polemon's questions

I've been using Icecast and SHOUTcast for several years now, to deliver audio and Video content.

I wonder what kind of alternatives do I have to those two, especially when streaming video. On the client side, what software can I choose from to stream to those servers live?

Making the streams available with Flash would be great, but that's maybe another story. We're still using EdCast, which is kinda dead by now, Shoutcast DSP plugin is not an option, as this tends to crash, etc. Are there any alternatives to that, when livestreaming video?

I'm using Liquidsoap for content generation, mixing, etc. It should work with Icecast, Liquidsoap and if possible SHOUTcast.

Now that MySQL is owned by Oracle, the future of the RDBMS seems uncertain. The fork by the main developer of MySQL, Monty Widenius, called MariaDB, is a drop-in replacement for MySQL. Version numbers match up of those two DB-Servers, and MariaDB will be binary compatible to MySQL at least for some versions to come. (But the way they explained that on their website, it seems those projects might diverge from one another at some point, making them incompatible).

I've build and installed MariaDB 5.2, and it looks and behaves just as MySQL. Even the binaries are called mysqld and mysql.

I heard, that it's very likely Oracle will stop releasing MySQL as a free or open-source data base system. The next logical step would be to switch to another RDBMS in time. Given that MariaDB is a fork of MySQL, it seems more than logical to use that one.

But is it smart to make the switch already? And should it really be MariaDB?

What makes me ask this question, is the project MariaDB itself. I don't want to jump to conclusions here, but is seems it's not getting much momentum. (I don't want to jump on a dying horse, if you know what I mean...)

I'm running a server "myserver.net", which has the subdomains "a.myserver.net" and "b.myserver.net".

When creating (self-signed) SSL certificates, I have to create one for every subdomain, containing the FQDN, even though those subdomains are just vhosts.

OpenSSL permits only one "common name", which is the domain in question. Is there any possibility to create a certificate that is valid for all subdomains of a domain?

I'd like to set up an OpenVPN server on my OpenBSD router.

I'd like to run it in bridged mode, so the IPs given to the road warriors are from the local network subnet. I'd like to use the DNS server of OpenVPN for those clients.

I found some tutorials on how to do this, but most seem to be out of date, to the point that it's virtually impractical to use anything from it.

Do I have to compile it from ports, isn't installing with pkg_add sufficient?

Could someone please point me to a how-to that is somewhat up-to-date?

I use NGINX on my server as WWW server.

Now, I've seen Cherokee being used on some pages, such as university websites.

Is it advisable to use it, when I have dynamic content (some of it in PHP, some of it in Perl, some other in Lua, and some in Python)?

How does Cherokee tackle the C10K problem?

My server is rather slow and low on specs (Intel Atom, etc) so please don't advice Apache; also, I've used Lighttpd, and didn't like it. NGINX was the best I used so far, but maybe Cherokee is a better alternative?

I use Zeroshell, and there, the DNS service of it.

Now, we have servers, that need to be accessible from internal servers. Problem is, some subdomains exist in the outside world, so it needs to query another server for those subdomains. How do I make Zeroshell query another server for subdomains that are not known to itself?

Zeroshell uses bind9, so configurations apply.

I have two networks in a LAN: 10.9.0.0/16 and 192.168.191.0/24. They use the same Linux router, what do I need to add with route so that all computers see each other in the network?

I'm using IPCop as router software.

after changing IPs on of the ESXi hypervisor (without setting to maintenance mode), I can't access the vCenter Server with vSphere anymore.

But I can access the ESXi over SSH. So, the IP is correct, but why can't I access it with the client?

I'd like to do Site-to-Site bridging with an IPsec VPN. How do I do that?

On the local side, I have a DrayTec Vigor2910, it is supposed to be able to manage IPsec tunnels. I need to have several VPN tunnels to various sites, but how exactly do I do that if the only router I can configure is the local one? As I understand it I'd need some sort of VPN server or client on the other side but I'm not sure.

I'm planning on upgrading my OpenBSD to 4.7 (from 4.6) and as you may or may not know, they changed the syntax for pf.conf.

This is the relevant portion from the upgrade guide:

pf(4) NAT syntax change

As described in more detail in this mailing list post, PF's separate nat/rdr/binat (translation) rules have been replaced with actions on regular match/filter rules. Simple rulesets may be converted like this:

nat on $ext_if from 10/8 -> ($ext_if)
rdr on $ext_if to ($ext_if) -> 1.2.3.4

becomes

match out on $ext_if from 10/8 nat-to ($ext_if)
match in on $ext_if to ($ext_if) rdr-to 1.2.3.4

and...

binat on $ext_if from $web_serv_int to any -> $web_serv_ext

becomes

match on $ext_if from $web_serv_int to any binat-to $web_serv_ext

nat-anchor and/or rdr-anchor lines, e.g. for relayd(8), ftp-proxy(8) and tftp-proxy(8), are no longer used and should be removed from pf.conf(5), leaving only the anchor lines. Translation rules relating to these and spamd(8) will need to be adjusted as appropriate.

