500 reputation
314
bio website 2130706433
location California
age 34
visits member for 4 years, 11 months
seen 1 hour ago
while(1)
{
    share(knowledge);
}

1d
comment ip route get recognizes address as anycast
@pawel7318 it might be helpful to show the full output of ip -4 route and ip -4 addr in your question. And clarify what you mean when you say the address "doesn't work". (What, specifically, isn't working? What troubleshooting steps have you tried? Also, what Linux distribution are you using?)
Jun
14
comment How does Intel AMT (Active Management Technology) not interfere with the TCP/IP host stack?
@kasperd thanks; I didn't know you could easily do that. I went ahead and ran the test. Not looking good for AMT...
Jun
14
comment How does Intel AMT (Active Management Technology) not interfere with the TCP/IP host stack?
I noticed someone voted to close this as off-topic. In that case, I'd like to ask: how is this not relevant to professional server administrators? If you're going to enable an out-of-band management technology, wouldn't you want to know if it will have an effect on your network communications?
Jan
30
comment SSH Error: unknown key type '-----BEGIN'
@HaukeLaging, actually yes you can, but it depends on the key type. If it's a PKCS#8 key, you are correct. But if it's a PKCS#1 key or a DSA key, you'll see something like -----BEGIN DSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,0000000000000000 before the base64 which is the giveaway. Also, if the PKCS#8 key is encrypted, the PEM header should say -----BEGIN ENCRYPTED PRIVATE KEY----- rather than just -----BEGIN PRIVATE KEY-----.
Jan
23
comment SSH Error: unknown key type '-----BEGIN'
After the BEGIN RSA PRIVATE KEY line, do the next few lines indicate that the key is encrypted, or is it just a block of base64?
Jan
23
comment How to undo rm -rf?
Could try something like this... no guarantees though. Keep good backups.
Jan
15
comment site to site vpn between sonicwall and pfsense
Not sure, but if you have completed phase 2 the tunnel should be up. Looks like it stays up for a little over 30 seconds, then dead peer detection shuts it down. What are your DPD timeouts set to? Do you have traffic going over the tunnel? Have you tried capturing packets while establishing the tunnel and then pushing traffic? Can you paste logs from the same time period so we can match up what happens on either side?
Nov
2
comment HP Procurve 2610 intervlan routing
@KenWhite I voted to close as off topic. I thought it may get automatically migrated, but I may be behind the times on that. On second thought though, it might be better to just close it without migration - there is not enough information to really answer the question as-is. I only posted an answer because I had a theory that seemed like a reasonable answer that was too long to post in the comments; really the question should have 2-3x the amount of details to make a good question on another site.
Nov
2
comment HP Procurve 2610 intervlan routing
@KenWhite, the accepted answer says it's OK to answer questions you think will be migrated. ;-)
Nov
2
comment HP Procurve 2610 intervlan routing
@KenWhite, point taken. I didn't realize this was controversial; I figured if the question was migrated, it could still be helpful at the destination site.
Nov
2
comment HP Procurve 2610 intervlan routing
No, I can't transfer it. I don't have the appropriate privilege level. Can you post a route table from one of the machines on VLAN 4 that cannot access the other VLANs?
Nov
2
comment HP Procurve 2610 intervlan routing
Welcome to Stack Overflow. Unfortunately, this question is off topic for Stack Overflow. Server Fault might be a better site for this. But you'll need to be more specific about your question if you'd like an answer (there as well). For example, what troubleshooting steps have you tried? Can you ping the switch at 10.10.1.1 using a device off port 25 configured with a static IP address? Is there a DHCP server on that subnet? How are the hosts configured? If you don't get ping replies, do you see arp entries? What exactly do you mean by "inter vlan routing" not working?
Nov
1
comment How to specify proxy server big ip f5?
I think that's two different concepts. You're talking about setting up a reverse proxy, but then you're asking how to set up a forward proxy. If you're talking about HTTP replies in responses to requests that clients sent, those will already be flowing through the reverse proxy, since the reverse proxy opens a TCP session to the back-end server. What other traffic types do you need to go through the proxy?
Nov
1
comment Simple, centralized user management on a small LAN - NIS or LDAP?
It does look better supported on RHEL/CentOS. When setting up something as critical as an identity management service, it might be advisable to use the best-supported distribution, regardless of what the client machines are using, IMHO.
Mar
18
comment Can't get self-signed CA cert to request corresponding client cert; Apache
One other note. The fact that the openssl returned 3 acceptable CAs raises a red flag for me. (You might want to double-check that this isn't a security risk?)
Mar
18
comment Can't get self-signed CA cert to request corresponding client cert; Apache
Interesting; I just checked a cert I use for client SSL authentication, and its key usage field indeed matches this requirement. (It's using Digital Signature, Non Repudiation, Key Encipherment.)
Mar
9
comment Can't get self-signed CA cert to request corresponding client cert; Apache
Did you also create a server certificate from the same CA? In other words, does the output of openssl s_client -connect <yourserver.com>:443 -showcerts < /dev/null return a trust chain that is trusted by the same self-signed CA? Actually, it would be helpful if you post the full transcript from the openssl s_client command I mentioned.
Mar
9
comment Can't get self-signed CA cert to request corresponding client cert; Apache
Does the client trust your self-signed CA?
Nov
9
comment How do I configure OpenSwan to allow pure IPsec (not L2TP) connections from an iPhone?
This question, as written, is probably obsolete now. StrongSwan offers a WeakSwan option now which should allow this configuration. I haven't tested yet.
Jun
12
comment Requiring client certificate issued by a specific intermediate CA in Apache
Never mind. Looks like you'd do it with SSLCACertificateFile set to PRODUCTION-CA. And in your case this might be fine because you have root_ca.crt (your own) specified in the configuration. I was worried about implicit trust from a public CA. I guess from a general security perspective it's better to trust less, so why not use the production CA and just exclude everything else?