Le 2011-09-15 15:36, Orchid XP v8 a écrit :

>>>> On Windows, you'd type:
>>>>
>>>> route add 192.168.200.0 mask 255.255.255.0 192.168.1.1
>>>
>>> 1. I didn't know you could do that.
>>> 2. What does it do?
>>>
>>
>> It tells your PC that there's a network called 192.168.200.0 somewhere
>> voer there, and that to get ot it, you must forward the packets to
>> 192.168.1.1 and he'll take care of them.
>
> Interesting. I didn't know Windows was actually capable of doing that.
> Usually when I need a router in a hurry, I load up Linux and read some
> manpages...
>
> Hmm, I wonder... If my VPN client doesn't route all the subnets I want,
> can I get it to dump the packets onto the wrong LAN segment, and then
> trust the router at that end to take it to the correct place?
>

Assuming your router knows the way and there are no filters or 
restrictions in place, yes.

>>> Incidentally, I gather that there's two ways to control the ASA. One
>>> involves telnet. The other involves a serial cable...
>>
>> Serial cable is required to give the machine its initial barebones
>> config, after that, it's telnet or preferably ssh. Since anyone could
>> sniff the telnet password.
>
> It's neat that you can configure it via IP. Then again, if you configure
> the IP stuff wrong, you need to connect somehow so you can reconfigure
> it. :-}
>
> I wonder what authentication options there are for SSH...
>

Userid / password.  Either local or via an external authentication 
system (TACACS, Radius, Kerberos, RSA SecurID, etc...)

-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

Le 2011-09-14 04:40, Invisible a écrit :
>>> So how do you prevent somebody connecting to your server a thousand
>>> times per second and feeding it duff credentials, thereby preventing any
>>> legitimate users logging in, and wasting lots of CPU power?
>>>
>>> See, security isn't so simple...
>>>
>>
>> by having a real firewall (such as the aforementioned Cisco ASA)
>> configured to throttle individual connections. ;)
>
> I'm sorry, I thought we were still talking about "why the average home
> user can't easily send a file to another average home user". :-) I doubt
> many home users will pay hundreds of pounds for a Cisco ASA and spend
> god-knows how long learning what "tee sea pee eye pee" is in order to
> set this up.

The average user will not get DDOSed unless he pissed off the person 
DDoSing him.  Even the morons of 4Chan don't DDoS random people for the 
lulz.

If you are afraid of a denial of service attack, it means you have 
something worth attacking.  Therefore the few thousand dollars spent on 
a decent security appliance will be worth it.  How long can your 
business withstand being offline before your loses are more than the 
price of the firewall?

>
>> Now the /b/tard in question would have to use zombie PCs to do his DOS
>> against your machine.
>
> Yeah, because none of the script kiddies have figured out how to do
> that. ;-)
>

Most of them still ask how to download LOIC and act all surprised when 
they get a knock on their door.

> Then again, if somebody decides to DDoS you, it doesn't matter if you
> have *no* ports exposed to the Internet... You still get no service.
>
> Sometimes I think it would be nice if there was a widely-supported
> standard for configuring the firewall at the /other end/ of the last
> mile to drop certain packets. But anyway...

A DDoS needs to be extremely big for an ISP to notice one of its 
customers is under attack.  And you need a special business relationship 
to be able to call them up and ask that they block a certain type of 
traffic at the head end.

-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

Le 2011-09-14 16:52, Orchid XP v8 a écrit :
>>>> Yep. You still need a computer for each user, tho.
>>>
>>> Sure. But I mean, you can set up an application server that more than
>>> one
>>> person can access, without doing anything particularly special.
>>
>> You can do exactly the same thing on Windows that you do on Unix.
>>
>> Log into the windows box remotely. Start an X client and point it at
>> your display. Disconnect without logging out. Someone else logs into the
>> windows box remotely. They start an X client and points it at their
>> display. They disconnect without logging out. Guess what? Windows
>> running X clients talking to two different X servers.
>
> Does anyone, anywhere on Earth, actually run X on Windows?
>
 > I mean, I gather that you *can*. But does anybody actually *do* this?
 >

Yes.

For two reasons.

1) One of the network monitoring software suite I use is an ugly Windows 
port of something that was developped for Solaris.  Most of the 
configuration tools were written for Motif, and many of the command line 
utilities are ksh scripts.  So the 5 servers that run this particular 
tool all run not only X11, but a "unix environment for Windows" as well.

2) Other servers I manages ARE running AIX, Solaris or Linux.  so the 
only way to run their GUI utilities is by tunnelling X through ssh back 
to my PC.  Just like about 100,000 of my coworkers do.

