Jochen's questions

I need to run a script when a specific network interface is brought up with systemd/networkctl, i.e. each time it enters state "routable".

• When the interface goes up or down, the device stays "active", i.e. I cannot depend on the "sys-subsystem-net-devices-$DEVICE.device" unit.

• I tried creating a path unit to watch "/sys/class/net/$DEVICE/operstate", but this does not seem to work with the sysfs file system.

Any other ways to do this?

I want to do the equivalent of

iptables -t nat -A POSTROUTING -m ipvs --vaddr 1.2.3.4 -j MASQUERADE

in nftables. The nftables wiki says ipvs is supported, but

add rule ip nat POSTROUTING ipvs vaddr 1.2.3.4 masquerade

does not work. All other variations I have tried do not work either... When I add the rule using iptables and list all rules using nft, I get

vaddr 1.2.3.4 counter packets 0 bytes 0 masquerade

but using this in "add rule" does not work either.

So what would be the correct syntax to use nft in this case?

Calling journalctl --setup-keys creates a new key pair for Forward Secure Sealing (FSS). How can I check if this was done on a system without generating those keys if it has not happened yet?

Alternatively, since this process creates the key in file fss in the journal directory, how can I find this directory, since it contains some "arbitrary" hash, e.g. /var/log/journal/3c726bc3b46e1333bb57fa1857efcf35?

Ubuntu uses pam_motd to display the message of the day (motd) when logging in. This message is in turn generated from the scripts in /etc/update-motd.d.

Inside one of those scripts I would like to check if the terminal used supports Sixels.

I tried using the LC_TERMINAL variable, but it is not set yet. I also found out that printing a control code with echo -n "\u001B[0c" allows to check for Sixel support, but I have found no way to capture and examine the output in the script. I also do not know if this even would work inside a script run by PAM.

So

• Is there a way to get LC_TERMINAL passed to the script when logging in with SSH?
• Is there a way to capture the output of echo -n "\u001B[0c" in the motd script and examine it?
• Is there any other way to check for Sixel support in the motd script?

how can I configure strongSwan to require IPSec for all connections except SSH connections?

I tried creating two connections:

1. Create a "connection" for SSH using passthrough mode (left=%any/right=%any) and leftsubnet=%dynamic[tcp/22]
2. Secure all traffic with transport mode (left=%any/right=%any)

However, when I restart strongSwan, I cannot SSH into the server. It seems to me I have to prioritize the connections, but I have found no way to do that.

Any help would be greatly appreciated.

Regards, Jochen

I am serving proxied content with Apache that already contains an Expires header. Using mod_expires' ExpireDefault to override the already present Expires header does not work, the old header is left untouched.

Is there another way to override the Expires header? I tried using mod_headers, but it seems I cannot do date calculation there. I also must override the Expires header, I cannot use Cache-Control with max-age for this.

Regards, Jochen

I want to log all network traffic on a Mac OS X server (like tcpdump does), but including the ID of the process that is responsible. Using lsof only gives me the current connections, not the past ones.

Is there a way to do this?

Regards, Jochen