Below is my setup to enable Forward secrecy
Generate DH parameters:
# openssl dhparam -out /etc/pki/tls/dh-2048.pem 2048
and then configure your prosody with Let’s Encrypt certificates
VirtualHost "balaskas.gr"
ssl = {
key = "/etc/letsencrypt/live/balaskas.gr/privkey.pem";
certificate = "/etc/letsencrypt/live/balaskas.gr/fullchain.pem";
cafile = "/etc/pki/tls/certs/ca-bundle.crt";
# enable strong encryption
ciphers="EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4";
dhparam = "/etc/pki/tls/dh-2048.pem";
}
if you only want to accept TLS connection from clients and servers, change your settings to these:
c2s_require_encryption = true
s2s_secure_auth = true
Check your setup
or check your certificates with openssl:
Server: # openssl s_client -connect balaskas.gr:5269 -starttls xmpp < /dev/null
Client: # openssl s_client -connect balaskas.gr:5222 -starttls xmpp < /dev/null
Top Ten Linux Distributions and https
A/A | Distro | URL | Verified by | Begin | End | Key
01. | ArchLinux | https://www.archlinux.org/ | Let's Encrypt | 02/24/2016 | 05/24/2016 | 2048
02. | Linux Mint | https://linuxmint.com/ | COMODO CA Limited | 02/24/2016 | 02/24/2017 | 2048
03. | Debian | https://www.debian.org/ | Gandi | 12/11/2015 | 01/21/2017 | 3072
04. | Ubuntu | http://www.ubuntu.com | - | - | - | -
05. | openSUSE | https://www.opensuse.org/ | DigiCert Inc | 02/17/2015 | 04/23/2018 | 2048
06. | Fedora | https://getfedora.org/ | DigiCert Inc | 11/24/2014 | 11/28/2017 | 4096
07. | CentOS | https://www.centos.org/ | DigiCert Inc | 07/29/2014 | 08/02/2017 | 2048
08. | Manjaro | https://manjaro.github.io/ | DigiCert Inc | 01/20/2016 | 04/06/2017 | 2048
09. | Mageia | https://www.mageia.org/ | Gandi | 03/01/2016 | 02/07/2018 | 2048
10. | Kali | https://www.kali.org/ | GeoTrust Inc | 11/09/2014 | 11/12/2018 | 2048
Baïkal is a CalDAV and CardDAV server, based on sabre/dav,
To self hosted your own CalDAV & CardDAV server is one of the first step to better control your data and keep your data, actually, yours!So here comes Baikal which is really easy to setup. That easily you can also configure any device (mobile/tablet/laptop/desktop) to use your baikal instance and synchronize your calendar & contacts everywhere.
In this blog post are some personal notes on installing or upgrading baikal on your web server.
[ The latest version as this article was written is 0.4.1 ]
Change to your web directory (usually is something like: /var/www/html/) and download baikal:
Clean Install - Latest release 0.4.1
based on sabre/dav 3.1.2
You need at least PHP 5.5 but preferable use 5.6.
# wget -c https://github.com/fruux/Baikal/releases/download/0.4.1/baikal-0.4.1.zip
# yes | unzip baikal-0.4.1.zip
# chown -R apache:apache baikal/
That’s it !
Be Aware that there is a big difference between 0.2.7 and versions greater that 0.3.x.
And that is, that the URL has an extra part: htmlfrom: https://baikal.example.com/admin
to : https://baikal.example.com/html/admin
If you already had installed baikal-0.2.7 and you want to upgrade to 0.4.x version and later, then you have to follow the below steps:
# wget -c http://baikal-server.com/get/baikal-flat-0.2.7.zip
# unzip baikal-flat-0.2.7.zip
# mv baikal-flat baikal
# wget -c https://github.com/fruux/Baikal/releases/download/0.4.1/baikal-0.4.1.zip
# yes | unzip baikal-0.4.1.zip
# touch baikal/Specific/ENABLE_INSTALL
# chown -R apache:apache baikal/
I prefer to create a new virtualhost every time I need to add a new functionality to my domain.
Be smart & use encryption !