-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

Le 2011-09-15 15:29, Orchid XP v8 a écrit :
>>> I'm fairly sure I tested it, and discovered that I needed to turn off
>>> multiple things to stop it accepting my password as a valid login. But
>>> since that was then and this is now, I guess I might be incorrect.
>>>
>>
>> Did you at least refresh (aka reload) sshd when updating the
>> configuration ?
>
> Is rebooting the machine sufficient to do that?
>
> If so, yes...
>

Heathen!  Linux machines do not need to be rebooted.  Ever.

To quote Yoda:  Unlearn everything you must.

-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

Le 2011-09-15 13:15, Orchid XP v8 a écrit :
>>> 1995? Jesus, that's WITHIN MY OWN LIFETIME! Compared to Unix, which
>>> almost pre-dates binary computers, that's ultra-modernist!
>>
>> Not only, but current ssh is version 2, which leave the status of draft
>> only in 2006; (1.99 is drafted version 2)
>>
>> ssh of 1995 was version 1 and limited to remote shell (with very limited
>> inband file transfer).
>
> I'm told v1 isn't as secure either. I don't know if that's actually true...
>

ssh 1.0's insecurity was a major plot point of the Matrix II or III.

-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

On 9/12/2011 1:41, Invisible wrote:
> After reading several dozen forum posts, it seems nobody has a really good
> solution for doing this.

Actually, when you think about it, the two people in this situation are not 
unlikely using two computers both of which are using the same IP address, 
like 192.168.0.2.  Hard to see how to make a TCP/IP transfer easy if both 
target machines have the same IP address, regardless of software installed 
or operating system in use.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On 9/15/2011 18:19, Francois Labreque wrote:
> Heathen! Linux machines do not need to be rebooted. Ever.

I'm pretty sure you're wrong on that one.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On 9/15/2011 1:07, clipka wrote:
> An X /client/ on Windows (that is, software running on a Windows host and
> displaying on an X terminal)? Doesn't sound like a common use case to me.

Yep. On the other hand, I was merely trying to point out that it wasn't the 
fact that Windows was present that was causing the problem. Even non-server 
versions of Windows (Pro, not Home, generally) let you have multiple people 
logged in using it as a server.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On 9/15/2011 2:44, Le_Forgeron wrote:
> try playing xonix via VNC... it's far easier with just a X server on the
> windows system.

VNC wasn't really designed for efficiency.

> It's just a shame that windows applications are unable to be translated
> into X clients by MS.

X is a rather sucky protocol, in modern times, for doing this sort of stuff. 
Lots of code breaks, for example, on a high-latency link, because so many 
programs assume that things like change of focus will complete before 
keypress events start arriving, but they don't. There's whole piles of 
kludges to account for that kind of thing.

 > (well, they still have that "one user at a time"
> approach in a lot of their code too)

No they don't. That's enforced entirely by the login program checking licenses.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On 9/15/2011 11:17, Orchid XP v8 wrote:
> If the two machines are on the same LAN, this probably isn't a problem.

Only if it's difficult to transfer data between the outside world and the 
systems you're connecting, a la the original topic of the thread.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On Thu, 15 Sep 2011 19:17:36 +0100, Orchid XP v8 wrote:

>>> As far as I know, getting X to actually work remotely is extremely
>>> difficult, whereas I know from experience that getting VNC to work
>>> remotely is trivial.
>>
>> VNC is also trivially compromised unless you tunnel it over ssh or wrap
>> it in ssl.
> 
> If the two machines are on the same LAN, this probably isn't a problem.
> (And presumably the same applies to X as well anyway...)

Yes, that's true, if you trust the LAN.

Jim

Post a reply to this message

On Thu, 15 Sep 2011 19:46:42 +0100, Orchid XP v8 wrote:

>> Man pages are not intended to be tutorials.  They're manual pages.
> 
> ...which is the point I'm trying to make, yes.

So then what's the problem?  You're complaining that they're not 
tutorials, but they're not intended to be tutorials.

>>> Then again, sometimes the manpage just says "use info". And then you
>>> had /another/ problem...
>>
>> Well, no, it's not *another* problem - you just need to use the info
>> command instead.
> 
> Have /you/ tried navigating the thing?
> 
> Since I'm guessing the answer is probably "yes", then I don't need to
> explain to you how hard it is...

Yes, and I usually end up googling instead.  I'm sure I could figure it 
out, but I don't need it that often.

>>> So even with this line, people can *still* authenticate by password.
>>
>> Not to the best of my knowledge.
> 
> I'm fairly sure I tested it, and discovered that I needed to turn off
> multiple things to stop it accepting my password as a valid login. But
> since that was then and this is now, I guess I might be incorrect.

