Four reasons to have a firewall
Recently I ran across someone asking the question 'why have a firewall?'As it turned out, he had several sorts of host-based firewall protection,but in thinking about the question I came up with four broad reasons thatfirewalls can be a good idea:
- because your services and servers suck. You're forced to run thingsthat were written by addled monkeys, in environments that eitherrequire random services of unknown and dubious security impactor just start them up every so often whenever they feel like it.
The ordering of SSL chain certificates
SSL certificates for hosts are usually not directly signed by yourCA's trust root certificate, the certificate that is in your browser,your mail client, or whatever. Instead there is generally at least oneintermediate certificate (sometimes several), and in order for clientsto accept your host certificate you need to send them not just the hostcertificate but also all of the intermediate certificates in the chainof signatures between you and the CA trust root.
How you configure this depends on the server software, with two general
How os.path exposes some Python import weirdness
For reasons beyond the scope of this entry, I wasrecently looking at the source code for the os module when a question suddenly struckme: how on earth does ' import os.path ' work?
The conventional way to have submodules like this is to have your modulebe a directory with an __init__.py file, and then the submodule iseither a Python file or a subdirectory. However, the os module is nota directory; instead it is a single file, os.py
Some yum tricks with distro-sync and --releasever
Suppose, not entirely hypothetically, that you have just upgraded yourFedora 13 workstation to Fedora 14 (with the latest updates) only tofind out that your window manager now causes the X server to crash.Seeing as this renders the system unable to start your environment, youwould like to find a solution by trying older versions of the X server.
As it happens, yum has added some interesting options since Ilast read through its manual page; in fact, I found out about --releasever and
The changing assumptions about viruses in email
Once upon a time, back at the dawn of the virus age, viruses in emailtended to come from actual people innocently sending around infectedfiles. Somewhat later, they came from actual people having either theiroutgoing email modified by the virus or simply having their addressbooks pillaged by the virus, which also borrowed their mail client.
Back in those halcyon days, it made sense to do things like cleanviruses from messages (leaving the rest of the message intact) and toquarantine virus-contaminated email. When a
Directory link counts and a find trick
In the beginning, Unix directories were remarkably non-special. Oneof the ways that they were non-special is that connections betweendirectories were not special in any way; a directory entry for adirectory was just a hard link to the directory's inode, the same aswith any other sort of inode. This applied to the two special names . and .. too; each of them was a regular directory entry, the first ahard link to the directory itself and the second a hard link to
When Linux's rp_filter might make sense
I wrote a grumpy entry about net.ipv4.conf.*.rp_filter setting back here , where I said that it didn't make anysense. Well, I can actually come up with one situation where it maymake sense: virtualization and thus virtualization networks.
One relatively common virtual machine setup is NAT-based, where thevirtual machines get IP addresses on a private virtual network on thehost. While the host doesn't route to its virtual network (or networks,if you
A find optimization and a piece of history, all in one
One of the floating pieces of modern Unix lore is that if you are doinga find that matches against both filenames and other properties of thefile, it's best to put the filename match first. That is, if you want tofind zero-sized object files the right order is:
find . -name '*.o' -size 0 -print
I called this a piece of modern Unix lore for good reason; this wasn'tnecessarily true in the old days (and even today it
When you should care about security
Recently I wrote about http to https redirection and mentioned in passing somethingabout caring or not caring about security. I figure I should expand onthat a bit.
First off: as I mentioned, caring about encryption is not quite the samething as caring about security. End to end encryption frustrates manysorts of eavesdroppers and is one of the ways of preventing tamperingwith your traffic. But as lots of people have learned the hard way overthe years, encryption by itself does not create security as such.
When I
Modern versions of Apache and Redirect
Our main web server is currently running Ubuntu 8.04. For reasons beyondthe scope of this entry, we want to upgrade it to Ubuntu 10.04, so todayI did a test install, which wound up exploding with a bunch of logmessages that looked like:
[...] .htaccess: Redirect: invalid first argument (of three)
Internet searches will give you inconclusive and somewhat confusedanswers; it doesn't help that Apache doesn't report a line number,