KCLUG

1 participants
3235 discussions

RE: KCLUG.NET available
by Kelsay, Brian - Kansas City, MO 07 Feb '06

07 Feb '06

For a preconfigured solution, see www.IPCop.org, current version is 1.4.10. The Red is Internet, Green is local LAN, Orange is DMZ, Blue is untrusted wireless. You use DMZ pinholes to allow specific hosts or a range of hosts to have direct connection from one net to another. E.g. allow specific IP address access to server on Orange (DMZ) so that your laptop can admin the server. Blue (wireless), by default has access to the internet, but you may want to add nocatauth to allow you to add an acceptable useage notice to users. -----Original Message----- From: On Behalf Of Jack Dinsmore Sent: Tuesday, February 07, 2006 1:33 PM To: kclug(a)kclug.org Subject: Re: KCLUG.NET available I disagree. The way I see it he could build a tri-homed firewall. Three NICs , One NIC is a wireless on a private IP range, one NIC is assigned a different IP range, and the third connects to the Internet. I don't know enough about switches to analyze the first answer, but it seemed reasonable, basically the same as my solution - except the switch is the tri-homed device. My solution has the added benefit of offering some protection to the wireless device and also prevents maliscious persons from using the wireless to launch attacks. The downside is, if the tri-homed device is compromised all is exposed. Another solution here would be to have a gateway firewall machine, put the wireless on the DMZ side of this firewall add a DMZ firewall protecting the internal network from both the wireless and the Internet. solution #2: Internet | +----------+ | Firewall | +----------+ | | +----------+ +------| Wireless | | +----------+ | +----------+ | Firewall | +----------+ | | +----------+ | LAN | +----------+ solution #1: Internet | +----------+ | Firewall | |----------| | FW | FW | +----------+ | | | | +----------+ | +------| Wireless | | +----------+ | +----------+ | LAN | +----------+ Granted this configuration is an advanced firewall, and the previous set up requires two different firewalls. In all cases the first firewall is a gateway firewall and the others are choke firewalls. However it is doable without a second access point. The first solution can be done with a single iptables configuration. Brian JD

1 0

dual monitor nvidia board lowered in resolution on new 1.0.8178
by hanasaki 03 Feb '06

