KCLUG

kclug@kclug.org

9 participants
3251 discussions

RE: firewalls and webservers request for comments
by Brian Densmore 08 Oct '04

08 Oct '04

> -----Original Message----- > From: Dustin Decker > > I would say one of the primary benefits of a dedicated > firewall is found in > the very clear separation of duties across hosts. For > example, I make use > of IPCop frequently with clients. If I need a port open for > them (which > isn't always the case) then I can forward it. In those cases > where I have a > handful of Windows users, I have the added benefit of using > proxy services, > tuned to the satisfaction of management, etc. Separation is good, but can be costly too. > > My personal favorite is intrusion detection. In the case of > IPCop, I make > use of idabench to log all packets in/out of the network in > binary format, > farm it out to my analysis units, and replay through snort. > Any of this > type of activity, if performed on the web server, mail > server, or what have > you, adds an unnecessary load to that system. In addition, with extra > services floating on the box, the odds that I will drop > packets increases - > and I only have to miss one to miss the Really Bad Packet(tm). I guess the question is what kind of load does iptables and idabench and snort place on a machine? Is it big enough to cause dropped packets? What about processor speed and memory? Does intrusion detection cause a problem only on machines below a certain CPU speed and/or below a certain memory limit? > > One other concern I would have is for vulnerable software. > If I have an > apache server behind a firewall, and a new vulnerability is > discovered, > exploitation of it doesn't place my firewall at risk, where > as root access > gained through [insert hack of the week here] quickly gains > the ability to > disable iptables entirely. This is of course the primary reason I can think of for separation, but by the firewall forwarding doesn't that leave the webserver vulnerable anyway? Of course it would still keep the firewall intact and thus prevent the compromised machine to be wide open. Or would it? > > Just for fun, while looking at the ports you have listed > above, I wonder if > you even need port 993 open. You mentioned in a previous > post that you use > webmail. If this is the _only_ method you use to check your mail, 993 This is correct. I don't need that port because most of the time I use the webmail interface, but occasionally I use an IMAPS client. I could do away with that, but wanted to do the IMAPS server and client just to do it. PS Anyone notice the KCStar ad in last Sunday's paper for a Linux tech?

1 0

RE: firewalls and webservers request for comments
by Brian Densmore 08 Oct '04

08 Oct '04

Well, actually I already have iptables running. I have only the ports open that need to be open and only running the services that are needed. I was really looking for what people thought about firewalls protecting webservers and such. I mean not just iptables but the whole ball of wax, the tools for monitoring, etc. Ports I use: SMTP 25 WWW ports 80 and 443 IMAPS port 993 and the SSH ports > -----Original Message----- > From: Frank Wiles > > On Thu, 7 Oct 2004 17:05:45 -0500 > "aaron hirsch" > > > Why tell anyone here are the ports you will need to have > open when all > > ... > > http/https. Why open the door further than it needs to be? > > I wasn't trying to give him advice on how to run his E-mail setup. > > The listing of the ports was just an example to help illustrate why > running a firewall in front of an E-mail server is typically > pointless. > > I apologize if that wasn't clear.

3 2

Re: OT: ogg file blind, listening test
by Brian Kelsay 08 Oct '04

08 Oct '04

Jeff, I don't know about the .ogg bitrates, but with .MP3 I listen to 128Kb streams and files. My ears can detect a slight difference, but the space savings is worth it. At 256kb on MP3, even the most sensitive ears shouldn't detect the difference. Maybe less than 1% of the population would hear a difference. I seem to recall similar data on this at the Ogg Vorbis site and the WinAmp site. Look here and read down a ways: http://www.vorbis.com/faq.psp#lossy Brian Kelsay >>> jeffslists <> 10/08/04 02:10AM >>> Since someone here has just mentioned .ogg files I was wondering what encoding rate I need to use so that I cannot distinguish my .ogg file from my cd. A couple years back I read about a double-blind (maybe just single blind) study with 256kbit constant bitrate mp3's. The listeners, who were described to have excellent ears, could not distinguish the mp3's from the cd's, though a computer could. I don't care what a computer can distinguish. I have searched the net several times and found no similar study with .ogg files. Aren't there any people who have done a blind study with .ogg files? I want to know the minimum quality settings I can use with .ogg in order to save hd space. I have about 120gb 256kb mp3 music. According to my preliminary research I think I can save at least 30% space.

