[OT] Connection tracking for IPSec
by Felipe Alfaro Solana
Hi all!
I'm starting with IPSec right now. To make it work, I must open up
protocols 50 and 51 to pass across my Linux firewalls, but I want to use
connection tracking much like I do when not using IPSec.
For example,
iptables -A INPUT -m state --state RELATED,ESTABLISHED
When using IPSec, if I open up protocols 50 and 51, all IPSec-protected
traffic passes through the firewall, but it's not checked against the
connection tracking module. How can I configure iptables so an
IPSec-protected packet, after being classified as IP protocol 50 or 51,
loop back one more time to pass through the connection tracking module?
I don't want to set up IPSec to get addititional protection by using AH
and ESP and then let any machine talking IPSec pass entirely through my
firewall ignoring the rest of rules.
Thanks!
20 years, 10 months
Modprobe.conf in Severn
by RaXeT
If anyone would like to share their modprobe.conf under 2.6.0 kernel, I
would be interested in taking a peak.
I have an Asus P4PE.
Raxet
20 years, 10 months
xauth changes?
by Chris Ricker
Has something changed with xauth in rawhide recently? SSH autoforwarding of
magic cookies has been failing for me today after upgrading to rawhide.
Here, I just logged into X through gdm, and then immediately tried to ssh
after an ssh-add. I get:
[cricker@yoshimi cricker]$ ssh localhost
Warning: No xauth data; using fake authentication data for X11 forwarding.
/usr/X11R6/bin/xauth: error in locking authority file
/home/cricker/.Xauthority
[cricker@yoshimi cricker]$ xeyes
X11 connection rejected because of wrong authentication.
X connection to localhost:11.0 broken (explicit kill or server shutdown).
[cricker@yoshimi cricker]$ ls -l .Xauthority
-rw------- 1 cricker cricker 1261 Aug 19 16:36 .Xauthority
[cricker@yoshimi cricker]$
Same thing if I use ssh -X
later,
chris
20 years, 10 months
RE: up2date from rawhide
by Vanco, Donald
Thiago Vinhas de Moraes wrote:
> Dude! I´ve been using RH since version 3.0, and I really didn´t know
> noted the -F option of rpm.
> Thanks a lot!
Then this should make your head explode:
If you do decide NOT to use rsync (and it's ability to control revision) you
want to insure that there's no duplicate RPMs to mess things up. This works
for me:
(NOTE: cut-n-paste at your own risk!; pdksh assumed here)
#!/bin/ksh
ls | sed 's/-[0-9]*\..*//g' | sort > /tmp/lsdup.all.$$
ls | sed 's/-[0-9]*\..*//g' | sort | uniq > /tmp/lsdup.uniq.$$
diff -y --suppress-common-lines /tmp/lsdup.all.$$ /tmp/lsdup.uniq.$$ |\
tr -d "[:blank:]\<" | sort | uniq
rm -f /tmp/lsdup.all.$$ /tmp/lsdup.uniq.$$
...this is from a script from IBM called "lsdup"
..and you might also want to NOT Freshen kernel RPMs - but rather, Install,
verify functional, then Erase old kernels:
so instead of "rpm -Fvh *.rpm" do:
rpm -Fvh $(ls *.rpm | egrep -v '^(kernel-)')
...and them manually do an -ivh on kernels as desired...
You can check on installed kernels with:
rpm -q kernel kernel-smp --queryformat
"%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n"
...adding kernel-enterprise and/or kernel-bigmem as distro
dictates...
Cheers -
Don
20 years, 10 months
RE: up2date from rawhide
by Vanco, Donald
Thiago Vinhas de Moraes wrote:
> Dude, but it will install all RPMS downloaded from rawhide right? It
> will not just get and update the rpms I have installed on my system.
>
Nope - man rpm, man
F = Freshen (if present)
U = Freshen if present, but install if not
The script will, in fact PULL all rpms - but not install them
As stated, it's a less than elegant but "works for me" solution
Don
20 years, 10 months
Re: Stock kernels
by Jef Spaleta
Maynard Kuona wrote:
> Like recently,the kernel.org kernels will not build because of
> how Redhat split rpm into rpm and rpmbuild
http://www.rpm.org/hintskinks/rpmbuild/
Recently....that url would suggest that the actual functionality split
was a while ago. I think the backwards compatibility mode for rpm hung
around too long.
>So if you could provide stock
>kernels, unsupported though, even for download, it would really be
>appreciated. The thing is that if they build at Redhat, then there should be
>less trouble building in the users' hands.
What you are actually asking for...is you want Red Hat to take the most
recent stock source and test it just enough to make sure that end-user
can "easily" roll their own kernel. That just isn't going to happen
inside the distro. What you get is the stock source code and the spec
file for the kernels red hat does provide...but thats seldom going to be
the "newest" kernel...especially if you like running development kernels
Now, developers being developers, you might likely see an individual
developer offering up kernel rpms for testing newer kernel
releases...and the associated src.rpm will have the unpatched source.
But as part of the distro...I highly doubt yer not going to see a second
set of kernel sources...even if its just for download.
And I'm really not sure of the value of the Red Hat developers making it
"end-user easy" to build a custom kernel. If you are building yer own
custom kernel from stock...you should KNOW how to apply patches and KNOW
how to build your own spec file from provided examples.
-jef
20 years, 10 months
Gnome 2.4 gnome panel problems
by Mike Chambers
I upgraded some of the gnome packages to 2.4 from rawhide yesterday.
But as one user pointed out on another mailing list, I had same problem
with gnome-panel not wanting to start. Is there a problem with this or
an easy fix to get it going?
--
Mike Chambers
Madisonville, KY
"The road to to success is always under construction!"
20 years, 10 months
Fatal error on initializing USB mouse etc
by RaXeT
On Severn with 2.6.0-0.test3.1.31.
I get this message on kernel boot and wonder what should be contained
the file /drivers:
grep:/proc/bus/usb/drivers no such file or directory?
Raxet
20 years, 10 months
'Fn key' and ACPI on dell laptops
by Alexander Volovics
Dell laptops have a blue Fn key.
Under APM pressing 'Fn-setup' and 'Fn-battery' would show the
BIOS setup and the battery status.
Under ACPI this is no longer possible.
Why does using ACPI disable this functionality?
Alexander
20 years, 10 months
Re: Odd USB mouse + PCMCIA Ethernet happenings
by Dee-Ann LeBlanc
"Michael K. Johnson" <johnsonm(a)redhat.com> wrote:
> You'll think I'm nuts, but please try booting with acpi=off and see
> if that fixes it.
No crazier than having to move my mouse to let network traffic through.
:)
Nope. I still have to move the USB laser mouse to get traffic to pass
through the PCMCIA Ethernet card.
--
Dee-Ann LeBlanc, RHCE
Lots of things Linux
http://www.Dee-AnnLeBlanc.com/
20 years, 10 months