03 Feb '06

dual monitor nvidia board lowered in resolution on new 1.0.8178 tis a geforce 5700 from gainward. darn thing ran dual at 1600x1200 per monitor now its running in one of the monitors is running at a lower resolution than the other. Any thoughts? # nvidia-xconfig: X configuration file generated by nvidia-xconfig # nvidia-xconfig: version 1.0 (buildmeister@builder3) Wed Dec 14 16:39:22 PST 2005 # XF86Config-4 (XFree86 X Window System server configuration file) # # This file was generated by dexconf, the Debian X Configuration tool, using # values from the debconf database. # # Edit this file with caution, and see the XF86Config-4 manual page. # (Type "man XF86Config-4" at the shell prompt.) # # This file is automatically updated on xserver-xfree86 package upgrades *only* # if it has not been modified since the last upgrade of the xserver-xfree86 # package. # # If you have edited this file but would like it to be automatically updated # again, run the following commands as root: # # cp /etc/X11/XF86Config-4 /etc/X11/XF86Config-4.custom # md5sum /etc/X11/XF86Config-4 >/var/lib/xfree86/XF86Config-4.md5sum # dpkg-reconfigure xserver-xfree86 # Option "Xinerama" # Option "NvAGP" "1" # Option "TwinView" "true" # Option "SecondMonitorHorizSync" "30.0-121.0" # Option "SecondMonitorVertRefresh" "48.0-160.0" # Option "MetaModes" "1280x1024, 1280x1024; 1280x1024, 1280x1024;" Section "ServerLayout" # Screen 0 "ScreenPrimary" 0 0 # Screen "ScreenSecondary" RighOf "ScreenPrimary' # Option "Xinerama" # Option "NvAGP" "1" # Option "TwinView" "true" # Option "SecondMonitorHorizSync" "30.0-121.0" # Option "SecondMonitorVertRefresh" "48.0-160.0" # Option "MetaModes" "1280x1024, 1280x1024; 1280x1024, 1280x1024;" # Option "TwinViewOrientation" "LeftOf" Identifier "Layout" Screen 0 "OneBigWide" 0 0 InputDevice "Generic Keyboard" InputDevice "Configured Mouse" EndSection Section "Files" # local font server # if the local font server has problems, we can fall back on these FontPath "unix/:7100" FontPath "/usr/lib/X11/fonts/misc" FontPath "/usr/lib/X11/fonts/cyrillic" FontPath "/usr/lib/X11/fonts/100dpi/:unscaled" FontPath "/usr/lib/X11/fonts/75dpi/:unscaled" FontPath "/usr/lib/X11/fonts/Type1" FontPath "/usr/lib/X11/fonts/CID" FontPath "/usr/lib/X11/fonts/Speedo" FontPath "/usr/lib/X11/fonts/100dpi" FontPath "/usr/lib/X11/fonts/75dpi" EndSection Section "Module" Load "bitmap" Load "dbe" Load "ddc" Load "extmod" Load "freetype" Load "glx" Load "int10" Load "record" Load "speedo" Load "type1" Load "vbe" EndSection Section "InputDevice" Identifier "Generic Keyboard" Driver "keyboard" Option "CoreKeyboard" Option "XkbRules" "xfree86" Option "XkbModel" "pc104" Option "XkbLayout" "us" EndSection Section "InputDevice" Identifier "Configured Mouse" Driver "mouse" Option "CorePointer" Option "Device" "/dev/gpmdata" Option "Protocol" "IntelliMouse" Option "ZAxisMapping" "4 5" EndSection Section "Monitor" Identifier "NFL9905" HorizSync 36.0 - 90.0 VertRefresh 50.0 - 140.0 Option "DPMS" EndSection Section "Monitor" Identifier "Samsung900DF" HorizSync 36.0 - 90.0 VertRefresh 50.0 - 140.0 Option "DPMS" EndSection Section "Device" # Option "ConnetedMonitor" Identifier "DualHeadNVida5700a" Driver "nvidia" BusID "PCI:01:00:0" Screen 0 EndSection Section "Device" # Option "ConnetedMonitor" Identifier "DualHeadNVida5700b" Driver "nvidia" Option "NvAgp" "0" BusID "PCI:01:00:0" Screen 1 EndSection Section "Screen" Identifier "ScreenPrimary" Device "DualHeadNVida5700a" Monitor "NFL9905" DefaultDepth 24 SubSection "Display" Viewport 0 0 Depth 24 Modes "1920x1440" "1600x1200" "1024x768" EndSubSection EndSection Section "Screen" Identifier "ScreenSecondary" Device "DualHeadNVida5700b" Monitor "Samsung900DF" DefaultDepth 24 SubSection "Display" Viewport 0 0 Depth 24 Modes "1920x1440" "1600x1200" "1024x768" EndSubSection EndSection Section "Screen" Identifier "OneBigWide" Device "DualHeadNVida5700a" Monitor "Samsung900DF" DefaultDepth 24 Option "Xinerama" Option "NvAGP" "1" Option "backingstore" "true" Option "TwinView" "true" Option "TwinViewOrientation" "LeftOf" Option "SecondMonitorHorizSync" "36.0-90.0" Option "SecondMonitorVertRefresh" "50.0-140.0" Option "MetaModes" "1600x1200, 1024x768;" SubSection "Display" Viewport 0 0 Depth 24 Modes "1600x1200" EndSubSection EndSection

3 3

Po' Man's SAN
by Charles Steinkuehler 02 Feb '06

02 Feb '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I work for a fairly small company and am getting ready for our next round of server upgrades (every 5-6 years whether we need it or not!). I'd like to get some of the benefits of having a SAN (mainly one place to add/manage raid-cards & HDDs), but don't really need the performance or sticker-shock of the commercially available units. Basically a big chunk of SATA RAID storage I can share between a few systems (mail server and a couple of file servers) would be ideal. I'm currently thinking the ATA-over-Ethernet stuff looks like about the right fit...no expensive fiber-channel, no accelerated TCP/IP cards required for decent performance (the protocol is raw ethernet, no IP involved). I can start off with 'dedicated' storage areas for each machine (using 'conventional' ext3/jfs/etc filesystems) , and graduate to something like GFS in the future, if necessary. I'd start out running over GigE copper, possibly bonding a couple interfaces on the actual data server (or maybe even migrate to 10GigE) if required for performance. Has anyone setup anything like this, or played around with AoE? Am I missing some obvious solution to doing the same thing without using 'exotic' technology like AoE, iSCSI, or <insert buzzword of the day>? I know a bunch of you run linux on 'real' hardware, but my experience has been limited mainly to the 32-bit x86 world, and software RAID [1|5] + LVM is about as fancy as we get. Any comments/pearls of wisdom will be greatly appreciated! - -- Charles Steinkuehler charles(a)steinkuehler.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFD4naMLywbqEHdNFwRAonuAJ4sG7O7TqonCN+7O41HLDXy47JeCgCfYbcq ythyQKcWJAgzaGAHwADugY4= =qiR9 -----END PGP SIGNATURE-----

