VPN options
by Keith Lofstrom
I am planning on running a Virtual Private Network from my Fedora
firewall out to a UML virtual colo (running RH9) at another site.
That site will be the place I present services to the world;
httpd, ssh, sftp, smtp. This is to comply with the "no servers"
and dynamic ip restrictions on my Comcast connection to the net;
if my firewall always drives an outbound connection to the
colocation site, I am not worried about changes of ip address,
and I am not opening any inbound ports.
There are a number of options for the VPN - the most attractive
are cipe ( http://sites.inka.de/sites/bigred/devel/cipe.html )
and FreeSwan ( http://www.freeswan.org/ ), though I am told that
one can do all this through an ssh tunnel. I would rather have
simple and secure than super-duper; I have plenty of bandwidth,
and will send outbound http and smtp from the firewall, so the
main bandwidth user will be incoming spam/b/b/b/b mail.
Anyone have some experiences to share about setting up VPN? Is
there anything about either cipe or FreeSwan that is likely to
break with FC1 or FC2?
Keith
--
Keith Lofstrom keithl(a)ieee.org Voice (503)-520-1993
KLIC --- Keith Lofstrom Integrated Circuits --- "Your Ideas in Silicon"
Design Contracting in Bipolar and CMOS - Analog, Digital, and Scan ICs
3 months, 2 weeks
how to correctly log without journald (and its blobs)?
by Franta Hanzlík
In previous Fedora distros was (IMHO) right way to log only to syslog,
without journald and its (for me) unwanted annoying binary logs, by using
configuration as:
*) Set systemd log target to syslog:
systemd.log_target=syslog (syslog-or-kmsg) ---- on kernel cmdline
systemd.default_standard_output=syslog --/
and
LogTarget=syslog ---- in systemd.conf
DefaultStandardOutput=syslog --/
*) configuring rsyslog to listen on /dev/log unix socket:
$SystemLogSocketName /dev/log ------ in rsyslog.conf
$ModLoad imuxsock ----/
$OmitLocalLogging off ---/
$AddUnixListenSocket /run/systemd/journal/syslog --/(legacy directives)
$AddUnixListenSocket /run/systemd/journal/socket -/
$AddUnixListenSocket /run/systemd/journal/stdout /
(not sure when all last three directives needed)
*) prevent to run journald:
systemctl mask systemd-journald.service
(and maybe mask systemd-journal-flush.service)
And it works fine.
But in actual Fedora 24 in systemd man page values syslog-or-kmsg and
syslog are missing in LogTarget option. As systemd/journald man pages
say hardly anything about exact mean of appropriate configuration for
this purpose, then please when someone more knowledgeable can advise:
- where to direct the systemd output? Maybe to kmsg an then read it in
rsyslog via imklog?
(rsyslog should have also imkmsg module, but is not in rsyslog-8.12.0-3.fc24)
- what about /run/log/journal/.../system.journal ?
On my test F24 system it have open rsyslogd, abrt-dump-journal-oops and
abrt-dump-journal-xorg (no need for these last two) processes. Uses it
also something else?
- what about /run/systemd/journal/{dev-log,socket,stdout} unix sockets?
Should rsyslogd listen on them?
- /dev/log seems be now symlink to /run/systemd/journal/dev-log socket
(as defined by systemd-journald-dev-log.socket) Should it be left
(because now something sends to /run/systemd/journal/dev-log), or can
be /run/systemd/journal/dev-log removed?
Thanks in advance for some clarification about this.
Franta Hanzlik
1 year, 10 months
Running local SSH as background process - possible??
by bruce
Ok guys,
I know this isn't strictly "Fed" related, but the group might have suggestions.
My use case, the process has a number of remote servers. I'd like to
be able to run a bunch of commands on the remote servers as fast as
posible. The initial thought was to loop through the different
IPAddresses, and SSH into each server, to run the commands.
However, this process was still "sequential" in that each SSH session
needs to complete, prior to running the next server/ssh command.
