Traceroute, firewalls, and the modern Internet: a horrible realization
The venerable traceroute command sort of reports the hops your packets take to reach a host,and in the process can reveal where your packets are getting droppedor diverted. The traditional default way that traceroute works isby sending UDP packets to a series of high UDP ports with increasingIP TTLs , and seeingwhere each reply comes from. If the TTL runs out on the way,traceroute gets one reply; if the packet reaches the host, traceroutegets another one (assuming that nothing is listening on the particularUDP port
A note to myself about using traceroute to check for port reachability
Once upon a time, the Internet was a simple place; if you couldping some remote IP, you could probably reach it with anything. TheInternet is no longer such a simple place, or rather I should saythat various people's networks no longer are. These days there area profusion of firewalls, IDS/IDR/IPS systems , and soon out there in the world, and some of them may decide to blockaccess only to specific ports (and only some of the time).
Some thoughts on OpenSSH 9.8's PerSourcePenalties feature
One of the features added in OpenSSH 9.8 is a new SSH serversecurity feature to slow down certain sorts of attacks. To quotethe release notes:
[T]he server will now block client addresses that repeatedlyfail authentication, repeatedly connect without ever completingauthentication or that crash the server. [...]
This is the PerSourcePenalties configurationsetting and its defaults, and also see PerSourcePenaltyExemptList and PerSourceNetBlockSize .OpenSSH 9.8 isn't yet in anything we can use at work, but it will be
Uncertainties and issues in using IPMI temperature data
In a comment on my entry about a machine room temperaturedistribution surprise , tbuskeysuggested (in part) using the temperature sensors that many server BMC ssupport and make visible through IPMI .As it happens, I have flirted with this and have some pessimisticviews on it in practice in a lot of circumstances (although I'mless pessimistic now that I've looked at our actual data).
The big issue we've run into is limitations in what temperaturesensors are available with any particular IPMI, which
ZFS properties sometimes change their default values over time
For an assortment of reasons, we don't want ZFS to do compressionon most of the filesystems on our fileservers . Some of these reasons are practicaltechnical ones and some of them have todo with our particular local non-technical ('political') decisionsaround disk space allocation .Traditionally we've done this by the simple mechanism of notspecifically enabling compression, because the default was off.Recently I discovered, more or less by coincidence, that OpenZFShad changed the default for ZFS compression from off
Allocating disk space (and all resources) is ultimately a political decision
In a multi-person or multi-group environment with shared resources,like a common set of fileservers ,you often need to allocate resources like disk space between differentuses. There are many different technical ways to do this, and alsoyou can often not explicitly do this by shoving everyone into a bigpile. Sometimes, you might be tempted to debate the technicalmerits of any particular approach, and while the technical meritsof different ways potentially matter, in the end resource allocationis a political decision (although what
The Broadcom 'bnxt' Ethernet driver and RDMA (in Ubuntu 24.04)
We have a number of Supermicro machines with dual 10G-T Broadcombased networking; specifically what they have is the 'BCM57416NetXtreme-E Dual-Media 10G RDMA EthernetController'. Under Ubuntu 22.04, everything is fine with these cards(or at least seems to be in non-production use), using the normalbnxt_en kernel driver module. Unfortunately this is not ourexperience in Ubuntu 24.04.
In Ubuntu 2
How Linux kernel driver modules for hardware get loaded (I think)
Once upon a time, a long time ago, the kernel modules for yourhardware got loaded during boot because they were listed explicitlyas 'load these modules' in configuration files somewhere. You canstill explicitly list modules this way (and you may need to forthings like IPMI drivers), but most hardware driver modules aren'tloaded like this any more. Instead they get loaded through udev , through what I believe is twomechanisms.
The first mechanism is that as the kernel inventories things likePCIe devices,
Maybe understanding Crowdstrike's argument arity problem
Crowdstrike recently released an "External Technical Root CauseAnalysis" [PDF] ( via )for their recent extreme failure. The writeup is rather unclearabout what exactly happened, but I think I understand it and if Ido, it's an uncomfortably easy programming mistake to make. Sohere is my version of the core programming issue.
Part of Crowdstrike's agent is a signature matching system, wherethey match signature patterns ( templates ) against what's goingon. There are different types of patterns (
Host names in syslog messages may not be quite what you expect
Over on the Fediverse, I said something :
It has been '0' days since I (re)discovered that the claimed hostnamein syslog messages can be utter junk, and you may be going to live afun life if you use it for anything much.
Suppose that on your central syslog server you see a syslog line of the form:
[...] alkyone exim[864974]: no host name found for IP address 115.187.1