Nabble - leaf-user

Vmware, bering and a Merlin XU870

2009-11-10T20:19:10Z

First, a bit of detail about what I am doing. I have a 3
MobileBroadband card (the Merlin XU870) which I want to share amongst
the three virtual machines running on my laptop.

Installed on the laptop is Vmware Workstation.

I have built a Bering firewall virtual machine (it requires bugger all
resources) and have networking setup with one interface on "host-only"
and one interface "bridged".

For POC, I wanted to see if eth0 would get a dhcp assigned IP address. Tick, success!!

Now I give the firewall control of the wireless card and the following happens (ultimately, no ppp0 connection).

Any ideas would be greatly appreciated.

Code:
cadia# cat /proc/bus/usb/drivers
usbdevfs
hub
serial
acm
Code:
cadia# cat /proc/bus/usb/devices
T: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
B: Alloc= 11/900 us ( 1%), #Int= 1, #Iso= 0
D: Ver= 1.00 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=0000 ProdID=0000 Rev= 0.00
S: Product=USB UHCI Root Hub
S: SerialNumber=2440
C:* #Ifs= 1 Cfg#= 1 Atr=40 MxPwr= 0mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
E: Ad=81(I) Atr=03(Int.) MxPS= 8 Ivl=255ms
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1410 ProdID=1430 Rev= 0.00
S: Manufacturer=Novatel Wireless
S: Product=Novatel Wireless HSDPA Modem
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=128ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=84(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 2 Spd=12 MxCh= 7
D: Ver= 1.10 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=0e0f ProdID=0002 Rev= 1.00
S: Product=VMware Virtual USB Hub
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr= 0mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
E: Ad=81(I) Atr=03(Int.) MxPS= 1 Ivl=255msI think this is where the problem lies. The device is "seen" by the virtual machine, but not assigned?

Code:
cadia# cat /proc/tty/driver/usb-serial
usbserinfo:1.0 driver:v1.4

cadia# dmesg
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
usb-uhci.c: $Revision: 1.275 $ time 16:04:45 Jan 31 2009
usb-uhci.c: High bandwidth mode enabled
usb-uhci.c: USB UHCI at I/O 0x2440, IRQ 11
usb-uhci.c: Detected 2 ports
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb-uhci.c: v1.275:USB Universal Host Controller Interface driver
usb.c: registered new driver serial
usbserial.c: USB Serial support registered for Generic
usbserial.c: USB Serial Driver core v1.4
usb.c: registered new driver acm
acm.c: v0.21:USB Abstract Control Model driver for USB modems and ISDN adapters
hub.c: new USB device 02:03.0-2, assigned address 2
hub.c: USB hub found
hub.c: 7 ports detected
hub.c: new USB device 02:03.0-1, assigned address 3
usb.c: USB device 3 (vend/prod 0x1410/0x1430) is not claimed by any active driver.

__________________________________________________________________________________
Win 1 of 4 Sony home entertainment packs thanks to Yahoo!7.
Enter now: http://au.docs.yahoo.com/homepageset/

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Bering-uClibc 2.2.1 IP Alias Configuration Question

2009-11-05T23:20:08Z

Hi

Robert Harrison wrote:

> I've run my firewall with this software for several years. Recently
> changed ISP and in the confusion something went wrong that I can't
> figure out. The firewall is supposed to send web browser requests and
> ssh requests to a computer on the local net. The Apache server is
> configured using virtualhost to provide results based on one of
> several domain name all of which resolve to the same ip address
> 173.x.x.180. However, the virtualhost configuration is only read if a
> wild card is given for the ip address or the computer's local ip
> address (192.168.1.120)! Other sites which should be served based on
> their IP address alone are not seen at all. It seems to me that the
> HTTP request is being rewritten to contain the local destination
> (192.168.1.120) rather than the originating address (173.x.x.180).
> Configuration information is given below. I'd appreciate any advice
> on how to proceed.

Maybe proxy-arp will help, this would mimic the desired behaviour, but
then you will have to assign the public addresses to the server on the
internal network. See http://www.shorewall.net/ProxyARP.htm

cheers

Erich

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Bering-uClibc 2.2.1 IP Alias Configuration Question

2009-11-05T14:01:54Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Robert Harrison wrote:

> Thanks for the quick reply but I'm not sure I understand. Here is the
> Shorewall "rules" file:
> #
> # Shorewall version 2.0 - Rules File
> # /etc/shorewall/rules
> # Accept all http and ssh connections to anneMC
> DNAT net loc:192.168.1.120 tcp http,https,ssh - 173.x.x.178
> DNAT net loc:192.168.1.120 tcp http,https,ssh - 173.x.x.179
> DNAT net loc:192.168.1.120 tcp http,https,ssh - 173.x.x.180
> DNAT net loc:192.168.1.120 tcp http,https,ssh - 173.x.x.181
> DNAT net loc:192.168.1.120 tcp http,https,ssh - 173.x.x.182

<snip>

> I thought the purpose of the "Original Destination" in the DNAT rule
> was to pass the IP address used to access the website. Could you tell
> me what is wrong with this (rules) setup?

You are routing traffic from all of your original destinations to the
same final destination. Since they all point to the same internal IP
address, apache on your internal system has no way to tell which IP they
were originally sent to on the firewall. You need to change the
internal IP address on each rule, and add more IPs to your internal
apache box, something like:

DNAT net loc:192.168.1.120 tcp http,https,ssh - 173.x.x.178
DNAT net loc:192.168.1.121 tcp http,https,ssh - 173.x.x.179
DNAT net loc:192.168.1.122 tcp http,https,ssh - 173.x.x.180
DNAT net loc:192.168.1.123 tcp http,https,ssh - 173.x.x.181
DNAT net loc:192.168.1.124 tcp http,https,ssh - 173.x.x.182

...then you can use the unique internal IP addresses in your apache
configuration to do IP based virtual hosting.

- --
Charles Steinkuehler
charles@...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iD8DBQFK80tSLywbqEHdNFwRAoGbAJ44lSk21d5KcCO/2U2eLMXBvVz5PwCfT+6o
L9juZ80HsqwQoQ9gN+3mUog=
=nEGp
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Bering-uClibc 2.2.1 IP Alias Configuration Question

2009-11-05T12:03:52Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Robert Harrison wrote:

Based on your rules, it looks like you have assigned all of the IP
addresses to your firewall, and are port-forwarding the desired traffic
to the internal system(s). This should work, but you did not include
any real details on your port-forwarding setup (/etc/shorewall/rules) or
how your apache is configured.

