>

Show a bit more details:

 sudo mdadm --detail /dev/md0
/dev/md0:
           Version : 1.2
     Creation Time : Wed Feb 26 14:52:54 2020
        Raid Level : raid5
        Array Size : 488132976 (465.52 GiB 499.85 GB)
     Used Dev Size : 244066488 (232.76 GiB 249.92 GB)
      Raid Devices : 3
     Total Devices : 3
       Persistence : Superblock is persistent

     Intent Bitmap : Internal

       Update Time : Wed Feb 26 14:57:43 2020
             State : clean, degraded, recovering
    Active Devices : 2
   Working Devices : 3
    Failed Devices : 0
     Spare Devices : 1

            Layout : left-symmetric
        Chunk Size : 4K

Consistency Policy : bitmap

    Rebuild Status : 7% complete

              Name : raspberrypi:0  (local to host raspberrypi)
              UUID : 3291b54e:fad8f43b:cc398574:a1845ff9
            Events : 57

    Number   Major   Minor   RaidDevice State
       0       8       16        0      active sync   /dev/sdb
       1       8       32        1      active sync   /dev/sdc
       3       8       48        2      spare rebuilding   /dev/sdd

Dmesg shows

[ 2462.122882] md/raid:md0: device sdc operational as raid disk 1
[ 2462.122892] md/raid:md0: device sdb operational as raid disk 0
[ 2462.126278] md/raid:md0: raid level 5 active with 2 out of 3 devices, algorithm 2
[ 2462.142439] md0: detected capacity change from 0 to 499848167424
[ 2462.222689] md: recovery of RAID array md0

So what am I doing wrong with the creation of RAID5? I'm also confused in output of mdadm --detail /dev/md0 with disknumber 0, 1 and 3 and not 0, 1, 2

I try to write a little script that overwrites from adress of nullmailer. Nullmailer has an option "allmailfrom" you can put a mail adress into /etc/nullmailer/allmailfrom and all mails sent have this address as "Return-Path", but From is still the value from so sending programm like pi@raspberrypi

So I've tried to create a little script to rewrite the from adress. Basically you move sendmail to sendmail-bin and name the created script sendmail. It works with the command "mail", adress is rewritten as it should. However with cron it doesn't work. STDIN is empty and so the output of cron isn't received via E-Mail. Syslogs writes

 /usr/sbin/sendmail: line 11: /dev/stdin: permission denied

Here the script.

#!/bin/bash
#########################################
#Beginn change here
export NULLMAILER_USER=user
export NULLMAILER_HOST=somedomain.com
#Ende change here
#############################################

export NULLMAILER_FLAGS=ft

stdin=$(</dev/stdin)

optPosition=0 #defaultvalue when not found

while getopts ":f:" from; do
    case $from in
        f) optPosition=$OPTIND
           break
           ;;
    esac
done


arguments=($@)

if (($optPosition != 0)); then #-f Option was used
 arguments[(($optPosition-2))]=$NULLMAILER_USER@$NULLMAILER_HOST
 set -- "${arguments[@]}"
fi



echo "$stdin" | /usr/sbin/sendmail-bin "$@"   

The NULLMAILER_USER with NULLMAILER_HOST and NULLMAILER_FLAGS=f tell nullmailer to use this as the from adress. That part works, see http://manpages.ubuntu.com/manpages/trusty/man1/nullmailer-inject.1.html

In crontab is just

*/1 * * * * echo test 

When orignal sendmail of nullmailer is present, then "test" is in the body of the mail, as it should. So why can't read this bash script from stdin?