WoJ's questions

I am testing a bare metal recovery of my server which basically starts a set of docker container with my services. I recovered from a backup /etc/docker, where I keep all the configuration and persistent volumes.

I then tried to start one of the containers:

root@srv-backup:/etc/docker# docker-compose --verbose -f /etc/docker/docker-compose.d/20-registry.yaml up
compose.config.config.find: Using configuration files: /etc/docker/docker-compose.d/20-registry.yaml
ERROR: compose.cli.main.main: .IOError: [Errno 2] No such file or directory: '/etc/docker/docker-compose.d/20-registry.yaml'

The file is however there:

root@srv-backup:/# ll /etc/docker/docker-compose.d/20-registry.yaml
-rwxrwxr-x+ 1 root root 842 Jan 24 15:19 /etc/docker/docker-compose.d/20-registry.yaml*

root@srv-backup:/# cat /etc/docker/docker-compose.d/20-registry.yaml
services:
  registry:
    container_name: registry
    image: registry
    labels:
      - traefik.http.routers.registry.rule=Host(`registry.example.com`)
      - traefik.http.routers.registry.entryPoints=https
      - traefik.http.routers.registry.tls=true
      - traefik.http.routers.registry.tls.certresolver=le
      - traefik.http.middlewares.lan.ipwhitelist.sourcerange=192.168.10.0/24, 192.168.20.0/24
      - traefik.http.routers.registry.middlewares=lan
      - traefik.enable=true
    restart: unless-stopped
    volumes:
      - /etc/docker/container-data/registry:/var/lib/registry
version: '3'

root@srv-backup:/# file /etc/docker/container-data/registry
/etc/docker/container-data/registry: directory

I tried all kind of incantations with relative and full paths - the issue is the same.

I was wondering whether the docker daemon has access to the file, but it also runs as root:

root@srv-backup:/# ps -ef | grep docker
root      2048     1  0 10:58 ?        00:00:08 dockerd -G docker --exec-root=/var/snap/docker/423/run/docker --data-root=/var/snap/docker/common/var-lib-docker --pidfile=/var/snap/docker/423/run/docker.pid --config-file=/var/snap/docker/423/config/daemon.json
root      2200  2048  0 10:58 ?        00:00:07 containerd --config /var/snap/docker/423/run/docker/containerd/containerd.toml --log-level error

I am quite at loss why it does not work (the docker file works correctly on the server I am trying to replicate in this DRP exercise)

I would like to test UDP connectivity with iperf3 but do not know how to start it in UDP server mode.

iperf3 -s only opens a TCP socket:

root@srv ~# lsof -i -P | grep iperf3
iperf3    21030            root    3u  IPv4 15606995      0t0  TCP *:5201 (LISTEN)

The A record for hello.world.example.com can be registered

• as the hello entry in the domain world.example.com
• or as the hello.world entry in the domain example.com

Is there a practical difference, from the perspective of the services which resolve the name, between these two approaches?

As far as I can tell, the resolution of both of them yields the value A record (the IP) so the replies are not discernable for the client.

I have a domain (example.com) which is setup to have two views. host1.example.com will be 10.0.0.1 in an internal network and 149.120.10.14 (a public IP) when queried from outside.

This means that a device connected to Internet should have its usual set of DNSes used normally (the ones it gets from DHCP, say 8.8.8.8) and they will resolve host1.example.com to its external IP.

When connected via VPN, this device should however receive from the OpenVPN server a specific DNS to resolve example.com (and only example.com).

My understading is that using

push "dhcp-option DNS 10.10.10.100"

where 10.10.10.100 is the internal, VPN reachable DNS server would overwrite the DNS servers on the device, loosing the ones it already had.

Is there a way to push a DNS nameserver with the option to use it only for a specific domain and retain the existing other DNSes (used for Internet/company resolution)?

docker inspect returns all sorts of interesting information about a docker image or container (or another object).

Where is this information stored? Is it possible to edit it?

