- Roundtable - muug.ca

forcing dns over vpn
by Trevor Cordes 02 Nov '15

02 Nov '15

I've setup a linux server with a strongswan VPN server. I have a Win7 (also, separately, Android) client (builtin IKEv2) connecting ok to the linux server. Things seemed to be VPN'ing nicely. I can get to internal hosts on other subnets I wouldn't be able to see without the VPN. I can watch the ESP traffic to/from the client with tcpdump. (For these tests the clients are on a separate locked-down subnet for my wifi.) But I noticed some traffic isn't using the VPN. It's just coming in on the normal wifi connection/subnet. In particular, I'm looking at DNS udp port 53. If I ping from Windows to wherever, the dns occurs over non-VPN (I run my own caching name server, so the same linux server is the DNS server in this case.) I want dns to hit my server over the VPN. The strongswan is configured on server to provide a DNS server entry to the client. I can confirm Windows is seeing the proper DNS server on the VPN with ipconfig /all. I can even try to set those servers manually in the Win7 VPN properties menus. But the dns query never goes out over the VPN. For kicks I iptables'd out port 53 from the non-VPN'd IP and then the client can't resolve anything (ie it doesn't fallback to using the VPN). So if I ping from the VPN to anywhere on the net, the DNS is not VPN'd but the ICMP *is*. Same with web browsing: it seems to do non-VPN DNS and then VPN the http traffic. How can I force the Windows client to force *all* traffic over the VPN? Especially DNS. After that's fixed, how can I force *all* traffic over the VPN on Android? I've heard rumours Android screws with VPN and makes some things impossible. Thanks!

2 1

IP rule (multihoming) problem
by Adam Thompson 28 Oct '15

28 Oct '15

I have CentOS 6 system - my tape backup server - that's connected to two different subnets ("100" and "158"). There is also a router (actually a firewall) that routes between subnets "100" and "158". The server's default gateway is the router IP on subnet "158". The server's primary management IP address is the address on subnet "158". There are client systems on subnet "100", both management workstations and things to back up. When I try to SSH to the management IP in 158, the default behaviour in Linux is to send the reply back out the 'closest' interface, which is the "100" interface. This breaks things, because the router is actually a stateful firewall and I suddenly have asymmetric routing. If I "ifconfig down" the "100" interface, suddenly everything works again... except now a large volume of traffic has to run through the firewall. I'm trying to follow the various guidelines I've found for doing "ip rule" rules, but none of them seem to work. Has anyone here accomplished this sort of thing before? [image: Avant logo] *Adam Thompson* Senior Systems Administrator *voice:* 204.789.9596 x24 | *email:* athompson(a)avant.ca | *web:* avant.ca

4 4

raid 1 on partitions on raid 0 on paritions; booting; bug??
by Trevor Cordes 25 Oct '15

