KCLUG

kclug@kclug.org

3239 discussions

Re: Simple VPN?
by Sean Crago 29 Jul '08

29 Jul '08

Actually, I really don't care that much evading detection. Is there a simple way with DropBear's minimal SSH implementation to just establish an SSH tunnel from my router in Kathmandu to a box in KC and route only :80 and :443 over it? -Sean

1 0

Re: Simple VPN?
by Billy Crook 28 Jul '08

28 Jul '08

Openvpn is actually detectable apart from regular ssl web servers because while SSL is always authenticated, the very beginning of the session is not encrypted, and handshake parameters will reveal the certificate issuer, and use and such. If a bad guy tried go mangle any of it, it would be detected because it's all signed, but it's clear, and that's how deep packet inspection IDS systems can tell https apart from ssh on port 443 and openvpn on port 443. IPSEC for one purpose though would look identical to IPSEC for any other purpose. It also encapsulates layer 4 stuff, so a bad guy can't manipulate window sizes and send RST packets to DoS your connection. In this sense, IPSEC would have prevented comcast from attacking their p2p using customers. Even sneakier VPN systems include ones that tunnel the data through ICMP echo and echo reply packets, and ones that tunnel using DNS queries and responses. While I've never set either of those up, I imagine they are quite slow. I know the former requires some invasive kernel patch as well. On Mon, Jul 28, 2008 at 14:08, Bradley Hook <bhook(a)kssb.net> wrote: > IPSec is very difficult to setup and extremely easy to break. It's easy to > end up locking yourself out of remote systems too. > > The nice thing about OpenVPN is that you can configure it to do all sorts of > sneaky stuff. You could always configure your OpenVPN to run TCP over port > 443 (HTTPS), which your ISP would have an awful time trying to block. IPSec > wont give you that kind of flexibility, and when your ISP starts seeing > those kind of weird packets they are likely to start filtering them. > > IPSec is awesome when you have control over all or most of a network, and > want the traffic to be extremely secure. When you start routing it over the > public Internet, you can expect problems. > > ~Bradley > > Billy Crook wrote: >> >> Nor am I. But I know that it is valiable as a module in ddwrt and >> openwrt, so it is likely also avaliable on tomato, and for the common >> "router" architectures. >> >> I probably shouldn't have overlooked IPSEC. While significantly more >> difficult to set up, it works at a lower layer of the stack, and is >> thus harder to make sense of. Assuming the ISP's tampering works in a >> default-allow, tamper-by-list setup, IPSEC may work as well as >> anything else. >> >> On Mon, Jul 28, 2008 at 13:42, Bradley Hook <bhook(a)kssb.net> wrote: >>> >>> OpenVPN seems fairly flexible and is cross platform. Not sure about which >>> CPU architectures it has been ported to though. >>> >>> ~Bradley >>> >>> >>> >>> Sean Crago wrote: >>>> >>>> My DSL provider with the DNS masquerading and Squid transparent proxy >>>> is feeding me all sorts of bad DNS information. I think I need to move >>>> to the VPN option temporarily. Anyone have any advice on a basic, easy >>>> to configure VPN solution? Support by Tomato firmware (a DD-WRT like >>>> replacement) to allow my wife's Windows box access and to allow access >>>> from my Internet Tablet is deeply desired. >>>> >>>> Thanks, >>>> Sean Crago >>>> _______________________________________________ >>>> Kclug mailing list >>>> Kclug(a)kclug.org >>>> http://kclug.org/mailman/listinfo/kclug >>> >>> _______________________________________________ >>> Kclug mailing list >>> Kclug(a)kclug.org >>> http://kclug.org/mailman/listinfo/kclug >>> > >

2 1

Semi-OT: Windows98 now truly obsolete thanks to Printers (helps encourage Linux)
by Leo Mauler 28 Jul '08

28 Jul '08

I was going to donate a HP printer to the arts center I'm volunteering for, but the computer they have right now is a PII-233Mhz machine running Windows98. This turns out to be a sticking point which prevents the printer from being useful to them, as I don't have the original Windows driver CD. I found out that HP (and I expect most other printer manufacturers) have discontinued support for Windows98 (since July 2007), going so far as to remove all Windows98 printer drivers from their website, not even making them available on an "as-is, no official support" manner. Folks with older computers running Windows98 (that can't run any newer version of Windows) cannot use new printers, even those manufactured prior to July 2007. Linux, of course, still receives printer driver support from HP and a few other places (and auto-installs HP USB printers without any prompting), so it appears that to donate the HP printer I'm probably going to have to donate Linux as well, either on the existing system or donate a newer computer as well. (sits back and waits for the inevitable "standards printers are a better choice than driver-based printers" comment from someone... ;-) )

6 9

Simple VPN?
by Sean Crago 28 Jul '08

28 Jul '08

My DSL provider with the DNS masquerading and Squid transparent proxy is feeding me all sorts of bad DNS information. I think I need to move to the VPN option temporarily. Anyone have any advice on a basic, easy to configure VPN solution? Support by Tomato firmware (a DD-WRT like replacement) to allow my wife's Windows box access and to allow access from my Internet Tablet is deeply desired. Thanks, Sean Crago

