Re: Firewall and DNS caching without NetworkManager
by Thomas Woerner
On 05/18/2013 03:41 PM, আনন্দ কুমার সমাদ্দার Ananda Samaddar wrote:
> Hello all,
>
> I've just installed Fedora 18 X86-64. I disabled and uninstalled
> networkmanager and use the standard networking stuff which seems to
> use dhclient. I'm using a standard ethernet connection.
>
> So I need to do two things. Feel free to tell me to RTFM if you can
> provide a link!
>
> 1. How do I enable pre-pending of nameservers? I want to use dnsmasq
> to cache DNS requests so I need to add 127.0.0.1 to the top of
> resolv.conf. Google searchs take me to the Arch Wiki. I can't seem to
> find a dhclient.conf file anywhere in /etc.
>
> 2. How do I assign a zone in firewalld to my connection? I want to be
> able to open ports for bittorrent and XMPP jingle voice/video. The
> firewalld wiki on the Fedora site doesn't seem to be able to answer my
> question.
>
Just add ZONE=<name> to the ifcfg file for the interface to set the zone
for the interface. If ZONE is not set or empty, the default zone for the
system will be used. Please have a look at
https://fedoraproject.org/wiki/FirewallD for more information.
> thanks in advance,
>
> Ananda Samaddar
>
Regards,
Thomas
10 years, 12 months
Proposal: ReadOnlyDirectories /etc and /usr for network-services
by Reindl Harald
-------- Original-Nachricht --------
Betreff: Proposal: ReadOnlyDirectories /etc and /usr for network-services
Datum: Mon, 22 Jul 2013 00:02:02 +0200
Von: Reindl Harald <h.reindl(a)thelounge.net>
An: Mailing-List fedora-devel <devel(a)lists.fedoraproject.org>
Hi
has anybody considered to put the following as default in systemd-units of
network services? cross-posting to users-list intented because i think it
is a good idea to bring it to a broader userbase!
ReadOnlyDirectories=/etc
ReadOnlyDirectories=/usr
http://www.freedesktop.org/software/systemd/man/systemd.exec.html
additionally having the RPM database to accessable for network-services
is fine, set for all listed below and reduces the attack surface
InaccessibleDirectories=/var/lib/rpm
InaccessibleDirectories=/var/lib/yum
__________________________________________________
this would greatly reduce the impact of a possible root-exploit
and IMHO make installing a rootkit hard to impossible while
it is a good compromise to read-only /usr on a own partition
without make system-administration via SSH harder
__________________________________________________
currently i am in prodcution with it for the following services
most of them real production (customer-services) and a few on
home-servers or even not available in the Fedora repos
* asterisk
* dbmail
* dhcpd
* dnsmasq
* dovecot (running as IMAP/POP3 proxy and SASL)
* hostapd
* httpd
* hylafax
* iaxmodem
* mailgraph
* mpd
* mpdscribble
* mysqld
* named
* netatalk
* ntpd
* open-vm-tools
* openvpn
* postfix
* prosody
* pulseaudio (systemwide)
* pure-ftpd
* rsyslog
* smbd
* smokeping
* unbound
* vnstat
* xinetd (TFTP)
__________________________________________________
exeptiopns:
* trafficserver
it touchs /etc/trafficserver at startup
"ReadOnlyDirectories=/usr" is fine
* mediathomb
refuses for whatever reason to start with read-only /etc
"ReadOnlyDirectories=/usr" is fine
10 years, 10 months
Re: NFS Performance Woes
by Peter Skensved
>
>
> On 07/21/14 19:59, Ian Chapman wrote:
> > Nfsstat, wireshark and the system logs do not show anything which screams there's a problem.
> >
> > The network card in the client machine and the server shows no collisions, dropped packets, frame overruns etc.
> >
> > I've tested with the export that isn't using Kerberos and still have the
> > same issue. Messing with the rsize, wsize, async, sync parameters makes no difference either.
> >
> > The server has 32GB RAM, the client 16GB.
> >
> > For all intents and purpose it looks like its working as it should, it's just painfully slow.
> >
> > Any NFS gurus out there, that can tell me what I'm doing wrong?
>
> I've been using NFSv4 extensively for several years and I've not had an issue that you
> describe where everything is fine and then suddenly performance goes to hell in a hand basket.
>
> It sounds as if you only have 2 systems to work with? No, tiebreaker so to speak?
>
> Have you considered running a VM on your client system to see if it is affected in the same way?
>
DNS problems can do it . Are your /etc/resolv.conf files correct ?
You could try running your own nameserver ( dnsmasq ) if the upstream
one is too slow or too busy.
peter
9 years, 10 months
Re: NFS Performance Woes
by Ian Chapman
On 22/07/14 02:39, Peter Skensved wrote:
>> I've been using NFSv4 extensively for several years and I've not had an issue that you
>> describe where everything is fine and then suddenly performance goes to hell in a hand basket.
>>
>> It sounds as if you only have 2 systems to work with? No, tiebreaker so to speak?
>>
>> Have you considered running a VM on your client system to see if it is affected in the same way?
>>
> DNS problems can do it . Are your /etc/resolv.conf files correct ?
> You could try running your own nameserver ( dnsmasq ) if the upstream
> one is too slow or too busy.
I'm fairly sure it's not DNS. I run a DNS server actually on the same
server, which serves NFS exports with the only DNS server in resolv.conf
being itself (over localhost). All clients point to that DNS server and
only that one. It's authoritative for my home LAN and both forward and
reverse lookups work and resolve correctly and quickly too. Besides, the
exports are specified by IP address on the server and the problem still
occurs even why I mount an export from the client machine using the
server's IP as opposed to its hostname.
--
Ian Chapman.
9 years, 10 months
Re: Libvirt networking question (SOLVED)
by Tom H
On Tue, Apr 19, 2016 at 1:22 PM, Patrick O'Callaghan
<pocallaghan(a)gmail.com> wrote:
> On Mon, 2016-04-18 at 12:56 -0700, Samuel Sieb wrote:
>>
>> Have you tried rebooting since then? Does it still work? I don't
>> think you should have an ifcfg file for that interface as you don't
>> want NetworkManager interacting with it. If everything still works
>> after rebooting, then great. Otherwise, try removing that file.
>
> Good call. It failed again on rebooting. I removed the file and
> rebooted again and now it works.
>
> Is one supposed to know this by magic? I can't be the only one who's
> had this problem. I read the Release Notes every time I update the
> system and can't recall seeing it anywhere.
This thread finally explains why you had a virbr0 a few months ago
that wasn't created by libvirt but was messing up your dnsmasq setup!
8 years, 1 month
Re: Libvirt networking question (SOLVED)
by Patrick O'Callaghan
On Tue, 2016-04-19 at 15:49 +0200, Tom H wrote:
> On Tue, Apr 19, 2016 at 1:22 PM, Patrick O'Callaghan
> <pocallaghan(a)gmail.com> wrote:
> >
> > On Mon, 2016-04-18 at 12:56 -0700, Samuel Sieb wrote:
> > >
> > >
> > > Have you tried rebooting since then? Does it still work? I don't
> > > think you should have an ifcfg file for that interface as you
> > > don't
> > > want NetworkManager interacting with it. If everything still
> > > works
> > > after rebooting, then great. Otherwise, try removing that file.
> > Good call. It failed again on rebooting. I removed the file and
> > rebooted again and now it works.
> >
> > Is one supposed to know this by magic? I can't be the only one
> > who's
> > had this problem. I read the Release Notes every time I update the
> > system and can't recall seeing it anywhere.
> This thread finally explains why you had a virbr0 a few months ago
> that wasn't created by libvirt but was messing up your dnsmasq setup!
You have a good memory :-)
poc
8 years, 1 month
Re: Libvirt networking question (SOLVED)
by Tom H
On Tue, Apr 19, 2016 at 5:09 PM, Patrick O'Callaghan
<pocallaghan(a)gmail.com> wrote:
> On Tue, 2016-04-19 at 15:49 +0200, Tom H wrote:
>>
>> This thread finally explains why you had a virbr0 a few months ago
>> that wasn't created by libvirt but was messing up your dnsmasq setup!
>
> You have a good memory :-)
Sometimes. I can't remember what the resolution was...
But I do remember that didn't really make sense and found it frustrating.
8 years, 1 month
Re: Libvirt networking question (SOLVED)
by Patrick O'Callaghan
On Tue, 2016-04-19 at 17:50 +0200, Tom H wrote:
> On Tue, Apr 19, 2016 at 5:09 PM, Patrick O'Callaghan
> <pocallaghan(a)gmail.com> wrote:
> >
> > On Tue, 2016-04-19 at 15:49 +0200, Tom H wrote:
> > >
> > >
> > > This thread finally explains why you had a virbr0 a few months
> > > ago
> > > that wasn't created by libvirt but was messing up your dnsmasq
> > > setup!
> > You have a good memory :-)
> Sometimes. I can't remember what the resolution was...
>
> But I do remember that didn't really make sense and found it
> frustrating.
Apparently at the time I changed from NAT to Bridged networking, which
fixed it (don't ask me why). However removing the redundant file seems
to be the way to go. It's now back to NAT.
<OT>
BTW, I'd give the URL of the old thread but I can't find it on the list
archives. My original post is from 17/12/2015 if you want to search for
it, but I'm afraid the new archive page defeats me. It seems quite
astoundingly slow and hard to use compared to the old one. The search
function couldn't find the thread when I looked for it and there
appears to be no way to list threads the way one used to be able to do.
</OT>
poc
8 years, 1 month
Re: Libvirt networking question (SOLVED)
by Samuel Sieb
On 04/19/2016 10:24 AM, Patrick O'Callaghan wrote:
> On Tue, 2016-04-19 at 17:50 +0200, Tom H wrote:
>> On Tue, Apr 19, 2016 at 5:09 PM, Patrick O'Callaghan
>> <pocallaghan(a)gmail.com> wrote:
>>>
>>> On Tue, 2016-04-19 at 15:49 +0200, Tom H wrote:
>>>>
>>>>
>>>> This thread finally explains why you had a virbr0 a few months
>>>> ago
>>>> that wasn't created by libvirt but was messing up your dnsmasq
>>>> setup!
>>> You have a good memory :-)
>> Sometimes. I can't remember what the resolution was...
>>
>> But I do remember that didn't really make sense and found it
>> frustrating.
>
> Apparently at the time I changed from NAT to Bridged networking, which
> fixed it (don't ask me why). However removing the redundant file seems
> to be the way to go. It's now back to NAT.
>
Bridged networking doesn't use the virbr0 interface, that's why it worked.
> <OT>
> BTW, I'd give the URL of the old thread but I can't find it on the list
> archives. My original post is from 17/12/2015 if you want to search for
> it, but I'm afraid the new archive page defeats me. It seems quite
> astoundingly slow and hard to use compared to the old one. The search
> function couldn't find the thread when I looked for it and there
> appears to be no way to list threads the way one used to be able to do.
> </OT>
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.o...
I agree that it would be nice to just see a list of threads without the
previews...
8 years, 1 month
Re: Libvirt networking question (SOLVED)
by Patrick O'Callaghan
On Tue, 2016-04-19 at 23:52 +0200, Tom H wrote:
> > <OT>
> > BTW, I'd give the URL of the old thread but I can't find it on the
> > list archives. My original post is from 17/12/2015 if you want to
> > search for it, but I'm afraid the new archive page defeats me. It
> > seems quite astoundingly slow and hard to use compared to the old
> one.
> > The search function couldn't find the thread when I looked for it
> and
> > there appears to be no way to list threads the way one used to be
> able
> > to do.
> > </OT>
>
> It wasn't in December.
>
> My complaint about the new archives is that the default's 10 threads
> per page. So I went to Feb and then Jan and expanded them to 200
> threads (the max) and searched (the page not the "db") for "dnsmasq".
> Thankfully Feb had 104 threads (or "discussions") and Jan had 125 so
> they were all on one page.
Agreed. The fancy HTML formatting is a waste of space, especially as
the list Guidelines discourage posting in HTML.
> This was the thread:
>
> https://lists.fedoraproject.org/archives/list/users@lists.fedoraproje
> ct.org/thread/XSEPSJI4ZPNVTPJIUCDS2LLOLHGUSAUU/
>
> If I search the list for "dnsmasq" via the search box, I get
>
> https://lists.fedoraproject.org/archives/search?q=dnsmasq&page=1&mlis
> t=users%40lists.fedoraproject.org&sort=date-desc
>
> and neither of your two dnsmasq Jan threads appear. Also the search
> results' page only displays 10 emails and it's unchangeable. (I've
> never used the previous archive format's search function.)
In fact I was searching for references to virbr0, which I did ask about
in December in relation to VirtualBox. That's the URL that Samuel came
up with, but my search on the subject line didn't find it. Clearly the
archiving system needs work.
poc
8 years, 1 month