25 Oct '15

I'm soliciting opinions on whether this is a bug or not. I had this wacky setup on my Fedora 21 (don't ask why!): RAID1 on top of 1st HALF: 2nd HALF: partitions partitions on top of on top of RAID0 raw disk on top of partitions on top of raw disk And it all worked great. Until I rebooted. Then the RAID1's would come up but degraded, with only their non-RAID0 half ("2nd HALF" above) in the array, and the RAID0 parts "gone". I could then re-add the RAID0 half, reboot and get the same thing. No matter what I did (messing with mdadm, dracut, grub2, etc) I couldn't get these things to assemble properly on boot. Lots of bugs on the net about simpler cases of nested RAID having the same problem, and many bz's were fixed years ago regarding this. I checked, and their fixes are in my distro. I got some help from the old bug guys and when I redid my setup to be layered like this instead: RAID1 1st HALF: 2nd HALF: RAID0 partitions paritions raw disk raw disk ... it all magically worked, and they came up on boot, and the bug disappeared. The only difference being whether I partition my RAID0 array or make partitions and then put the multiple RAID0's separately, directly into each RAID1 array. (The reason I didn't want to do this in the first place is I was making 5 of these groupings and I didn't want to manage 10 arrays, just 6. And it was only temporary anyhow. I know the buggy setup is bad design.) My question is, is this a bug I should report? In theory, in my mind, the RAID1 on partitioned RAID0 should work fine. The fact mdadm and the kernel happily support it leans me towards answering "yes". If I can have it live in the kernel, why not have it survive reboots? I thought you could nest arbitrary combinations and levels (to X depth) of md, lvm, paritions, etc. (And, yes, I really tried everything to make it boot, including insanely detailed mdadm.conf and grub2 boot lines, to minimal configs, and yes I have partition type fd.) However, I want to make sure I'm not doing something here that is completely insane and shouldn't be supported. It appears dracut, udev and mdadm are responsible for all of this. That's where the other similar bugs were fixed. Details: Here's what it looked like when it was buggy. md9 was the big RAID0 array that was then parititioned into 4. Note how md9 does come up, get recognized, but then the boot stuff doesn't "recurse" into those partitions to see that they themselves are array components. So then md126 (root by the way) only comes up with 1 or 2 components, after an annoyingly long delay. Oct 23 02:37:57 pog kernel: [ 19.542533] sd 8:0:3:0: [sdc] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA Oct 23 02:37:57 pog kernel: [ 19.542624] sd 8:0:2:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA Oct 23 02:37:57 pog kernel: [ 19.553021] sdb: sdb1 sdb2 Oct 23 02:37:57 pog kernel: [ 19.553835] sda: sda1 sda2 sda3 sda4 Oct 23 02:37:57 pog kernel: [ 19.554991] sdc: sdc1 sdc2 Oct 23 02:37:57 pog kernel: [ 19.556918] sd 8:0:2:0: [sdb] Attached SCSI disk Oct 23 02:37:57 pog kernel: [ 19.558970] sd 8:0:3:0: [sdc] Attached SCSI disk Oct 23 02:37:57 pog kernel: [ 19.559332] sd 8:0:0:0: [sda] Attached SCSI disk Oct 23 02:37:57 pog kernel: [ 19.610787] random: nonblocking pool is initialized Oct 23 02:37:57 pog kernel: [ 19.737894] md: bind<sdb1> Oct 23 02:37:57 pog kernel: [ 19.742379] md: bind<sdb2> Oct 23 02:37:57 pog kernel: [ 19.744213] md: bind<sdc2> Oct 23 02:37:57 pog kernel: [ 19.748375] md: raid0 personality registered for level 0 Oct 23 02:37:57 pog kernel: [ 19.748619] md/raid0:md9: md_size is 285371136 sectors. Oct 23 02:37:57 pog kernel: [ 19.748623] md: RAID0 configuration for md9 - 1 zone Oct 23 02:37:57 pog kernel: [ 19.748625] md: zone0=[sdb2/sdc2] Oct 23 02:37:57 pog kernel: [ 19.748631] zone-offset= 0KB, device-offset= 0KB, size= 142685568KB Oct 23 02:37:57 pog kernel: [ 19.748633] Oct 23 02:37:57 pog kernel: [ 19.748650] md9: detected capacity change from 0 to 146110021632 Oct 23 02:37:57 pog kernel: [ 19.752284] md9: p1 p2 p3 p4 Oct 23 02:37:57 pog kernel: [ 19.776482] md: bind<sda1> Oct 23 02:37:57 pog kernel: [ 19.786343] md: raid1 personality registered for level 1 Oct 23 02:37:57 pog kernel: [ 19.786643] md/raid1:md127: active with 2 out of 2 mirrors Oct 23 02:37:57 pog kernel: [ 19.786669] md127: detected capacity change from 0 to 419364864 Oct 23 02:37:57 pog kernel: [ 19.823529] md: bind<sda2> Oct 23 02:37:57 pog kernel: [ 143.320688] md/raid1:md126: active with 1 out of 2 mirrors Oct 23 02:37:57 pog kernel: [ 143.320733] md126: detected capacity change from 0 to 36350984192

1 0

transistor wall-clock
by Trevor Cordes 19 Oct '15

19 Oct '15

Off-topic, but cool: http://www.transistorclock.com/?imm_mid=0da80b&cmp=em-prog-na-na-newsltr_20… A guy selling kits to make a all-parts-exposed digital wall clock that uses *no ICs* and *no crystals*. You build it yourself, 1250 parts to solder onto a custom board. Too pricey for me, otherwise I'd love to put one together. ICYW, I dug around the FAQ and he is cheating a bit: he's using the 60Hz of the AC as a timer source. Hmm, since it plus into AC, does that mean touching some parts of the exposed circuits might give you a nice zap?