2 1

Re: Linux-compatible Laptop add-on sound cards?
by Sean Crago 28 Jul '08

28 Jul '08

I'm kind of shocked that his sound card doesn't has support under ALSA or OSS - What's the chipset? Is NetBSD an option if Linux isn't? On a more on topic note, I've had good experiences with my Logitech USB headsets. 350 something or other is what they're called. Anything with the same chipset should work. Can't personally vouch for anything else, but they sound like the USB sound cards are fairly standardized: http://www.linux-usb.org/USB-guide/x319.html That said, if this thing is as old as it sounds, you might want to check and make sure that the USB ports actually work with reasonably modern devices before spending any money. Might have to buy one of those old PCI add-on USB controllers. -Sean Crago/MrZaius MrZaius.com

2 1

Immediate, paying gig -- halp!
by Greg Brooks 24 Jul '08

24 Jul '08

Guys, Got an ancient server that runs primarily as a Samba/FTP setup (intra-LAN for the former, remote access for the latter). It's been rock solid running Ubuntu server, until. well, yesterday. Now I get timeouts, lack of accessibility from the LAN, etc. Rebooting fixes things, but only temporarily. What I need: Someone who Knows More Than I Do (that would be virtually all of you) to SSH in and poke around, telling me what the problem might be. If it's something big and terminal, I just need to get stuff stable enough to move files off of it and bring in a Netgear RAID unit. This is a paying gig - if you're available immediately, send me a short email with 1-2 sentences about your experience and your hourly rate. I can pay via PayPal, credit card or old-fashioned, drive-the-check-to-you means. Thanks, Greg Brooks

2 1

Re:
by Luke -Jr 24 Jul '08

24 Jul '08

On Saturday 19 July 2008, Leo Mauler wrote: > --- On Wed, 7/16/08, Luke -Jr <luke(a)dashjr.org> wrote: > > On Wednesday 16 July 2008, Oren Beck wrote: > > > Consider how YOU would write a RFC draft to sever adult from non-adult > > > content ! > > > > 1. Please don't refer to immoral images as "adult"; there are still some > > decent adults left, no matter how many damn themselves with this crud. > > And to top it all off, why is a photograph of a nude woman "pornography" > while a painting of a nude woman is "art"? This distinction has allowed > people to get away with all kinds of stuff in the Pornographic Painting > Industry. Sculpture too, as you can even see "David's" tallywhacker on > half a dozen websites, entirely for free. It seems you need to review the difference between nudity and porn... Main Entry: por·nog·ra·phy 1 : the depiction of erotic behavior (as in pictures or writing) intended to cause sexual excitement 2 : material (as books or a photograph) that depicts erotic behavior and is intended to cause sexual excitement Main Entry: nude 2 a: devoid of a natural or conventional covering; especially : not covered by clothing or a drape b (1): of the color of a white person's flesh (2): giving the appearance of nudity <a nude dress> > Immoral images can be adult, its just in how you present them. Immoral images are inherently abusive and not appropriate for any audience. > > 2. Standards on how to say "I am porn!" never work because the porn > > industry does not want filters blocking access to them. Not only do they > > *want* children and others to get addicted, they certainly aren't going to > > participate in something any ISP blocks off entirely without user consent. > > Porn filters never work because of the sheer collective lust drive of > teenage boys. There could be 100% acceptance of a porn filter and teenage > boys would still get access to porn. Not if they don't know it exists. Your claim depends on incompetent parents.

4 5

Re: Samba Web Interface
by Billy Crook 21 Jul '08

21 Jul '08

And the irony is CIFS is quite secure if you tunnel it through SSH, but on any platform where you would have to use CIFS (read: on windows), you can never bind to the local port 445, and can't connect to cifs on any port other than 445. I'd try those two web apps over apache+SSL. in the off chance your requirement of being 'web' is less to do with the user interface and more to do with firewalls, there are several methods of tunnelling arbitrary network traffic over http as valid (proxy and firewall compatible) http requests. See: http://freshmeat.net/projects/corkscrew/ On Mon, Jul 21, 2008 at 13:54, Mark Gardner <markgard(a)gmail.com> wrote: >> Is there a specific reason your uploading of files to your home server >> has to have anything to do with samba? > > No, It does not have to do with Samba, any web based file browser will do. > >> If you could use a web site interface to uploading and managing files >> on a webserver, try http://webfilebrowser.sourceforge.net/ and >> http://freshmeat.net/projects/pfb/. Of course, you will probably want >> to set up ssl, and offer those services exclusively over SSL. > > This is exactly the type of things that I've been looking for. Something > that I can upload my files to, and secure down with > Authentication/Encryption > >> >> If it doesn't even have to be 'web', use scp, an sftp client like >> filezilla, or fuse-sshfs. > > > I would prefer a web interface. But yes, I've used winscp, and other sftp > clients > >> >> you could actually use Samba right over the >> net, but it is usually blocked, and isn't very smart for security >> reasons. > > I agree 100% CIFS over open internet is just a bad idea. > > -- > James Thurber - "Women are wiser than men because they know less and > understand more."

1 0

Samba Web Interface
by Mark Gardner 21 Jul '08

21 Jul '08

Does anyone know of a decent web interface to a samba file system. I would like to be able to securely upload files to my home server via a web interface. -- Rodney Dangerfield - "I worked in a pet store and people would ask how big I would get."

5 4

NIC Promiscuous Mode
by Greg Lawson 20 Jul '08

20 Jul '08

I need to demonstrate the differences of a NIC being in promiscuous mode and when it's not for a college class. Can anyone think of any good shell commands to run "before and after" which show what traffic the NIC can and can't see? Greg Lawson Rolling Hills Consolidated Library 1912 N. Belt Highway St. Joseph, MO 64506

6 7

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG