- main - earth.li

Re: [ALUG] Solved [was How to limit passwordless ssh login to allow only outgoing tunnel? Possible?]
by mick 29 Oct '12

29 Oct '12

On Mon, 29 Oct 2012 12:57:23 +0000 Mark Rogers <mark(a)quarella.co.uk> allegedly wrote: > On 27 October 2012 18:02, mick <mbm(a)rlogin.net> wrote: > > > I had a think about this and then set up a test system to enable > > someone "on the internet" to connect to another system "on the > > internet" behind two (or more) NAT routers. > > > > That all looks great, thanks for the effort. I need to find the time > to play with it but it looks like a good starting point for me. > > I wasn't sure looking through it (I haven't read it in detail yet) > whether it dealt with Chris' specific problem of ensuring that anyone > who got onto the boat did not thus gain access to his home network? Yes it does. Because the VPN end point is on a VPS "somewhere out there" and not on his home network (where it could easily be placed). The only connection between the VPS and the home network is an SSH session out to the VPS from the home network. Of course someone on the boat could get out to the VPS if they could compromise the boat system and knew the client VPN passwords (though I didn't use passwords in my example). > For my needs, what I really want is a single server (VPS) with the > ability to control which connections can connect to which (and in > which direction). Ie I might have 10 "devices" and 10 "users" (ie 20 > connections to the VPN/VPS). In general (but I'm sure I'd find an > exception!) no two "users" should be able to connect to each other. > The "devices" should not be able to connect to anything (again I'm > sure I'd find an exception). I'd then be able to control which > "users" could connect to which "devices", ideally though something I > can easily manage (eg a database). Beyond that basic level I don't > really need the ability to control which ports are accessed by which > users but again I'm sure I'd quickly find exceptions to that rule. > So, is this something I can manage completely at the VPS end? Is it > "just" an iptables configuration issue? (I don't have much experience > with iptables but really should change that.) No, it is not just iptables configuration. Take a look at the main openvpn.net "howto" - specifically the section marked: "Configuring client-specific rules and access policies" Essentially what you do is specify individual client configurations in a specific directory on the server and then refer to those configurations in a server side directive (e.g. "client-config-dir /etc/openvpn/clients/client-1"). Each client is then given a specific (and separate) ip address and route to the VPN end point. The VPN server "pushes" those addresses and routes out to the clients when they connect. You then use iptables rules to forward the appropriate traffic over the tun interface. This has the advantage that (as you want) no two clients can see each other's networks (unless you want them to and configure the VPN server appropriately) > > (For the record, I think I have already come up with exceptions for > all of the cases listed above, so think of the above as "defaults" > not "fixed in stone" :-) There are /always/ exceptions... Cheers Mick --------------------------------------------------------------------- blog: baldric.net gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 ---------------------------------------------------------------------

1 0

How to limit passwordless ssh login to allow only outgoing tunnel? Possible?
by Chris Green 28 Oct '12

28 Oct '12

If I want to do something like:- ssh -R 12345:localhost:80 -N chris(a)mycomputer.com from a remote machine with a passwordless login is there any way I can make it so that the *only* thing allowed from the remote machine is the ssh tunnel? I want to be able to see the apache web server running on the remote computer from my home machine. The remote computer may have occasional reboots/upgrades etc. so it needs a passwordless login to be able to reconnect the ssh tunnel. At present I don't allow passwordless (i.e. public key with no passphrase) logins and I don't want to allow them unless I can, as stated above, somehow allow ssh to only be used to create a tunnel. -- Chris Green

8 29

Re: [ALUG] Norwich Based MongoDB Users Group
by Anthony Anson 26 Oct '12

26 Oct '12

Paul Grenyer wrote: > Hi Anthony > >> You'll have to expand on that for this Bear of Very Little Brain[TM] >> >> Wosser MongoDB? > > It's a NoSQL database: http://www.mongodb.org/ Oh, ta. Sorry, forgot this pogrom sends back to author unless told otherwise. -- Tony Anson www.girolle.co.uk/

1 0

Norwich Based MongoDB Users Group
by Paul Grenyer 26 Oct '12

26 Oct '12

Hi All I'm hoping some of you might be interested in the local MongoDB users group I've started: http://www.meetup.com/EastAnglia-MongoDB/ I'm hoping to get someone from 10gen to speak at the first meeting in January. -- Thanks Paul Paul Grenyer e: paul.grenyer(a)gmail.com b: paulgrenyer.blogspot.com t: pjgrenyer SyncNorwich: http://www.syncnorwich.com East Anglia MongoDB User Group: http://www.meetup.com/EastAnglia-MongoDB/ ACCU Member: License to code: http://www.accu.org

1 0

Interrupt to emulate key-press?
by Ted.Harding＠wlandres.net 26 Oct '12

26 Oct '12

Greetings All! Background: I have my screen set to blank out after 5 minutes of user inactivity. Fine for its purpose, since if I'm working at the computer I shall be generating key-presses, mouse actions, etc., far more frequently than that! On the other hand, if I'm not doing anything, then there is not excessively long screen on-time. However, it can be irritating if I'm watching a video or similar, since if I forget to (e.g.) tap on the Ctrl key (which resets the timeout) then the screen will go blank on me just when I don't want it to! So what I'm looking to do is set up a script which would send an interrupt, say every minute, which would be interpreted by the OS as a key-press or similar. Then I could forget about it until I've done watching. Is there some signal that can be sent using kill <signal> ... which would do that? I've not been able to suss out anything suitable. With thanks, Ted. ------------------------------------------------- E-Mail: (Ted Harding) <Ted.Harding(a)wlandres.net> Date: 25-Oct-2012 Time: 17:46:57 This message was sent by XFMail -------------------------------------------------