1 0

Job Posting
by Dan Thomasset 02 Feb '06

02 Feb '06

The Stowers Institute for Medical Research has an opening for a Linux System Administrator: http://www.stowers-institute.org/ScientistsSought/ScientistsSought.asp ---------------------------------------------- Systems Administrator The Stowers Institute for Medical Research has an opening for a Systems Administrator to support the Unix and Linux systems in the department of Information Technology. Responsibilities include building and maintaining the Unix infrastructure; administering the Unix and Linux systems, including desktop and server installation, configuration, maintenance, and security; and providing programmer services in Bash or Bourne shell, Perl, Python; C/C++ or Java. In addition to excellent communication skills and the ability to effectively work in a team-oriented environment, the successful candidate will have expertise in system installation, configuration, maintenance, and troubleshooting; server configuration; fundamental knowledge of security and RDBMS; experience with TCP/IP networking; distributed computing environments and network services including Sendmail, Apache, NFS, NTP, and NIS; experience with capacity planning, performance tuning, backup, and recovery; and knowledge of cross-platform and porting. The minimum requirements include a degree in computer science or a related field and three to five years of experience in Linux and/or Unix systems administration; an AA degree in computer science or a related field and five to seven years of experience in Linux and/or Unix systems administration; or a HS diploma and three to five years of experience in Linux and/or Unix systems administration. Apply at: http://www.stowers-institute.org/ScientistsSought/ScientistsSought.asp

4 3

RE: state of Missouri to archive cell phone location data?
by Kelsay, Brian - Kansas City, MO 31 Jan '06

31 Jan '06

>From the Article: "The program charts drivers' relative speed by measuring the time between the intermittent signals cell phones send to towers along a stretch of road. Then, that information - stripped of the personal identification and serial numbers that identify the cell phone's owner - is overlaid with highway maps to determine where the phones are and how fast they are moving." This says ABSOLUTELY NOTHING about issuing speeding tickets. I assume that this is to add functionality to the KCScout system. The call for hoax on the original email stands. Though this has the POTENTIAL to do the speeding ticket thing, there is no proof that this is what it is intended for and there are still many major hurdles to overcome. -----Original Message----- From: Jeremy Turner Sent: Monday, January 30, 2006 10:41 AM I can't find a date of Feb 1, but it has been approved: http://www.kansascity.com/mld/kansascity/news/local/13314831.htm http://hardware.slashdot.org/article.pl?sid=05/11/01/159241 >From what I read, it is more for aggregate data, traffic conditions, etc. Although they could probably start tracking individual users if they wanted to. If this became more common place and people heard about it, you'd have some upset users. I've heard that OnStar can't pass on speed info to authorities. Although, they could probably be strong-armed. Jeremy

5 4

RE: getting to www servers from inside where they have an Internal IP
by Jeremy Fowler 31 Jan '06

31 Jan '06

> The "wacky" port numbers for the httpd are to keep it off low numbered > ports and run as non-root. Any suggestions for something > better and how > to do it? Well, I think the only security reason to run an http server on a port other than 80 is to hide it from the general public. Port scanners can get around this hurdle quite easily though. Plus, the fact that you SNAT port 80 to that high number port, as far as I can see, makes it useless. Might as well just run the server on port 80 and save yourself some potential headaches. > ah.. "split dns" cute term... what iptables rules can be put in the > firewall to bounce the traffic back? Tried it and failed :( Split DNS has nothing to do with iptables. Its just telling your DNS server to resolve a host to a different address if the request comes from inside your network. It would be the ideal solution. Just host you http server on port 80, and split your DNS to resolve local requests to the internal IP. Problem solved. However, if you insist on keeping the high port, you could still DNAT requests for the external IP of your http server back to the internal IP:port. So anything going to port 80 of the external IP address of your webserver thru your firewall is redirected back into your network. Try this: Assuming: External IP of HTTP Server: 63.63.63.63 Internal IP of HTTP Server: 10.1.1.3 External Port of HTTP Server: 80 Internal Port of HTTP Server: 7777 External interface of your firewall: eth0 Internal interface of your firewall: eth1 iptables -t nat -A PREROUTING -i eth1 -p tcp -d 63.63.63.63 \ --dport 80 -j DNAT --to-destination 10.1.1.3:7777