Below is mine virtualhost as an example:
< VirtualHost *:443 >
ServerName baikal.example.com
# SSL Support
SSLEngine on
SSLProtocol ALL -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite HIGH:!aNULL:!MD5
SSLCertificateFile /etc/letsencrypt/live/baikal.example.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/baikal.example.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/baikal.example.com/chain.pem
# Logs
CustomLog logs/baikal.access.log combined
ErrorLog logs/baikal.error.log
DocumentRoot /var/www/html/baikal/
< Directory /var/www/html/baikal/ >
Order allow,deny
Allow from all
< /Directory >
< /VirtualHost >
Next step is to open your browser and browse your baikal's location,
eg. https://baikal.example.com/html/
admin interface:
https://baikal.example.com/html/admin/
or
if you have an older version (0.2.7) on your system
eg. https://baikal.example.com
I use SQLite for personal use (makes easy backup process) but you can always choose MySQL .
Dashboard on 0.4.1
Useful URIs are:
Principals:
Plugins:
Nodes:
Here is a sceen-guide on latest versions:
Login to the admin dashboard and create your user through
Users and resources tab
and you are done with the baikal installation & configuration process.
Principals
Applications (caldav/carddav and task clients) can now be accessed by visiting principals URI:
https://baikal.example.com/html/card.php/principals
or via dav.php
https://baikal.example.com/html/dav.php
but If your client does not support the above holistic URI, then try the below for calendar & contacts:
CalDAV
https://baikal.example.com/html/cal.php/calendars/test/default
CardDAV
https://baikal.example.com/html/card.php/addressbooks/test/default
On android devices, I use: DAVdroid
If you have a problem with your self-signed certificate,
try adding it to your device through the security settings.
I’ve started a new project with bottle.py and had some hiccups with static files and templates.
My project layout is (something) like that:
/
app.wsgi
bottle.py
static/
static/css
static/css/bootstrap-theme.min.css
static/css/bootstrap.min.css
static/img
static/img/logo.png
static/js
static/js/bootstrap.min.js
static/js/npm.js
static/js/tab.js
static/js/jquery-1.12.1.min.js
views/
views/search.tpl
views/index.tpl
views/header.tpl
views/footer.tpl
my app.wsgi is looking something like (dynamic routes & templates):
@bottle.route('/')
@bottle.route('/< action >/< name >')
def main(action='/',name=None):
if ( action == '/' ) :
return template("index", title=" some title ")
else:
return template(action, title=" some title ", name=name)
application = bottle.default_app()
I can translate every REST request to a new template and use AJAX inside the templates.
But what-about static files like stylesheets and javascripts ?
eg.
< script src="jquery-1.12.1.min.js"> < / script>
< img src="logo_hp.png" >
When working with dynamic routes (or any routes in bottle) unless you are using the main app.wsgi everything else will be translated to something like:
GET /search/jquery-1.12.1.min.js
GET /view/jquery-1.12.1.min.js
etc
If you noticed the layout then somehow we need to map all static files (css,js,images) to our static folder. We can map static files from "/" with the code below:
@bottle.get('< filename:re:.*.js >')
def static_js(filename):
return static_file(filename, root='static/js')
@bottle.get(' < filename:re:.*.css > ')
def static_css(filename):
return static_file(filename, root='static/css')
@bottle.get(' < filename:re:.*.png > ')
def static_img(filename):
return static_file(filename, root='static/img')
Ok, that worked for the initial route (index page) but what about all the other templates & requests?
The solution was really (really) very very simply, even if it took me a couple hours to figure it out!!
I just needed to add a forward slash in front of every static file:
< script src="/jquery-1.12.1.min.js"> < / script>
< img src="/logo.png" >
and the GET request becomes:
"GET /jquery-1.12.1.min.js
and we can now route the static files to our static file directory.
I spent a lot of time on commute, so the last year I’ve spent a lot of time listening to podcasts and audio books!
Here are the latest books (in random order) I’ve heard:
Little Brother by Cory Doctorow
Information Doesn’t Want to Be Free by Cory Doctorow
The Hitchhiker’s Guide to the Galaxy (radio edition) by Douglas Adams
debootstrap is a very powerful tool that most of debian/ubuntu people already know about.