Note that when the traffic is port-forwarded from the various IP
addresses on the firewall, the destination address *WILL* get
re-written. If you want to use IP based virtual hosting, you will need
to assign multiple IP addresses on the internal system, and port-forward
each public IP on the firewall to an appropriate IP address on the
internal system. Otherwise, apache will have no idea which IP address
the original request was sent to.

If you don't want to use IP addresses, you could do a similar thing with
ports on the internal apache system, forwarding each external public IP
to a unique port number on the internal system.

- --
Charles Steinkuehler
charles@...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iD8DBQFK8y+oLywbqEHdNFwRAkPbAJ9kUA56uRlrJ8KfwVxTJi219I1iAwCeN04y
KH+zxJbCyvxlkRDB/TQUpmk=
=hxLP
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Bering-uClibc 2.2.1 IP Alias Configuration Question

2009-11-05T09:54:11Z

I've run my firewall with this software for several years. Recently
changed ISP and in the confusion something went wrong that I can't
figure out. The firewall is supposed to send web browser requests and
ssh requests to a computer on the local net. The Apache server is
configured using virtualhost to provide results based on one of
several domain name all of which resolve to the same ip address
173.x.x.180. However, the virtualhost configuration is only read if a
wild card is given for the ip address or the computer's local ip
address (192.168.1.120)! Other sites which should be served based on
their IP address alone are not seen at all. It seems to me that the
HTTP request is being rewritten to contain the local destination
(192.168.1.120) rather than the originating address (173.x.x.180).
Configuration information is given below. I'd appreciate any advice
on how to proceed.

Results from "ip addr"
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop
link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:50:bf:1c:57:f2 brd ff:ff:ff:ff:ff:ff
inet 173.x.x.180/29 brd 173.x.x.255 scope global eth0
inet 173.x.x.178/29 brd 173.x.x.255 scope global secondary eth0:0
inet 173.x.x.179/29 brd 173.x.x.255 scope global secondary eth0:1
inet 173.x.x.181/29 brd 173.x.x.255 scope global secondary eth0:2
inet 173.x.x.182/29 brd 173.x.x.255 scope global secondary eth0:3
4: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:14:6c:76:1c:56 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.254/24 scope global eth1

Results from "ip route"
173.x.x.176/29 dev eth0 proto kernel scope link src 173.x.x.180
192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.254
default via 173.x.x.177 dev eth0

Selected Results from "shorewall show"
Shorewall-2.09 Chain at issacA - Thu Nov 5 18:43:53 UTC 2009

Chain eth0_fwd (1 references)
pkts bytes target prot opt in out source destination
879 501K dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
19 1068 smurfs all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW
19 1068 norfc1918 all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW
878 501K tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
879 501K net2loc all -- * eth1 0.0.0.0/0 0.0.0.0/0

Chain eth0_in (1 references)
pkts bytes target prot opt in out source destination
369 68491 dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
5 240 smurfs all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW
5 240 norfc1918 all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW
5 240 tcpflags tcp -- * * 0.0.0.0/0 0.0.0.0/0
369 68491 net2fw all -- * * 0.0.0.0/0 0.0.0.0/0

Chain eth1_fwd (1 references)
pkts bytes target prot opt in out source destination
945 173K dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
945 173K loc2net all -- * eth0 0.0.0.0/0 0.0.0.0/0

Chain eth1_in (1 references)
pkts bytes target prot opt in out source destination
385 25807 dynamic all -- * * 0.0.0.0/0 0.0.0.0/0
385 25807 loc2fw all -- * * 0.0.0.0/0 0.0.0.0/0

Chain net2all (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
5 240 Drop all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0 ULOG copy_range 0 nlgroup 1
prefix `Shorewall:net2all:DROP:' queue_threshold 1
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain net2fw (1 references)
pkts bytes target prot opt in out source destination
364 68251 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
5 240 net2all all -- * * 0.0.0.0/0 0.0.0.0/0

Chain net2loc (1 references)
pkts bytes target prot opt in out source destination
860 500K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
1 48 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.120 multiport dports
80,443,22 ctorigdst 173.x.x.178
1 48 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.120 multiport dports
80,443,22 ctorigdst 173.x.x.179
9 544 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.120 multiport dports
80,443,22 ctorigdst 173.x.x.180
3 176 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.120 multiport dports
80,443,22 ctorigdst 173.x.x.181
1 48 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.120 multiport dports
80,443,22 ctorigdst 173.x.x.182
4 204 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.120 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.120 tcp dpt:25
0 0 net2all all -- * * 0.0.0.0/0 0.0.0.0/0

Chain norfc1918 (2 references)
pkts bytes target prot opt in out source destination
0 0 rfc1918 all -- * * 172.16.0.0/12 0.0.0.0/0
0 0 rfc1918 all -- * * 0.0.0.0/0 0.0.0.0/0 ctorigdst 172.16.0.0/12
0 0 rfc1918 all -- * * 192.168.0.0/16 0.0.0.0/0
0 0 rfc1918 all -- * * 0.0.0.0/0 0.0.0.0/0 ctorigdst 192.168.0.0/16
0 0 rfc1918 all -- * * 10.0.0.0/8 0.0.0.0/0
0 0 rfc1918 all -- * * 0.0.0.0/0 0.0.0.0/0 ctorigdst 10.0.0.0/8

Chain reject (11 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 PKTTYPE = broadcast
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 PKTTYPE = multicast
0 0 DROP all -- * * 173.x.x.255 0.0.0.0/0
0 0 DROP all -- * * 192.168.1.255 0.0.0.0/0
0 0 DROP all -- * * 255.255.255.255 0.0.0.0/0
0 0 DROP all -- * * 224.0.0.0/4 0.0.0.0/0
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset
0 0 REJECT udp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT icmp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-unreachable
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain rfc1918 (6 references)
pkts bytes target prot opt in out source destination
0 0 ULOG all -- * * 0.0.0.0/0 0.0.0.0/0 ULOG copy_range 0 nlgroup 1
prefix `Shorewall:rfc1918:DROP:' queue_threshold 1
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain smurfs (2 references)
pkts bytes target prot opt in out source destination
0 0 ULOG all -- * * 173.x.x.255 0.0.0.0/0 ULOG copy_range 0 nlgroup 1
prefix `Shorewall:smurfs:DROP:' queue_threshold 1
0 0 DROP all -- * * 173.x.x.255 0.0.0.0/0
0 0 ULOG all -- * * 192.168.1.255 0.0.0.0/0 ULOG copy_range 0 nlgroup
1 prefix `Shorewall:smurfs:DROP:' queue_threshold 1
0 0 DROP all -- * * 192.168.1.255 0.0.0.0/0
0 0 ULOG all -- * * 255.255.255.255 0.0.0.0/0 ULOG copy_range 0
nlgroup 1 prefix `Shorewall:smurfs:DROP:' queue_threshold 1
0 0 DROP all -- * * 255.255.255.255 0.0.0.0/0
0 0 ULOG all -- * * 224.0.0.0/4 0.0.0.0/0 ULOG copy_range 0 nlgroup 1
prefix `Shorewall:smurfs:DROP:' queue_threshold 1
0 0 DROP all -- * * 224.0.0.0/4 0.0.0.0/0

