KCLUG

kclug@kclug.org

3239 discussions

Re: KCLUG.NET available
by Jared 10 Feb '06

10 Feb '06

IPCOP it is. I neglected to mention that the wireless AP would be open access for all, including internal use. The picture below is roughly what I'll be doing. I happen to have a spare 586 sitting around waiting for a Linux image, and IPCOP does both firewall and routing. Basically, for free, and that's the selling point. Thanks to all for the help! p.s. The KCLUG.NET address went very quickly. -Jared >>> small network whose owner wants to make it available >>> for web-browsing to anyone roaming the neighborhood via >>> wireless. However, as best I know this gives access to >>> the other computers on the network, and I'm curious to >>> know if there is a way to expose a single computer to >>> the world as a wireless server, without giving access to >>> the rest of the network. >> >>Internet to 5-port switch >>Switch to Wireless AP and a NAT/Firewall device >>NAT/Firewall to private network > > solution #1: > > Internet > | > +----------+ > | Firewall | > |----------| > | FW | FW | > +----------+ > | | > | | +----------+ > | +------| Wireless | > | +----------+ > | > +----------+ > | LAN | > +----------+

2 1

RE: KCLUG.NET available
by Kelsay, Brian - Kansas City, MO 10 Feb '06

10 Feb '06

If it is open to all, make static IP assignments for the MAC addresses of the cards that are the network owner's. If he needs internal LAN access to a server, either put it in the DMZ or in local (Green) LAN and make DMZ pinholes for those MACs/IPs to get to the server IP. That prevents outside/free users from getting to the local server and network. I'd also either make sure nocatauth is on IPCop or put it on there yourself. As I said before, it gives the Acceptable Use Policy for outside users. The first Internet hit they try will bounce them to the AUP. If you want to filter Internet access, use Dan's Guardian. There is info on the IPCop page about adding it. Good Luck -----Original Message----- From: kclug-bounces(a)kclug.org [mailto:kclug-bounces@kclug.org] On Behalf Of Jared Sent: Friday, February 10, 2006 5:28 AM IPCOP it is. I neglected to mention that the wireless AP would be open access for all, including internal use. The picture below is roughly what I'll be doing. I happen to have a spare 586 sitting around waiting for a Linux image, and IPCOP does both firewall and routing. Basically, for free, and that's the selling point. Thanks to all for the help! p.s. The KCLUG.NET address went very quickly. -Jared >>> small network whose owner wants to make it available >>> for web-browsing to anyone roaming the neighborhood via >>> wireless. However, as best I know this gives access to >>> the other computers on the network, and I'm curious to >>> know if there is a way to expose a single computer to >>> the world as a wireless server, without giving access to >>> the rest of the network. >> >>Internet to 5-port switch >>Switch to Wireless AP and a NAT/Firewall device >>NAT/Firewall to private network > > solution #1: > > Internet > | > +----------+ > | Firewall | > |----------| > | FW | FW | > +----------+ > | | > | | +----------+ > | +------| Wireless | > | +----------+ > | > +----------+ > | LAN | > +----------+

1 0

Re: KCLUG.NET available
by rcedelman＠comcast.net 08 Feb '06

08 Feb '06

Well, if buying some new (used) equipment is in the budget, I'd pick up a Cisco Aironet 1200 AP. You can get them pretty reasonable on EBay. I'd also pick up a couple of directional attennas. The Aironet can have multiple SSIDs, each on its own VLAN. Then all you need is some kind of device capable of routing between VLANs (I believe a linksys with hacked firmware can do this, or any linux router with 3 nics), and you're good to go. The only downside to this, aside from spending $$$, is that when you have multiple SSIDs on the same AP, you can't broadcast. This is pretty similar to what we use at Netstandard for our wireless solution, but we've got 3 Wifi networks on the same AP. Rich -------------- Original message ---------------------- From: David Nicol <davidnicol(a)gmail.com> > On 2/7/06, Jack <quiet_celt(a)yahoo.com> wrote: > > --- David Nicol wrote: > > > > as I see it the question is, is there a way to > > > expose the one server, > > > while still providing wireless for your other > > > devices, using a single > > > access point, and the answer is no. He's going to > > > need a second > > > access point. One AP for the public wireless and > > > one for his > > > unrestricted private. > > > > I disagree. > > no you don't. Your pictures, with one wireless node, are not providing > a trusted wireless, that has access to the LAN section, > in addition to the untrusted wireless. > > I said that if you want a trusted wireless and an untrusted wireless both, > you need to WAPs. Your diagrams agree with that. > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug

1 0

KCLUG.NET available
by Jared 07 Feb '06

07 Feb '06

Coupla things, 2nd one is off topic: 1. A couple of years ago I bought the name KCLUG.NET, intending to set up mail accounts or make it available for the cluster idea, but soon found myself with limited resources. The domain name expires at the end of May, and in the past when I've relinquished a quality domain name, I watched it snapped up by a reseller who made it available for 3 digits or more. So, I have this quality domain name which I will transfer for free to a good home; it expires in 3 months, so it's not much, but it's a start for anyone with time to spare. 2. I write software so I dunno networking, requesting help from the user group. I was invited to manage a very small network whose owner wants to make it available for web-browsing to anyone roaming the neighborhood via wireless. However, as best I know this gives access to the other computers on the network, and I'm curious to know if there is a way to expose a single computer to the world as a wireless server, without giving access to the rest of the network. Wireless Belkin Router/AP, but willing to buy other equipment if necessary. Thanks, -Jared

4 4

RE: KCLUG.NET available
by Kelsay, Brian - Kansas City, MO 07 Feb '06

07 Feb '06

For a preconfigured solution, see www.IPCop.org, current version is 1.4.10. The Red is Internet, Green is local LAN, Orange is DMZ, Blue is untrusted wireless. You use DMZ pinholes to allow specific hosts or a range of hosts to have direct connection from one net to another. E.g. allow specific IP address access to server on Orange (DMZ) so that your laptop can admin the server. Blue (wireless), by default has access to the internet, but you may want to add nocatauth to allow you to add an acceptable useage notice to users. -----Original Message----- From: On Behalf Of Jack Dinsmore Sent: Tuesday, February 07, 2006 1:33 PM To: kclug(a)kclug.org Subject: Re: KCLUG.NET available I disagree. The way I see it he could build a tri-homed firewall. Three NICs , One NIC is a wireless on a private IP range, one NIC is assigned a different IP range, and the third connects to the Internet. I don't know enough about switches to analyze the first answer, but it seemed reasonable, basically the same as my solution - except the switch is the tri-homed device. My solution has the added benefit of offering some protection to the wireless device and also prevents maliscious persons from using the wireless to launch attacks. The downside is, if the tri-homed device is compromised all is exposed. Another solution here would be to have a gateway firewall machine, put the wireless on the DMZ side of this firewall add a DMZ firewall protecting the internal network from both the wireless and the Internet. solution #2: Internet | +----------+ | Firewall | +----------+ | | +----------+ +------| Wireless | | +----------+ | +----------+ | Firewall | +----------+ | | +----------+ | LAN | +----------+ solution #1: Internet | +----------+ | Firewall | |----------| | FW | FW | +----------+ | | | | +----------+ | +------| Wireless | | +----------+ | +----------+ | LAN | +----------+ Granted this configuration is an advanced firewall, and the previous set up requires two different firewalls. In all cases the first firewall is a gateway firewall and the others are choke firewalls. However it is doable without a second access point. The first solution can be done with a single iptables configuration. Brian JD

1 0

dual monitor nvidia board lowered in resolution on new 1.0.8178
by hanasaki 03 Feb '06

03 Feb '06

dual monitor nvidia board lowered in resolution on new 1.0.8178 tis a geforce 5700 from gainward. darn thing ran dual at 1600x1200 per monitor now its running in one of the monitors is running at a lower resolution than the other. Any thoughts? # nvidia-xconfig: X configuration file generated by nvidia-xconfig # nvidia-xconfig: version 1.0 (buildmeister@builder3) Wed Dec 14 16:39:22 PST 2005 # XF86Config-4 (XFree86 X Window System server configuration file) # # This file was generated by dexconf, the Debian X Configuration tool, using # values from the debconf database. # # Edit this file with caution, and see the XF86Config-4 manual page. # (Type "man XF86Config-4" at the shell prompt.) # # This file is automatically updated on xserver-xfree86 package upgrades *only* # if it has not been modified since the last upgrade of the xserver-xfree86 # package. # # If you have edited this file but would like it to be automatically updated # again, run the following commands as root: # # cp /etc/X11/XF86Config-4 /etc/X11/XF86Config-4.custom # md5sum /etc/X11/XF86Config-4 >/var/lib/xfree86/XF86Config-4.md5sum # dpkg-reconfigure xserver-xfree86 # Option "Xinerama" # Option "NvAGP" "1" # Option "TwinView" "true" # Option "SecondMonitorHorizSync" "30.0-121.0" # Option "SecondMonitorVertRefresh" "48.0-160.0" # Option "MetaModes" "1280x1024, 1280x1024; 1280x1024, 1280x1024;" Section "ServerLayout" # Screen 0 "ScreenPrimary" 0 0 # Screen "ScreenSecondary" RighOf "ScreenPrimary' # Option "Xinerama" # Option "NvAGP" "1" # Option "TwinView" "true" # Option "SecondMonitorHorizSync" "30.0-121.0" # Option "SecondMonitorVertRefresh" "48.0-160.0" # Option "MetaModes" "1280x1024, 1280x1024; 1280x1024, 1280x1024;" # Option "TwinViewOrientation" "LeftOf" Identifier "Layout" Screen 0 "OneBigWide" 0 0 InputDevice "Generic Keyboard" InputDevice "Configured Mouse" EndSection Section "Files" # local font server # if the local font server has problems, we can fall back on these FontPath "unix/:7100" FontPath "/usr/lib/X11/fonts/misc" FontPath "/usr/lib/X11/fonts/cyrillic" FontPath "/usr/lib/X11/fonts/100dpi/:unscaled" FontPath "/usr/lib/X11/fonts/75dpi/:unscaled" FontPath "/usr/lib/X11/fonts/Type1" FontPath "/usr/lib/X11/fonts/CID" FontPath "/usr/lib/X11/fonts/Speedo" FontPath "/usr/lib/X11/fonts/100dpi" FontPath "/usr/lib/X11/fonts/75dpi" EndSection Section "Module" Load "bitmap" Load "dbe" Load "ddc" Load "extmod" Load "freetype" Load "glx" Load "int10" Load "record" Load "speedo" Load "type1" Load "vbe" EndSection Section "InputDevice" Identifier "Generic Keyboard" Driver "keyboard" Option "CoreKeyboard" Option "XkbRules" "xfree86" Option "XkbModel" "pc104" Option "XkbLayout" "us" EndSection Section "InputDevice" Identifier "Configured Mouse" Driver "mouse" Option "CorePointer" Option "Device" "/dev/gpmdata" Option "Protocol" "IntelliMouse" Option "ZAxisMapping" "4 5" EndSection Section "Monitor" Identifier "NFL9905" HorizSync 36.0 - 90.0 VertRefresh 50.0 - 140.0 Option "DPMS" EndSection Section "Monitor" Identifier "Samsung900DF" HorizSync 36.0 - 90.0 VertRefresh 50.0 - 140.0 Option "DPMS" EndSection Section "Device" # Option "ConnetedMonitor" Identifier "DualHeadNVida5700a" Driver "nvidia" BusID "PCI:01:00:0" Screen 0 EndSection Section "Device" # Option "ConnetedMonitor" Identifier "DualHeadNVida5700b" Driver "nvidia" Option "NvAgp" "0" BusID "PCI:01:00:0" Screen 1 EndSection Section "Screen" Identifier "ScreenPrimary" Device "DualHeadNVida5700a" Monitor "NFL9905" DefaultDepth 24 SubSection "Display" Viewport 0 0 Depth 24 Modes "1920x1440" "1600x1200" "1024x768" EndSubSection EndSection Section "Screen" Identifier "ScreenSecondary" Device "DualHeadNVida5700b" Monitor "Samsung900DF" DefaultDepth 24 SubSection "Display" Viewport 0 0 Depth 24 Modes "1920x1440" "1600x1200" "1024x768" EndSubSection EndSection Section "Screen" Identifier "OneBigWide" Device "DualHeadNVida5700a" Monitor "Samsung900DF" DefaultDepth 24 Option "Xinerama" Option "NvAGP" "1" Option "backingstore" "true" Option "TwinView" "true" Option "TwinViewOrientation" "LeftOf" Option "SecondMonitorHorizSync" "36.0-90.0" Option "SecondMonitorVertRefresh" "50.0-140.0" Option "MetaModes" "1600x1200, 1024x768;" SubSection "Display" Viewport 0 0 Depth 24 Modes "1600x1200" EndSubSection EndSection

3 3

Po' Man's SAN
by Charles Steinkuehler 02 Feb '06

02 Feb '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I work for a fairly small company and am getting ready for our next round of server upgrades (every 5-6 years whether we need it or not!). I'd like to get some of the benefits of having a SAN (mainly one place to add/manage raid-cards & HDDs), but don't really need the performance or sticker-shock of the commercially available units. Basically a big chunk of SATA RAID storage I can share between a few systems (mail server and a couple of file servers) would be ideal. I'm currently thinking the ATA-over-Ethernet stuff looks like about the right fit...no expensive fiber-channel, no accelerated TCP/IP cards required for decent performance (the protocol is raw ethernet, no IP involved). I can start off with 'dedicated' storage areas for each machine (using 'conventional' ext3/jfs/etc filesystems) , and graduate to something like GFS in the future, if necessary. I'd start out running over GigE copper, possibly bonding a couple interfaces on the actual data server (or maybe even migrate to 10GigE) if required for performance. Has anyone setup anything like this, or played around with AoE? Am I missing some obvious solution to doing the same thing without using 'exotic' technology like AoE, iSCSI, or <insert buzzword of the day>? I know a bunch of you run linux on 'real' hardware, but my experience has been limited mainly to the 32-bit x86 world, and software RAID [1|5] + LVM is about as fancy as we get. Any comments/pearls of wisdom will be greatly appreciated! - -- Charles Steinkuehler charles(a)steinkuehler.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFD4naMLywbqEHdNFwRAonuAJ4sG7O7TqonCN+7O41HLDXy47JeCgCfYbcq ythyQKcWJAgzaGAHwADugY4= =qiR9 -----END PGP SIGNATURE-----

1 0

Job Posting
by Dan Thomasset 02 Feb '06

02 Feb '06

The Stowers Institute for Medical Research has an opening for a Linux System Administrator: http://www.stowers-institute.org/ScientistsSought/ScientistsSought.asp ---------------------------------------------- Systems Administrator The Stowers Institute for Medical Research has an opening for a Systems Administrator to support the Unix and Linux systems in the department of Information Technology. Responsibilities include building and maintaining the Unix infrastructure; administering the Unix and Linux systems, including desktop and server installation, configuration, maintenance, and security; and providing programmer services in Bash or Bourne shell, Perl, Python; C/C++ or Java. In addition to excellent communication skills and the ability to effectively work in a team-oriented environment, the successful candidate will have expertise in system installation, configuration, maintenance, and troubleshooting; server configuration; fundamental knowledge of security and RDBMS; experience with TCP/IP networking; distributed computing environments and network services including Sendmail, Apache, NFS, NTP, and NIS; experience with capacity planning, performance tuning, backup, and recovery; and knowledge of cross-platform and porting. The minimum requirements include a degree in computer science or a related field and three to five years of experience in Linux and/or Unix systems administration; an AA degree in computer science or a related field and five to seven years of experience in Linux and/or Unix systems administration; or a HS diploma and three to five years of experience in Linux and/or Unix systems administration. Apply at: http://www.stowers-institute.org/ScientistsSought/ScientistsSought.asp

4 3

RE: state of Missouri to archive cell phone location data?
by Kelsay, Brian - Kansas City, MO 31 Jan '06

31 Jan '06

>From the Article: "The program charts drivers' relative speed by measuring the time between the intermittent signals cell phones send to towers along a stretch of road. Then, that information - stripped of the personal identification and serial numbers that identify the cell phone's owner - is overlaid with highway maps to determine where the phones are and how fast they are moving." This says ABSOLUTELY NOTHING about issuing speeding tickets. I assume that this is to add functionality to the KCScout system. The call for hoax on the original email stands. Though this has the POTENTIAL to do the speeding ticket thing, there is no proof that this is what it is intended for and there are still many major hurdles to overcome. -----Original Message----- From: Jeremy Turner Sent: Monday, January 30, 2006 10:41 AM I can't find a date of Feb 1, but it has been approved: http://www.kansascity.com/mld/kansascity/news/local/13314831.htm http://hardware.slashdot.org/article.pl?sid=05/11/01/159241 >From what I read, it is more for aggregate data, traffic conditions, etc. Although they could probably start tracking individual users if they wanted to. If this became more common place and people heard about it, you'd have some upset users. I've heard that OnStar can't pass on speed info to authorities. Although, they could probably be strong-armed. Jeremy

5 4

RE: getting to www servers from inside where they have an Internal IP
by Jeremy Fowler 31 Jan '06

31 Jan '06

> The "wacky" port numbers for the httpd are to keep it off low numbered > ports and run as non-root. Any suggestions for something > better and how > to do it? Well, I think the only security reason to run an http server on a port other than 80 is to hide it from the general public. Port scanners can get around this hurdle quite easily though. Plus, the fact that you SNAT port 80 to that high number port, as far as I can see, makes it useless. Might as well just run the server on port 80 and save yourself some potential headaches. > ah.. "split dns" cute term... what iptables rules can be put in the > firewall to bounce the traffic back? Tried it and failed :( Split DNS has nothing to do with iptables. Its just telling your DNS server to resolve a host to a different address if the request comes from inside your network. It would be the ideal solution. Just host you http server on port 80, and split your DNS to resolve local requests to the internal IP. Problem solved. However, if you insist on keeping the high port, you could still DNAT requests for the external IP of your http server back to the internal IP:port. So anything going to port 80 of the external IP address of your webserver thru your firewall is redirected back into your network. Try this: Assuming: External IP of HTTP Server: 63.63.63.63 Internal IP of HTTP Server: 10.1.1.3 External Port of HTTP Server: 80 Internal Port of HTTP Server: 7777 External interface of your firewall: eth0 Internal interface of your firewall: eth1 iptables -t nat -A PREROUTING -i eth1 -p tcp -d 63.63.63.63 \ --dport 80 -j DNAT --to-destination 10.1.1.3:7777

4 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG