- main - earth.li

Re: [Alug] march meeting
by MJ Ray 11 Feb '02

11 Feb '02

Syd wrote: > Sorry everyone, I had volunteered to hold the march meeting at my > place but due to varioius difficult circumstances I willhave to > cancel. I'm sorry to hear that. Best wishes to you during the difficult times. Rob, can you have us at Elmswell in March? That'll give me enough time to try to sort out something around here (West Norfolk) for April (no time for March) and give a nice ping-pong between Norfolk and Suffolk. -- MJR

3 2

[Fwd: Re: [Alug] "Reverse" VNC]
by Laurie Brown 11 Feb '02

11 Feb '02

Eric Sellin wrote: > Laurie Brown wrote: > >>What I need is a sort of reverse VNC for accessing machines >>where I don't know the IP address. >> > > Can't you start the VNC viewer in listen mode at your end, then get your > customer to start the VNC server and add a new client by giving your own IP > address? I'm trying to get my head around that (in the context of my reply to Brett). Care to elaborate, please? Cheers, Laurie. -- --------------------------------------------------------------------- Laurie Brown laurie(a)brownowl.com PGP key at http://pgpkeys.mit.edu:11371 ---------------------------------------------------------------------

1 0

Re: [Alug] "Reverse" VNC]
by Laurie Brown 11 Feb '02

11 Feb '02

brettp(a)users.sourceforge.net wrote: > On Mon, Feb 11, 2002 at 02:10:13PM +0000, Laurie Brown wrote: > >>Run a VNC-type "server": a remote client connects to it, and I can >>then, from my "server" control the client machine. >> >>For dial-up/DHCP/NAT situations where I can't reach a client >>directly, I need the client to be able to initiate the connection, >>but thereafter it to behave as if I'd done a normal VNC connect into it. >> > > Hrm... why not make the client machine use something like dyndns or myip > so that you can connect to it... there are clients for both of these for > both doze and nux... that way you can just vnc to something like > whatthefsckis.myip.org. Does that make any sense, what so ever? The specific problem that has caused this is good old NTL's business service. One of my clients, based in Farnborough, got a 1meg NTL line in on my recommendation. A good deal at 120squid a month, and AFAIKnew working the same as my home 512K line: that is, cable modem acting as a pass-through device, direct to Linux firewall, which is given an IP address by remote NTL server, then NAT in/out through said firewall. Firewall visible to 'Net: cushty. Sadly, no... NTL supplied a Cisco UBR9xxx router, which is given a NAT address of 172.16.blah, and which in turn gives the LAN-facing ports a 192.168.1.x IP address. My Linux firewall then NATs that again internally. Result: I can't see a single internal box, including the firewall from outside. This make remote management (the whole fscking point!) a shade difficult. I found a net-based service for $9.95 a month by which an internal machine "pings" their web site with some bespoke software, which responds when I "log in" to said web site, giving me a route to the internal machine and a VNC-like terminal. For millions of reasons, this isn't ideal (not least because I'm accessing an NT4 PDC), hence the requirement for a reverse VNC type thingy. Allegedly, this will go away when NTL release their fixed-ip service Real Soon Now... Customer can't wait, and this egg on my face is getting a mite smelly... Cheers, Laurie. -- --------------------------------------------------------------------- Laurie Brown laurie(a)brownowl.com PGP key at http://pgpkeys.mit.edu:11371 ---------------------------------------------------------------------

1 0

newer version of debian?
by Jenny_Hopkins＠toby-churchill.com 11 Feb '02

11 Feb '02

Hi all, I've managed to be persuasive and get the company to buy me a better box for linux, so the old one i currently use can be a sandpit and all the stuff I do that is starting to be important is on a dedicated box. A good step forward for linux here, as i was told last year not to waste too much time on this linux stuff as we would never have a need for it in the company. Now we have a website, secure file storage system, cvs for software and system for embedding ipaq's with linux kernel and speech system built in linux. Anyway, i digress in my excitement.....what i wondered was, does anyone have a copy of a newer debian version than 2.1.18pre21 I could blag a copy of? Cheep linux are doing them for about £19 so anything cheaper would be good. Of course, i could install my old one and upgrade the kernel just for fun instead.......................... Jenny.

2 2

Re: [Alug] port forwarding
by MJ Ray 11 Feb '02

11 Feb '02

D: > Some servers are a reseller style system, so your not in control of all the > users. This is the ONLY way to do it and it will stop the network being used > for spam It is not the only way, even if you write it in capitals. You provide documentation on how to send email (ie the relay's details) and if they do anything else, a polite REJECT from the firewall should help them along. That is (IMO) the best way to do it. Redirect is a poor substitute for instructions. Redirect will work in many (most?) cases, but it will confuse the clients in others. Don't mistake it for a perfect solution. I'm sure some of us have tunnelled around such draconian blocks when we needed to. Please don't think that that alone will stop the network being used for spam. If customers can send email from web scripts, one of them will put a buggy script up and a spammer will use it as a relay. Unless you do something a bit cleverer on the server to monitor it, you'll not be able to block it. You should also block port 25 incoming apart from your mail server, else you'll be used as a two-step relay and the official mail server will be dropped into the blackholes too. -- MJR

1 0

Re: [Alug] port forwarding
by MJ Ray 11 Feb '02

11 Feb '02

D: > I want to FORCE users/servers on the network to redirect outgoing data sent > on port 25 to another server (Internal mail server) That's a bit overbearing of you. If you really must, block port 25 at the firewall apart from to your relay mail server. This forces the clients to acknowledge that there is One True Email Relay for them. You can do "clever" stuff with catching port 25 and using an iptables redirect, as freeserve appear to, but why confuse any clients? Just chop their bits off if they attempt to do something that they should not. -- MJR

2 1

march meeting
by Syd Hancock 10 Feb '02

10 Feb '02

Sorry everyone, I had volunteered to hold the march meeting at my place but due to varioius difficult circumstances I willhave to cancel. Best wishes Syd

1 0

Re: [Alug] New member
by Jenny_Hopkins＠toby-churchill.com 10 Feb '02

10 Feb '02

Eric Sellin wrote: >My first question: do you guys ever meet in Ipswich? Hi Eric, welcome. Find a venue, set a date, and we'll be there! Jenny.

4 3

Secure Firewalling, Runlevel 0 (?!)
by James 09 Feb '02

09 Feb '02

Here is an interesting article of running firewalls with the machine "halted" (runlevel 0) for extra security <*tilt*> is a first reaction. But it _is_ an intriguing concept... Article here: http://www.samag.com/print/documentID=20294 Slashdot thread here: http://slashdot.org/articles/02/02/08/1624217.shtml?tid=172 Anyone have any personal experiences of such trickery to relate? --James

4 5

Re: [Alug] Re: clug Secure Firewalling, Runlevel 0 (?!)
by MJ Ray 09 Feb '02

09 Feb '02

Jon: > Get the terminology right. Runlevel 0 is known as single user mode > and it is not in anyway halted. [...] 0 is halt. 1 is single-user. At least in LSB-ready systems. Much cooler is to run the firewall without an IP address, but then you need console access too. -- MJR

1 0