1 0

tid-bisquet: how to convert every .flac to .ogg
by Jason Clinton 08 Oct '04

08 Oct '04

Just for fun, here's a tiny one liner to turn every .flac file on your system in to a ~150Kb .ogg Vorbis file in the same directory the .flac file lives -- inspired by the Neuros Audio Computer. find / -iregex ^.*\\.flac$ -exec oggenc -q 5 {} \;

1 0

Bittorrent
by Jonathan Hutchins 08 Oct '04

08 Oct '04

Well, I've got to say BitTorrent has come a long way... I installed the optional "shadow" client available on my Mandrake 10.0 system, read up on the firewall requirements, punched through, found a torrent, and nothing happened. "Failed to connect" - real helpful. However, I hunted around, and did manage to find a decent torrent, and sure enough, I got about what I get when I can manage to find a good FTP server, 300+ kB/s. The speed often dropped below that, down under 200, but what the heck, chances of finding a full-speed ftp feed on an iso are pretty poor too. Error reporting could be better. It's likely that that "failed to connect" was actually inability to write to the target directory, which also gives a meaningful "failed" when I know that's the problem. There are still a lot of bogus torrents listed out there. Maybe it's a good idea, but I still say it's not quite there yet. (Oh, and the firewall thing is so basic that it should be easy to code around it, or at least pop up the directions when the cleint detects that it's blocked.)

2 1

Re: Bittorrent
by Brian Kelsay 07 Oct '04

07 Oct '04

With Bittorrent and its brother BitTornado, getting a file becomes as easy as double clicking on it and choosing where to save. That is pretty easy if you ask me. Now for those with a firewall, there are simple instructions on the BitTornado site. You do need to know how to login to and alter your firewall. I opened a range of ports quite easily on IPCop, which I then disable after I finish getting the torrent and serving for a while. As for the Starband users problems, we know it is a problem. Ask someone to download an ISO for you like the dialup users do. It took about 20-30 minutes for me to get Xandros last night. A few minutes to burn. Hope I remember that part when I get home. As was discussed on IRC, it would be nice if the FTP would fail over to torrent if the server has more than a certain amount of requests, but at the least, the tracker could come from the same location as the ISO. It is useful that at least the links to ftp and torrent are usually on the same webserver page. ----------------------------------------------------------------------------------- >>> Oren Beck <oren_beck(a)hotmail.com> 10/05/04 02:00PM >>> Sadly the concept of blaming the user is easier than making things simply work . Making things work simply is the truly non-trivial part we often forget about . Your idea of an alternate protocol is quite well advised . If no other reason than to allow the early adopters some way to GET the Torrent software itself . Even then alternate protocols are smart due to some of us not easily adopting Torrent for several reasons . Forgetting * any* software issues being the problem what then of us on connections totally unfriendly to Torrent. For example Starband and other upload speed restricted users . The core concept of Torrent was never in doubt , it's the deploying that needs work . What is very disturbing to me is that certain un-named players seem to be profiteering on the altar of Torrent ! Charging someone $ 10 for a HTTP download but free as Torrent seems quite extreme . Not mentioning those who as above are disadvantaged in access to Torrent for whatever reason . I could even understand a priority launch of Torrent seeding to FTP or HTTP sites on day zero as Slashdot effect prevention by load balancing thru redundancy in mirrors -THAT seems a good Torrent use . Brian Kelsay