It’s really super easy to create your own basic debian docker image, even if you are not running debian.
I used the below steps to my archlinux box, but i believe are generic and you can also use them, without any effort.
Step One:
Download and prepare debootstrap
# wget -c http://ftp.debian.org/debian/pool/main/d/debootstrap/debootstrap_1.0.77.tar.gz
# tar xf debootstrap_*.tar.gz
# cd debootstrap
# sed -i -e 's#/usr/share/debootstrap#.#' debootstrap
Step Two:
debootstrap a new sid (unstable) debian:
# mkdir sid
# ./debootstrap --arch amd64 --include=aptitude sid sid/
Step Three:
Just to be safe, extract debian packages with ar
# cd sid
# for i in `ls -1 var/cache/apt/archives/*deb`; do ar p $i data.tar.xz | tar xJ ; done
# for i in `ls -1 var/cache/apt/archives/*deb`; do ar p $i data.tar.gz | tar xz ; done
# rm -rf var/cache/apt/archives/*deb
Step Four:
Prepare your debian unstable directory.
eg. create the sources.list file
# cat > etc/apt/sources.list << EOF
> deb http://ftp.gr.debian.org/debian unstable main contrib non-free
> deb http://ftp.debian.org/debian/ Sid-updates main contrib non-free
> deb http://security.debian.org/ Sid/updates main contrib non-free
> EOF
Step Five:
Dockerized your debian image:
# tar -c . | docker import - debian:sid
cdf6f22b76f23fa95ae2d5858cec4546086a2064b66cf34b937bc87c83f13c91
# docker images
REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE
debian sid cdf6f22b76f2 5 seconds ago 291.3 MB
You are now ready to play with your new image:
# docker run -t -i --rm debian:sid bash
I have no name!@f3ee67226a07:/#
Some time ago, I wrote this article: How to create an archlinux docker image from the latest bootstrap but I think the below approach is even better.
Step 0
This step is optional.
If you want to reduce the size of the docker image:
# vi /etc/pacman.conf
and add the below lines:
NoExtract = usr/lib/firmware/*
NoExtract = usr/lib/modules/*
NoExtract = usr/share/locale/*
NoExtract = usr/share/man/*
Step 1
Create the latest archlinux on a temporary directory:
# mkdir -pv /tmp/latestarchlinux/var/lib/pacman
# pacman -Syy -r /tmp/latestarchlinux/
# pacman -S base -r /tmp/latestarchlinux/ --noconfirm
Step 2
dockerized the above directory
# cd /tmp/latestarchlinux/
# tar -c . | docker import - archlinux:latest
99a9d7cd2e357f2463b4bb8f3ad1e8bea4bfc10531dfac1931004405727bf035
Step 3
Actually you ‘ve done !
Just play with it already.
# docker run -t -i --rm archlinux:latest bash
[root@de9b7a1d6058 /]#
I am not trying to resolv this issue, I have lost any faith on sourceforge a long time ago.
Although, it is sad. Once, if you wanted to download free software for your linux machine, SF was the place to be.
Nowadays the site is awful. You cant even browse the site if you dont use an ad-blocker.
It is chaotic with all these features and extremely painful if you actually try to do something, even if it is the simplest thing like changing your email address.
This post is just a personal rant about SF subscriptions and nothing more.
I have changed my email address on sourceforge for about a year now. Still I am getting subscription notifies from projects to my previous (deprecated) mail address:
…. so …. yes …
by clicking on the “Manage your subscriptions” link on the bottom of the notify email:
seems that I dont have any project subscriptions !
And that’s not even the big issue here, cause I do want to get notifies whenever SystemRescueCD do updates.
The big issue, for me at least, is when I tried to subscribe on SystemRescueCD (thinking that at least now the notifies will come to my new email address):
If you missed it, the problem is with this quote below:
sponsored content from our select partners, and more
sourceforge simple dont get it !
A colleague asked me to install MySQL UDF (MySQL user defined functions) on a server.
