And here is it, after just six weeks of waiting!
As you can see on the image it is as long as a cigarette lighter.
Now I just have to find some free time to play with the Debian image and to install my little music station :)
Imagine you have got the following iptables rule set:
*filter
:INPUT ACCEPT [2:130]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [119:14185]
-A INPUT -s 127.0.0.0/8 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN,RST,ACK SYN -j DROP
COMMIT
This would allow all traffic from 127.0.0.0/8, on port 22 and 80. Other (TCP/IP) SYN packages (so on all the other connections) would be dropped.
Now you see, that your counter for the SYN DROP rule is increasing and you want to know what is rejected, but how?
The simple answer is ULOG – the netfilter userspace logging daemon.
In Debian you have got various implementations/variants of it, the local logging one (which I will use here, just called ulogd) and the -postgres, -mysql and -sqlite3 one (that are not the exact package names), with that you also can log everything to a (remote) database.
An special variant is the -pcap one, it will write the logs in the .pcap format, so you can analyze the full traffic.
So for our example it is enough to install the package:
apt-get install ulogd
And then add another rule BEFORE our SYN DROP:
-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN,RST,ACK SYN -j ULOG
-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN,RST,ACK SYN -j DROP
Now you will find in /var/log/ulog/syslogemu.log a log of all connections, which would be dropped, the log looks like this:
Aug 13 14:42:07 srv1 IN=eth0 OUT= MAC=00:0c:29:8c:2b:6c:00:d0:02:eb:e8:0a:08:00 SRC=75.125.70.194 DST=XXX.XXX.XXX.XXX LEN=40 TOS=00 PREC=0x00 TTL=54 ID=9566 PROTO=TCP SPT=57144 DPT=445 SEQ=2770468863 ACK=0 WINDOW=512 SYN URGP=0
Aug 13 14:45:29 srv1 IN=eth0 OUT= MAC=00:0c:29:8c:2b:6c:00:d0:02:eb:e8:0a:08:00 SRC=75.125.70.194 DST=XXX.XXX.XXX.XXX LEN=40 TOS=00 PREC=0x00 TTL=55 ID=13702 PROTO=TCP SPT=58528 DPT=445 SEQ=1217789951 ACK=0 WINDOW=512 SYN URGP=0
So you have got now the information about the full date, mac address (mostly it will be the one of your gateway), source and destination IP, source and destination port, length, protocol, etc.
You also could use it to log outgoing connections to port 80 and the IRC ports:
-A OUTPUT -p tcp -m tcp –dport 80 -j ULOG
-A OUTPUT -p tcp -m tcp –dport 6666:6669 -j ULOG
Whatever you want.
While many (german) IT magazines write about glusterfs since RedHat has taken it over, here is a short summarzy of the glusterfs Debian packaging status.
If you are interested, I am still seeking for help!
Just a few photos of my vacation on the Isla de Fuerteventura in july 2012 :) But travelling will be continued in 2012 to Belek in the Turkey on Oct+Nov!
Debian Wheezy will come with otrs 3.1.7, I also backported one important upstream patch from 3.1.8 to it. Also you can get now 3.1.8+dfsg1-1 from experimental :)
With the 3.1.7 packaging I also migrated our otrs instance from 2.4.9 to 3.1.7 a few weeks ago, with some small problems:
Now after five years of working with otrs 2.x in my company, all our agents accept the new 3.1 one and they are happy with it :-)
In the next weeks I also will check a backport of the 3.1.7 release for Squeeze.
After too much months without a working fglrx-driver for Wheezys Xserver 1.12 we have got now a fully working version!
What happened?
Freeze exception for it is filled since > 10 days, we are now just waiting for an answer.
If you are missing support for the older RadeonHD series, Andreas (co-maint of fglrx-driver) just packaged the legacy driver, which is available in experimental.
Very much thanks to him, especially for all his very good fglrx-driver packaging work!
Yes after five years I had found the time to setup my whole new server and to start blogging again!
So hello world!