It might be easier now, yes.  Honestly, I've never even looked for a CHAP-
based authentication mechanism for ssh.

>>>>> I thought the host key is how the server identifies itself to you,
>>>>> not how you identify yourself to the server?
>>>>
>>>> Host keys aren't very commonly used AFAIK.
>>>
>>> All three of the SFTP systems we use commercially have them.
>>
>> A sample size of 3 isn't exactly data supporting "commonly used".
> 
> It's infinity times larger than a sample size of zero. ;-)

Sure, but not mathematically significant.

> Then again, one of these systems is set up to use PK authentication, and
> the server administrators emailled /us/ with the private key to use to
> get access. *facepalm*
> 
> Imagine it: Going to all the trouble of setting up a secure system, and
> not even knowing how to secure it properly...

I don't have to - I see it fairly regularly.

Jim

Post a reply to this message

On Thu, 15 Sep 2011 19:10:09 -0700, Darren New wrote:

> On 9/15/2011 18:19, Francois Labreque wrote:
>> Heathen! Linux machines do not need to be rebooted. Ever.
> 
> I'm pretty sure you're wrong on that one.

Yeah, kernel updates require a reboot.  Other than that, you usually 
don't have to (unless you're killing zombie processes), but sometimes 
"it's easier".

Jim

Post a reply to this message

On 9/15/2011 19:36, Jim Henderson wrote:
> Yeah, kernel updates require a reboot.  Other than that, you usually
> don't have to

Again, it depends on what you're doing and where the Linux is living. I'll 
grant that *desktop* linux systems rarely *need* rebooting. And I'd argue 
that if you have a server whose *only* job is being a web server, then 
restarting the web server after an upgrade is essentially the same as a 
reboot, except faster.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

>>> Did you at least refresh (aka reload) sshd when updating the
>>> configuration ?
>>
>> Is rebooting the machine sufficient to do that?
>>
>> If so, yes...
>>
>
> Heathen! Linux machines do not need to be rebooted. Ever.

It's not so much that I purposely rebooted it; more that it's a laptop 
that shuts down whenever the power is unplugged. So every time I moved 
it to a different location in the building, it was effectively rebooted.

> To quote Yoda: Unlearn everything you must.

If you're going to quote Yoda, do it right:

"Then you must /unlearn/ all that you have /learned/."

Not every sentence he utters is in object-subject-verb order. (At least, 
not in the original trilogy.)

If you really want to split hairs,

http://itre.cis.upenn.edu/~myl/languagelog/archives/002173.html

Post a reply to this message

On 16/09/2011 03:46 AM, Darren New wrote:

> Again, it depends on what you're doing and where the Linux is living.
> I'll grant that *desktop* linux systems rarely *need* rebooting. And I'd
> argue that if you have a server whose *only* job is being a web server,
> then restarting the web server after an upgrade is essentially the same
> as a reboot, except faster.

Actually Windows is getting better at not needing to be rebooted either.

You can quite often install or uninstall software, and it doesn't bother 
asking for a reboot. It just /works/. (Indeed, lots of older software 
asks for a reboot, but actually works fine without one.)

And - fortunately - it's becoming less common to need to reboot due to 
resource leaks too.

Post a reply to this message

On 16/09/2011 03:15 AM, Darren New wrote:
> On 9/15/2011 2:44, Le_Forgeron wrote:
>> try playing xonix via VNC... it's far easier with just a X server on the
>> windows system.
>
> VNC wasn't really designed for efficiency.

The fail!

Post a reply to this message

>> Sometimes I think it would be nice if there was a widely-supported
>> standard for configuring the firewall at the /other end/ of the last
>> mile to drop certain packets. But anyway...
>
> A DDoS needs to be extremely big for an ISP to notice one of its
> customers is under attack. And you need a special business relationship
> to be able to call them up and ask that they block a certain type of
> traffic at the head end.

Quite. I did actually hear about a guy having to spend ages on the phone 
to their ISP to ask for firewall configuration changes.

Now imagine if there were a standard, widely-implemented system for 
letting the customer make those configuration changes themselves... 
Let's face it, the ISP's routers are almost certainly remote-manageable 
anyway. If the unwanted packets can be blocked at the entrance to the 
ISP's network, they can save themselves the bother of having to route a 
bunch of traffic. (Although the amount of data you can fire at one 
customer is probably peanuts compared to the ISP network capacity.)

Ah well, dream on...

Post a reply to this message

On 16/09/2011 03:08 AM, Darren New wrote:
> On 9/12/2011 1:41, Invisible wrote:
>> After reading several dozen forum posts, it seems nobody has a really
>> good
>> solution for doing this.
>
> Actually, when you think about it, the two people in this situation are
> not unlikely using two computers both of which are using the same IP
> address, like 192.168.0.2. Hard to see how to make a TCP/IP transfer
> easy if both target machines have the same IP address, regardless of
> software installed or operating system in use.