So here are my notes on the subject, for a CentOS 6.7 linux box:
First you need to have mysql-devel on your system which install the mysql development headers on /usr/include/mysql/ directory:
# yum -y install mysql-devel
Then download the latest source code of mysqludf_udf:
# wget -c https://raw.githubusercontent.com/mysqludf/lib_mysqludf_udf/master/lib_mysqludf_udf.c
and compile it
# gcc -m64 -fPIC -Wall
-I/usr/include/mysql -I.
-L/usr/lib64/libstdc++.so.6
-shared lib_mysqludf_udf.c
-o /usr/lib64/mysql/plugin/lib_mysqludf_udf.so
confirm:
# ls -l /usr/lib64/mysql/plugin/lib_mysqludf_udf.so
Restart your MySQL and test it !
CPU
# cat /proc/cpuinfo
Processor : ARMv7 Processor rev 1 (v7l)
processor : 0
BogoMIPS : 3.27
processor : 1
BogoMIPS : 3.27
processor : 2
BogoMIPS : 3.27
processor : 3
BogoMIPS : 3.27
Features : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc05
CPU revision : 1
Hardware : ODROIDC
Revision : 000a
Serial : 1b00000000000000
MEM
# cat /proc/meminfo
MemTotal: 995480 kB
MemFree: 696624 kB
Buffers: 31200 kB
Cached: 119288 kB
SwapCached: 0 kB
Active: 73836 kB
Inactive: 87144 kB
Active(anon): 10596 kB
Inactive(anon): 1572 kB
Active(file): 63240 kB
Inactive(file): 85572 kB
Unevictable: 0 kB
Mlocked: 0 kB
HighTotal: 268288 kB
HighFree: 166504 kB
LowTotal: 727192 kB
LowFree: 530120 kB
SwapTotal: 1049084 kB
SwapFree: 1049084 kB
Dirty: 16 kB
Writeback: 0 kB
AnonPages: 10448 kB
Mapped: 17384 kB
Shmem: 1676 kB
Slab: 58992 kB
SReclaimable: 37252 kB
SUnreclaim: 21740 kB
KernelStack: 1080 kB
PageTables: 516 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 1546824 kB
Committed_AS: 30284 kB
VmallocTotal: 245760 kB
VmallocUsed: 19892 kB
VmallocChunk: 214012 kB
UPDATED: 14 February 2016
Blog Post: 16 December 2015
I have started (for some time now, to be honest) to transfer my router’s function to my ODROID-c1
that runs Archlinux arm so I have my favorite distribution on this beautiful development board.
# uname -a
Linux myodroid 3.10.80-13-ARCH #1 SMP PREEMPT Tue Sep 15 15:43:38 MDT 2015 armv7l GNU/Linux
for specs you can click here
The board has an Gigabit Ethernet port but no Wireless Card.
I had a spare USB Wireless Network card, so I’ve used it on one of the four USB slots of the board.
Bus 001 Device 003: ID 148f:3370 Ralink Technology, Corp. RT3370 Wireless Adapter
You need to verify that your wireless card, can support Access Point functionality.
To verify your card, type:
# iw list | grep AP
if you see something like that: #{ AP } then you probably are ok.
The most important thing is to find out what your card can do, mine:
valid interface combinations:
* #{ AP } <= 8,
total <= 8, #channels <= 1
That means that I can configure up to 8 AP (Access Points), 8 different ssid but only on one channel !
Reading through the internet (mostly on archlinux wiki) I had, first, to create a Bridge with my Ethernet card and then hostapd will add my Wireless Card to the same bridge.
Although I use systemd for a while sometime, I wasnt able to create the bridge interface via systemd. I’ve tested my confs/files to a secondary linux machine and I know for a fact that my notes are correct. Somehow it seems that there is a problem with systemd on ODROID-c1 regarding this or perhaps I havent found the problem with my setup!