I connect to a VPN server which requires authentication via

/usr/sbin/openvpn --config /etc/openvpn/server.ovpn

This prompts me for a login/password (= OK).

I added the login and password to a file and updated the /etc/openvpn/server.ovpn configuration with

auth-user-pass /etc/openvpn/auth.txt

I am not prompted for the password anymore (= OK).

I wanted to provide the authentication credentials from the command line instead of sourcing them from the config file:

/usr/sbin/openvpn --auth-user-pass /etc/openvpn/auth.txt --config /etc/openvpn/server.ovpn

This time, I am prompted for credentials. Why is it so?

The credentials file is the same, as well as the config (except for the auth-user-pass line which I removed for the last test).

The OpenVPN version is 2.3.10 and it was compiled with enable_password_save=yes (which must be the case since providing the credentials via the config file works, the package is installed from the standard Ubuntu repository)

I have a container created (docker create) from an image which was using EXPOSE 22 in the Dockerfile

I start it via docker start <container name or ID> and access it via ssh.

I now need to expose one more port, of a service running in this container. I cannot recreate it, it has to have its startup parameters changed in order to expose that extra port. Is this possible?

I was hoping that docker start would allow for the same parameters as docker create or docker run but this is not the case.

Note: I know that the philosophy of docker is to create ephemeral containers. It is a fact of life that I have to deal with this heavily customized container (as opposed to recreating it)

I would like to forward (rsyslog 8.4.2-1) all syslog messages to a port on 127.0.0.1. In order to do so, I added a file in /etc/rsyslog.d/expose-42000.conf:

*.* @127.0.0.1:42000

After restarting rsyslog (no error messages in the logs) I tried to listen to incoming messages:

netcat -u 127.0.0.1 42000

There was no output despite having messages appearing in /var/log/syslog.

To be sure that the file is indeed included I ran rsyslogd in debug mode and I see that the include happens:

# rsyslogd -dn
(...)
8836.556859167:main thread    : requested to include config file '/etc/rsyslog.d/expose-42000.conf'
8836.556895084:main thread    : config parser: pushed file /etc/rsyslog.d/expose-42000.conf on top of stack
Next token is token PRIFILT ()
Shifting token PRIFILT ()
Entering state 14
Reading a token: Next token is token LEGACY_ACTION ()
Shifting token LEGACY_ACTION ()
Entering state 12
Reducing stack by rule 35 (line 168):
   $1 = token LEGACY_ACTION ()
8836.557893160:main thread    : tried selector action for builtin:omfile: -2001
8836.557908388:main thread    : tried selector action for builtin:ompipe: -2001
8836.557923233:main thread    : tried selector action for builtin-shell: -2001
8836.558022055:main thread    : tried selector action for builtin:omdiscard: -2001
8836.558038075:main thread    : tried selector action for builtin:omfwd: 0
8836.558052488:main thread    : Module builtin:omfwd processes this action.
8836.558136499:main thread    : template: 'RSYSLOG_TraditionalForwardFormat' assigned
8836.558160039:main thread    : action 1 queue: parameter dump:
8836.558174916:main thread    : action 1 queue: queue.filename '[NONE]'
8836.558273542:main thread    : action 1 queue: queue.size: 1000
8836.558288080:main thread    : action 1 queue: queue.dequeuebatchsize: 16
8836.558302414:main thread    : action 1 queue: queue.maxdiskspace: 0
8836.558368788:main thread    : action 1 queue: queue.highwatermark: -1
8836.558384865:main thread    : action 1 queue: queue.lowwatermark: -1
8836.558413762:main thread    : action 1 queue: queue.fulldelaymark: -1
8836.558442666:main thread    : action 1 queue: queue.lightdelaymark: -1
8836.558470770:main thread    : action 1 queue: queue.discardmark: 980
8836.558552633:main thread    : action 1 queue: queue.discardseverity: 8
8836.558594909:main thread    : action 1 queue: queue.checkpointinterval: 0
8836.558608920:main thread    : action 1 queue: queue.syncqueuefiles: 0
8836.558623042:main thread    : action 1 queue: queue.type: 3 [Direct]
8836.558691335:main thread    : action 1 queue: queue.workerthreads: 1
8836.558727077:main thread    : action 1 queue: queue.timeoutshutdown: 0
8836.558741599:main thread    : action 1 queue: queue.timeoutactioncompletion: 1000
8836.558827751:main thread    : action 1 queue: queue.timeoutenqueue: 50
8836.558855694:main thread    : action 1 queue: queue.timeoutworkerthreadshutdown: 60000
8836.558869846:main thread    : action 1 queue: queue.workerthreadminimummessages: -1
8836.558884102:main thread    : action 1 queue: queue.maxfilesize: 1048576
8836.558950182:main thread    : action 1 queue: queue.saveonshutdown: 1
8836.558983020:main thread    : action 1 queue: queue.dequeueslowdown: 0
8836.558997187:main thread    : action 1 queue: queue.dequeuetimebegin: 0
8836.559011113:main thread    : action 1 queue: queuedequeuetimend.: 25
8836.559025491:main thread    : Action 0xb97a40: queue 0xb99120 created
-> $$ = nterm s_act ()
Stack now 0 1 14
Entering state 22
Reducing stack by rule 32 (line 164):
   $1 = nterm s_act ()
-> $$ = nterm actlst ()
Stack now 0 1 14
Entering state 21
Reading a token: 8836.559386173:main thread    : config parser: reached end of file /etc/rsyslog.d/expose-42000.conf
8836.559390418:main thread    : config parser: resume parsing of file /etc/rsyslog.conf at line 51
(...)

Is there something I am missing?

Summary of the problem: a ping from client does not go to rpi1, its ARP call is not answerd at srv.

• host0and tap0 are bridged by br0.
• vpninand lan0 are two independent interfaces.
• All traffic between the interfaces is allowed on srv (IP forwading is enabled and I have successful traffic between rpi1 and other interfaces not visible here, among others one which is the gateway to Internet)

Details: client successfully pings itself (10.20.1.2), 10.20.1.1, 10.20.1.254 and 10.10.10.254. When trying to ping 10.10.10.11:

root@client:~# ping 10.10.10.11
PING 10.10.10.11 (10.10.10.11) 56(84) bytes of data.
From 10.20.1.1: icmp_seq=2 Redirect Host(New nexthop: 10.10.10.11)
From 10.20.1.1 icmp_seq=1 Destination Host Unreachable
From 10.20.1.2 icmp_seq=3 Destination Host Unreachable
From 10.20.1.2 icmp_seq=4 Destination Host Unreachable
From 10.20.1.2 icmp_seq=5 Destination Host Unreachable

Please note the flip-flap in the From, between 10.20.1.1 and 10.20.1.2.

When running a tcpdumpon srv (where the ping ability is lost) I see ARP requests, but no replies:

root@srv ~# tcpdump -i vpnin -nn
17:10:54.463072 ARP, Request who-has 10.10.10.11 tell 10.20.1.1, length 28
17:10:55.459489 ARP, Request who-has 10.10.10.11 tell 10.20.1.1, length 28
17:10:56.459459 ARP, Request who-has 10.10.10.11 tell 10.20.1.1, length 28
17:10:56.473683 ARP, Request who-has 10.10.10.11 tell 10.20.1.2, length 28
17:10:57.469788 ARP, Request who-has 10.10.10.11 tell 10.20.1.2, length 28
17:10:58.469608 ARP, Request who-has 10.10.10.11 tell 10.20.1.2, length 28

Again, both 10.20.1.1 and 10.20.1.2 request an answer.

The ARP table on srv does have an answer

root@srv ~# arp -a
(...)
rpi1.10.in-addr.arpa (10.10.10.11) at f4:f2:6d:09:35:1b [ether] on lan0

What can be the reason

• for the lack of reply?
• and for this strange switch between 10.20.1.1 and 10.20.1.2?