Chain tcpflags (2 references)
pkts bytes target prot opt in out source destination
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x29
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03
0 0 logflags tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:0 flags:0x16/0x02

Thanks,
Bob

"In theory there is no difference between theory and practice. In
practice there is."
Yogi Berra

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Read/Write to USB stick when using the 3.1 CD image

2009-10-24T07:58:08Z

Thanks, Fred, for the instructions. Some questions:

1. I presume I have to rebuild the CD image to use the usb initrd since
I have an Intel board?
2. I don't see an isolinux.cfg on the 3.1 CD. There is a syslinux.cfg so
I guess that's the equivalent to isolinux.cfg?
3. Did you have to rebuild the bootdisk.ima?

Thanks,
Stephen
On Sat, 2009-10-24 at 08:46 -0500, Frederick Stevens wrote:

> Hello,
>
> First, make sure that you have loaded the proper usb kernel modules
> for your system in your initrd. I have a router that has OHCI usb
> root hubs on the motherboard and the stock initrd with the Bering CD
> image would not work since most intel systems have UHCI root hubs.
> Once you have the modules loading at boot, then do something like this
> to your leaf.cfg on the usb device that you created with the bering
> packages on it:
>
> # The first entry is the backup device.
> # If equal packages exist on multiple devices, the ones on the left most device
> PKGPATH="/dev/sda1:msdos"
>
> Also, on the bootable CD have your isolinux.cfg configured like this:
>
> display syslinux.dpy
> timeout 0
> append reboot=bios
> default linux initrd=initrd.lrp init=/linuxrc rw root=/dev/ram0
> LEAFCFG=/dev/sda1:msdos
>
> The last line above is all one line by the way. It's been a while
> since I set this up but I think that this is mostly what is needed to
> make it work. I have two systems like this that I maintain and they
> both work well. One has OHCI usb and the other has UHCI usb.
>
> Take Care & Good Luck,
>
> Fred Stevens
>
> On 10/23/09, Stephen Lee <splee@...> wrote:
> > Hi,
> >
> > I'm trying to save the config info onto a usb stick and be able to ready
> > it during boot up from a CD. How do I do this when booting from
> > Bering-uClibc_3.1_iso_bering-uclibc-iso.bin? Normally I would make a
> > bootable usb usb stick using the 3.1 usb image but I've got some PIII
> > boxes that can't boot from usb. Is there a document explaining this type
> > of setup?
> >
> > Thanks,
> > Stephen
> > ------------------------------------------------------------------------------
> > Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> > is the only developer event you need to attend this year. Jumpstart your
> > developing skills, take BlackBerry mobile applications to market and stay
> > ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> > http://p.sf.net/sfu/devconference
> > ------------------------------------------------------------------------
> > leaf-user mailing list: leaf-user@...
> > https://lists.sourceforge.net/lists/listinfo/leaf-user
> > Support Request -- http://leaf-project.org/
> >
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
>

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Read/Write to USB stick when using the 3.1 CD image

2009-10-24T06:46:17Z

Hello,

First, make sure that you have loaded the proper usb kernel modules
for your system in your initrd. I have a router that has OHCI usb
root hubs on the motherboard and the stock initrd with the Bering CD
image would not work since most intel systems have UHCI root hubs.
Once you have the modules loading at boot, then do something like this
to your leaf.cfg on the usb device that you created with the bering
packages on it:

# The first entry is the backup device.
# If equal packages exist on multiple devices, the ones on the left most device
PKGPATH="/dev/sda1:msdos"

Also, on the bootable CD have your isolinux.cfg configured like this:

display syslinux.dpy
timeout 0
append reboot=bios
default linux initrd=initrd.lrp init=/linuxrc rw root=/dev/ram0
LEAFCFG=/dev/sda1:msdos

The last line above is all one line by the way. It's been a while
since I set this up but I think that this is mostly what is needed to
make it work. I have two systems like this that I maintain and they
both work well. One has OHCI usb and the other has UHCI usb.

Take Care & Good Luck,

Fred Stevens

On 10/23/09, Stephen Lee <splee@...> wrote:

> Hi,
>
> I'm trying to save the config info onto a usb stick and be able to ready
> it during boot up from a CD. How do I do this when booting from
> Bering-uClibc_3.1_iso_bering-uclibc-iso.bin? Normally I would make a
> bootable usb usb stick using the 3.1 usb image but I've got some PIII
> boxes that can't boot from usb. Is there a document explaining this type
> of setup?
>
> Thanks,
> Stephen
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry(R) Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay
> ahead of the curve. Join us from November 9 - 12, 2009. Register now!
> http://p.sf.net/sfu/devconference
> ------------------------------------------------------------------------
> leaf-user mailing list: leaf-user@...
> https://lists.sourceforge.net/lists/listinfo/leaf-user
> Support Request -- http://leaf-project.org/
>

Read/Write to USB stick when using the 3.1 CD image

2009-10-23T19:41:22Z

Hi,

I'm trying to save the config info onto a usb stick and be able to ready
it during boot up from a CD. How do I do this when booting from
Bering-uClibc_3.1_iso_bering-uclibc-iso.bin? Normally I would make a
bootable usb usb stick using the 3.1 usb image but I've got some PIII
boxes that can't boot from usb. Is there a document explaining this type
of setup?

Thanks,
Stephen
------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Docs for the 2 NIC config

2009-10-13T13:27:04Z

Paul Rogers wrote:

>> I _believe_ the script should not take more than a few hundred
>> bytes as you need those utilities anyway. I think modutils is the
>> place to do it
>
> We had a Senator who famously said, "A billion here, a billion there,
> pretty soon you're talking real money." All I think we need is that
> the assignments be reliable, and the way it works be documented
> rather than arcane knowledge some people might not know. It could be
> "fixed" with a few sentences in the installation manual. (By someone
> that knows it, which obviously isn't me!)