So I’ve created a shell script that runs after boot: net.sh
!/bin/sh
ip link add br0 type bridge
ip link set br0 up
ip link set eth0 up
ip link set eth0 master br0
ip addr add 10.10.10.10/24 dev br0
ip route add default via 10.10.10.1 dev br0
# Wireless Vlan (Guest Network)
ip address add 10.10.20.10/24 dev br0:0
# Enable Forwarding
sysctl -w net.ipv4.ip_forward=1
# Masquerade traffic
iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
# Accept forwarding
iptables -P FORWARD ACCEPT
# Start (or restart) hostapd
systemctl restart hostapd.service
# Isolate Vlan 10.10.20.0/24 (Guest Network) from 10.10.10.0/24 (Home Network)
iptables -I FORWARD -s 10.10.20.0/24 -d 10.10.10.0/24 -j DROP
a basic setup of hostapd is below. I’ve used TEST as the ssid and TESTTESTTEST as the password:
/etc/hostapd/hostapd.conf
interface=wlan0
bridge=br0
driver=nl80211
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
ssid=Testing
hw_mode=g
channel=1
ap_isolate=1
own_ip_addr=127.0.0.1
wpa=2
wpa_passphrase=TestingTesting
wpa_key_mgmt=WPA-PSK
On this ODROID-C1 board, I run my own DNS Cache/DHCP server with dnsmasq.
/etc/dnsmasq.conf
interface=br0
# custom host file to reduce ads
addn-hosts=/etc/hosts.txt
dhcp-range=10.10.20.16,10.10.20.32,12h
dhcp-option=option:router,10.10.20.10
dhcp-option=option:dns-server,10.10.20.10
dhcp-option=option:ntp-server,193.93.167.241
As we getting closer to the amazing 32nd Chaos Communication Congress (32C3) we must consider some privacy steps to our electronic devices.
Perhaps it’s idiotic to take a smartphone to this conference, as we all know that in such events hacking is fair play to everyone.
The below quote, from Person of Interest, reminds us exactly that:
If they don’t want you to get inside, they ought to build it better.
You should treat every network as a hostile, already compromised network.
It’s probably true, anyway !
For us mere people that we dont have many security knowledge, we need to take some extra security measures if we want to bring our smartphone together. It’s just for browsing, taking some picture from the event (and not the people, respect that please), check some emails or tweet something interesting.
Btw, if you believe that it is ok to use your smartphone/laptop on your hotel room, think again!
Where do you think all the hackers from the event are going to sleep ?
Yeap, on the same hotel. So be extra careful in places you feel more safe!
This isnt a guide you must or should follow, or even a bulletproof solution. As the subject of this blog post suggest is just a step closer. You should also remind your self in idle times (as watching a presentation) to keep your phone in airplane mode and always use TOR for browsing.
So, on a spare -just formatted- android mobile phone install AFWall+, create a new profile and BLOCK everything. Whitelist only OpenVPN.
Check your browser to see that you dont have access on the internet:
Connect to your OpenVPN server and check again:
[UPDATE 2015 12 13]
How about if you could control your entire home temperature and hot water/central heating etc etc, through your smartphone over the internet ?
You are going to think that this is a dangerous IoT (Internet of Thing) that exposes your privacy to unknown attackers and your smart home is going to be under the control of an evil company.
What if I could tell you, that you can build your own smart controller with open-design/open hardware & free software that costs about €100 ?
Crazy, right ?
Actually there is a project that does exactly all the above and much more and it’s based on a Raspberry Pi.
Let me introduce you to HestiaPi .
The name comes from the greek word: εστία and everything you need to start with, have already been published by the core developer on their site.
The team behind this awesome project will host/run an open/free entrance two day Hackathon at Athens, Hackerspace on 2016.
If you are curious on the project, visit hackerspace.gr and be part of this amazing project.
First remove NetworkManager:
# systemctl stop NetworkManager
# systemctl disable NetworkManager
rm '/etc/systemd/system/multi-user.target.wants/NetworkManager.service'
rm '/etc/systemd/system/dbus-org.freedesktop.NetworkManager.service'
rm '/etc/systemd/system/dbus-org.freedesktop.nm-dispatcher.service'
# yum -y remove NetworkManager*
# /usr/bin/rm -rf /etc/NetworkManager
If you want to be more productive you should clean your system from FirewallD, install iptables-services and if you are going to install a redhat product/software disable SELinux as it’s manual going to suggest !
Now we can proceed.
# systemctl status network.service
will show us /etc/rc.d/init.d/network as the network orchestrator on the system.
