306 reputation
19
bio website ashish.is.lostca.se
location Delhi, India
age
visits member for 2 years, 11 months
seen Jan 17 at 15:52

A Lost Case


Nov
18
awarded  Caucus
Sep
24
awarded  Autobiographer
Jun
8
comment Securing debain with fail2ban or iptables
Also I would like to add that, like all other first time iptables POLICY users, please don't just flush iptables chains if you like to reset firewall. ;-) Rather set policy to ACCEPT, before flushing the chains.
Feb
25
awarded  Revival
Feb
25
awarded  Yearling
Nov
6
comment How can I set proxy for subversion with ssh tunnel?
@Deqing it's the SOCKS proxy which is used by polipo as its upstream.
Mar
25
comment vsftpd - PAM - MySQL and pam_mkhomedir to create directories
passwd: compat mysql, and ofcourse you need to configure nss_mysql.
Mar
24
comment Named doesn't seem to resolve or dig my domain
Could you please provide the sample output of dig including the address of server you're doing dig against? And also above mentioned configuration is not serving this zone to internet, in case you're expect it to.
Mar
24
comment vsftpd - PAM - MySQL and pam_mkhomedir to create directories
PAM is not same as NSS. PAM is targeted towards authentication, whereas NSS' objective is to resolve names (hostnames, usernames, etc.). Most of the distros provide a package for nss_mysql, e.g. Debian and derivatives provide it as libnss-mysql. And, yes it's not updated for half-a-decade, but it works fine. Once you install the module, configure it, and add it to your nsswitch.conf(5), things will start working for you.
Mar
24
comment Automatically shut down server on inactivity (SSH)?
@MichaelHampton you do realize there's a user named nobody ;-)
Mar
24
comment vsftpd - PAM - MySQL and pam_mkhomedir to create directories
How is pam_mkhomedir going to figure out the path to the home directory of the user it's supposed to create ? How does it know which database to use for resolving the user ? NSS provides it with that information. In your case, you'll be needing nss_mysql, assuming your user database is stored in a MySQL database.
Mar
24
comment Use postfix to relay mail based on sender
I'm not sure how to do it with Sieve, but if can be easily done with procmail(1) iff that's used as MDA
Mar
24
comment Where can I embed proprietary information in a layer 2 or layer 3 packet?
Yahoo L3DSR also works similarly, they encode extra information in DSCP field of IP header which their kernel module decodes.
Mar
24
answered Is multicast appropriate for sending a copy of a video chat to a server?
Mar
24
answered vconfig not tagging outgoing packets with vlan tag (Ubuntu)
Mar
24
answered vsftpd - PAM - MySQL and pam_mkhomedir to create directories
Mar
24
answered Automatically shut down server on inactivity (SSH)?
Mar
7
comment Squid TPROXY connection fails on specific sites?
You could just pastebin the tcpdump outputs, while masking the IP addresses of your $client, $squid-host, $gre-router hosts. Make sure you capture these tcpdump outputs on router on both internal (gigabit interface connect to squid host), and external interface (gre tunnel) for both TPROXY, and REDIRECT cases. And also as you mentioned only destination port 80 is being proxied, which you can do that via just REDIRECT or DNAT (simpler) instead of involving TPROXY from what I comprehend about TPROXY.
Mar
7
comment Squid TPROXY connection fails on specific sites?
Is it possible for you to tcpdump on the router, basically to verify whether request goes out in case of TPROXY ? And also I assume this TPROXY box is in front-of users, so all responses coming from remote endpoint with users' IP (like FTP data request) gets through this TPROXY box, so a network setup something like [internet] --- [gre-router] --- [tproxy box] --- [user1,user2,user3,...userN]. Right?
Mar
5
comment SLES11 random unreachability from a single machine
From looking at your pastes, it seems like your routing is messed up. Disabling iptables is just causing it to see ICMP redirect messages which were probably blocked due to firewall. For RIP, you need a RIP daemon (to update local routing table based on updates from RIP), which seems unlikely. A solution would be to audit/fix both forward/reverse routing between hosts to avoid relying on ICMP redirect messages.