3 2

RE: firewalls and webservers request for comments
by aaron hirsch 07 Oct '04

07 Oct '04

> Ok, y'all know I've got me one of them thar webservers > out there in the WWWild. I run a minimal firewall (aka > iptables). I'm wondering though what the consensus is > on running a full-blown firewall like say IPCop on a > server that is a busy box. My webserver is also a mail > server and naturally a webmail server. What are the benefits > of say adding a second box and running a full-metal jacket > firewall like IPCop, and can you run a webserver/mailserver > on the same box as IPCop (that is without ripping out the > guts of IPCop so it's no longer an IPCop version but some > chopped up hacked up Frankenstein monster)? If you are only running the services you need to be running and have locked down your system fairly well a firewall, either internal or external, is mostly pointless. If you're running an E-mail server and WWW server you'll need the following ports open: 25 SMTP 80 WWW 110 POP3 143 IMAP Possibly some others for SSL encrypted POP, IMAP, WWW and possibly SSHD if you're going to do remote administration. Putting a firewall in front of this box, or using iptables, is mostly a waste of time because you'll need all of these ports open to most every Internet IP address anyway or they can't provide their services. Firewalls aren't a magic bullet. Most every service you run on a Linux box can be IP restricted on it's own or if not you can use iptables to do this. That's all firewalls really do IP restrict who can access what ports. Considering most, if not all, of your services need to accessible from the entire Internet I wouldn't worry about a firewall. Why tell anyone here are the ports you will need to have open when all they have specified is services? Wouldn't it have been better to ask IF they wanted pop3/pop3s/imap/imaps before telling them to open xyz ports? I'm not trying to be a dick, but get the facts before telling someone to open xyz ports. Why should they open pop3 to the world if they are going to use imap, or vice-versa; heck why open them to the world at all if they are going to use webmail and imap and pop3 access are only required from the webserver? I've set up many mail servers where the only service available to the world is smtp, port 25, and http/https. Why open the door further than it needs to be?

2 1

firewalls and webservers request for comments
by Brian Densmore 07 Oct '04

07 Oct '04

Ok, y'all know I've got me one of them thar webservers out there in the WWWild. I run a minimal firewall (aka iptables). I'm wondering though what the consensus is on running a full-blown firewall like say IPCop on a server that is a busy box. My webserver is also a mail server and naturally a webmail server. What are the benefits of say adding a second box and running a full-metal jacket firewall like IPCop, and can you run a webserver/mailserver on the same box as IPCop (that is without ripping out the guts of IPCop so it's no longer an IPCop version but some chopped up hacked up Frankenstein monster)? Brian Densmore <Bush> Kerry voted 350 times for Tax increases! <Factcheck.org> U R an idiot, Bush. No he didn't! <Bush> Kerry voted 98 times for tax increases! <Factcheck.org> U R such an Idiot, Bush! No he didn't! <Bush> Uhh... Factcheck.org is an unlawful combatant!