Reading this file will get you a basic understanding of networking.
if [ ! -f /etc/sysconfig/network ]; then
exit 6
fi
that tells us that file: /etc/sysconfig/network must exist on our system.
If you want to disable the network on this linux machine you can do it by adding the below declaration:
NETWORKING=no
So here are my notes for bonding:
eth0 + eth1 = bond0 with Adaptive transmit load balancing:
# cat /etc/sysconfig/network-scripts/ifcfg-em1
DEVICE=em1
MASTER=bond0
SLAVE=yes
# cat /etc/sysconfig/network-scripts/ifcfg-em2
DEVICE=em2
MASTER=bond0
SLAVE=yes
and bond0:
DEVICE=bond0
BONDING_OPTS="miimon=1 updelay=0 downdelay=0 mode=balance-tlb"
TYPE=Bond
BONDING_MASTER=yes
DNS1=xxx.xxx.xxx.xxx
GATEWAY=8.8.8.8
IPADDR=xxx.xxx.xxx.1
PREFIX=24
DEFROUTE=yes
BOOTPROTO=none
ONBOOT=yes
and as yoda would tell:
“else everything do not need you”
I had the opportunity to participate on an Athen’s Hackerspace event with a dozen debian developers about the issue with reproducible distribution’s package builds.
I had never thought of this thing before and the presentation blown me away !
So here is the deal, if you download the latest openssl package from an archlinux mirror (want archlinux users will going to do):
# pacman -Sw openssl
What if we tried to build openssl by our selfs from the PKGBUILD file ?
# cd /var/abs/core/openssl
$ makepkg -cf
==> Making package: openssl 1.0.2.e-1 (Sun Dec 6 13:07:08 EET 2015)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
-> Found openssl-1.0.2e.tar.gz
-> Found openssl-1.0.2e.tar.gz.asc
-> Found no-rpath.patch
-> Found ca-dir.patch
==> Validating source files with md5sums...
openssl-1.0.2e.tar.gz ... Passed
openssl-1.0.2e.tar.gz.asc ... Skipped
no-rpath.patch ... Passed
ca-dir.patch ... Passed
==> Verifying source file signatures with gpg...
openssl-1.0.2e.tar.gz ... Passed
==> Extracting sources...
-> Extracting openssl-1.0.2e.tar.gz with bsdtar
==> Starting prepare()...
...
...
...
==> Leaving fakeroot environment.
==> Finished making: openssl 1.0.2.e-1 (Sun Dec 6 13:11:06 EET 2015)
==> Cleaning up...
Let’s check the md5sum:
# md5sum /var/cache/pacman/pkg/openssl-1.0.2.e-1-x86_64.pkg.tar.xz
/var/abs/core/openssl/openssl-1.0.2.e-1-x86_64.pkg.tar.xz
b555ac4294a2f39ef0caa19e21a28355 /var/cache/pacman/pkg/openssl-1.0.2.e-1-x86_64.pkg.tar.xz
08755bad654f74b8a1c4c5386934aeea /var/abs/core/openssl/openssl-1.0.2.e-1-x86_64.pkg.tar.xz
wat ???
why isnt both files similar exactly the same ?
Let’s find out what are the differences between these two files by using diffoscope
diffoscope --html /tmp/openssl.html
/var/cache/pacman/pkg/openssl-1.0.2.e-1-x86_64.pkg.tar.xz
/var/abs/core/openssl/openssl-1.0.2.e-1-x86_64.pkg.tar.xz
fire up an html browser and open /tmp/openssl.html
Read carefully the output, most of them are timestamps.
So what this fuzz is all about ?
There is a huge problem actually, we trust our distributions for privacy and security.
But what if governments have already compromised ftp mirrors or by MITM we have already installed a backdoor software?
That’s what core developers from major distributions are fighting as we speak, they are trying to engage more core developers and find a way to redistribute reproducible builds so that you can actually verify a package build on your PC.
Need to know more?
Click here: reproducible-builds
Can you help ?
take a look on diffoscope
There are some companies that have just started to dual stack (IPv4 & IPv6) their infrastructure, like twimg (the twitter hosting images site).