So, my question/need -- is to figure out how to run a ssh as a
background on the local server. This approach would/should allow the
process to quickly fire off commands to the remote ipaddresses/servers
in a much faster/parallel manner.
sortof:
foreach iplist as ipaddress
ssh user1@ipaddress command & (assuming that the '&' runs the local
ssh in the background -- it doesn't!)
Running "stuff" on the remote can occur in a "Screen" session, which
would allow the ssh process to fire off the remote cmd, but it still
doesn't run the local ssh as a "background" process..
Rick has mentioned/discussed the "Screen" function in past threads.
Thoughts/comments....
2 years, 4 months
Error building mkvtoolnix-9.6.0-1.fc26.src.rpm
by JD
$ rpmbuild -v -bb mkvtoolnix.spec 2>&1 | tee mkvtoolnix.build.out
.
.
.
WARNING: unable to read lib/avilib-0.6.10/avilib.c: invalid byte
sequence in US-ASCII
WARNING: unable to read lib/avilib-0.6.10/avimisc.c: invalid byte
sequence in US-ASCII
WARNING: unable to read src/common/checksums/adler32.cpp: invalid byte
sequence in US-ASCII
WARNING: unable to read src/common/checksums/base.cpp: invalid byte
sequence in US-ASCII
WARNING: unable to read src/common/checksums/crc.cpp: invalid byte
sequence in US-ASCII
WARNING: unable to read src/common/checksums/md5.cpp: invalid byte
sequence in US-ASCII
WARNING: unable to read src/common/spu.cpp: invalid byte sequence in
US-ASCII
.
.
.
At end of build, it belched
g++ -Wall -Wno-comment -Wfatal-errors -Wlogical-op
-D_FILE_OFFSET_BITS=64 -DMTX_LOCALE_DIR=\"/usr/share/locale\"
-DMTX_PKG_DATA_DIR=\"/usr/share/mkvtoolnix\"
-DMTX_DOC_DIR=\"/usr/share/doc/mkvtoolnix\" -fstack-protector -fPIC
-std=gnu++11 -Wnon-virtual-dtor -Woverloaded-virtual -Wextra
-Wno-missing-field-initializers -Wno-maybe-uninitialized
-I/usr/include/qt5/QtWidgets -I/usr/include/qt5 -I/usr/include/qt5/QtGui
-I/usr/include/qt5 -I/usr/include/qt5/QtNetwork -I/usr/include/qt5
-I/usr/include/qt5/QtCore -I/usr/include/qt5 -I/usr/include -O2 -g -pipe
-Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong
--param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic
-include src/common/common_pch.h -I. -Ilib -Ilib/avilib-0.6.10 -Isrc -c
-MMD -MF ./rake.d/dependency.d/tmp/src_common_json_o.d -o
src/common/json.o -x c++ src/common/json.cpp
In file included from src/common/json.cpp:19:0:
src/common/json.h:23:76: error: 'nlohmann::json<std::map, std::vector,
std::basic_string<char, std::char_traits<char>, std::allocator<char> >,
bool, long int, double, std::allocator>::parser_callback_t' has not been
declared
nlohmann::json parse(nlohmann::json::string_t const &data,
nlohmann::json::parser_callback_t callback = nullptr);
^
compilation terminated due to -Wfatal-errors.
2 years, 4 months
Openvpn start fails on reboot
by Stephen Davies
If I reboot my F24 system, openvpn server fails to properly start but a
subsequent manual systemctl start openvpn@server does succeed.
The reboot log shows:
Mar 5 11:52:51 mustang audit: SERVICE_START pid=1 uid=0 auid=4294967295
ses=4294967295 msg='unit=openvpn@server comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Mar 5 11:52:51 mustang systemd: Started OpenVPN Robust And Highly Flexible
Tunneling Application On server.
Mar 5 11:52:51 mustang audit: SERVICE_START pid=1 uid=0 auid=4294967295
ses=4294967295 msg='unit=openvpn@server comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Mar 5 11:52:53 mustang systemd: openvpn(a)server.service: Main process exited,
code=exited, status=1/FAILURE
Mar 5 11:52:53 mustang systemd: openvpn(a)server.service: Unit entered failed
state.
