My Linux IPSec/VPN setup and requirements
In response to my entry mentioning perhaps writing my own daemonto rekey my IPSec tunnel , anumber of people made suggestions in comments. Rather than write along response, I've decided to write up how my current IPSec tunnelworks and what my requirements are for it or any equivalent. As faras I know these requirements rule out most VPN software, at leastin its normal setup.
My IPSec based GRE tunnel runs between my home machine and my workmachine and its fundamental purpose is to cause my home
Delays on bad passwords considered harmful, accidental reboot edition
Here is what I just did to myself, in transcript form:
$ /bin/suPassword:[delay...]['oh, I must have mistyped the password'][up-arrow CR to repeat the su]bash# reboot Cue my 'oh damn' reaction .
The normal root shell is bash and it had a bash history file with'reboot' as the most recent command. When my
suinvocation didn't dropme into a root
Using the SSH protocol as a secure transport protocol
I have an IPSec problem: my IPSec tunnel uses constant keys , with no periodic automatic rekeying. WhileIPSec has an entire protocol to deal with this called IKE, in practiceIKE daemons (at least on Linux) are such a swamp to wade into that Ihaven't been willing to spend that much time on it. Recently I had arealization ;rather that wrestle with IKE, I could just write a special purposedaemon to rekey the tunnel for me. Since both ends of the IPSec tunnelneed to
I'm happier ignoring the world of spam and anti-spam
As I've mentioned a couple of times, I'm currently running a sinkholeSMTP server to collect spam samples . Doing this has letme learn or relearn a valuable lesson about anti-spam work.
My sinkhole SMTP server has several sorts of logging and monitoring,including a log of SMTP commands, and of course I can run it or turnit off as I feel like. When I first set it up, I configured it to beauto-started on system reboot and I watched the SMTP command
The effects of a moderate Hacker News link to here
A few days ago my entry on Intel screwing up their DC S3500 SSDs was posted to Hacker News here and rose moderatelyhighly up the rankings, although I don't think it made the frontpage (I saw it on the second page at one point). Fulfilling anold promise , here's a report of what theresulting traffic volume looked like.
First, some crude numbers from this Monday onwards for HTTP requestsfor Wandering Thoughts , excluding Atom feed requests. As asimple measurement
Lisp and data structures: one reason it hasn't attracted me
I've written before about some small scale issueswith reading languages that use Lisp style syntax, but I don't thinkI've said what I did the other day on Twitter , which isthat the syntax of how Lisp languages are written is probably theprimary reason that I slide right off any real interest in them.I like the ideas and concepts of Lisp style languages, the featurescertainly sound neat, and I often use all of these in other languageswhen I can, but actual Lisp syntax
Sometimes the way to solve a problem is to rethink the problem
After a certain amount of exploration and discussion, we've comeup with what we feel is a solid solution for getting our NFS mountauthentication working on Linux .Our solution is to not use Linux; instead we'll use OmniOS, where wealready have a perfectly working NFS mount authentication system .
To get there we had to take a step back and look at our actualobjectives and constraints. The reason we wanted our NFS mountauthentication on Linux is that we want to offer a service wherepeople give us
Finding free numbers in a range, crudely, with Unix tools
Suppose, not entirely hypothetically, that you have the zone filefor the reverse mapping of a single /24 subnet (in Bind format) andyou want to find a free IP address in that subnet. The first fieldin the zone file is the last octet of the IP (ie for '127.0.0.1'it is '1'), so this problem reduces to finding what numbers are notused in the file out of the range 1 to 254.
Why I need a browser that's willing to accept bad TLS certificates
One of my peculiarities is that I absolutely need a browser that'swilling to accept 'bad' TLS certificates, probably for all species ofbad that you can imagine: mismatched host names, expired certificates,self-signed or signed by an unknown certificate authority, or somecombination of these. There are not so much two reasons for this astwo levels of the explanation.
The direct reason is easy to state: lights out management processors.Any decent one supports HTTPS (and you really want to use it
States in a state machine aren't your only representation of state
I think in terms of state machines a lot; they're one of my standardapproaches to problems and I wind up using them quite a bit. I'verecently been planning out a multi-threaded program that has tocoordinate back and forth between threads as they manipulate thestate of host authentication . Atfirst I had a simple set of states, then I realized that thesesimple states only covered the main flow of events and needed tobe more and more complicated, and then I had a blinding realization
Menu
![]()