With NAT, it can work perfectly well. At long as each endpoint knows the 
other only by its publicly routable IP address, anyway.

There are probably web servers that run on RFC-1918 IP addresses. And 
plenty of home users who do. And yet, they can still talk to each other...

The /problem/ happens when you want to route between two entire 
/networks/ with the same network number.

Post a reply to this message

>>> Man pages are not intended to be tutorials.  They're manual pages.
>>
>> ...which is the point I'm trying to make, yes.
>
> So then what's the problem?  You're complaining that they're not
> tutorials, but they're not intended to be tutorials.

No, I'm complaining that tutorials don't exist. Only reference manuals.

>> Since I'm guessing the answer is probably "yes", then I don't need to
>> explain to you how hard it is...
>
> Yes, and I usually end up googling instead.  I'm sure I could figure it
> out, but I don't need it that often.

Let's just hope you're not trying to look up how to configure Internet 
access...

>>>> So even with this line, people can *still* authenticate by password.
>>>
>>> Not to the best of my knowledge.
>>
>> I'm fairly sure I tested it, and discovered that I needed to turn off
>> multiple things to stop it accepting my password as a valid login. But
>> since that was then and this is now, I guess I might be incorrect.
>
> It might be easier now, yes.  Honestly, I've never even looked for a CHAP-
> based authentication mechanism for ssh.

No, I mean, I might be remembering this wrong.

>>> A sample size of 3 isn't exactly data supporting "commonly used".
>>
>> It's infinity times larger than a sample size of zero. ;-)
>
> Sure, but not mathematically significant.

Not /statistically/ significant, if you want to be picky.

>> Imagine it: Going to all the trouble of setting up a secure system, and
>> not even knowing how to secure it properly...
>
> I don't have to - I see it fairly regularly.

This is the real WTF...

Post a reply to this message

Le 16/09/2011 10:24, Invisible a écrit :
> Actually Windows is getting better at not needing to be rebooted either.

Told me... this morning security update did insist on reboot.
As usual!

Post a reply to this message

On 16/09/2011 11:03 AM, Le_Forgeron wrote:
> Le 16/09/2011 10:24, Invisible a écrit :
>> Actually Windows is getting better at not needing to be rebooted either.
>
> Told me... this morning security update did insist on reboot.
> As usual!

Sure. But that's because it's probably replacing bits of the OS kernel, 
or at the very least it's replacing widely-used system libraries, and 
the simplest way to handle that is to just reboot.

I can install an AV product and not need to reboot. (Very useful for 
fileservers!) I can install .NET, or Office, or VisualStudio, and not 
need to reboot. I can install all kinds of stuff, and mostly I don't 
need to reboot. Sometimes you still do, but it used to be any installing 
or uninstalling *anything* always required a reboot.

Post a reply to this message

On 9/16/2011 3:03, Le_Forgeron wrote:
> Told me... this morning security update did insist on reboot.

And, oddly enough, mine didn't. Possibly because I actually closed the 
programs in the way before installing the updates.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On 9/16/2011 1:25, Invisible wrote:
> On 16/09/2011 03:15 AM, Darren New wrote:
>> On 9/15/2011 2:44, Le_Forgeron wrote:
>>> try playing xonix via VNC... it's far easier with just a X server on the
>>> windows system.
>>
>> VNC wasn't really designed for efficiency.
>
> The fail!

Nope. It was just designed to be easy to implement instead of being 
efficient. Show me X-Windows ported to a javascript client.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On 9/16/2011 1:30, Invisible wrote:
> With NAT, it can work perfectly well. At long as each endpoint knows the
> other only by its publicly routable IP address, anyway.

Assuming you have configured at least one to *have* a publicly routable IP 
address. That's kind of the point.

> There are probably web servers that run on RFC-1918 IP addresses. And plenty
> of home users who do. And yet, they can still talk to each other...

The problem comes when the person running the server doesn't know how to 
route traffic from the public IP address to the private one.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On Thu, 15 Sep 2011 19:46:30 -0700, Darren New wrote:

> On 9/15/2011 19:36, Jim Henderson wrote:
>> Yeah, kernel updates require a reboot.  Other than that, you usually
>> don't have to
> 
> Again, it depends on what you're doing and where the Linux is living.
> I'll grant that *desktop* linux systems rarely *need* rebooting. And I'd
> argue that if you have a server whose *only* job is being a web server,
> then restarting the web server after an upgrade is essentially the same
> as a reboot, except faster.

I don't see a need to regularly reboot Linux servers either, unless 
there's a kernel update.

