- main - earth.li

Windows software for managing remote Linux SVN server?
by Srdjan Todorovic 21 Dec '09

21 Dec '09

Hi all, I'm looking for some simple to use Windows software that can administer a remote SVN server that runs on Linux. Specifically, I'm looking for something that can create a repository, and setup users and change passwords. Normal SVN activities (code browsing/checking in/merging/diffing etc) will be run as normal. I'm currently looking into http://www.sublimesvn.com/ but I'm not sure I like the licensing (why would each developer have to be licensed?). Thanks Srdjan

2 2

Wireless Internet Link Security
by Ian 20 Dec '09

20 Dec '09

Hi Folks, The lady of the house wants a wireless internet connection for her laptop for Christmas as she is fed up with "tripping over cables everywhere!". I have purchased a router and laptop dongle and am experimenting with it so it is ready for The Big Day. One thing which is confusing me is the security modes it offers. It gives me the choice of using any of the following 5 modes: No Security WEP WPA-PSK (TKIP) WPA2-PSK (AES) WPA-PSK (TKIP) + WPA2-PSK (AES) or Mixed Mode I do not expect Security to be a big problem but I may as well set it up the best I can right from the start. Assuming the laptop dongle can also be configured for all five security modes mentioned above which is the best mode to use? (Sorry if the above seems a dumb question to all you experienced network admin bods but this is the first time I have touched a wireless Router and am not sure what I am doing) Ian.

3 3

How best to run a 'pull' backup using passwordless login?
by Chris G 20 Dec '09

20 Dec '09

As part of my sort out and tidy up of security, backups, etc. I've decided that it would be better to run my off site backups as 'pull' backups driven from the remote systems. This way an intruder into my home system won't see any evidence of these backups happening and hence won't be tempted to do anything to them. This requires (unless someone else has some bright ideas) that the remote system has a passwordless login to enable it to do the backup (or I put the password in the script, which comes to the same thing). For this to be (reasonably) secure it needs to be set up so that the *only* thing you can do with that login is a backup. So, finally to my question, what's the tidiest/easiest way of doing this? I can see two possible ways:- A dedicated login with the program to be executed when you login set to do the backup. A 'ForceCommand' in ssh that executes the backup when certain criteria are met. I think I prefer the second as it makes handling permissions etc. easier. E.g. I want to backup files belonging to user xxxx, if I can login as user xxxx then I don't need to worry about the files all being readable by the backup. This requires careful setting up of the sshd_config file though so that remote logins to user xxxx run the backup but one can still login to user xxxx locally. Can anyone see any serious flaws in the above and/or easier ways of doing it that are still reasonably secure? -- Chris Green

4 3

Gnome, seahorse, gnome-keyring-daemon - any good howtos or overviews anywhere?
by Chris G 18 Dec '09

18 Dec '09

I'm considering (though I'm rapidly going off the idea at the moment) using seahorse and gnome-keyring to manage passwords/keys etc. None of the manuals gives a clue as to what they all actually *do*. All you get is information about the mechanics of entering data into seahorse etc. which is pretty straightforward and obvious anyway. I want to know how it actually works to make keeping keys etc. easier and to make logging in to other systems easier. At present I do things manually by editing and copying the various files in $HOME/.ssh directly myself. I don't run ssh-agent, I *assume* that gnome-keyring is a sort of replacement for that but can't find anything that tells me anything actually useful. What concerns me slightly is that it's all a total waste of time if it's only protected by my login password which I think, by default, it is. I.e. if I understand things right (and I'm not at all sure about this) when I log in to the X gui and enter my password then gnome-keyring (and/or seahorse) extracts my key[s] from somewhere and then when I ssh to other systems that key is used and I don't have to type it in. Have I got that anything like right? If this *is* the way that it works how is it even remotely more secure than simply using password login on those systems I ssh into? If not can someone clarify a bit for me, or, as I said, point me at some sort of overview document that explains things. -- Chris Green

4 13

email addresses starting with asterisk?
by Peter Alcibiades 18 Dec '09

18 Dec '09

Helping a friend change computers, we found that the email login did not work, and after a series of conversations with the provider were told to log in to get messages using *(a)mydomain.com This did indeed work, and the effect appears to be that mail sent to any name at mydomain.com is picked up by the login, and also that any name used results in mail being accepted. So for instance you can apparently send to alexander(a)mydomain.com bacchus(a)mydomain.com calypso(a)mydomain.com and so on, and it will all arrive when you log in for messages as *(a)mydomain.com. Why would anyone set up an email system like this? Does it not make a lot more sense to have specific email addresses, both to reduce spam, and to allow you to segregate, for instance, home and business email? This is the same case where there was the incomprehensible networking with two cards and class B addresses for a three machine network. When set up in the usual way with a five port router modem, it all worked perfectly fine with a lot fewer cables. Very strange. Peter