Wrong, you are now

cheers

Erich

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Docs for the 2 NIC config

2009-10-13T09:51:38Z

> I _believe_ the script should not take more than a few hundred
> bytes as you need those utilities anyway. I think modutils is the
> place to do it

We had a Senator who famously said, "A billion here, a billion there,
pretty soon you're talking real money." All I think we need is that
the assignments be reliable, and the way it works be documented
rather than arcane knowledge some people might not know. It could be
"fixed" with a few sentences in the installation manual. (By someone
that knows it, which obviously isn't me!)
--
Paul Rogers
paulgrogers@...
http://www.xprt.net/~pgrogers/
Rogers' Second Law: "Everything you do communicates."
(I do not personally endorse any additions after this line. TANSTAAFL :-)

--
http://www.fastmail.fm - Or how I learned to stop worrying and
love email again

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Docs for the 2 NIC config

2009-10-13T07:18:12Z

Charles

Charles Steinkuehler wrote:
...
>
> The problem is most of the time if you have multiple NICs, they use the
> same chipset. That means the ethX order is determined by the device
> driver, not by the module load order, and the device drivers have no
> standardized way of indicating which physical interface is "first".

Implemented as specified...

>
> So...either something has to talk to the kernel the way modprobe, udev,
> etc. manage to do, or a different approach is needed (perhaps using MAC
> addresses or logical names to identify the interfaces instead of ethX).
>

How would a logical name survive a reboot? I guess the only fixed
identification would be the mac address.

cheers

Erich

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: [leaf-devel] Docs for the 2 NIC config

2009-10-13T05:07:53Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Erich Titl wrote:

> Actually it might not be that difficult to mimic the alias in Bering
> uClibc. We have the ip link command which allows us to assign whaever
> name we want to a specific NIC
>
> [root@tristan]# ip link set dev eth0 name inside
> [root@tristan]# ip link show dev inside
> 2: inside: <BROADCAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
> link/ether 00:80:c8:f8:4a:51 brd ff:ff:ff:ff:ff:ff
>
> All that is left now is to determine which NIC will get which name,
> which is not that obvious when you take the above snippet into
> consideration.
>
> What you can do is read the /etc/modules file for alias ethx lines, sort
> them and then load the drivers in that order, preferrably after all
> dependencies have been resolved :-)

The problem is most of the time if you have multiple NICs, they use the
same chipset. That means the ethX order is determined by the device
driver, not by the module load order, and the device drivers have no
standardized way of indicating which physical interface is "first".

So...either something has to talk to the kernel the way modprobe, udev,
etc. manage to do, or a different approach is needed (perhaps using MAC
addresses or logical names to identify the interfaces instead of ethX).

- --
Charles Steinkuehler
charles@...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iD8DBQFK1G2ZLywbqEHdNFwRAn+BAKDZa+bl8pxQ/ZkWgl7oe9UGSWyYIgCfZaS0
1FVfdiWZZRq2cnBS2+5h7VM=
=rVbg
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: [leaf-devel] Docs for the 2 NIC config

2009-10-12T23:52:20Z

Paul Rogers wrote:
> On Mon, 12 Oct 2009 22:15:15 +0200, "Erich Titl"
...
>
> And STILL get it all on one floppy? ;-) I'm one of the ones that has
> always been in favor of maintaining floppy compatability for a basic
> setup. As long as the behavior is documented where an installer is sure
> to see it, then I'm in favor of using the far simpler default behavior.

I _believe_ the script should not take more than a few hundred bytes as
you need those utilities anyway. I think modutils is the place to do it

# Loop over every line in /etc/modules.
echo 'Loading modules: '
(cat /etc/modules; echo) | # make sure there is a LF at the end
while read module args
do
case "$module" in
\#*|"") continue ;;
esac
echo -n "$module - "
MODTOLOAD=`find / -name $module.o |sort |sed -n 1p`
if [ "$MODTOLOAD" = "" ] ;then
module="` echo $module | cut -c-8`"
MODTOLOAD=`find / -name $module.o |sort |sed -n 1p `
fi
if [ ! "$MODTOLOAD" = "" ] ;then
insmod $MODTOLOAD $args
fi
# insmod /lib/modules/"$module".o $args
done

cheers

Erich

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: [leaf-devel] Docs for the 2 NIC config

2009-10-12T23:36:11Z

Paul

I move this to leaf users as I believe it is of general interest.

Paul Rogers wrote:

> On Mon, 12 Oct 2009 10:10:24 +0200, "Erich Titl"
> <erich.titl@...> said:
>
> Quite so. That's esentially what I found out from a message reply by
> Charles re Dachstein in searching the message base. Thing is, I've been
> running Linux for over 5 years. In the versions of modutils I use,
> derived from LFS, such things can be assigned by "alias eth1 3c59x" for
> example. I never ran across the "default case" before and didn't know
> it. If one HASN'T run across this before, then one needs to know it,
> since Bering doesn't seem to use aliases in its /etc/modules file. (MY
> firewall uses a modem, and Bering-1.2, because dialup is all I can
> afford.) I'm just suggesting that a few sentences like you wrote in the
> documentation would have been a big help, because I was stuck!

Oh I see, well I suppose you could look into the way the network gets
initialized. Basically the loading of the network drivers automagically
creates devices. MOdprobe does the aliasing for you, but it is not
implemented in LEAF.

I found this interesting snippet

>>>>>>>>>>>>>
The first thing you need in your modules.conf file is something to tell
modprobe what driver to use for the eth0 (and eth1 and...) network
interface. You use the alias command for this. For example, if you have
an ISA SMC EtherEZ card which uses the smc-ultra.o driver module, you
need to alias this driver to eth0 by adding the line:

alias eth0 smc-ultra

Important Note: The alias above is only used by the module utilities to
translate a generic device name (e.g.eth0) into a hardware specific
driver module name. When the driver loads, it never even sees this
alias; instead it will simply choose the first free ethN (N=0,1,2,...)
device name available. Thus, if more than one ethernet module is being
loaded, the ethN assigned to the driver by the kernel may or may not be
the same as the one given on the alias line,
>>>>>>>>>>>>>>>

So you may never have seen this, because you never had multiple
instances of the same card in your other *x systems.

Actually it might not be that difficult to mimic the alias in Bering
uClibc. We have the ip link command which allows us to assign whaever
name we want to a specific NIC

[root@tristan]# ip link set dev eth0 name inside
[root@tristan]# ip link show dev inside
2: inside: <BROADCAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:80:c8:f8:4a:51 brd ff:ff:ff:ff:ff:ff

All that is left now is to determine which NIC will get which name,
which is not that obvious when you take the above snippet into
consideration.