N.B.: Previously, translation rules had "stop at first match" behaviour, with binat being evaluated first, followed by nat/rdr depending on direction of the packet. Now the filter rules are subject to the usual "last match" behaviour, so care must be taken with rule ordering when converting.

pf(4) route-to/reply-to syntax change

The route-to, reply-to, dup-to and fastroute options in pf.conf move to filteropts;

pass in on $ext_if route-to (em1 192.168.1.1) from 10.1.1.1
pass in on $ext_if reply-to (em1 192.168.1.1) to 10.1.1.1

becomes

pass in on $ext_if from 10.1.1.1 route-to (em1 192.168.1.1)
pass in on $ext_if to 10.1.1.1 reply-to (em1 192.168.1.1)

Now, this is my current pf.conf:

#       $OpenBSD: pf.conf,v 1.38 2009/02/23 01:18:36 deraadt Exp $
#
# See pf.conf(5) for syntax and examples; this sample ruleset uses
# require-order to permit mixing of NAT/RDR and filter rules.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

ext_if="pppoe0"
int_if="nfe0"
int_net="192.168.0.0/24"

polemon="192.168.0.10"
poletopw="192.168.0.12"
segatop="192.168.0.20"

table <leechers> persist

set loginterface $ext_if
set skip on lo

match on $ext_if all scrub (no-df max-mss 1440)

altq on $ext_if priq bandwidth 950Kb queue {q_pri, q_hi, q_std, q_low}
queue q_pri priority 15
queue q_hi priority 10
queue q_std priority 7 priq(default)
queue q_low priority 0

nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

nat on $ext_if from !($ext_if) -> ($ext_if)
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $ext_if proto tcp to port 2080 -> $segatop port 80
rdr pass on $ext_if proto tcp to port 2022 -> $segatop port 22

rdr pass on $ext_if proto tcp to port 4000 -> $polemon port 4000
rdr pass on $ext_if proto tcp to port 6600 -> $polemon port 6600

anchor "ftp-proxy/*"

block

pass on $int_if queue(q_hi, q_pri)

pass out on $ext_if queue(q_std, q_pri)
pass out on $ext_if proto icmp queue q_pri
pass out on $ext_if proto {tcp, udp} to any port ssh queue(q_hi, q_pri)
pass out on $ext_if proto {tcp, udp} to any port http queue(q_std, q_pri)
#pass out on $ext_if proto {tcp, udp} all queue(q_low, q_hi)

pass out on $ext_if proto {tcp, udp} from <leechers> queue(q_low, q_std)

pass in on $ext_if proto tcp to ($ext_if) port ident queue(q_hi, q_pri)
pass in on $ext_if proto tcp to ($ext_if) port ssh queue(q_hi, q_pri)
pass in on $ext_if proto tcp to ($ext_if) port http queue(q_hi, q_pri)
pass in on $ext_if inet proto icmp all icmp-type echoreq queue q_pri

If someone has experience with porting the 4.6 pf.conf to 4.7, please help me do the correct changes.

OK, this is how far I've got:

I commented out nat-anchor and rdr-anchor, as describted in the guide:

#nat-anchor "ftp-proxy/*"
#rdr-anchor "ftp-proxy/*"

And this is how I've "converted" the rdr rules:

#nat on $ext_if from !($ext_if) -> ($ext_if)
match out on $ext_if from !($ext_if) nat-to ($ext_if)
#rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
match in on $int_if proto tcp to port ftp rdr-to 127.0.0.1 port 8021
#rdr pass on $ext_if proto tcp to port 2080 -> $segatop port 80
match in on $ext_if proto tcp tp port 2080 rdr-to $segatop port 80
#rdr pass on $ext_if proto tcp to port 2022 -> $segatop port 22
match in on $ext_if proto tcp tp port 2022 rdr-to $segatop port 22

rdr pass on $ext_if proto tcp to port 4000 -> $polemon port 4000
match in on $ext_if proto tcp tp port 4000 rdr-to $polemon port 4000
rdr pass on $ext_if proto tcp to port 6600 -> $polemon port 6600
match in on $ext_if proto tcp tp port 6600 rdr-to $polemon port 6600

Did I miss anything? Is the anchor for ftp-proxy OK as it is now? Do I need to change something in the other pass in on... lines?