Jim

Post a reply to this message

On Fri, 16 Sep 2011 09:34:42 +0100, Invisible wrote:

>> So then what's the problem?  You're complaining that they're not
>> tutorials, but they're not intended to be tutorials.
> 
> No, I'm complaining that tutorials don't exist. Only reference manuals.

Tutorials exist, they're not included with the OS.  Do I really need to 
say (again) "GIYF"?

>>> Since I'm guessing the answer is probably "yes", then I don't need to
>>> explain to you how hard it is...
>>
>> Yes, and I usually end up googling instead.  I'm sure I could figure it
>> out, but I don't need it that often.
> 
> Let's just hope you're not trying to look up how to configure Internet
> access...

I've managed to do that enough times that it generally isn't something I 
need to look up these days.  But if I did, a quick trip to my public 
library to use one of their computers to do the search will in fact solve 
that problem.

Or I could use my phone.

Or I could use another of my systems here.

>> It might be easier now, yes.  Honestly, I've never even looked for a
>> CHAP- based authentication mechanism for ssh.
> 
> No, I mean, I might be remembering this wrong.

That's certainly possible.

>>>> A sample size of 3 isn't exactly data supporting "commonly used".
>>>
>>> It's infinity times larger than a sample size of zero. ;-)
>>
>> Sure, but not mathematically significant.
> 
> Not /statistically/ significant, if you want to be picky.

Statistics is a branch of mathematics. :P

>>> Imagine it: Going to all the trouble of setting up a secure system,
>>> and not even knowing how to secure it properly...
>>
>> I don't have to - I see it fairly regularly.
> 
> This is the real WTF...

People who work in IT have not had to learn as much these days as they 
did 20 years ago.  That means they set up systems and often don't have 
the knowledge or skills to properly secure a system.

And the first thing to get cut from IT budgets is funding for training, 
usually.  Training that could actually resolve some of those security 
issues by having competent staff.

Jim

Post a reply to this message

On 9/16/2011 9:54, Jim Henderson wrote:
> I don't see a need to regularly reboot Linux servers either, unless
> there's a kernel update.

So when the memory leak in your Linux-based wireless access point crashes 
your machine, what do you do?  When your cable box no longer synchronizes 
with the cable provider, or you get a new configuration pushed to your cable 
modem from the head end, what do you do? When you update the PRL on your 
android phone, what happens after the new PRL is stored?

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On 16/09/2011 5:57 PM, Jim Henderson wrote:
> Training that could actually resolve some of those security
> issues by having competent staff.

You're asking a lot there, Jim. ;-)

-- 
Regards
     Stephen

Post a reply to this message

Le 2011-09-15 22:10, Darren New a écrit :
> On 9/15/2011 18:19, Francois Labreque wrote:
>> Heathen! Linux machines do not need to be rebooted. Ever.
>
> I'm pretty sure you're wrong on that one.
>
A previous version of that post had a smiley at the end.  I guess it got 
lost during the vetting process.

-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

On Fri, 16 Sep 2011 10:01:51 -0700, Darren New wrote:

> On 9/16/2011 9:54, Jim Henderson wrote:
>> I don't see a need to regularly reboot Linux servers either, unless
>> there's a kernel update.
> 
> So when the memory leak in your Linux-based wireless access point
> crashes your machine, what do you do?  

I report the bug with supporting data, build the latest version of the 
code, and try to fix it.  I don't just reboot it.

In fact, I went through something very similar to this not long ago - my 
wireless router/access point runs openWRT, and a recent update borked the 
atheros driver.  Rebuilt the older kernel, reported the bug, and applied 
the downgrade.

> When your cable box no longer
> synchronizes with the cable provider, or you get a new configuration
> pushed to your cable modem from the head end, what do you do? 

Well, I don't have cable any more (it was an expense we had to cut when I 
was laid off).  But that's an appliance, not the same as "running a Linux 
server" in my book.  If Comcast wants to reboot their box, they can 
reboot their box.

> When you
> update the PRL on your android phone, what happens after the new PRL is
> stored?

Again, not a Linux *server* - it's an appliance.  If Verizon decides the 
phone needs rebooted, then it gets rebooted.

There's probably a way to do this without rebooting the device 
(especially if it's rooted), but often times it's just simpler to reboot.

That doesn't mean a reboot is *necessary*, which is what we were 
discussing.