2 1

Re: RE: Help configuring email server...
by Brian Kelsay 07 Oct '04

07 Oct '04

Congratulations on not giving up and starting from scratch. Why don't you point us to the documentation that you found helpful? I would like to try exim or postfix for one of my next home server projects and could use the help. Exim is installed by default on Debian server class installs, instead of Sendmail, IIRC. Or was that postfix? Smarthost usage is what allows your mail to be relayed thru the ISP SMTP server. Your mail gets a note in the header that it was relayed via a smarthost and so it is allowed at some destinations that would have previously bounced the mail, since you don't own the IP address. Reverse DNS of mdg.homelinux.net, shows RoadRunner owning the IP address instead matching the owner of mdg.homelinux.net. If you had a business class account you would get static IPs and RR would handle the reverse DNS to look right to the world. Some mail servers will still block your mail however, because your IP is in the range of a broadband provider and they choose to blanket block all those IPs. Some choose also to block ranges that are assign to countries such as China and Korea that are notorious for spammers and open relays. On the MX host settings to use at dyndns.org, read their FAQ on MX and then read it a few more times. I did and it eventually made sense. If you have a firewall that is accepting all outside connections from one IP address and forwarding to the appropriate server, then you may be able to leave the MX blank. DNS will then use the same IP address as the rest of the domain. http://en.wikipedia.org/wiki/MX_record Brian Kelsay >>> <linux(a)bizniche.com> 10/07/04 09:46AM >>> >It's nearly there! I decided to give exim one more shot, and then move >to sendmail if I still can't get it going. Following the advise in >several emails, I found a few errors and corrected them. Earlier, for >a test, I setup an account in fetchmail to see where _that_ mail would >end up, and after correcting my errors, it those messages (from the >pop3 account fetchmail was pulling down) ended up in my inbox. (Viewed >in mutt.) That was encouraging. New mails to that account also end up >in my inbox. So...SOMETHING is working right. >I still can't get local mail (mail -s "testing" mdg) or mail sent straight to mdg(a)mdg.homelinux.org to get to my inbox though. The other issues, that I figured I would deal with last, is that reading through the exim logs, I find that some test mails I sent from the mdg(a)mdg.homelinux.org account are rejected by the recipient server, and it tells me to stop using a dhcp host, and to use my isp's smarthost. Also, this domain is a dyndns.org domain, and it lets me setup an MX host for this domain. I assume it would be mdg.homelinux.org. So...great help so far. I'm not quitting this time...I'm getting this thing going if it kills me. Here is a question that I've wondered about. I see great benefit by using fetchmail and some spam filters together. I have a few pop3 accounts that I check via thunderbird. It seems like I could have my little linux email server checking these for me, filtering the spam, and making the emails availble in an IMAP format (which I prefer.) Knowing that...Can I also _send_ from each of these accounts, through my linux server? That is...if fetchmail is pulling mail from mdg(a)domain1.com and mgraham(a)otherdomain.com, and I'm reading them trough an IMAP setup in thunderbird...can I respond to these mails and have them come from mdg(a)domain1.com and msgraham(a)otherdomain.com respectively? It seems like they'd always come from mdg(a)mdg.homelinux.org. Right? Matt