Reminder that IPv6 is preferable on the Internet (by design)
query[AAAA] pbs.twimg.com from 192.168.1.4
pbs.twimg.com to xxx.xxx.xxx.xxx
reply pbs.twimg.com is
reply ipv6.twimg.com is 2606:1f80:a000:102::2
reply ipv6.twimg.com is 2606:1f80:a000:106::2
reply ipv6.twimg.com is 2606:1f80:a000:105::2
reply ipv6.twimg.com is 2606:1f80:a000:107::2
reply ipv6.twimg.com is 2606:1f80:a000:104::2
reply ipv6.twimg.com is 2606:1f80:a000:100::2
reply ipv6.twimg.com is 2606:1f80:a000:101::2
reply ipv6.twimg.com is 2606:1f80:a000:103::2
query[A] pbs.twimg.com from 192.168.1.4
cached pbs.twimg.com is
forwarded pbs.twimg.com to xxx.xxx.xxx.xxx
reply pbs.twimg.com is
reply ipv6.twimg.com is 104.244.43.103
reply ipv6.twimg.com is 104.244.43.231
reply ipv6.twimg.com is 104.244.43.135
reply ipv6.twimg.com is 104.244.43.39
reply ipv6.twimg.com is 104.244.43.199
reply ipv6.twimg.com is 104.244.43.71
reply ipv6.twimg.com is 104.244.43.7
reply ipv6.twimg.com is 104.244.43.167
but twitter itself, doesnt support IPv6 !
query[AAAA] twitter.com from 192.168.1.4
forwarded twitter.com to xxx.xxx.xxx.xxx
reply twitter.com is NODATA-IPv6
query[A] twitter.com from 192.168.1.4
forwarded twitter.com to xxx.xxx.xxx.xxx
reply twitter.com is 199.16.156.102
reply twitter.com is 199.16.156.70
reply twitter.com is 199.16.156.38
reply twitter.com is 199.16.156.6
So below is the result on IPv4 twitter that calls IPv6 twimg:
UPDATE Thu Nov 26 11:28:05 EET 2015
Does SPF break forwarding?
(like in mailing lists)
- Yes, it does break forwarding.
So learn from my mistake and think this through.
Wednesday, 25 November 2015
There is a very simply way to add spf [check] support to your postfix setup.
Below are my notes on CentOS 6.7
Step One: install python policy daemon for spf
# yum -y install pypolicyd-spf
Step Two: Create a new postfix service, called spfcheck
# vim + /etc/postfix/master.cf
spfcheck unix - n n - - spawn
user=nobody argv=/usr/libexec/postfix/policyd-spf
Step Three: Add a new smtp daemon recipient restrictions
# vim +/^smtpd_recipient_restrictions /etc/postfix/main.cf
smtpd_recipient_restrictions =
permit_mynetworks,
...
check_policy_service unix:private/spfcheck
policy_time_limit = 3600
And that’s what we see in the end on a receiver’s source-view email:
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=xxx.xxx.xxx.xxx;
helo=server.mydomain.tld; envelope-from=user@mydomain.tld; receiver=username@example.com
where xxx.xxx.xxx.xxx is the IP of the sender mail server
server.mydomain.tld is the name of the sender mail server
user@mydomain.tld is the sender’s email address
and of-course
username@example.com is the receiver’s mail address
You can take a better look on postfix python SPF policy daemon by clicking here: python-postfix-policyd-spf
A few days ago, I gave a presentation on fosscomm 2015 about DNS, OpenNic Project and DNScrypt
So without further ado, here it is: dns_opennic_dnscrypt.pdf
I did a road trip last week and had almost 11 hours to “kill” while driving.
So I’ve downloaded an audio book to accompany me all those hours.
I chose ‘I, Robot’ a collection of short stories by Isaac Asimov.
I have to admit that although I was aware on the core beliefs and the Three Laws of Robotics, I had never had the change to read (or listen) I, Robot.
These dystopia stories captivate me from the start!
If anyone havent yet read these stories, PLZ make yourself a present and read (or listen) them.
After that, you should really watch the swedish TV series Real Humans / Äkta människor and/or the british version Humans which are about androids!