I have a Windows 10 machine which often changes networks and retrieves its IP configuration via DHCP. Since an indefinite moment in the past it started to set its DNS as fixed, despite the fact that they are retrieved via DHCP:

The initial setting was Obtain DNS server address automatically and upon receiving this address, it switches to the "static mode" above (the DNS IPs are the one it received from DHCP).

Only the DNS setting is impacted.

What is the reason for this behaviour?

I want to redirect all HTTP and HTTPS traffic to squid acting as a transparent proxy. This traffic will then be blocked or authorized (in bulk) during certain hours. Specifically I do not want to decrypt/reencrypt HTTPS traffic but push it as it.

The HTTP part works, a REDIRECT rule in shorewall transfers all traffic intended for destination port 80 to the listening 3128 squid port in transparent mode.

The same trick for port 443 does not work.

There are tutorials on how to set up transparent proxy for HTTPS traffic, but all the ones I found describe the creation of a certifcate pair to decrypt/reencrypt the traffic - something I do not want to do.

The squid wiki mentions CONNECT as a way to tunnel HTTPS traffic, but adding http_access allow CONNECT all to the configuration (and disabling the default deny) does not change anything.

Then some previous answers suggest that transparent HTTPS traffing is not possible without breaking the TLS tunnel.

Therefore: is there a way to configure squid so that HTTPS traffic rerouted to it via iptables is then transparently transferred, without any modification?

(I would just eventually block when some time rules are met (this is to say the the block is not going to be based on anything within the HTTPS stream itself))

I have a network of Windows 10 machines served (DNS and DHCP) by a dnsmasq instance on a Ubuntu server (Ubuntu 15.10, dnsmasq 2.75). The setup basically works (dnsmasq provides addresses and manages DNS requests correctly) except for one specific case.

I wanted to provide a specific DNS server to one particular machine. I used the tag option in dnsmasq:

# open zone
dhcp-host=84:3a:4b:20:94:f0,set:open

# DNS for everyone = OpenDNS
dhcp-option-force=option:dns-server,208.67.222.222,208.67.220.220
# DNS for open = Google
dhcp-option-force=tag:open,option:dns-server,8.8.8.8,8.8.4.4

Upon ipconfig /renew on the client, the correct options are sent by dnsmasq:

root@srv ~# dnsmasq -d
dnsmasq: started, version 2.75 cachesize 150
dnsmasq: compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect inotify
dnsmasq: reading /etc/resolv.conf
dnsmasq: using nameserver 192.168.0.254#53
dnsmasq-dhcp: DHCP, IP range 10.10.10.20 -- 10.10.10.100, lease time 5d
dnsmasq: cleared cache
dnsmasq-dhcp: 342453732 available DHCP range: 10.10.10.20 -- 10.10.10.100
dnsmasq-dhcp: 342453732 vendor class: MSFT 5.0
dnsmasq-dhcp: 342453732 client provides name: helloworld.example.com
dnsmasq-dhcp: 342453732 DHCPREQUEST(lan0) 10.10.10.21 84:3a:4b:20:94:f0
dnsmasq-dhcp: 342453732 tags: open, known, lan0
dnsmasq-dhcp: Ignoring domain example.com for DHCP host name helloworld
dnsmasq-dhcp: 342453732 DHCPACK(lan0) 10.10.10.21 84:3a:4b:20:94:f0 helloworld
dnsmasq-dhcp: 342453732 requested options: 1:netmask, 3:router, 6:dns-server, 15:domain-name,
dnsmasq-dhcp: 342453732 requested options: 31:router-discovery, 33:static-route, 43:vendor-encap,
dnsmasq-dhcp: 342453732 requested options: 44:netbios-ns, 46:netbios-nodetype, 47:netbios-scope,
dnsmasq-dhcp: 342453732 requested options: 121:classless-static-route, 249, 252
dnsmasq-dhcp: 342453732 next server: 10.10.10.254
dnsmasq-dhcp: 342453732 sent size:  1 option: 53 message-type  5
dnsmasq-dhcp: 342453732 sent size:  4 option: 54 server-identifier  10.10.10.254
dnsmasq-dhcp: 342453732 sent size:  4 option: 51 lease-time  5d
dnsmasq-dhcp: 342453732 sent size:  4 option: 58 T1  2d8h23m1s
dnsmasq-dhcp: 342453732 sent size:  4 option: 59 T2  4d5h23m1s
dnsmasq-dhcp: 342453732 sent size:  4 option:  1 netmask  255.255.255.0
dnsmasq-dhcp: 342453732 sent size:  4 option: 28 broadcast  10.10.10.255
dnsmasq-dhcp: 342453732 sent size:  4 option:  3 router  10.10.10.254
dnsmasq-dhcp: 342453732 sent size:  4 option: 15 domain-name  testlab
dnsmasq-dhcp: 342453732 sent size: 18 option: 81 FQDN  03:ff:ff:6c:77:35:79:6f:70:32:64:73:79:2e...
dnsmasq-dhcp: 342453732 sent size:  8 option:  6 dns-server  8.8.8.8, 8.8.4.4
dnsmasq-dhcp: 342453732 sent size:  1 option: 46 netbios-nodetype  08
dnsmasq-dhcp: 342453732 sent size:  4 option: 44 netbios-ns  10.10.10.254

So the client is given the IP 10.10.10.21 (I changed it during the tests and the correct one is assigned every time, for every change - so the response to the request is correctly interpreted by the client) and, among others, the specific DNS servers.

Everything looks good from the dnsmasqside.

On the client I get

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . : testlab
   Description . . . . . . . . . . . : Intel(R) Centrino(R) Advanced-N 6205
   Physical Address. . . . . . . . . : 84-3A-4B-20-94-F0
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::74d6:d6c:a5cc:54c7%8(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.10.10.21(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : samedi 2 avril 2016 15:59:55
   Lease Expires . . . . . . . . . . : jeudi 7 avril 2016 16:03:15
   Default Gateway . . . . . . . . . : 10.10.10.254
   DHCP Server . . . . . . . . . . . : 10.10.10.254
   DHCPv6 IAID . . . . . . . . . . . : 75774539
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1C-87-7B-B4-3C-97-0E-67-52-6C
   DNS Servers . . . . . . . . . . . : 10.10.10.254
   Primary WINS Server . . . . . . . : 10.10.10.254
   NetBIOS over Tcpip. . . . . . . . : Enabled

I checked with Wireshark on the client the received traffic. In the DHCP ACK packet (the one recived from the DHCP server) the option is correct (so it was no stripped on the way or something like this):

The IP is OK but the DNS server is not correct: it defaults to the DHCP server - it looks like the received option is not correctly interpreted (?)

I am trying to understand namespaces in the context of lxd / lxc.

I have two containers which respective eth0 is bridged to br1 and br2 on the host. This is done via a Virtual Ethernet interfaces

root@srv:~# ip link
(...)

5: br1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default 
    link/ether fe:f0:ca:e8:c4:ae brd ff:ff:ff:ff:ff:ff
6: br2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default 
    link/ether fe:45:66:a8:37:a7 brd ff:ff:ff:ff:ff:ff
11: vethHRMPOM@if10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br1 state UP mode DEFAULT group default qlen 1000
    link/ether fe:f0:ca:e8:c4:ae brd ff:ff:ff:ff:ff:ff link-netnsid 1
27: vethNTG58H@if26: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br2 state UP mode DEFAULT group default qlen 1000
    link/ether fe:45:66:a8:37:a7 brd ff:ff:ff:ff:ff:ff link-netnsid 0

I wonder where the other side of, say, vethHRMPOM@if10 is?

ip netns list is empty.

/var/run/netns does not exist (this is an Ubuntu 15.10)

ip netns list-id shows

nsid 0 
nsid 1 

which seem to correspond to the last element in the ip list above. How can I get more information about these nsid 0 an 1 since all commands refer to a namespace by name (and not ID)?

Solid State Drives (SSD) have a garbage collection functionality which makes space from deleted files available. It is triggered

• automatically by the drive
• via a TRIM command sent by the OS

Is there a way to put an SSD in a state where the automatic garbage collection does not occur?

Having forensics data collection in mind, I would like to ensure that the checksum of the image does not change between collection exercises because of this functionality (all other precautions being in place).

I am setting up a small elasticsearch cluster and one of the nodes does not get any shards. It works, is part of the cluster - just empty (eu2 in the screenshot of head below):

This node is a worker, the only difference in the configuration vs. the other nodes are the lines

node.master: false
node.data: true

Is there a specific action which needs to be taken in order to have it populated with shards?

I have several devices, each with its own IP address. There are various names pointing to these addresses (in several different domains). As an example the device with

• IP address 10.0.0.1 is known as dev1.example.com and abc.example.net
• IP address 192.168.1.1 is known as dev2.example.com and xyz.example.net

in the respective DNS authoritative for example.com and example.net (A records).

I would like to understand if there are DNS implications of having both IP addresses pointing back (PTR) to a single name (say, contact-john-doe.example.org).

The rationale for this is to ensure that someone who sees one of the IP addresses in their logs, monitoring, etc. gets contact-john-doe.example.org as the resolved name. This resolved name may or may not point back to a real IP address/CNAME, it should not matter due to the nature of the service behind the IP addresses (these are scanners and they do not offer any service for the end user).

We have a password policy with a maximum password age of 180 days. For various reasons we need to change it to 90 days, with a minimum impact for the users.

Our users are normally warned about the upcoming password change several times before. If we changed the GPO today, those who changed their password more than 90 days ago would be faced with an immediate password change request, which would lead to problems. The obvious solution would be to send warnings telling them that password expiration will change on such and such day, so they are requested to change theirs before that day in order to reset their counter and not to be impacted. History and scientific studies have shown that such warnings are read, understood and taken into account in 0.37% of the cases.

Another possibility would be to enforce this new policy on a per-user basis only after the next password change (voluntary or forced by the expiration). If that was introduced today, the effective coverage would be in place after a maximum of 179 or 180 days (for those who would have changed their password right before the policy modification). Good enough.

Is there a suitable setting in for such a policy change?

I am starting with ansible and will use it, among others, to install packages on several Linux distros.

I see in the docs that the yum and apt commands are separated - what would be the easiest way to unify them and use something like this:

- name: install the latest version of Apache
  unified_install: name=httpd state=latest

instead of

- name: install the latest version of Apache on CentOS
  yum: name=httpd state=latest
  when: ansible_os_family == "RedHat"

- name: install the latest version of Apache on Debian
  apt: pkg=httpd state=latest 
  when: ansible_os_family == "Debian"

I understand that the two package managers are different, but they still have a set of common basic usages. Other orchestators (salt for instance) have a single install command.

I have a few Linux devices (without TOY chips, so they completely rely on ntp) which may boot without access to Internet (the link to the switch is up). The ntp service will start but obviously no peers will be contacted. I then end up with an ntp service which is running but not synchronizing with any peers (ntpq -p gives an .INIT. status)

The problem is that this does change when connection to Internet is established.

If the connection is available at boot time then everything works fine. Idem if I manually issue a service ntp restart (ntp connects to the peers and time is correctly synchronized).

Shouldn't ntp try to reconnect at regular intervals?

• if yes: is this something I am expected to configure (I did not see anything in the config)
• if not: what would be a good way to handle the service restart, or service start delay (I could assume that connectivity to Internet will be back n minutes after bootup)

Note: It looks like from the docs that the maximum pool time (which I understand is the max time ntp will try to connect to peers before giving up?) is 1024 seconds = 17 minutes, which is way more than the time needed to establish Internet access (about 2 to 5 minutes, worst case)

With the introduction of Google Authenticator and the ability to use it with ssh I was wondering if someone has gone through a sshd_config setup which would

• first expect a key
• if this fails, fall back to an authentication with Google Authenticator

The idea being to usually connect seamlessly with a key and, usually in less friendly environments, connect with a two factor mechanism.