1 0

Re: RE: Help configuring email server...
by linux＠bizniche.com 07 Oct '04

07 Oct '04

Brian Densmore <DensmoreB(a)ctbsonline.com> wrote on 10/07/2004, 03:33:19 PM: > So what happened with your mail server? Get it working? It's nearly there! I decided to give exim one more shot, and then move to sendmail if I still can't get it going. Following the advise in several emails, I found a few errors and corrected them. Earlier, for a test, I setup an account in fetchmail to see where _that_ mail would end up, and after correcting my errors, it those messages (from the pop3 account fetchmail was pulling down) ended up in my inbox. (Viewed in mutt.) That was encouraging. New mails to that account also end up in my inbox. So...SOMETHING is working right. I still can't get local mail (mail -s "testing" mdg) or mail sent straight to mdg(a)mdg.homelinux.org to get to my inbox though. The other issues, that I figured I would deal with last, is that reading through the exim logs, I find that some test mails I sent from the mdg(a)mdg.homelinux.org account are rejected by the recipient server, and it tells me to stop using a dhcp host, and to use my isp's smarthost. Also, this domain is a dyndns.org domain, and it lets me setup an MX host for this domain. I assume it would be mdg.homelinux.org. So...great help so far. I'm not quitting this time...I'm getting this thing going if it kills me. Here is a question that I've wondered about. I see great benefit by using fetchmail and some spam filters together. I have a few pop3 accounts that I check via thunderbird. It seems like I could have my little linux email server checking these for me, filtering the spam, and making the emails availble in an IMAP format (which I prefer.) Knowing that...Can I also _send_ from each of these accounts, through my linux server? That is...if fetchmail is pulling mail from mdg(a)domain1.com and mgraham(a)otherdomain.com, and I'm reading them trough an IMAP setup in thunderbird...can I respond to these mails and have them come from mdg(a)domain1.com and msgraham(a)otherdomain.com respectively? It seems like they'd always come from mdg(a)mdg.homelinux.org. Right? Matt > > Hey everyone: > > > > For some reason, understanding how to run a for-fun email server is > > beyond me. So, I'm trying to get this configured one step at a time. > > I find some tutorials online that say..."Yeah, just setup exim, > > fetchmail, squirrelmail, courier-imap, and spamassassin and you're > > almost there!" That sounds like a lot to me. So...I'm > > starting small. > > First things first, I want to get exim working with courier-imap. > > > > Here is my setup, then I will show the errors I'm getting: > > > > Debain Testing > > exim > > courier-imap > > Timewarner cable > > mdg.homelinux.org pointing from dyndns.org to my server. > > > > Here is a snip of my exim conf. (the parts that seem relevant) > > ===== > > host_accept_relay = 127.0.0.1 : ::::1 > > host_auth_accept_relay = * > > local_delivery: > > driver = appendfile > > group = mail > > mode = 0660 > > mode_fail_narrower = false > > envelope_to_add = true > > return_path_add = true > > #file = /var/mail/${local_part} > > directory=${home}/Maildir > > maildir_format = true > > prefix="" > > =================== > > > > My /etc/login.defs file has: > > QMAIL_DIR Maildir/ > > #MAIL_DIR > > MAIL_FILE Maildir/ > > > > ================== > > > > And my /etc/pam.d file has: > > session optional pam_mail.so standard noenv dir=~/Maildir > > > > =================== > > > > In my home dir, I have a .forward with: > > ~/Maildir > > > > I also have a folder called Maildir with mdg:mail ownership. > > > > ==================== > > > > Now, when I log into mutt, and send a test mail somewhere, it > > works just > > fine. Comes from mdg(a)mdg.homelinux.org. When I try to mail back, I > > get this header: > > ----- Message header follows ----- > > > > Received: by 10.11.98.52 with SMTP id v52mr399875cwb; > > Mon, 04 Oct 2004 08:47:12 -0700 (PDT) > > Received: by 10.11.98.53 with HTTP; Mon, 4 Oct 2004 08:47:12 > > -0700 (PDT) > > Message-ID: > > Date: Mon, 4 Oct 2004 10:47:12 -0500 > > From: Matt Graham > > Reply-To: Matt Graham > > To: Matt Graham > > Subject: Re: Testing > > In-Reply-To: > > Mime-Version: 1.0 > > Content-Type: text/plain; charset=US-ASCII > > Content-Transfer-Encoding: 7bit > > References: > > ======================== > > > > > > And I see this in my exim log: > > > > > > 2004-10-05 13:08:02 Start queue run: pid=5976 > > 2004-10-05 13:08:02 1CEnRF-0001Pe-00 == ~/Maildir/(a)mdg.homelinux.org > > directing defer (-41): retry time not reached > > 2004-10-05 13:08:02 1CEXlE-000104-00 == ~/Maildir/(a)mdg.homelinux.org > > directing defer (-41): retry time not reached > > 2004-10-05 13:08:02 1CEXfM-0000zL-00 == ~/Maildir/(a)mdg.homelinux.org > > directing defer (-41): retry time not reached > > 2004-10-05 13:08:02 1CEXIh-0000xp-00 == ~/Maildir/(a)mdg.homelinux.org > > directing defer (-41): retry time not reached > > 2004-10-05 13:08:02 1CEXIg-0000xp-00 == ~/Maildir/(a)mdg.homelinux.org > > directing defer (-41): retry time not reached > > 2004-10-05 13:08:02 1CEXcW-0000zA-00 == ~/Maildir/(a)mdg.homelinux.org > > directing defer (-41): retry time not reached > > 2004-10-05 13:08:02 End queue run: pid=5976 > > > > ========================

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG