Ivan Vučica's questions

Currently I'm reducing failed authentication spam in logs by blocking access to Dovecot and SSHD based on the IP address country of origin. Both services require authentication and I have no users or automation needing access, outside a rather small list of countries.

This is done using a tcpwrappers' aclcheck and a shell script being passed %a and invoking geoiplookup (or geoiplookup6) binary that I happen to have installed on my system. All set up with /etc/hosts.allow, /etc/hosts.deny.

This is enough to get rid of most failed logins.

Postfix, despite being authored by the same person as tcpwrappers, does not do tcpwrappers -- at least in Debian, its various binaries are not linked against libwrap.so.

iptables is, to my knowledge, not applicable; I don't believe it can ask a userspace binary to determine whether an IP packet (such as TCP SYN) should be accepted or rejected.

Is there a convenient way to either make Postfix's daemons that listen for TCP connections, such as master, make use of hosts.allow/hosts.deny? Is tcpd an answer? How would one make proper use of it?

I'm interested in blocking just the smtps and submission ports -- those that allow authentication (and thus allow post-authentication relaying) -- based on the country of origin.

I have a web application written in PHP where I would like to allow existing users to log into Windows computers, too. Re-hash of their passwords is doable (by requesting them to change the password). And to solve desync of passwords, I intend to have webapp authenticate users primarily against the domain.

I don't want to give webapp users accounts on the existing domain, which we can call example.local. Instead, I want to provide them accounts on a new domain, let's call it webapp.example.local.

From some research I have done, setting up a Samba4 domain and joining computers into this webapp.example.local domain would be one way to allow webapp users to log in. But, the computers should be members of the example.local domain.

How can I get computers that are members of and are authenticating against Windows 2008-based example.local to also authenticate users against webapp.example.local?

Magic keywords seem to be "trust relationship", "forest", etc, but at this point I haven't found a concrete example on how to establish this trust.

inadvertedly, a bind9 server I ran was an open resolver. Whoops.

Now it's been months and the recursive queries for isc.org are still incoming. I would not mind if my /var/log/syslog did not look like this:

Jul  6 01:10:23 servername last message repeated 6 times
Jul  6 01:10:23 servername named[2580]: client YYY.YY.YYY.YYY#25345: query (cache) 'isc.org/ANY/IN' denied
Jul  6 01:10:23 servername named[2580]: client ZZZ.ZZ.ZZZ.ZZ#25345: query (cache) 'isc.org/ANY/IN' denied
Jul  6 01:10:23 servername last message repeated 7 times
Jul  6 01:10:23 servername named[2580]: client AAA.AAA.A.AAA#25345: query (cache) 'isc.org/ANY/IN' denied
Jul  6 01:10:23 servername named[2580]: client BBB.BB.BB.BBB#25345: query (cache) 'isc.org/ANY/IN' denied
Jul  6 01:10:23 servername last message repeated 6 times

(One might find it funny that the above messages all appear within one second... I no longer don't.)

This really, REALLY makes it hard to catch any real errors that another service on the system may report.

I'd like to make bind9 no longer log these messages. And I'm crossing my fingers that it is possible to make only these messages disappear from the logs.

In what way can I disable messages that recursion is disallowed from appearing in the syslog (or other logs)?

servername:/etc/bind9# named -V
BIND 9.8.4-rpz2+rl005.12-P1 built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-geoip=/usr' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2'
using OpenSSL version: OpenSSL 1.0.1c 10 May 2012
using libxml2 version: 2.8.0

servernane:/etc/bind9# uname -a
Linux servername 3.2.0-4-686-pae #1 SMP Debian 3.2.35-2 i686 GNU/Linux

To clarify:

I'm interested in more detailed example on how to silence just the 'recursion denied'-type messages.

At an educational non-profit, I've inherited a previously set-up Windows domain that, after the first reinstall of the machines, we ended up not using by simply not joining machines back into the domain.

Over last summer, before the annual reinstall for shipping machines to the summer school, I toyed with the idea of installing Windows 7 over network, instead of just imaging the machines. It took a bit longer than I expected to figure out the basics; honestly, I expected that Windows would be more friendly for PXE installation out of the box.

What I'm interested in is best practices for installing Windows 7 over PXE with domain autojoin. I'd love it if the whole setup could optionally be hosted on a UNIX based system as well.

I've had some success by preparing an ISO using Windows AIK, and loading the ISO into memory. This was needed since I wanted a menu, and I think I couldn't get PXELINUX to chainload into Windows' bootloader. Unfortunately, I couldn't figure out much about customization of the Windows setup in that timeframe nor could I get Samba to work properly; studying the stuff ended up being too lengthy, especially the portion where I edited a disk image on Windows and copied it outside. AIK didn't make things easier by mounting the disk image into RAM, and writing it in its entirety when done with it, making me a very sad boy.

I've recently found a different approach, too, that appears to be closer to Microsoft's original idea for netboot deployment and does not involve ISOs.

So my question boils down to the following.

1. What exact approach do you use for netbooting Windows 7 setup?
2. How can Windows 7 setup be best customized to be completely unattended, including installation on specific system partition and not destroying the data partition, creation of passworded admin and default user, choice of MAC-address-based hostname, and joining a domain?

As much details as possible for everyone's future reference would be appreciated. WDS isn't a bad choice, but if a Linux-based install can be used, that'd be better.