mivk's questions

When I run route print on my "normal" Windows 10 Pro machine, the "Persistent Routes" section lists 136 (!) Network addresses with a /32 mask, and "On-link" as the Gateway.

Many of the IP addresses seem to belong to Microsoft or Akamai, but there are also many others.

Where do all these routes come from? What is their purpose? Can I delete them all?

Here is a shortened version of my route print output:

===========================================================================
Interface List
 12...48 0f cf 51 50 6b ......Intel(R) Ethernet Connection (2) I218-LM
  1...........................Software Loopback Interface 1
 17...00 15 5d 10 76 b6 ......Hyper-V Virtual Ethernet Adapter
 32...00 15 5d 82 1b 63 ......Hyper-V Virtual Ethernet Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.88     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
[ ... etc. as usual ... ]
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
      23.99.10.11  255.255.255.255         On-link        1
      23.102.21.4  255.255.255.255         On-link        1
    23.212.108.87  255.255.255.255         On-link        1
    23.212.108.95  255.255.255.255         On-link        1
[ ... many more ...]
   212.30.134.205  255.255.255.255         On-link        1
   216.38.172.128  255.255.255.255         On-link        1
   216.58.198.230  255.255.255.255         On-link        1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 12    281 ::/0                     fe80::125a:f7ff:fe53:1d07
  1    331 ::1/128                  On-link
[ ... etc. ... ]
===========================================================================
Persistent Routes:
  None

And in case it's useful (or just for the curious), here is an excerpt of the hostnames or whois "NetName" of these IP addresses:

cat win10-pers-routes.txt \
| while read ip; do h=$(host $ip) || h=$(whois $ip | grep -i NetName:); printf "%-15s  %s\n" "$ip" "$h"; done

23.102.21.4      NetName:        MSFT
23.212.108.87    87.108.212.23.in-addr.arpa domain name pointer a23-212-108-87.deploy.static.akamaitechnologies.com.
23.212.108.95    95.108.212.23.in-addr.arpa domain name pointer a23-212-108-95.deploy.static.akamaitechnologies.com.
...
37.252.163.4     netname:        EUADNEXUS-AMS1-IB-1
...
64.4.6.100       NetName:        MICROSOFT
...
65.39.117.230    NetName:        PINPOINT-PNPT
65.52.100.7      7.100.52.65.in-addr.arpa domain name pointer df.telemetry.microsoft.com.
...
65.55.39.10      10.39.55.65.in-addr.arpa domain name pointer xnacreators.net.
...
65.55.252.190    NetName:        MICROSOFT-1BLK
68.67.152.94     NetName:        APPNE-NET1
68.67.153.87     87.153.67.68.in-addr.arpa domain name pointer lbip767081.nym2.adnexus.net.
...
68.67.152.172    NetName:        APPNE-NET1
68.232.34.200    NetName:        EDGECAST-NETBLK-04
82.199.80.143    netname:        TC-MEDIAMIND
93.184.215.200   netname:        EDGECAST-NETBLK-03
94.245.121.179   179.121.245.94.in-addr.arpa domain name pointer db3aqu.atdmt.com.
...
98.124.243.41    NetName:        ENOM-BLOCK-2
111.221.29.177   netname:        Microsoft
...
131.107.255.255  255.255.107.131.in-addr.arpa domain name pointer dns.msftncsi.com.
131.253.40.37    NetName:        MICROSOFT
...
157.55.129.21    NetName:        MSFT-GFS
...
168.61.24.141    NetName:        MICROSOFT
168.62.187.13    NetName:        MICROSOFT
168.63.108.233   NetName:        MICROSOFT
173.252.88.160   NetName:        FACEBOOK-INC
191.232.80.58    
191.232.80.60    
191.232.80.62    
191.232.139.253  
191.232.139.254  
191.232.140.76   
191.237.208.126  
192.229.233.249  NetName:        EDGECAST-NETBLK-08
207.46.101.29    NetName:        MICROSOFT-GLOBAL-NET
...
212.30.134.204   netname:        Akamai-in-MTS-node
216.38.172.128   NetName:        WIRE-TV
216.58.198.230   230.198.58.216.in-addr.arpa domain name pointer lhr26s04-in-f6.1e100.net.
230.198.58.216.in-addr.arpa domain name pointer lhr26s04-in-f230.1e100.net.
230.198.58.216.in-addr.arpa domain name pointer lhr44s02-in-f6.1e100.net.

I upgraded a Debian 9 "Stretch" server to Debian 10 "Buster", which also upgrades Mediawiki to version 1.31.

Trying to run update.php, it fails with "Cannot access the database: No database connection":

/var/lib/mediawiki/maintenance# php update.php
MediaWiki 1.31.10 Updater

Your composer.lock file is up to date with current dependencies!
[6b70dd5bdc9deadcca99506a] [no req]   Wikimedia\Rdbms\DBConnectionError from line 1004 of /usr/share/mediawiki/includes/libs/rdbms/database/Database.php: Cannot access the database: No database connection
Backtrace:
#0 /usr/share/mediawiki/includes/libs/rdbms/loadbalancer/LoadBalancer.php(1140): Wikimedia\Rdbms\Database->reportConnectionError(string)
#1 /usr/share/mediawiki/includes/libs/rdbms/loadbalancer/LoadBalancer.php(750): Wikimedia\Rdbms\LoadBalancer->reportConnectionError()
#2 /usr/share/mediawiki/includes/GlobalFunctions.php(2813): Wikimedia\Rdbms\LoadBalancer->getConnection(integer, array, boolean)
#3 /usr/share/mediawiki/maintenance/Maintenance.php(1311): wfGetDB(integer, array, boolean)
#4 /usr/share/mediawiki/maintenance/update.php(147): Maintenance->getDB(integer)
#5 /usr/share/mediawiki/maintenance/doMaintenance.php(94): UpdateMediaWiki->execute()
#6 /usr/share/mediawiki/maintenance/update.php(248): require_once(string)
#7 {main}

The database is Postgresql, and I can access it fine with psql etc.

In LocalSettings.php I have

## Database settings
$wgDBtype           = "postgres";
$wgDBserver         = "localhost";
$wgDBname           = "wikidb";
$wgDBuser           = "...";
$wgDBpassword       = "...";

# Postgres specific settings
$wgDBport           = "5432";
$wgDBmwschema       = "mediawiki";
$wgDBts2schema      = "public";

In the Mediawiki debug log, I also see

IP: 127.0.0.1
Start command line script update.php
[caches] cluster: EmptyBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff
[caches] LocalisationCache: using store LCStoreNull
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.
[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {
    "IPAddress": "127.0.0.1",
    "UserAgent": false,
    "ChronologyProtection": false,
    "ChronologyPositionIndex": 0
}
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: failed to connect to database 0 at 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::reportConnectionError: connection error: Unknown error ([Null])
[exception] [6b70dd5bdc9deadcca99506a] [no req]   Wikimedia\Rdbms\DBConnectionError from line 1004 of /usr/share/mediawiki/includes/libs/rdbms/d
atabase/Database.php: Cannot access the database: No database connection

I'm now completely stuck...

I am trying to log messages from a specific remote host to a separate log file (and only to that file). I tried this:

# cat /etc/rsyslog.d/avs110door.conf 

if $fromhost == 'avs110' then /var/log/avs110-door.log
& stop

The log file is not created, and the messages form that host are still sent to user.log, syslog, messages and auth.log (depending on the facility).

I did run systemctl restart rsyslog.service and other .conf files from that directory do work as expected.

This is a Debian Jessie server with rsyslog version 8.4.2-1+deb8u2.

The messages in the wrong files are like this (so the remote hostname is indeed 'avs110' as in my .conf file condition):

Jul 18 18:27:19 avs110 sshd[781]: Server listening on :: port 22.
Jul 18 18:27:39 avs110 engine[844]: Finished initialization
Jul 18 18:44:20 avs110 engine[844]: Calling sip:[email protected]:5060

Apache writes log entries after it has finished serving a request.

