93 reputation
27
bio website
location
age
visits member for 3 years, 4 months
seen Aug 25 at 2:14

Mar
7
comment ssh-agent forwarding and sudo to another user
I disagree with the statement that "This must NEVER EVER be done!" There are many cases where this risk is acceptable. For example, a small team where everyone has the same permissions and you trust all the other users. It should never be done without understanding the risks it involves. But once those risks are understood, there are times that risk is acceptable.
Dec
18
comment How useful is mounting /tmp noexec?
Installing nVidia CUDA 5.0 on Ubuntu 12.04 failed when /tmp was mounted with noexec.
Jun
23
comment curl can't verify cert using capath, but can with cacert option
@Sellers First, I no longer have access to the certs in the original question so I can't easily reproduce this. However, if I remember correctly the issue was not that curl couldn't use any intermediate cert. The issue was that curl couldn't use an intermediate cert that contained a copy of the root cert. That said, as I clarified in my later comment, it is possible that openssl was using my system-installed certs while curl was using only the specified certs. In short, I can't draw any firm conclusions about curl's ability to work with intermediate certs.
Jun
9
comment How to prevent GNU screen from expanding tabs into spaces?
I also get the same behavior in tmux. I wonder if this is a difficult problem to solve.
Jun
9
comment How to prevent GNU screen from expanding tabs into spaces?
It could be something to do with both gnome-terminal (I tried versions 2.30.2 and 3.0.1) and screen together, it can't be just gnome-terminal because it "works" when I don't use screen. Also when I use screen's copy mode (CRTL+A ESC), highlight the output (arrow keys, then SPACE, then arrow keys), and write out the output to the screen's temp file buffer, it sees it as spaces.
May
2
comment curl can't verify cert using capath, but can with cacert option
I found a different root cert (one that was preinstalled on my system) and that seems to have addressed the issue. I wonder if openssl was using my system-installed certs in addition to the cert directory that I specified on the command line, while curl was using only the specified cert directory.
May
2
comment curl can't verify cert using capath, but can with cacert option
I don't know what was going on for this to work before, but now (even with a properly installed cert on the server and a proper intermediate cert) I'm still getting this exact same problem.
Apr
21
comment curl can't verify cert using capath, but can with cacert option
To further clarify, it seems that the server also did not have the intermediate certificate properly installed. Because it was a Verisign cert, I was able to use this tool to confirm that: knowledge.verisign.com/support/ssl-certificates-support/…
Apr
20
comment curl can't verify cert using capath, but can with cacert option
I found the answer. The intermediate certificate file also included a root certificate. (It had two -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- bits.) It seems that openssl, when used directly on the command line, can handle this. But curl (and some other programs which use openssl, I tried Ruby 1.9.2) can't. I removed this extra root certificate and curl works now too.
Apr
20
comment curl can't verify cert using capath, but can with cacert option
Just to clarify, this is a server I (somewhat) control. It is entirely possible that the SSL cert was installed incorrectly. That said, Firefox and Chromium don't show any SSL warnings.
Apr
11
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
This seems like a very related question: serverfault.com/questions/190570/haproxy-ssl-farm-options
Apr
11
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
The X-Forwarded-For header is very useful. But this doesn't get at the root of the problem. Both the BigIP and TrafficServer have SSL termination at the load balancer level. Based on my current benchmarks, SSL termination is my bottleneck. If I can get an F5 BigIP (and I might be able to), then it may be fast enough. However, that doesn't answer the theoretical problem (which I still think is interesting). My goal is to allow an SSL farm and still have the original client IP passed along to the app servers. This guarantees (theoretically) that SSL will never be the bottleneck.
Apr
11
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
This is looking like the best option. Unfortunately (for me) the more I read about LVS the less it seems I know about networking!
Apr
10
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
I am wondering if HAProxy's "usesrc clientip" option might be the best solution. However, it looks like that depends on TPROXY. I'm running RHEL 5.5, which has kernel 2.6.18. TPROXY isn't included until 2.6.28. I'd rather not have to recompile the kernel, but I guess we'll see.
Apr
10
comment OpenSource (Layer 4) Load Balancer that can pass through original client IP?
Yes. As I mentioned in the original post, this is exactly how I have STunnel setup. The problem with this approach is that request is being decrypted on the load balancer. That creates a bottleneck because you can't just add more load balancers (while maintaining HA) like you can add more app servers. That is the reason for a load balancer before decrypting SSL.