neoice's questions

I'm using LDAP to deal with users and authentication across my network. I'm now adding FreeBSD hosts and have hit a problem with login shells. on Linux, shells tend to be in /bin/$shellname, so setting my login shell in LDAP to /bin/zsh works perfectly. on FreeBSD, /bin/zsh doesnt exist, I need to use /usr/local/bin/zsh. is there a solution to this? I imagine I might be able to make some sort of login-shell.sh script that LDAP passes out as the "shell" and then use the script to determine the actual shell for the user, but I'm not a fan of that idea.

I'm using Debian and FreeBSD, both with a standard OpenLDAP/PAM/nss setup.

edit: it looks like using /bin/sh and adding an exec $shell to .profile would "work", but that doesnt scale very well.

I currently use my MBP7,1 as my primary computer, running 10.6 and Win7. I would like to switch to OSX Server so I can have a bit more control over the network services and ipfw. is it possible to run OSX Server on a laptop? if so, will anything important or obscure break like VLC, 3D rendering (Steam) or sound devices (external soundcard)?

I've been tasked with restoring a RAID from a failed Buffalo NAS. the NAS box has failed, but our understanding at this point is that the drives are still functioning. I believe that Buffalo's NAS was using mdraid+Linux in a RAID5 of 4x1TB drives. my understanding of mdadm is that it's not smart enough to figure out the correct striping of the drives by itself.

I've seen a DEFCON presentation on "Rebuilding RAID By Sight and Sound", so I know some techniques for manually determining the order if I can get access to the drives. I'm not sure how to go about working on these in a non-destructive way. I'm not sure I can even get access to 4TB of scratch space for storing working images.

I'll update as I go/research, but some pointers on how to proceed would be appreciated!

I'm having an ipv6 problem that's plagued me for some time. (IPv6 routing over VPN) the goal is to use a HurricaneElectric v6 tunnel to get v6 on my laptop, no matter where I am by using my VPN.

I'm going to be overly-detailed here, so settle in.

Network layout:

svr1 --- vpn --- laptop

• svr1 is a Linux OpenVPN client with a static v4 and HE's ipv6 tunnel.

• vpn is a Linux OpenVPN server (amongst other things). it has a dynamic v4 address and as such, cant be used with HurricaneElectric's tunnel.

• laptop is an OSX laptop and OpenVPN client

Interfaces:

• HE gateway: 2001:470:a:ed::1

• svr1 v6: 2001:470:a:ed::2

• srv1-tap: 2001:470:a:ed::20

• laptop-tap: 2001:470:a:ed::99

what I'd like:

HE --- svr1 --- (vpn) --- laptop

the problem hinges on the fact that I can make this set up work, but only under certain conditions.

for example, I connect up everything, ping6 2001:470:a:ed::2 (and beyond) is ICMP unreachable. as soon as I ping6 2001:470:a:ed::20 (the next hop). this kind of problem existed when I first set up the tunnel on srv1, but appears to have gone away with the addition of 'metric 1' to the interface declaration. I have however replicated this on vpn, although I havent yet tested the 'metric 1' component. I have been unable to find the 'metric' command on OSX, but I have found a number of people having issues with ipv6 on OSX

I'm looking for some sort of solution. I'd prefer static routes, no extra prefixes, but at this point, I'm willing to try anything. I've tried radvd, ipv6 on vpn, prefix (albeit probably incorrectly). I have almost no ipv6 experience, so assume I know nothing.

I'm using a Linux server to do iptables NAT routing for a small business network. We also have a 24port managed switch that will be providing connections for all the wall ethernet jacks.

The layout looks like this:

INTERNET
    |
   eth1
    |
[server]
    |
   eth0
    |
[ switch ]
|        |
(vl1)    (vl2)

My goal is to have vlan1 and vlan2 completely isolated from each other, although able to share Samba mounts on the server. The server will also be handling DHCP, firewalling and content-filtering via Squid.

So far, I have everything but vlan2 working. I'm using eth0 as 192.168.1.1 and eth0:1 as 192.168.2.1, with the switch assigned .2 on the respective vlans. I however, cannot get any routes to 192.168.2.2. I've tried several different routes, but I haven't made any progress. Currently, I'm using the defaults, that is:

192.168.1.0     *               255.255.255.0   U     0      0        0 eth0
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0

I'm wondering if I might need to switch to bridges, but since I won't be physically at the machines for a few days, I don't want to mess with things. Does anyone have some suggestions on a solution? I'm tempted to just throw another NIC in, but I'd like to add vlan3 eventually, so I'll wind up back here in a month if I just try to work around.

I've been wondering for a while if LDAP can be used to control user privileges. For example, if I have UNIX and web logins, is there an easy way to grant a user access to just or just UNIX (or even both?)

My current attempt at solving this very problem was to create 'login' and 'nologin' groups, but this doesn't seem fine-grained enough to meet the ideas I have in my head. I'm also still in the situation where all UNIX users are web users, which isn't a problem so much as an indicator of the limitations.

Does anyone have any input on this? Has this problem already been solved?

I have an ipv6 tunnel that refuses to work until traffic goes outbound. if I turn the device on and ping in, I get no response until the second I start to ping out. if I then walk away for a few hours and try to ping in again, I'll get no response.