Is there a way to make it log the start of a request, possibly to a fifo, and preferably only according to some criteria (file size, or else file type or something).

We sometimes have very big downloads running over HTTP, and it would be useful to be able to see that they have started.

My firewall logs get written to my custom iptables.log file, but also to kern.log, messages, and syslog. I don't want these messages duplicated in all these logs.

What is wrong with my config?

$ cat /etc/rsyslog.d/iptables.conf

# This works, and the messages do get to iptables.log.
:msg, regex,  "^\[ *[0-9]*\.[0-9]*\] IPT" -/var/log/iptables.log
& ~

In /etc/rsyslog.conf, $IncludeConfig /etc/rsyslog.d/*.conf is called before the lines for the standard log files:

$ cat /etc/rsyslog.conf

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
mail.*              -/var/log/mail.log
user.*              -/var/log/user.log
mail.info           -/var/log/mail.info
mail.warn           -/var/log/mail.warn
mail.err            /var/log/mail.err
news.crit           /var/log/news/news.crit
news.err            /var/log/news/news.err
news.notice         -/var/log/news/news.notice
*.=debug;\
    auth,authpriv.none;\
    news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none      -/var/log/messages
*.emerg             :omusrmsg:*
daemon.*;mail.*;\
    news.err;\
    *.=debug;*.=info;\
    *.=notice;*.=warn   |/dev/xconsole

This is on a Debian Wheezy (7.9) system, with rsyslog version 5.8.11-3+deb7u2

I have the following in main.cf:

smtpd_recipient_restrictions = permit_mynetworks,
 permit_sasl_authenticated,
 reject_unauth_destination,
 check_sender_access pcre:/etc/postfix/sender_access.pcre,
 check_recipient_access hash:/etc/postfix/recipient_access,

And this line in the /etc/postfix/sender_access.pcre file:

/^[A-Z][a-z]{2,}[A-Z][a-z]{2,}\d\d+@/i REJECT You look like spam bot 1

Testing the map with an address from the mail log seems to show it should have been rejected:

$ postmap -q "[email protected]" pcre:/etc/postfix/sender_access.pcre 
REJECT You look like spam bot 1

However, that mail was accepted.

What is wrong with my config?

Below is my full (slightly edited) postconf -n output in case there is something relevant:

alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
delay_warning_time = 4h
home_mailbox = Maildir/
inet_interfaces = all
local_recipient_maps = unix:passwd.byname, $alias_maps
mailbox_size_limit = 0
message_size_limit = 20480000
milter_connect_macros = j {daemon_name} v {if_name} _
milter_default_action = accept
mydestination = mail.example.com, localhost.example.com, localhost
myhostname = mail.example.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 my.ip.add.ress/26
myorigin = /etc/mailname
non_smtpd_milters = unix:/opendkim/opendkim.sock
queue_directory = /var/spool/postfix
readme_directory = no
recipient_delimiter = +
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_error_sleep_time = 5s
smtpd_hard_error_limit = 10
smtpd_helo_required = yes
smtpd_milters = unix:/opendkim/opendkim.sock
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, check_sender_access pcre:/etc/postfix/sender_access.pcre, check_recipient_access hash:/etc/postfix/recipient_access,
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_tls_CAfile = /etc/ssl/MyCA.pem
smtpd_tls_cert_file = /etc/ssl/MyCert.pem
smtpd_tls_key_file = /etc/ssl/private/MyCert.key
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3
smtpd_tls_protocols = !SSLv2,!SSLv3
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
virtual_alias_maps = regexp:/etc/postfix/virtual.regex

Update:

A debugging test session shows that the address is converted to lower case before the real lookup, even though postmap -q doesn't do that. This also makes the /i flag in pcre: tables useless in this situation.

... smtpd[28637]: >>> START Sender address RESTRICTIONS <<<
... smtpd[28637]: generic_checks: name=check_sender_access
... smtpd[28637]: check_mail_access: [email protected] > ... smtpd[28637]: ctable_locate: move existing entry key [email protected]
... smtpd[28637]: check_access: [email protected]
... smtpd[28637]: dict_pcre_lookup: /etc/postfix/sender_access.pcre: [email protected]

I seem to get variable and inconsistent results for the IP/MAC addresses from a particular machine, using nmap or arp-scan.

The machine has 3 interfaces, and this is what it shows:

$ uname -a
Linux showstore-81 2.6.35.13 #1 SMP PREEMPT Thu Feb 9 12:20:36 PST 2012 i686 GNU/Linux

$ LC_ALL=C /sbin/ifconfig
eth0      Link encap:Ethernet  HWaddr 00:1b:21:ac:17:19
          inet addr:192.168.81.54  Bcast:192.168.81.255  Mask:255.255.255.0
          ...

eth1      Link encap:Ethernet  HWaddr 00:25:90:25:d0:4e
          inet addr:192.168.81.129  Bcast:192.168.81.255  Mask:255.255.255.128
          ...

eth2      Link encap:Ethernet  HWaddr 00:25:90:25:d0:4f
          inet addr:169.254.1.1  Bcast:169.254.255.255  Mask:255.255.0.0
          ...

So whatever tool and options I use, I would expect:

• IP .54 => MAC 00:1b:21:ac:17:19
• IP .129 => MAC 00:25:90:25:d0:4e

But nmap -n -sP 192.168.81.0/24 (nmap v. 5.00) reports it reversed:

Host 192.168.81.54 is up (0.000078s latency).
MAC Address: 00:25:90:25:D0:4E (Super Micro Computer)

Host 192.168.81.129 is up (0.000058s latency).
MAC Address: 00:1B:21:AC:17:19 (Intel Corporate)

And nmap -n -sP -PR 192.168.81/24 reports only one of the MAC addresses on both IPs:

Host 192.168.81.54 is up (0.000081s latency).
MAC Address: 00:1B:21:AC:17:19 (Intel Corporate)

Host 192.168.81.129 is up (0.00011s latency).
MAC Address: 00:1B:21:AC:17:19 (Intel Corporate)

Finally, arp-scan -l (v. 1.8.1) reports both IP addresses twice with both MAC addresses:

192.168.81.54      00:1b:21:ac:17:19    Intel Corporate
192.168.81.54      00:25:90:25:d0:4e    Super Micro Computer, Inc.

192.168.81.129     00:1b:21:ac:17:19    Intel Corporate
192.168.81.129     00:25:90:25:d0:4e    Super Micro Computer, Inc.

How can I do a scan which gives correct results? (I only need IP and MAC. No port scanning.)

From a Linux server, how can I quickly determine if a remote machine is running Windows or Samba?

I want to run commands on remote Windows machines (XP and 7) to list the installed software and versions. And I want to run these commands from a Linux server (using winexe).

To find the Windows hosts, I use this nmap command:

nmap -oG - -T4 -p T:445 192.168.1.0/24 | awk '{print $2, $3}'

However, I also get all the Samba servers and a few printers.

Is there a simple way, through additional nmap options or through a separate command, to get only the real Windows machines, and avoid sending irrelevant Windows commands to non-Windows servers and devices?

Update:

I followed pferate's suggestion and used -O. I hadn't tried it because I thought it would be slow and unreliable, but it works well in this situation. I now use this to detect real Windows machines:

nmap -oG - -T4 -p T:445 -O --max-os-tries 1 192.168.1.0/24 | grep '445/open/.* Windows' | awk '{print $2, $3}'

I have a Linux PXE server used to boot Clonezilla, Debian rescue, etc. on client machines when needed.

Is it possible to add the Windows 7 recovery CD (repair disc) to the available systems on this Linux PXE server?

I do NOT need to install Win7 over the network, and I don't have a WDS server. All I found were solutions for a full install (like this or this). I am hoping that it can be much simpler in the case of the repair disc, which contains the following files:

\
 \boot\
    bcd                262'144 bytes 
    boot.sdi         3'170'304 bytes
    bootfix.bin          1'024 bytes
 \sources\
    boot.wim       369'906'796 bytes
 bootmgr               383'786 bytes

The Linux PXE server is also a Samba domain controller in case that makes a difference. And it is also the DHCP server of course.