What you can do is read the /etc/modules file for alias ethx lines, sort
them and then load the drivers in that order, preferrably after all
dependencies have been resolved :-)

cheers

Erich

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

IPV6

2009-10-11T20:14:55Z

Hi folks,

I'm running out of hair to pull trying to get IPV6 working on my beta 3.1.1
Leaf box. I've set everything up as it would seem should be setup and yet, no
go. I've used freenet6.lrp to acquire a /56 prefix which works flawlessly. I
can ping6 any IPV6 host out there from the Leaf box ONLY! I have a subnet
assigned to eth0, my lan, with proper routes and addresses including a correct
default route. I've also setup radvd to annouce on eth0 and all the local
hosts do indeed get automagically configured and can ping6 each other and the
Leaf box, but nothing beyond. I've obviously setup forwarding, shorewall and
6wall rules but alas, it doesn't fly. It must be something incredibly obvious
that I can't see it. HELP :)

Regards,

pgm

------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Net-snmpd leaks memory

2009-09-22T23:17:51Z

Hi Folks

More a nuisance than anything else. I was observing a loss of free
memory on our systems over time, the culprit appears to be the snmpd
process. Googling around revealed I was not alone. It appears that there
are a number of fixes in more recent net-snmpd versions which address
memory leaks.

Right now I just restart the snmpd process daily, but in the long run I
will have to address this.

cheers

Erich

------------------------------------------------------------------------------
Come build with us! The BlackBerry® Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9-12, 2009. Register now!
http://p.sf.net/sfu/devconf
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

wget and --postdata

2009-09-20T18:20:11Z

Hello,

[First: thanks to all the developers, I have just moved to 3.1.1beta3 and
everything (except for my own fat fingers/brain) has worked just fine.]

My problem is:

1. I have a cable plan that will, if I break the 'cap' start charging me
punitively. I want to avoid that.
2. I like to run a fairly open wireless environment for my friends,
family and guests.

My proposed solution is to make my LEAF box:

1. Look up the usage statistics for my account
2. Apply traffic shaping (or selective turning-off) to stay smoothly
within the 'cap'

I looked at the usage meter, and it turns out that it is protected by a
https login page and sessionID cookies. Tricky.
So, I installed wget-ssl (thanks for that too!) and tried this beginning
script:

breaker# wget --post-data='password=\[mypasswd]&Action=login' \
--save-cookies=mycookies.txt \
--keep-session-cookies \
https://[usagepageURL]/?username=[myusername]

unfortunately, it gives me:
wget: unrecognized option `--post-data=password=volley12&Action=login'
Usage: wget [OPTION]... [URL]...

I suppose because --postdata is not compiled into this wget (Version:
1.8.2-11 Rev 1 uClibc 0.9.28) or because it wasn't available back then?

Questions:
Am I going about this in a sensible way? and
Is there a wget-ssl that does --postdata?

Many thanks again,

Sam
------------------------------------------------------------------------------
Come build with us! The BlackBerry® Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9-12, 2009. Register now!
http://p.sf.net/sfu/devconf
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

How to update snort rules for the snort package

2009-09-04T02:28:12Z

Hi All
Are there anyone using the snort.lrp package. If so you do you keep the
rules up to date?
Thank you.
Huy

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Webconf Access Control

2009-08-20T14:06:48Z

Am Donnerstag, 20. August 2009 17:48:29 schrieb n22e113:

As I wrote - "the information on the page is wrong". Will be corrected for a
future release.

> The above is correct because Linux and open source
> are all about choices. Users in our case are only allowed to access webconf
> from inside our private LAN. Admins/Users shall all have the ability to
> decide what level of security of Webconf access for a particular
> installation. The information on the page also correctly states: "While it
> provides some protection, please note that the passwords are sent over the
> network in clear text."
>

IMHO the target audience for webconf is the home user who does not take care
about security and more than a default setup. Therefor forcing them to choose
a login password is following the line "better safe than sorry".
Admins usually use the shell based configuration, which is a lot mor flexible
and secure.

kp

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Webconf Access Control

2009-08-20T13:59:19Z

> If you don't like this behaviour, as you said it is open source, you can
> look into
>
> /var/webconf/lib/preamble.sh for
>
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
> <html>
> <head>
> $( /var/webconf/lib/passcheck.sh )
> <title>Bering LEAF Firewall</title>
> <link rel="stylesheet" type="text/css" href="/webconf.css">
> </head>
>
> either remove the call to passcheck or extend it to look for a
> configuration option (and if so feed back). If you want my honest
> opinion... just use credentials...
> :-)
>

Thanks! All I need is to remove the line:
$( /var/webconf/lib/passcheck.sh )
which is not part of the v3.1 distro!
Cheers, ;-0

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Webconf Access Control

2009-08-20T09:35:06Z

n22e113 wrote:

>>> While testing leaf v3.1.1-beta3, I am stuck at the page using firefox:
>>> http://192.168.1.210/wc-passwd.cgi
>>> Except for the "General Health" and "Active Connections" pages. Leaving
>>> both Username and Password blank and hitting the |Apply| button will only
>>> get me back to the same page? If Username=admin and Password=blank and
>>> hitting the |Apply| button, the web page will transfer data forever?
>>> Thanks!
>> It's not obvious and the information on the page is wrong: Please add a
>> password!
>> It's pretty unsecure to use webconf without password andf therefor not
>> allowed.
>>
> But from the page "Webconf authentication":
> "To completely disable authentication, leave the fields for username as well as password blank."
> The above is correct because Linux and open source are all about choices. Users in our case are only allowed to access webconf from inside our private LAN. Admins/Users shall all have the ability to decide what level of security of Webconf access for a particular installation. The information on the page also correctly states:
> "While it provides some protection, please note that the passwords are sent over the network in clear text."

That depends, I never allow http access :-) only https

If you don't like this behaviour, as you said it is open source, you can
look into

/var/webconf/lib/preamble.sh for

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
$( /var/webconf/lib/passcheck.sh )
<title>Bering LEAF Firewall</title>
<link rel="stylesheet" type="text/css" href="/webconf.css">
</head>

either remove the call to passcheck or extend it to look for a
configuration option (and if so feed back). If you want my honest
opinion... just use credentials...

:-)

Erich

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Webconf Access Control

2009-08-20T08:48:29Z

>> While testing leaf v3.1.1-beta3, I am stuck at the page using firefox:
>> http://192.168.1.210/wc-passwd.cgi
>> Except for the "General Health" and "Active Connections" pages. Leaving
>> both Username and Password blank and hitting the |Apply| button will only
>> get me back to the same page? If Username=admin and Password=blank and
>> hitting the |Apply| button, the web page will transfer data forever?
>> Thanks!
>
> It's not obvious and the information on the page is wrong: Please add a
> password!
> It's pretty unsecure to use webconf without password andf therefor not
> allowed.
>

But from the page "Webconf authentication":
"To completely disable authentication, leave the fields for username as well as password blank."
The above is correct because Linux and open source are all about choices. Users in our case are only allowed to access webconf from inside our private LAN. Admins/Users shall all have the ability to decide what level of security of Webconf access for a particular installation. The information on the page also correctly states:
"While it provides some protection, please note that the passwords are sent over the network in clear text."