5 4

Questionnaire software - any suggestions?
by Chris G 17 Dec '09

17 Dec '09

I want to build an on-line questionnaire, a very basic one, are there any ready made applications in the Linux/Open Source world for doing this? I can't find anything obvious in the Ubuntu repositories. -- Chris Green

5 8

[ALUG Announce] POSTPONED: December's 3rd Monday Monthly Ipswich Social Meeting
by samwise 16 Dec '09

16 Dec '09

ALUG Announce Please send announcements to Announce(a)lists.alug.org.uk Unsub, change settings via http://lists.alug.org.uk/mailman/listinfo/announce ----- The monthly "Third Monday" ALUG Ipswich Social Meeting has been postponed until January. Off-list five us of have agreed on an ALUG Christmas meal on the evening of Tuesday January 5th 2010 (the only day everybody's calendars agreed!). If anyone would like to join us then, please drop me a line. With no other suggestions, I'll probably try making a booking soon at Mr. Wings - the chinese restaurant we went to last time. Thanks, Peter. ----- Send discussion replies to main(a)lists.alug.org.uk (Reply-To set) Unsub, change settings via http://lists.alug.org.uk/mailman/listinfo/announce

1 0

Eee bah gum - feature...
by Anthony Anson 16 Dec '09

16 Dec '09

If there is a memory-stic plugged-in to any USB socket, the Vodafone internet dongle will not work. Click on the icon to start the software, and all you get is an egg-timer, for less time than it takes to boil an egg - if memory serves. So, introduced the Eee to a memory card in the slot provided. Dongle software failed to open. Same failure if I have an external HDD or CD/DVD plugged in. This is *VERY* inconvenient. Not tried it using a hub yet. Any ideas/suggetions, O all ye cognoiscenti? -- Tony Anson www.girolle.co.uk/

1 1

Relative merits/security of Public Key and old-fashioned password with ssh
by Chris G 16 Dec '09

16 Dec '09

I'm probably being totally paranoid but still. Is there any significant difference in security between using password login and Public Key when using ssh to connect to my home server? Just to clarify ssh connections are *only* allowed from two systems 'out there' where I have shell login accounts so an intruder has to get onto one of those systems before having any possibility of connecting to my server. Is it any easier for an intruder to guess my password (remember, no access to the system so I don't think a dictionary attack is possible is it?) or to guess the encryption key for my private key? I can't see any really significant difference between the two but I'm open to any comments. -- Chris Green

3 4

Security thoughts/questions
by Chris G 14 Dec '09

14 Dec '09

I have a small SoHo LAN which is used by the family (mostly just two of us now) for personal use and in running our small Ltd. company. There's no very sensitive (as in confidential) information on any of the systems but I guess there is stuff in E-Mails etc. that we don't really want to escape. More impportant is the *safety* (as in not losing) of a lot of information such as the company accounts, E-Mail trails of work we do and so on. Recently I have set up a small server machine which now handles DNS (using dnsmasq), has the publicly visible web pages (not the company site but bits and pieces that I want to make visible to 'the world') and runs an SMTP server. This means that firstly I can turn my desktop machine off now (it used to be the server) and secondly there's no direct access from the outside world to my desktop machine. The firewall is set up to allow only ssh, http and SMTP connections from the outside and all three of these are routed to the server machine. So far so good. Now I'm wondering whether I have overlooked anything obvious and/or if there's any way I can improve things. The most likely sort of exploit/damage as I see it is someone breaking into the server machine and just making a mess. I keep the server software as up to date as possible with security fixes etc. for apache, ssh and SMTP (postfix) so it should be fairly difficult to break in. I only allow ssh connections from two hosts (where I have shell login accounts) so password guessing needs to get there first and then into the server. All important data from desktop machines is backed up to a NAS in the garage (separate machine from the server) so that should protect against fire damage and even burglars as they're unlikely to break into both the house and the garage as well as notice hardware in both places. I also back up the critical company files 'off site' to my hosting company's site. The final barrier(s) I'm thinking about are the ease (or otherwise) of doing damage if someone breaks into one system in the LAN. For example would I win anything by enabling the root account on the server (currently sudo only) so that if someon breaks in as me they'd still have to guess the root password to be able to do anything nasty. Are there any NFS exploits I should worry about? There are quite a few NFS mounts across the various systems. -- Chris Green

1 0