7 7

paul-nechifor/ohmu · GitHub
by Adam Thompson 19 Oct '15

19 Oct '15

https://github.com/paul-nechifor/ohmu Someone was looking for something like this recently... -Adam -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

2 1

Re: [RndTbl] transistor wall-clock (John Donovan)
by jd 18 Oct '15

18 Oct '15

Exposed components or not, I hope the instructions advise youngsters AGAINST taking their finished clockwork to Show&Tell ** "Any technology, sufficiently advanced, is indistinguishable from magic." ++ _ _ ** Sept.15th news item: Irving,Tx teen Ahmed Mohamed, repackaged a Micronta clock's guts into a size-small tech briefcase 'pencil case' enclosure, and trotted off to school with it. The clock was received with [ahem] alarm(s). Kid gets arrested, gets released, gets invited to TheWhiteHouse & to MIT, then gets (at least) $15k in 'support', etc. In defense of Histrionics, any Hollywood SFX designer would vote that choice of enclosure, so..C'mon! In defense of Kid: Those old Microntas never showed a CountDown mode, so..C'mon! ++ One of 130-or-so Murphy's Laws quotes&quips from a mid-80s dos freeware: " murphy.com " Another example: "If carpenters built buildings the way programmers built programs, the first woodpecker to come along would destroy civilisation." Any time you execute murphy, it outputs a fairly random (think:fortune) selection on console. Dan Keizer &/or Kelly Kitson were always handing me dos utils, like this - e.g: Vern Buerg's (still) excellent LIST.com, uEmacs, f32 filer, QT fuzzy clock ("it's around quarter to three"), kermit, etc. Some say murphy was compiled (gathered) by a Canadian salesguy w/ Data General (Edmonton?). I should have a vintage'85 CP/M 5.25" from Austin Codeworks, with source in murphy.ASM or _.FOR .. It's gotta be somewhere around here .. [fumble] .. or in here .. [shuffle] .. or maybe in he.. [sound effect: "Fibber McGee & Molly" hall closet avalanche]

1 0

MUUG PayPal payments with two-factor
by Trevor Cordes 16 Oct '15

16 Oct '15

It was brought up by Wyatt that 2-factor auth ("security key") login in the new MUUG PayPal payment system does not work. It won't let you login. Note, if you don't know what 2-factor auth or PayPal's "security key" is (hint: it's not your "password"), then you aren't using it and you can ignore this notice. It seems PayPal is aware of this bug, and are working on putting 2-factor auth into all their API's, including the one MUUG is using. Who knows when they'll get it done. I did find a new workaround that might help: Login to PayPal first, manually, using your 2-factor auth, by going to their main page. Then access the MUUG payment interface before you timeout (around 10 minutes). It may just let you skip the login completely via the MUUG links. The only other option is to go into PayPal manually and disable 2-factor auth before you use the MUUG system. Also, you can always skip the login completely and use the "buy as guest" option to enter your card details directly. >From a quick show of hands it appears less than 5% of our users are using 2-factor, so for the time being we'll just be hoping PayPal fixes this bug soon.

2 2

Pricerazzi Live!
by Robert Keizer 13 Oct '15

13 Oct '15

Hey MUUG, I've been crazy busy the last few months - I'm a co-founder in a company! We do the work of searching competitors sites to get you money back using price protection policies. We just launched an app for iOS and Android to make it easier to send us receipts. https://www.pricerazzi.com/ All the best, Rob

1 0

Re: [RndTbl] security implications of "what's your rock-star name"-type quizzes
by Trevor Cordes 08 Oct '15

08 Oct '15

That's why for security questions I use randomly generated, long strings. My security questions have stronger passwords than my passwords! Security questions aren't. They should be called insecurity questions. They're the stupidest idea ever. I would never program a web site with them.

1 0

security implications of "what's your rock-star name"-type quizzes
by Kat 08 Oct '15

08 Oct '15

These have been around for ages in magazines, but there seem to be even more of them recently on Facebook (sometimes posted from a third-party site). Some of the suggestions/questions are harmless, but I've noticed there are a few floating around like: "for your rock star first name, use the name of your first pet", or "your mother's maiden name". As in, on this public forum under your full name, please post what you use as an answer for security questions for your bank, email, etc. Even if the 3rd-party site isn't involved, you can bet someone else is scraping that data. I'll be having a word with my family and friends... -- ------------------------------------------------------------ Katherine Scrupa Network Technology CCNA, Hons.

1 0