I'm using Debian Lenny and Hurricane Electric for my tunnel. I'm not even sure where to begin debugging this behavior because it's so unusual. I've used both of the Debian configs from http://www.tunnelbroker.net/forums/index.php?topic=18.0 and the configs from http://wiki.debian.org/DebianIPv6 and a variety of tweaks in between, but I still cannot get the device to persistently accept inbound traffic. there's no ip6tables, but I do have a variety of iptable rules. has anyone else experienced this kind of issue? what could I possibly do to debug or solve this?

edit: there's no NAT involved and it's all IPv4 Cisco infrastructure. I dont think there's any IPv6 between me, the switches and the router.

I'm running OpenVPN on Debian Lenny and Tunnelblick on OSX. my goal is to have a fully routed VPN that supports IPv6. the OpenVPN server has a functional 6to4 device, so now my goal is to get the clients to route their IPv6 traffic over the VPN.

after OpenVPN starts, it runs these commands to configure its tap0 device for IPv6:

ifconfig $dev up
ifconfig $dev add 2001:470:e910:1000::1/64

so far, I've been manually performing the OSX side of things. I've gotten to here:

ifconfig tap0 inet6 2001:470:e910:1000::2
route add -inet6 default 2001:470:e910:1000::1
route add -inet6 2000:: -prefixlen 3 2001:470:e910:1000::1

with these commands, I can ping client.tap0, server.tap0 and server.6to4, but cannot get any traffic beyond the 6to4 device. without BOTH routes, no traffic gets to the server at all. I havent done much routing or IPv6, so I'm stumped.

I've been using these firewall rules:

-I FORWARD -p tcp --syn -m connlimit --connlimit-above 50 -j REJECT
-I FORWARD -p tcp --syn -m connlimit --connlimit-above 50 -j LOG --log-prefix "CONNLIMIT: " --log-level debug

it seems straightforward enough: prevent someone from opening more than 50 connections and causing a denial of service. I've tested it successfully against slowloris. I turned the limit up to 50 specifically to prevent issues with false-positives (Apache can be very connection-hungry.) however, this morning, I get an email from my Nagios monitor and my logs show several lines of "CONNLIMIT" with the source IP being my monitoring system.

I have no idea why this is happening. at most, my monitoring server should be performing 5-10 checks and perhaps a ping or SSH connection. I'd be shocked if I had more than 25 conncetions open, yet 2 weekends in a row, I've managed to trigger connlimit 50 and rudely awaken myself.

is there something wrong with my firewall rules? (maybe add the 'new' flag?) is Nagios not closing its connections properly? I'm not even sure how to continue debugging this issue without logging every packet on the wire and patiently waiting for my cell phone to go off at some awful hour.

[edit: just for fun, here's the server logs]

Oct  9 11:33:22 adapt kernel: [1888526.442640] CONNLIMIT: IN=eth0 OUT=eth1 SRC=[MONITOR] DST=[HOST] LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=2076 DF PROTO=TCP SPT=46536 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
Oct  9 11:34:22 adapt kernel: [1888586.443869] CONNLIMIT: IN=eth0 OUT=eth1 SRC=[MONITOR] DST=[HOST] LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=43048 DF PROTO=TCP SPT=57931 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
Oct  9 11:35:42 adapt kernel: [1888667.011376] CONNLIMIT: IN=eth0 OUT=eth1 SRC=[MONITOR] DST=[HOST] LEN=64 TOS=0x00 PREC=0x00 TTL=54 ID=19161 DF PROTO=TCP SPT=63669 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Oct  9 11:35:48 adapt kernel: [1888673.093663] CONNLIMIT: IN=eth0 OUT=eth1 SRC=[MONITOR] DST=[HOST] LEN=64 TOS=0x00 PREC=0x00 TTL=54 ID=48302 DF PROTO=TCP SPT=63673 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Oct  9 11:35:53 adapt kernel: [1888678.361267] CONNLIMIT: IN=eth0 OUT=eth1 SRC=[MONITOR] DST=[HOST] LEN=64 TOS=0x00 PREC=0x00 TTL=54 ID=11711 DF PROTO=TCP SPT=63677 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Oct  9 11:36:04 adapt kernel: [1888688.517868] CONNLIMIT: IN=eth0 OUT=eth1 SRC=[MONITOR] DST=[HOST] LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=6316 DF PROTO=TCP SPT=44206 DPT=443 WINDOW=5840 RES=0x00 SYN URGP=0
Oct  9 11:36:21 adapt kernel: [1888705.382273] CONNLIMIT: IN=eth0 OUT=eth1 SRC=[MONITOR] DST=[HOST] LEN=64 TOS=0x00 PREC=0x00 TTL=54 ID=29613 DF PROTO=TCP SPT=63697 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Oct  9 11:36:49 adapt kernel: [1888733.467511] CONNLIMIT: IN=eth0 OUT=eth1 SRC=[MONITOR] DST=[HOST] LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=52433 DF PROTO=TCP SPT=40930 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0
Oct  9 11:37:04 adapt kernel: [1888748.574700] CONNLIMIT: IN=eth0 OUT=eth1 SRC=[MONITOR] DST=[HOST] LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=26329 DF PROTO=TCP SPT=44223 DPT=443 WINDOW=5840 RES=0x00 SYN URGP=0

we can see that it's checking a few ports and issuing a check about once a minute.