Mar 5 11:52:53 mustang audit: SERVICE_STOP pid=1 uid=0 auid=4294967295
ses=4294967295 msg='unit=openvpn@server comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
Mar 5 11:52:53 mustang systemd: openvpn(a)server.service: Failed with result
'exit-code'.
It looks as if the automatic start may be happening too early in the boot process.
2 years, 4 months
Scriptlet errors during manual installation of Fedora 23
by Andrej Podzimek
Hi,
Because Anaconda doesn't support my usual partitioning scheme (root on Btrfs in LVM in LUKS in LVM in GPT, /boot on Btrfs, etc.), I created the entire layout manually and tried to install Fedora using dnf. The same layout works perfectly fine in ArchLinux.
I basically followed this howto, with adjustments for s/yum/dnf/ and for EFI/GPT: http://dustymabe.com/2014/05/29/manual-linux-installs-with-funky-storage-...
The initial filesystem installation (dnf install -y --releasever=23 --installroot=/mnt/sysimage filesystem) already got a few glitches of this form:
Non-fatal POSTIN scriptlet failure in rpm package filesystem
This^^^ happened to roughly half of the installed packages. I tried to proceed with the rest (i.e., to install @core @standard kernel grub2 grub2-efi sihm grub2-tools), but it failed with scriptlet errors that prevented a few key packages from getting installed at all:
error: %prein(selinux-policy-targeted-3.13.1-157.fc23.noarch) scriptlet failed, exit status 126
Error in PREIN scriptlet in rpm package selinux-policy-targeted
Packages with those errors are reported as failed after the verify step. What I tried next:
* setenforce 0
* upgrading the installation environment and/or the sysimage with dnf and rpm from rawhide
* --releasever=22 instead of 23
* ...and checking for a few other common points with this bug: https://bugzilla.redhat.com/show_bug.cgi?id=1270663
* a plain sysimage directory with no predefined Btrfs subvolumes in it
* unmounting, remounting, checking that everything has seclabel on, no weirdness in dmesg, etc.
Well, nothing of the above helped; the error is still the same.
How can I diagnose this? Where can I dig out the exact reason why the scriptlets are failing?
Provided that Anaconda actually does some steps that I'm missing and can carry out the installation correctly, is there a way to *force* it to just accept whatever is mounted into /mnt/sysimage at the moment, without trying to make sense of it? I'm pretty sure dracut can handle my partition layout just fine, so the entire issue here is about getting the basic installation done somehow.
Theoretically I could create a simple-and-stupid layout that Anaconda can handle, proceed with the installation and reshuffle the partitions afterwards, but that's sooo cumbersome that I thought I'd first ask whether someone knows a workaround to the scriptlet problems.
Cheers,
Andrej
2 years, 8 months
F25, Electrum and Trezor
by Mark
Hi
I'm testing Electrum on Fedora 25 and I'm missing the support for
hardware wallet that Electrum is supposed to have. Do I need to install
some additional package or has this feature been omitted?
Cheers
Mark
2 years, 9 months
[F25] issue with SSL connexions: Failure of SSL transaction with
by Frédéric Bron
I often experience very slow internet surf. No idea where it comes
from, just that it started when I switched from opensuse to F25.
Today, I may have obtained a clue:
I normally use firefox.
Today I got the following issue:
- searched in google for "python os.path"
- clicked on the first linked https://docs.python.org/2/library/os.path.html
- nothing happened (tried many times)
- I removed all firefox cookies and cache -> same issue
- I removed current firefox profile and created a new one -> same issue
- I tried the search on a windows computer + firefox on the same
internet connexion -> no issue
- I did the same on fedora with konqueror -> no issue
- again with konqueror -> got an error message:
"Adresse : https://docs.python.org/2/library/os.path.html
Protocole : https
Date et heure : mercredi 22 mars 2017 16:47
Informations complémentaires : Échec de la négociation SSL avec docs.python.org"
Which means:
- again with konqueror -> error message:
"Address: https://docs.python.org/2/library/os.path.html
Protocol: https
Date and time: Wednesday 22nd March 2017 16:47
Additionnal informations: Failure of SSL transaction with docs.python.org"
I suspect that firefox has the same error but just does nothing. What
does that mean?