3 2

I post without comment
by mick 25 Oct '12

25 Oct '12

http://digital.cabinetoffice.gov.uk/govuk-launch-colophon/ What do you think? --------------------------------------------------------------------- blog: baldric.net fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 Note that I have recently upgraded my GPG key see: http://baldric.net/2012/07/20/gpg-key-upgrade/ ---------------------------------------------------------------------

3 4

Re: [ALUG] Voltage logging with a PC, ideas wanted for cheap ways to do it
by Phil Ashby 25 Oct '12

25 Oct '12

On 25/10/12 12:00 Chris Green wrote: > I'm looking for reasonably priced and reasonably easy to implement ways > to measure voltages with a computer. To be more specific:- > > The computer will either be the existing eeePc running Ubuntu (but > no GUI) or a raspberry pi. > > I need to monitor at least four and preferably eight or so voltages, > some of these are 12 volts (i.e. lead acid batteries) and others are > current transducers giving an output around 2.5 volts with a +-0.5 > volts swing. > > I don't need *incredible* accuracy but something around 2% or better > is necessary for it to be useful in monitoring battery charge state. > > I want it to be cheap! > > Sample rate can be slow, once an hour would be fine. I built myself a home power monitor using a Freescale 8-bit HCS08 series micro-controller and an FTDI USB/serial interface chip, both powered from USB. I'm running two ADC channels @1kHz sample rate to take differential samples from either side of a biased current detector clamp. I'm sure something similar would be ideal for battery monitoring. Total cost - micro-controller free - obtained as a 'sample', FTDI chip you might get a 'sample' for free, but more likely to pay ~ £5, PCB ~ £0.50 if you use 0.1" DIP pinout devices and stripboard. The fun bit is writing the code :) P

1 0

Re: [ALUG] sda1 missing in action
by Phil Ashby 19 Oct '12

19 Oct '12

On 19/10/12 12:00, John Woodard <mail(a)johnwoodard.co.uk> wrote: > I got this returned > > xubuntu@xubuntu:~$ sudo dd if=/dev/sda count=1 bs=512 | hexdump -s 446 > 0+0 records in > 0+0 records out > 0 bytes (0 B) copied, 0.000170134 s, 0.0 kB/s > > Does this mean I'm screwed? Possibly - you might like to try using ddrescue (standard Ubuntu package) which is a much enhanced version of dd designed to get as much data as possible off a disk. You will need another disk to hold the image file (external USB is probably easiest). From your recovered image file you should then be able to use testdisk to locate the partitions and recover the contents. Good luck (I got all but 12k of my head-crashed disk back a couple of weeks ago). Phil.

1 0

sda1 missing in action
by John Woodard 19 Oct '12

19 Oct '12

I'd really appreciate some help with this but I do fear the worst. Yesterday I had a broken super block on my boot drive sda1 which I fixed by finding the backup superblocks with: mke2fs -n /dev/sda1 Then by replacing the corrupted superblock with: e2fsck -b <backup_superblock_number>/dev/sda1 This I thought had fixed the problem, Linux booted up went through a fschk on all disks which passed and gave me a desktop that seemed okay. I left it over night and thought I'd grab the home partition and replace the physical disk in the morning to be on the safe side. Today I can't see sda? lsscsi returns: [0:0:0:0] cd/dvd SONY DVD RW AW-G170A 1.71 /dev/sr0 [2:0:0:0] disk ATA WDC WD5000KS-00M 07.0 /dev/sda [3:0:0:0] disk ATA ST31500341AS CC1H /dev/sdb [4:0:0:0] disk ATA ST31500341AS CC1H /dev/sdc [6:0:0:0] disk Generic USB SD Reader 1.00 /dev/sdd [6:0:0:1] disk Generic USB CF Reader 1.01 /dev/sde [6:0:0:2] disk Generic USB SM Reader 1.02 /dev/sdf [6:0:0:3] disk Generic USB MS Reader 1.03 /dev/sdg [7:0:0:0] disk SanDisk Cruzer Micro 8.01 /dev/sdh So the node sda is there and the physical disk is being reported correctly. sda1 is not seen in gparted and fdisk -l doesn't show it up either. mke2fs -n /dev/sda1 returns: mke2fs 1.42 (29-Nov-2011) Could not stat /dev/sda1 --- No such file or directory The device apparently does not exist; did you specify it correctly? There is obviously something wrong with the disk which I'm going to replace but I would like to get the data from /home if at all possible. This isn't a raid disk or anything fancy just standard ext3 with 1 primary partition / and an extended partition containing a swap partition. Any help from the ALUG Community in getting me to my data would be greatly appreciated. Cheers, BJ

3 9

Vector graphics tools
by Mark Rogers 17 Oct '12

17 Oct '12

I want to mock up something similar to the design here: http://www.reallygood.uk.com/bright-side-wedding-guest-book-guests-p-2941.h… Specifically, lots of individual characters (in various fonts, sizes and colours) jumbled around a bit. I had a quick play in gimp (because it was installed) but that got me nowhere, which could well be down to me. Before I start installing lots of different tools does anyone have any suggestions? Assume little or no graphics competency. -- Mark Rogers // More Solutions Ltd (Peterborough Office) // 0844 251 1450 Registered in England (0456 0902) 21 Drakes Mews, Milton Keynes, MK8 0ER

3 4