4 4

OT: Teir 1 technical support Job Opening @ VoIP company
by crash3m 31 Jan '06

31 Jan '06

We have an opening for a Teir 1 tech support rep at our company. The more tech savvy the better, though VoIP experience is not required. There is a definate chance for advancement at this position. Must have pleasent phone demeanoer. You can send your resumes to me, and I will pass them on to management. While the other techs do run windows on their workstations, you can run linux. Our service runs strictly from linux servers, so being comfortable with a shell will help, as will knowledge of tethereal/ethereal and ngrep. Good luck! Matt Luettgen -- Got gmail? I do hahaha

1 0

(no subject)
by Kelsay, Brian - Kansas City, MO 31 Jan '06

31 Jan '06

Where's my tinfoil hat today? Is it work release day at the nuthouse? -----Original Message----- From: kclug-bounces(a)kclug.org On Behalf Of James Nelson Sent: Monday, January 30, 2006 3:13 PM It's a heck of a lot more simple than that and it's not only the U.S. Government that can 'tap' your calls at will. Check out this Fox News story from 2001: http://www.informationclearinghouse.info/article6480.htm > -----Original Message----- > From: kclug-bounces(a)kclug.org On Behalf > Of David Nicol > Sent: Monday, January 30, 2006 2:53 PM > To: kclug; kcpm > Subject: more hot gossip to distract you from your real work > > ---------- Forwarded message ---------- > From: Marsee Henon <> > Date: Jan 30, 2006 10:11 AM > Subject: O'Reilly Podcast Includes NSA Wiretapping News Scoop > To: kcpm-moderate(a)davidnicol.com > > > Hello-- > > "Distributing the Future" this week features a scoop we > thought was worth sharing: > > Wiretapping doesn't require someone lurking in the bushes with a > directional antenna and headphones, or a pair of aligator clips and a > tape recorder, or someone sneaking into your room while you're out to > place a transmitter on your phone. In the U.S., if it's the government > doing the wiretapping, it's technically simple. At the O'Reilly Emerging > Telephony Conference Jack Herrington, author of "Podcasting Hacks" > interviewed Electronic Frontier Foundation Chairman of the Board Brad > Templeton about the technical, social, and political aspects of > wiretapping. At the end there's a nice juicy hint about upcoming action > from the EFF with regards to the recent NSA wiretapping case. > http://www.oreillynet.com/future > > --Marsee

4 3

more hot gossip to distract you from your real work
by David Nicol 30 Jan '06

30 Jan '06

---------- Forwarded message ---------- From: Marsee Henon <marsee(a)oreilly.com> Date: Jan 30, 2006 10:11 AM Subject: O'Reilly Podcast Includes NSA Wiretapping News Scoop To: kcpm-moderate(a)davidnicol.com Hello-- "Distributing the Future" this week features a scoop we thought was worth sharing: Wiretapping doesn't require someone lurking in the bushes with a directional antenna and headphones, or a pair of aligator clips and a tape recorder, or someone sneaking into your room while you're out to place a transmitter on your phone. In the U.S., if it's the government doing the wiretapping, it's technically simple. At the O'Reilly Emerging Telephony Conference Jack Herrington, author of "Podcasting Hacks" interviewed Electronic Frontier Foundation Chairman of the Board Brad Templeton about the technical, social, and political aspects of wiretapping. At the end there's a nice juicy hint about upcoming action from the EFF with regards to the recent NSA wiretapping case. http://www.oreillynet.com/future --Marsee ================================================================ O'Reilly 1005 Gravenstein Highway North Sebastopol, CA 95472 http://ug.oreilly.com/ http://www.oreilly.com ================================================================ -- David L Nicol "It is pointless to give advice and sometimes dangerous to take it." -- Gore Vidal

2 1

Permissions for webadmin access on FC4
by Jon Moss 30 Jan '06

30 Jan '06

I know I'm probably going to get slammed for being an idiot, but oh well . . . I've finally got some help (volunteer) for the church webserver I host at home. It's an FC4 server with Apache 2.x installed. She's from the M$ world and asking me about ASP and DreamWeaver access, which I told her was a no go. Learn PHP! :) Anyway, I created a webadmin account that I want to have full access to the /var/www/html folder tree. I added that account to the apache group, but that didn't work. What is the proper process for accomplishing this? I don't want to give this person root access to the server. -- Thanks very much, Jon Moss jon.moss(a)cnonline.net

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG