user99545's questions

Recently I have come across a security module for the Linux kernel called Linux-VServer which allows you to virtualize many things and "partition" the OS to reduce the effects of a compromise. I was surprised to see that it required a re-compilation of the kernel as most of these types of things are simply modules that can be loaded at run time (selinux, apparmor).

My problem with recompiling the kernel to enable Linux-VServer is I am a beginner when it comes to compiling my own kernel. I use the Ubuntu package repositories to update my kernel which gives me the peace of mind that whoever compiled it, configured it properly so there won't be too many problems down the road. Is there a way to obtain the kernel configuration file (the thing created from running make menuconfig) that Ubuntu uses for their kernel distributions? I have tried looking at kernel compilation guides but most just explain how to download, extract and run make on the kernel, documentation about the actual configuration seems to be sparse.

I tried running apt-get source linux-image-3.2.0-generic on my Ubuntu box in hopes of grabbing the "configuration file", but I am presented with the error Unable to find a source package for linux-image-3.2.0-generic. Any ideas? Thank you!

I have setup several drives in an Ubuntu 12.04 x64 machine by deleting all the partitions and formatting them as ext4 with fdisk, but when I ran df -h, it showed me that a substantial amount of the drive space had already been used up. For example, on my 1TB drive, it showed me that 14GB was already in use. I mounted the drive to a folder and went to examine it with ls -a and there are no files except for a directory lost+found that contains no files which really confuses me. Where are these 14GB "hiding"? I have tried re-partitioning it twice and un-mounting and then mounting again but no luck. Must I run dd to wipe the drive with /dev/null to regain those 14GB? If it is 100MB or so I would not complain, but 14GB is a lot of space.

I was wondering if it was possible to setup a local DNS server though BIND9 that contained a large amount of entries for DNS names, similar to what an ISP DNS server or something like Google DNS would have. I have explored some options, active DNS caching being one of them. This article along with this post, both demonstrate how to setup a DNS daemon to save a copy when somebody on the network queries a DNS name so the next query is much quicker as it is no longer having to perform an external DNS request. While this is a step in the right direction, I was wondering if it was possible to download all these "cached entries" or a huge DNS zone file beforehand so I would not have to manually load a whole bunch of sites for my server to make sense. Is this how ISPs or Google DNS runs their DNS servers, with a huge DNS file? How can I get one of these? I have looked into zone transfering which is nicly demonistrated here, but according to the guy, most DNS servers deny zone transfers so it appears I am out of luck.

I am doing this for a couple reasons, first because I would like to have a faster connection ( I saw the speed increase greatly when I switched from my ISP servers to OpenDNS) and because I would like to explore the science in how ISP's run their DNS servers and how all these things work with a hands-on approach instead of reading a huge book or article.

I have been working with the firewall/router distribution Pfsense for a while now and I have been trying to figure out how to "isolate" a server on my LAN from other computers on my LAN by using deny/reject LAN rules. I have tried adding a rule under Firewall->rules->LAN that denies a device (my phone for example 192.168.1.102) from sending any TCP packets to my web server at 192.168.1.105. For some reason, the packets manage to get though. The odd part is that if I specify the router itself as the destination, and to block the phone/computer from talking with it, it works. I have tested this with a wireless laptop and wireless phone, both on the same subnet.

My topology is as follows:

(internet)->(modem)->(pfsense)->(wireless router /w switch)->(wired devices)
                                            |
                                        (Wireless laptop/phone)
| == wifi
-> == wire

Is it possible the wireless router/switch is just relaying the packets from my phone to the server and completely bypassing the firewall (explaining why my rule isn't working)? If so, how could I set it up so that all LAN traffic has to go though my firewall to talk to any other computer on the network?

Image of the web interface available here as 3 rep won't let me post an image :( image

I am trying to setup a home VPN with IPsec as I have read about PPTP having some security problems and being outdated. I found an article on the web that shows you how to setup an IPsec VPN here which I was able to follow and setup, but when I went to connect to it I could not. I tried port scanning the router from the LAN and by using a computer outside of my LAN and both scans concluded that port 500 (the VPN port) was closed. Is there something else I have to do to set it up to listen so clients can connect? I checked the error logs and everything was clean so I am confused here.

In addition, from what I know IPsec is supposed to be a wrapper around L2TP so am I supposed to setup L2TP first and then configure my IPsec to work with L2TP which would explain why it's not "listening"? If so, could you kindly share a link with me that helps me accomplish that? I've gone though the first couple pages of Google and all I can seem to dig up is PPTP guides. Many thanks!

I run a Ubuntu 11.10 server at my house and in the past I have been using apt-get to keep all my packages up to date. Recently I noticed that when I run apt-get update/upgrade the version of some software is usually not the latest. Apache for instance is a good x.2.x versions behind the latest on Apache's website. The change logs that Apache provides indicates that the version on their site has updated several security vulnerabilities. This means that there are vulnerabilities for the version I have installed using apt-get.

In simple terms, is it better to download and compile essential software from source such as SSH and Apache to have the most secure and up-to-date version or is using a package manager such as apt-get a better option? I run only 1-2 servers so automating or updating multiple machines does not apply to me. Thank you!