Giovanni Bajo's questions

My company has a router/firewall deployed with the "common" Proxy ARP setup: it sits between some servers and the ISP gateway, and intercepts all the packets with proxy arp, so that it can apply both filtering rules and traffic shaping for enforcing bandwidth constraints. Using Proxy ARP means that, if the router/firewall breaks for any reason, we can simply pull it off the network, connect the ISP gateway directly to the server switch, and the service keeps going on (though not firewalled/shaped).

See: http://www.shorewall.net/ProxyARP.htm

Any idea how can we convert this setup to IPv6? I tried looking around but couldn't find any resource on the matter.

I'm doing a preliminary study for a contract to build a VPN network between ~600 remote servers running Linux CentOS 6 (+ their 600 private LANs). The network is supposed to be star-based, so that each remote server connects to a central server(s) to enter the VPN (I know it's a SPOF but that's OK because the main application for which this VPN is built will run on the central server anyway).

I would like to use OpenVPN (it's really flexible and can be tuned to the configuration we need), but I was wondering what are the best practices for running it on such a large network. For instance, if used in tun mode, it would create 600 tun interfaces on the central server(s), which I don't even know if it's supported and/or creates any problem.

I don't have any experience with such a large network, so I'm open to any kind of suggestion and pointers. Thanks!

there's a computer ("server") that has no Internet connection, and it is located in a place with no GSM signal. The only way to get connection to it is an analog modem (US Robotics 56Kbit/s). This modem is connected to a national PSTN line with a geographical number, and the server (running a modern Linux distribution) is configured to offer a dial-in serial terminal. To clarify, when you phone to this PSTN line, the modem handshakes (I think it's the V90 protocol), then you're presented with the login and then you are in on ttyS0. There's no IP/PPP protocol stack, just the serial terminal.

I would like to connect to this server in any way that does not require me to carry around a physical analog modem and (what's worse) finding around a physical PSTN line which is really a scarce resource at least in business context here in Italy. To clarify: the PSTN line on the server side is the only way through, but I would like to be able to connect to it without a physical PSTN line on the client side.

Some ideas that came through my mind but I do not know if they can be really implemented or not:

• Having a mobile phone connected through bluetooth/USB. Old phones exported a ttyUSB that handled AT commands, but then there was no way (AFAICT) to get the audio stream. I don't know if it's technically possible to write an Android app that makes a phone call, then encodes the audio into a semi-raw UDP stream.

• Routing the call through VOIP. Googling around, some people seems to have had mixed success with doing analog modem calls through a VOIP termination with g711 (uLaw/aLaw). It looks like it is possible to get at least 9600bps, which is enough for me.

• Even if one of the above is possible, is there any software available that emulates the full V90 protocol/handshake/whatever and en/decodes audio into bytes?

• Is there any online service that offers a battery of analog modems to subscribers? Doesn't sound a business I would personally invest on, but you never know :)

• Is there any physical object that is the modern UMTS equivalent of an analog modem, like a box connected through USB where you put the SIM inside, it does all the magic, and gives you a ttyUSB on your PC?

• Assuming that I can physically access the server just once, is there anything I can install (either hardware or software) on the server and that would make my life easier? The only requisite is that must go through a standard national PSTN line (dual twisted copper), there's no other way to get any other signal. The modem looked like the best option, at first, but you never know.

Thanks!

Given one Linux server, and many Linux clients, I need to export some shared directories from the server. The behavior I want to obtain is really simple: a group of users can use a shared space on the server, without having to worry about the existence of UNIX file permissions. If I were in a Windows world, I would just share the directory as r/w, add the users to the permission list, and boom, it's done.

But, in the Linux world, I don't know how to obtain this:

1. Each shared directory can be mounted only by a subset of users, identified by a group (user/groups/logins are all handled through centralized LDAP). So eg. the share "/var/foobar" on the server must be accessible (read/write) only by members of LDAP group "foobar".
2. Users must be able to create/modify/delete directories, files, etc. on the share with full access, provided they are in the right group.
3. Users must be unable to screw permissions of files/directories in a share in a way that other users of the share cannot access them anymore. Big stress on an unable.

The problem with requirement #3 is that there are many Linux applications that like to screw permissions by ignoring the umask and/or forcing a chmod/chgrp after touching a file. Notable examples are Nautilus and OpenOffice.

Failed experiments:

• NFS: tried in different ways, but if I squash I cannot authenticate, and if I authenticate and user tries to copy a directory with Nautilus, permissions are screwed.
• NFS + ACL setgid. Still screwable through standard desktop programs doing standard operations that somehow end up forcing a chmod or chgrp.
• sshfs/sftp-server: there doesn't not seem to be a simple way to avoid calls to chmod/chgrp. There is a patch floating around that allows to block chmod/chgrp but it returns errors to the client that complains to the user. Looks like I could patch the patch to silently ignore chmod/chgrp, but I am already using SFTP on that server for other reasons and there does not seem to be a simply way to define different behaviors for different directories.

Would Samba help somehow? Other solutions?