Frédéric
2 years, 10 months
System alive but can't access from the monitor
by Paolo Galtieri
Folks,
I have 2 F25 systems that have been updated today. These 2 systems
share a monitor. One system is attached via a kvm switch to the
monitor, the other system is attached via hdmi. This morning and twice
this evening a problem has started to manifest itself. This
configuration has been working fine for several years. I will call the
systems A and B, system A is attached to the monitor via hdmi, system B
via VGA. If I switch to system A for a while and then try to switch
back to system B the monitor instead of staying on VGA cycles from VGA
to DVI to HDMI and returns to system A. I can ssh into system B and
everything looks fine, i.e. things that were running under my user id
are still running, e.g. chrome and firefox. I looked at
/var/log/messages and I see this:
Mar 29 23:00:02 jackstraw systemd: Stopping User Manager for UID 0...
Mar 29 23:00:02 jackstraw systemd: Stopped target Default.
Mar 29 23:00:02 jackstraw systemd: Stopped target Basic System.
Mar 29 23:00:02 jackstraw systemd: Stopped target Sockets.
Mar 29 23:00:02 jackstraw systemd: Closed D-Bus User Message Bus Socket.
Mar 29 23:00:02 jackstraw systemd: Stopped target Timers.
Mar 29 23:00:02 jackstraw systemd: Stopped target Paths.
Mar 29 23:00:02 jackstraw systemd: Reached target Shutdown.
Mar 29 23:00:02 jackstraw systemd: Starting Exit the Session...
Mar 29 23:00:02 jackstraw systemd: Received SIGRTMIN+24 from PID 17588
(kill).
This was at the time I switched from system A to system B. Each of the
other times I saw this problem I see the same set of messages in the log
file. Can someone explain what they mean and could they be the cause of
the problem?
I see the same messages on the other system, but there they were part of
other messages related to rebooting the system.
The only way I can recover is reboot the system.
Here's my video card info:
01:00.0 VGA compatible controller: NVIDIA Corporation G86 [GeForce 8500
GT] (rev a1)
Any assistance is appreciated.
Thanks,
Paolo
2 years, 10 months
F25 + Killer 1535 @ 1mb/s
by InvalidPath
Fellas, I noticed today, while finally getting to use the Fedora side of my
work laptop, that my wifi is running at 1MB/s on d Dell XPS 13 9550.
According to Dell this model has the Killer AC 1535 wireless chipset so
possibly just a driver issue?
➜ .ssh iwconfig
wlp2s0 IEEE 802.11 ESSID:"waffle_house"
Mode:Managed Frequency:2.447 GHz Access Point: C0:56:27:C4:77:BC
Bit Rate=1 Mb/s Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:on
Link Quality=58/70 Signal level=-52 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:285 Invalid misc:1819 Missed beacon:0
lo no wireless extensions.
virbr0-nic no wireless extensions.
macvtap0 no wireless extensions.
virbr0 no wireless extensions.
vnet0 no wireless extensions.
02:00.0 Network controller: Qualcomm Atheros QCA6174 802.11ac Wireless
Network Adapter (rev 32)
Attached is wireless-info.txt, generated from: wget -N -t 5 -T 10
https://github.com/UbuntuForums/wireless-info/raw/master/wireless-info &&
chmod +x wireless-info && ./wireless-info Found via:
https://forums.linuxmint.com/viewtopic.php?t=217258
(Yes I know Mint.. the results for later version of Fedora were severely
lacking)
Whats odd is that I Put F25 on the wifes Lenovo just Sunday night to
resolve this exact issue.
Thanks!
2 years, 10 months