Jim

Post a reply to this message

On Fri, 16 Sep 2011 18:06:01 +0100, Stephen wrote:

> On 16/09/2011 5:57 PM, Jim Henderson wrote:
>> Training that could actually resolve some of those security issues by
>> having competent staff.
> 
> You're asking a lot there, Jim. ;-)

Indeed, I am - but things could get interesting here job-wise, as I've 
found a job where I might actually have to solve that one. :)

Jim

Post a reply to this message

On Fri, 16 Sep 2011 13:16:49 -0400, Jim Henderson wrote:

> On Fri, 16 Sep 2011 18:06:01 +0100, Stephen wrote:
> 
>> On 16/09/2011 5:57 PM, Jim Henderson wrote:
>>> Training that could actually resolve some of those security issues by
>>> having competent staff.
>> 
>> You're asking a lot there, Jim. ;-)
> 
> Indeed, I am - but things could get interesting here job-wise, as I've
> found a job where I might actually have to solve that one. :)

(Not as in "been given an offer for", rather I found a posting that I'm 
applying for)

Jim

Post a reply to this message

Le 2011-09-16 04:30, Invisible a écrit :
>
> With NAT, it can work perfectly well. At long as each endpoint knows the
> other only by its publicly routable IP address, anyway.

Correction: as long as both endpoints know each other by an address that 
works for them.

I know of customers who do inbound natting of third party servers as 
well, because they don't want to route the public IP range inside their 
network.

> There are probably web servers that run on RFC-1918 IP addresses.

I would wager that the vast majority of them do.

-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

Le 2011-09-16 04:28, Invisible a écrit :
>>> Sometimes I think it would be nice if there was a widely-supported
>>> standard for configuring the firewall at the /other end/ of the last
>>> mile to drop certain packets. But anyway...
>>
>> A DDoS needs to be extremely big for an ISP to notice one of its
>> customers is under attack. And you need a special business relationship
>> to be able to call them up and ask that they block a certain type of
>> traffic at the head end.
>
> Quite. I did actually hear about a guy having to spend ages on the phone
> to their ISP to ask for firewall configuration changes.
>
> Now imagine if there were a standard, widely-implemented system for
> letting the customer make those configuration changes themselves...
> Let's face it, the ISP's routers are almost certainly remote-manageable
> anyway. If the unwanted packets can be blocked at the entrance to the
> ISP's network, they can save themselves the bother of having to route a
> bunch of traffic. (Although the amount of data you can fire at one
> customer is probably peanuts compared to the ISP network capacity.)
>
> Ah well, dream on...

Then it would take 2.5 nanoseconds for a hacker to steal your 
credentials and make those changes for you.  BLAM! total denial of service.

Some IDS/IPS vendors have programmed routines in their systems that can 
automatically change firewall rules in the event that they detect an 
attack, yet the majority of installations leave this feature turned off 
because people are afraid of false alerts blocking valid traffic, and 
having HAL in control of the pod bay doors.

I'm sure ISPs feel the same way about having their customers be able to 
play with their firewall configs.
-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

On 16/09/2011 6:17 PM, Jim Henderson wrote:
>>
>>> On 16/09/2011 5:57 PM, Jim Henderson wrote:
>>>> Training that could actually resolve some of those security issues by
>>>> having competent staff.
>>>
>>> You're asking a lot there, Jim. ;-)
>>
>> Indeed, I am - but things could get interesting here job-wise, as I've
>> found a job where I might actually have to solve that one. :)
>
> (Not as in "been given an offer for", rather I found a posting that I'm
> applying for)
>

Good luck with that one. I hope that you can deliver on time and in 
budget ;-)


-- 
Regards
     Stephen

Post a reply to this message

On 9/16/2011 10:15, Jim Henderson wrote:
>  not the same as "running a Linux server" in my book.

I agree. That's precisely my point.  Saying "you never have to reboot a 
Linux machine except for kernel upgrades" is incorrect. It assumes the box 
has all the tools it needs to manage it without rebooting, and it assumes 
your software environment isn't hardened against you manipulating it in the 
ways described.

> That doesn't mean a reboot is *necessary*, which is what we were
> discussing.

OK, so how do you upgrade your PRL without rebooting your phone? My point is 
that claiming "you don't have to" assumes a whole bunch of facts that 
aren't true just because you're running Linux.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On Fri, 16 Sep 2011 12:00:28 -0700, Darren New wrote:

> On 9/16/2011 10:15, Jim Henderson wrote:
>>  not the same as "running a Linux server" in my book.
> 
> I agree. That's precisely my point.  Saying "you never have to reboot a
> Linux machine except for kernel upgrades" is incorrect. It assumes the
> box has all the tools it needs to manage it without rebooting, and it
> assumes your software environment isn't hardened against you
> manipulating it in the ways described.

You specified servers and desktops - not appliance devices.

I also never said "you never have to reboot a Linux machine except for 
kernel updates".  I said "you usually never have to reboot a Linux 
machine except for kernel updates".  There's a world of difference in 
those two statements.

I also very specifically stated that if you're dealing with zombie 
processes, a Linux system *requires* a reboot to the best of my knowledge.

>> That doesn't mean a reboot is *necessary*, which is what we were
>> discussing.
> 
> OK, so how do you upgrade your PRL without rebooting your phone? My
> point is that claiming "you don't have to" assumes a whole bunch of
> facts that aren't true just because you're running Linux.

I've never had a need to, so I don't know.  Presumably you could stop a 
service or unload/reload a driver, or drop to single user mode and then 
go back to the default runlevel.

Jim

Post a reply to this message

On Fri, 16 Sep 2011 19:10:30 +0100, Stephen wrote:

> On 16/09/2011 6:17 PM, Jim Henderson wrote:
>>>
>>>> On 16/09/2011 5:57 PM, Jim Henderson wrote:
>>>>> Training that could actually resolve some of those security issues
>>>>> by having competent staff.
>>>>
>>>> You're asking a lot there, Jim. ;-)
>>>
>>> Indeed, I am - but things could get interesting here job-wise, as I've
>>> found a job where I might actually have to solve that one. :)
>>
>> (Not as in "been given an offer for", rather I found a posting that I'm
>> applying for)
>>
>>
> Good luck with that one. I hope that you can deliver on time and in
> budget ;-)

A little late on the "on time" bit (I had wanted to be back to work about 
2 months ago - but only in a position that was right for me), but yeah, I 
think this could work out well once I get the resume into the right 
person's hands.  The trick is making sure it gets to the right person 
rather than going through "the front door".

Jim

Post a reply to this message

On 9/16/2011 12:57, Jim Henderson wrote:
> You specified servers and desktops - not appliance devices.

No I didn't.  I was responding to someone else's comment of

 >> Heathen! Linux machines do not need to be rebooted. Ever.

That didn't say "Linux machines with a full development environment 
installed and to which you have root access never have to be rebooted." 
That's my point here. :-)

> I've never had a need to, so I don't know.  Presumably you could stop a
> service or unload/reload a driver, or drop to single user mode and then
> go back to the default runlevel.

Cool. How do I drop to single-user mode on my cell phone?

Again, you're making assumptions that the linux in your phone (or your cable 
box or your credit card terminal) is like the linux in your desktop or 
server machine.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

Am 16.09.2011 19:14, schrieb Francois Labreque:
> Le 2011-09-15 22:10, Darren New a écrit :
>> On 9/15/2011 18:19, Francois Labreque wrote:
>>> Heathen! Linux machines do not need to be rebooted. Ever.
>>
>> I'm pretty sure you're wrong on that one.
>>
> A previous version of that post had a smiley at the end. I guess it got
> lost during the vetting process.

Id didn't get lost - it just hid between the lines. I swear I can hear 
it chuckling.

Post a reply to this message

On Fri, 16 Sep 2011 13:22:55 -0700, Darren New wrote:

> On 9/16/2011 12:57, Jim Henderson wrote:
>> You specified servers and desktops - not appliance devices.
> 
> No I didn't.  I was responding to someone else's comment of
> 
>  >> Heathen! Linux machines do not need to be rebooted. Ever.
> 
> That didn't say "Linux machines with a full development environment
> installed and to which you have root access never have to be rebooted."
> That's my point here. :-)

That's fair.  You wrote your reply to a message I wrote, so clearly I 
thought you were responding to what I said.

>> I've never had a need to, so I don't know.  Presumably you could stop a
>> service or unload/reload a driver, or drop to single user mode and then
>> go back to the default runlevel.
> 
> Cool. How do I drop to single-user mode on my cell phone?

Probably depends on the phone.  Like I said, I've never needed to find 
out, so I don't know.

> Again, you're making assumptions that the linux in your phone (or your
> cable box or your credit card terminal) is like the linux in your
> desktop or server machine.

Linux is a kernel.  I'm not making assumptions about the kernel.

Jim

Post a reply to this message

On 9/16/2011 21:36, Jim Henderson wrote:
> That's fair.  You wrote your reply to a message I wrote, so clearly I
> thought you were responding to what I said.

I still never specified servers at all, and I only mentioned desktops in a 
disclaimer. :-)

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On 9/16/2011 21:36, Jim Henderson wrote:
 > Linux is a kernel.  I'm not making assumptions about the kernel.

Incidentally, in the real world, nobody cares about the kernel. If you have 
10,000 airline agents hitting your database from all around the world, and 
your database server takes 10 minutes to restart and recache its indexes 
after you upgrade the code, nobody really cares if the kernel survived the 
upgrade or not. :-)  That's what always amuses me about such discussions.

Indeed, people don't really even care if it was the database down or the 
router provided by your ISP.  A backhoe outside your door is going to screw 
up your uptime stats as much as a kernel upgrade will.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On Sat, 17 Sep 2011 07:13:26 -0700, Darren New wrote:

> On 9/16/2011 21:36, Jim Henderson wrote:
>  > Linux is a kernel.  I'm not making assumptions about the kernel.
> 
> Incidentally, in the real world, nobody cares about the kernel. If you
> have 10,000 airline agents hitting your database from all around the
> world, and your database server takes 10 minutes to restart and recache
> its indexes after you upgrade the code, nobody really cares if the
> kernel survived the upgrade or not. :-)  That's what always amuses me
> about such discussions.

Certainly - and the question of whether it has to be rebooted or not is 
somewhat mooted by that point.  I can get a lot of things to restart 
properly by just going to single user mode and back to runlevel 3 or 5, 
but if services are offline, that's still downtime.

Server uptime isn't a great measure of availability.  Service uptime is 
more meaningful.

Just like the neverending debate about which Linux desktop environment is 
the "best".  I've used pretty much all of them, and have come to the 
conclusion that the DE is pretty irrelevant - if I am using a computer, 
I'm using it for the apps, not the DE.  If I'm focused on the DE so much 
that I "hate" KDE or GNOME or LXDE or whatever - then I'm obviously not 
using the computer as a tool to get actual work done.

> Indeed, people don't really even care if it was the database down or the
> router provided by your ISP.  A backhoe outside your door is going to
> screw up your uptime stats as much as a kernel upgrade will.

Absolutely.

Jim

Post a reply to this message

On Fri, 16 Sep 2011 22:37:00 -0700, Darren New wrote:

> On 9/16/2011 21:36, Jim Henderson wrote:
>> That's fair.  You wrote your reply to a message I wrote, so clearly I
>> thought you were responding to what I said.
> 
> I still never specified servers at all, and I only mentioned desktops in
> a disclaimer. :-)

"And I'd argue that if you have a server whose *only* job is being a web 
server, then restarting the web server after an upgrade is essentially 
the same as a reboot, except faster."

That seems to be the source of the misunderstanding, because you did talk 
about servers there.

Jim

Post a reply to this message

On 9/17/2011 10:32, Jim Henderson wrote:
> On Fri, 16 Sep 2011 22:37:00 -0700, Darren New wrote:
>
>> On 9/16/2011 21:36, Jim Henderson wrote:
>>> That's fair.  You wrote your reply to a message I wrote, so clearly I
>>> thought you were responding to what I said.
>>
>> I still never specified servers at all, and I only mentioned desktops in
>> a disclaimer. :-)
>
> "And I'd argue that if you have a server whose *only* job is being a web
> server, then restarting the web server after an upgrade is essentially
> the same as a reboot, except faster."
>
> That seems to be the source of the misunderstanding, because you did talk
> about servers there.

Fair enough. Plus that statement applies to any OS, not just Linux. :-)

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On 9/17/2011 10:31, Jim Henderson wrote:
> that I "hate" KDE or GNOME or LXDE or whatever - then I'm obviously not
> using the computer as a tool to get actual work done.

Heh heh heh. I'm definitely going to steal that.

-- 
Darren New, San Diego CA, USA (PST)
   How come I never get only one kudo?

Post a reply to this message

On Sun, 18 Sep 2011 09:14:28 -0700, Darren New wrote:

> On 9/17/2011 10:32, Jim Henderson wrote:
>> On Fri, 16 Sep 2011 22:37:00 -0700, Darren New wrote:
>>
>>> On 9/16/2011 21:36, Jim Henderson wrote:
>>>> That's fair.  You wrote your reply to a message I wrote, so clearly I
>>>> thought you were responding to what I said.
>>>
>>> I still never specified servers at all, and I only mentioned desktops
>>> in a disclaimer. :-)
>>
>> "And I'd argue that if you have a server whose *only* job is being a
>> web server, then restarting the web server after an upgrade is
>> essentially the same as a reboot, except faster."
>>
>> That seems to be the source of the misunderstanding, because you did
>> talk about servers there.
> 
> Fair enough. Plus that statement applies to any OS, not just Linux. :-)

That's certainly true.

Jim

Post a reply to this message

On Sun, 18 Sep 2011 09:15:21 -0700, Darren New wrote:

> On 9/17/2011 10:31, Jim Henderson wrote:
>> that I "hate" KDE or GNOME or LXDE or whatever - then I'm obviously not
>> using the computer as a tool to get actual work done.
> 
> Heh heh heh. I'm definitely going to steal that.

Feel free. :)

Jim

Post a reply to this message