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Webconf Access Control

2009-08-20T03:13:39Z

Am Donnerstag, 20. August 2009 11:52:02 schrieb n22e113:
> While testing leaf v3.1.1-beta3, I am stuck at the page using firefox:
> http://192.168.1.210/wc-passwd.cgi
> Except for the "General Health" and "Active Connections" pages. Leaving
> both Username and Password blank and hitting the |Apply| button will only
> get me back to the same page? If Username=admin and Password=blank and
> hitting the |Apply| button, the web page will transfer data forever?
> Thanks!

It's not obvious and the information on the page is wrong: Please add a
password!
It's pretty unsecure to use webconf without password andf therefor not
allowed.

kp

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Webconf Access Control

2009-08-20T02:52:02Z

While testing leaf v3.1.1-beta3, I am stuck at the page using firefox:
http://192.168.1.210/wc-passwd.cgi
Except for the "General Health" and "Active Connections" pages. Leaving both Username and Password blank and hitting the |Apply| button will only get me back to the same page? If Username=admin and Password=blank and hitting the |Apply| button, the web page will transfer data forever? Thanks!

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

TUNO 2.6 kernel - some feedback

2009-08-19T20:19:26Z

I've been testing the 2.6 kernel. Nice!

To the developers:

I don't think you're wasting your time. I very much appreciate your efforts (I read that old thread). I think you should put TUNO on the main page, even if it's "alpha".

Some issues:

busybox 1.12.1:

insmod does not search /lib/modules or /lib/modules/`uname -r`.

I tried 1.12.4, no difference.

Running under vmware workstation 6.5 in linux:

The clock can slow down drastically, about 3-4 seconds for every one second. No amount of fiddling helped (acpi=off, clock=whatever). So I added VMI to the kernel config. Problem solved.

[*] Paravirtualized guest support --->
--- Paravirtualized guest support
[*] VMI Guest support
[ ] Lguest guest support

Size increase: 20,128 bytes - uncompressed.

I can't get the UPX kernel working under VMware:

*** Virtual machine kernel stack fault (hardware reset) ***

Other matters:

Is there a debate on whether or not it should fit on a floppy? If it's possible, why not, otherwise why bother? I know some people like to write protect their floppies. If you get hacked in, just reboot. Nevertheless, I think the floppy holds back the project more than it helps. Some people believe Leaf is a floppy distro and won't touch it for that reason. Obviously it can run on anything. Just my $.02.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Kernel crash with vlan on Bering 3.1 Kernel 2.4.34

2009-08-13T10:00:03Z

I'm not using the vlan package only the 8021q module with a static config so that makes sense.

-----Original Message-----
From: Erich Titl [mailto:erich.titl@...]
Sent: Wednesday, August 12, 2009 11:40 PM
To: Dillabough, Dave
Cc: leaf-user@...
Subject: Re: [leaf-user] Kernel crash with vlan on Bering 3.1 Kernel 2.4.34

Hi Dave

Dillabough, Dave wrote:
> Hi Erich,
>
> It is working for me with 2.4.34 in one office and on my test LAN. I will be rolling it out in 12 other offices in the next month or so. Here is my configuration.
>
> From /etc/interfaces
>

Thanks for the info, after a few hours debugging the vlan driver I
figured something out, it appears that the 8021q module conflicts with
the vlan module, don't ask me why Anyway after loading only 8021q the
problem appears to be gone.

cheers

Erich

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Kernel crash with vlan on Bering 3.1 Kernel 2.4.34

2009-08-12T23:39:43Z

Hi Dave

Dillabough, Dave wrote:
> Hi Erich,
>
> It is working for me with 2.4.34 in one office and on my test LAN. I will be rolling it out in 12 other offices in the next month or so. Here is my configuration.
>
> From /etc/interfaces
>

Thanks for the info, after a few hours debugging the vlan driver I
figured something out, it appears that the 8021q module conflicts with
the vlan module, don't ask me why Anyway after loading only 8021q the
problem appears to be gone.

cheers

Erich

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Kernel crash with vlan on Bering 3.1 Kernel 2.4.34

2009-08-12T09:43:02Z

Hi Erich,

It is working for me with 2.4.34 in one office and on my test LAN. I will be rolling it out in 12 other offices in the next month or so. Here is my configuration.

>From /etc/interfaces

# Step 2: configure internal interface
auto eth1
iface eth1 inet static
address 192.168.101.254
netmask 255.255.255.0
broadcast 192.168.101.255
vlan_raw_device eth1

# Add VLANS
auto eth1.5
iface eth1.5 inet static
address 192.168.201.254
netmask 255.255.255.0
broadcast 192.168.201.255
vlan_raw_device eth1
up echo 1 > /proc/sys/net/ipv4/conf/eth1.5/arp_filter
up echo 2 > /proc/sys/net/ipv4/conf/eth1.5/arp_ignore
up echo 1 > /proc/sys/net/ipv4/conf/eth1.5/rp_filter

ip addr shows

4: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:40:63:ef:c4:b1 brd ff:ff:ff:ff:ff:ff
inet 192.168.101.254/24 brd 192.168.101.255 scope global eth1
6: eth1.5: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue
link/ether 00:40:63:ef:c4:b1 brd ff:ff:ff:ff:ff:ff
inet 192.168.201.254/24 brd 192.168.201.255 scope global eth1.5

The tagged VLAN is being used for public Internet access in a few meeting rooms and with a WiFi access point. I am using HP 2600 series switches to tie it all together.

The LEAF hardware is a VIA Mini-ITX EK10000G which uses the via-rhine driver. I also have a couple of Intel boards in the system which use the eepro100 driver but I am only using VLANs on the via-rhine interface.

The system has been in place for about 2 months without issues with light loading.

Let me know if you need any other details.

Dave

-----Original Message-----
From: Erich Titl [mailto:erich.titl@...]
Sent: Wednesday, August 12, 2009 5:10 AM
To: leaf-user@...
Subject: [leaf-user] Kernel crash with vlan on Bering 3.1 Kernel 2.4.34

Hi folks

has anyone successfully used vlan tagging on the above mentioned release.

I have the folowing set up on a WRAP with natsemi interfaces

################################################################
#
# eth2 / Fixed IP
#
auto eth2
iface eth2 inet static
address 10.250.21.1
netmask 255.255.255.0
################################################################
# end of generated interface file
################################################################
auto eth2.34
iface eth2.34 inet static
address 192.168.223.1
netmask 255.255.255.0
################################################################

So eth2 is untagged while eth2.34 is a tagged interface

it shows up like

5: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:0d:b9:00:80:42 brd ff:ff:ff:ff:ff:ff
inet 10.250.21.1/24 scope global eth2
6: ipsec0: <NOARP> mtu 0 qdisc noop qlen 10
link/void
7: ipsec1: <NOARP> mtu 0 qdisc noop qlen 10
link/void
8: ipsec2: <NOARP> mtu 0 qdisc noop qlen 10
link/void
9: ipsec3: <NOARP> mtu 0 qdisc noop qlen 10
link/void
10: eth2.34: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue
link/ether 00:0d:b9:00:80:42 brd ff:ff:ff:ff:ff:ff
inet 192.168.223.1/24 scope global eth2.34

so basically it looks like the vlan tagging is enabled and working, but
as soon as I try to use the eth2.34 interface, for example to ping a
station on that vlan like 192.168.223.11 the kernel panics with a NULL
pointer dereference.

STYX# ping 192.168.223.11
PING 192.168.223.11 (192.168.223.11): 56 data bytes
Unable to handle kernel NULL pointer dereference at virtual address 0000003c
*pgd = 0
*pmd = 0
Oops: 0000
CPU: 0
EIP: 0010:[<c48c31ae>] Not tainted
EFLAGS: 00010206
eax: 00000000 ebx: 00000022 ecx: c391af00 edx: c48c5af4
esi: 00000000 edi: 00000081 ebp: 00000040 esp: c0229f0c
ds: 0018 es: 0018 ss: 0018
Process swapper (pid: 0, stackpage=c0229000)
Stack: c37bd81e c48c41b2 00000000 00000022 c391af00 00000000 00000081
00000040
c01920c3 c391af00 00000000 c48c5af4 c345e000 c0226b28 00000000
c019215b
c391af00 00036ca3 c0226bf0 c0226b28 00036ca3 00000046 c0192242
c0226b28
Call Trace: [<c48c41b2>] [<c01920c3>] [<c48c5af4>] [<c019215b>]
[<c0192242>]
[<c0121df2>] [<c011492c>] [<c0111c0e>] [<c01167b8>] [<c0111c0e>]
[<c0110018>]
[<c0111c31>] [<c0111c89>] [<c01039c7>] [<c0110199>]

Code: ff 70 3c e8 65 ff ff ff 89 c2 31 c0 85 d2 59 74 07 0f b7 c3
<0>Kernel panic: Aiee, killing interrupt handler!
In interrupt handler - not syncing

Thanks for pointers

Erich

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Kernel crash with vlan on Bering 3.1 Kernel 2.4.34

2009-08-12T05:09:44Z

Hi folks

has anyone successfully used vlan tagging on the above mentioned release.

I have the folowing set up on a WRAP with natsemi interfaces

################################################################
#
# eth2 / Fixed IP
#
auto eth2
iface eth2 inet static
address 10.250.21.1
netmask 255.255.255.0
################################################################
# end of generated interface file
################################################################
auto eth2.34
iface eth2.34 inet static
address 192.168.223.1
netmask 255.255.255.0
################################################################

So eth2 is untagged while eth2.34 is a tagged interface

it shows up like

5: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:0d:b9:00:80:42 brd ff:ff:ff:ff:ff:ff
inet 10.250.21.1/24 scope global eth2
6: ipsec0: <NOARP> mtu 0 qdisc noop qlen 10
link/void
7: ipsec1: <NOARP> mtu 0 qdisc noop qlen 10
link/void
8: ipsec2: <NOARP> mtu 0 qdisc noop qlen 10
link/void
9: ipsec3: <NOARP> mtu 0 qdisc noop qlen 10
link/void
10: eth2.34: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue
link/ether 00:0d:b9:00:80:42 brd ff:ff:ff:ff:ff:ff
inet 192.168.223.1/24 scope global eth2.34

so basically it looks like the vlan tagging is enabled and working, but
as soon as I try to use the eth2.34 interface, for example to ping a
station on that vlan like 192.168.223.11 the kernel panics with a NULL
pointer dereference.

STYX# ping 192.168.223.11
PING 192.168.223.11 (192.168.223.11): 56 data bytes
Unable to handle kernel NULL pointer dereference at virtual address 0000003c
*pgd = 0
*pmd = 0
Oops: 0000
CPU: 0
EIP: 0010:[<c48c31ae>] Not tainted
EFLAGS: 00010206
eax: 00000000 ebx: 00000022 ecx: c391af00 edx: c48c5af4
esi: 00000000 edi: 00000081 ebp: 00000040 esp: c0229f0c
ds: 0018 es: 0018 ss: 0018
Process swapper (pid: 0, stackpage=c0229000)
Stack: c37bd81e c48c41b2 00000000 00000022 c391af00 00000000 00000081
00000040
c01920c3 c391af00 00000000 c48c5af4 c345e000 c0226b28 00000000
c019215b
c391af00 00036ca3 c0226bf0 c0226b28 00036ca3 00000046 c0192242
c0226b28
Call Trace: [<c48c41b2>] [<c01920c3>] [<c48c5af4>] [<c019215b>]
[<c0192242>]
[<c0121df2>] [<c011492c>] [<c0111c0e>] [<c01167b8>] [<c0111c0e>]
[<c0110018>]
[<c0111c31>] [<c0111c89>] [<c01039c7>] [<c0110199>]

Code: ff 70 3c e8 65 ff ff ff 89 c2 31 c0 85 d2 59 74 07 0f b7 c3
<0>Kernel panic: Aiee, killing interrupt handler!
In interrupt handler - not syncing

Thanks for pointers

Erich

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Write Protect

2009-08-11T10:48:34Z

On Mon, 2009-08-10 at 13:02 -0700, Mike Noyes wrote:

> On Mon, 2009-08-10 at 14:39 -0500, Ralph Green wrote:
> > This is pretty interesting. I thought no one was making them with
> > write protect anymore. I have been using a USB to SD card adapter and
> > SD cards, because the SD cards usually have a write protect switch.
> > Now, I wonder if any of these write protectable USB drives use good NAND
> > memory. Most of them these days are MLC(junk), instead of SLC. None of
> > the drives in this list said anything in their specs about the type of
> > flash chips they are using. Do you know any that use SLC(Single Level
> > Cell) and have a write protect switch? If they were close to reasonably
> > priced, I'd have to go buy a few.
>
> Ralph,
> I suggest you contact Kanguru and Imation directly, and ask them about
> the NAND memory they use.

-snip-

Ralph,
>From what I can tell, it looks like the Imation Pivot and Kanguru
Defender Pro use SLC.

http://www.google.com/search?q=Imation+Pivot+NAND+SLC
http://www.imation.com/en/Imation-Products/USB-Flash-Drives--Accessories/Pivot-Flash-Drive/

http://www.google.com/search?q=Kanguru+Defender+Pro+NAND+SLC
http://www.kanguru.com/defenderpro.html

--
Mike Noyes <mhnoyes at users.sourceforge.net>
http://sourceforge.net/users/mhnoyes/
SF.net Projects: leaf, sourceforge/sitedocs

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Write Protect

2009-08-11T09:27:32Z

On Tue, 2009-08-11 at 08:53 -0700, Paul Rogers wrote:
> > Write protected hardware requires physical access to the LEAF box. A
> > software write protect has the advantage that you can set and unset the
> > read and write access to the boot media with putty, ssh. I use two
>
> If you can, then somebody else can. Ultimately, there's no software
> scheme that can provide the surety of a well-engineered hardware
> protection. Is what you're protecting important enough to go lay
> hands on the box?

Paul,
In many situations it's not practical to perform on-site maintenance on
a client's machine. Each level of write protection has advantages and
disadvantages.

--
Mike Noyes <mhnoyes at users.sourceforge.net>
http://sourceforge.net/users/mhnoyes/
SF.net Projects: leaf, sourceforge/sitedocs

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Write Protect

2009-08-11T08:53:48Z

> Write protected hardware requires physical access to the LEAF box. A
> software write protect has the advantage that you can set and unset the
> read and write access to the boot media with putty, ssh. I use two

If you can, then somebody else can. Ultimately, there's no software
scheme that can provide the surety of a well-engineered hardware
protection. Is what you're protecting important enough to go lay
hands on the box?
--
Paul Rogers
paulgrogers@...
http://www.xprt.net/~pgrogers/
Rogers' Second Law: "Everything you do communicates."
(I do not personally endorse any additions after this line. TANSTAAFL :-)

--
http://www.fastmail.fm - Send your email first class

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Project Admin

2009-08-11T07:36:21Z

I used LEAF from version 2.x on an IDE flash adapter since my first
installation, using Eric's instructions. Thanks, Eric! To persuade my
first flash to boot was a long lasting pain for me, especially the boot
process, but it was worth every minute of it. Later, moving on to a real
solid state platform, like Soekris, was another effort with a serial
console. PC Engines WRAP board gave me some more trouble than Soekris.
But all of it was rewarded with a great feeling thet there are no
mechanical parts involved and that the power consumption was only about
4W. Today, setting up a flash installation, either into a CF or into a
DoM module, is a breeze. Especially on mini-ITX boards with VGA consoles.

Therefore I warmly recommend moving into the flash world.

Using well documented LEAF procedures from the Net, setup can be saved
into a different partition on a flash, for more security. Removing IDE
or SCSI drivers from RAM disk enables the flash installation to be less
accessible to an intruder. And keeping the installation in a RAM disk
prevents the flash from wearing out by frequent writing to it.

Moving into flashes, enables also more sophisticated applications on the
LEAF platform. I am still using Dansguardian, which is free licensed for
home use, on 2.x platform and I am sorry it has not been compiled for
3.x platform. On another box I am running a remote NAS through OpenVPN,
all running from flash. Here I'd appreciate if Power Management module
was available for the kernel in LEAF. Yet another LEAF box serves me as
a solid state web server.

LEAF in a flash is a brilliant platform.

:-)

Tom

======== snip ===================

>> I'm interested in the CF media or moving off old PC platforms to
something
> > like the Alix platform. But that is a lot of hardware/low level software
> > learning curve.

======== snip ===================

======== snip ===================

>> do not misinterpret me, I wrote an early HOWTO about using secure flash
>> disks for leaf :-( and yes, I agree, I live easily with the flash memory
>> world.
>>
>> There are 2 main things that are different from a floppy
>>
>> - size
>> - write protection
>>
>> In my eyes, the write protection is the more important factor. There
>> have been multiple attempts to solve this, amongst it unloading the
>> device driver.

======== snip ===================

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Write Protect

2009-08-11T06:42:30Z

On Mon, 2009-08-10 at 19:40 -0700, Victor McAllister wrote:
> On Mon, 2009-08-10 at 09:27 -0700, Mike Noyes wrote:
> >> You can obtain a write protect hardware option fairly easy now. It's not
> >> like it was seven years ago, when a hardware hack (ADM module using the
> >> LD017 controller chip) was necessary.
> >>
> >> http://reviews.cnet.com/usb-flash-drives/?filter=502909_14791771_
> >>
> Write protected hardware requires physical access to the LEAF box.

Victor,
Indeed.

> A software write protect has the advantage that you can set and unset
> the read and write access to the boot media with putty, ssh. I use two
> scripts loaded by local.lrp. Granted this is a little cumbersome
> because you have to keep a copy of three modules on your desktop
> machine and scp / winscp them over as needed. If you command a reboot,
> the machine is restored to read write status since the scripts are
> only run manually via ssh.

Please commit your script to our cvs repository. Thanks.

> **************
> #! /bin/ash
> # rm-ide by Victor McAllister
> # This script removes modules to prevent
> # access to the boot media - CF ide disk
> echo
>
> MODULES="ide-disk ide-detect ide-core"
> BOOTDIR="/boot/lib/modules"
> LIBDIR="/lib/modules"
>
> for MODULE in ${MODULES}
> do
> rmmod ${MODULE}
> rm ${BOOTDIR}/${MODULE}.o
> rm ${LIBDIR}/${MODULE}.o
> done
> echo
> echo "The modules needed for IDE access are not plugged into"
> echo "the kernel or located in the TWO modules directories."
> echo
> echo "The Compact Flash is NOT accessible."
>
> ########
>
> #! /bin/sh
> # load-ide by Victor McAllister
> #
> echo "Ths script installs ide modules to access Compact Flash"
> echo "First copy the files ide-core.o ide-dectect.o ide-disk.o"
> echo "using SCP to the /lib/modules directory."
> echo
>
> MODULES="ide-core ide-detect ide-disk"
> LIBDIR="/lib/modules"
> BOOTDIR="/boot/lib/modules"
>
> for MODULE in ${MODULES}
> do
> insmod ${MODULE}
> cp ${LIBDIR}/${MODULE}.o ${BOOTDIR}/${MODULE}.o
>
> done
>
> if (lsmod | grep ide-)
> then
>
> echo
> echo "Mount the CF possibly using: mount -t msdos /dev/hda1 /mnt"
> echo
> echo "modules necessary are also in /boot/lib/modules"
> echo "for possible backing up your configuration."
>
> else
> echo
> echo "IDE modules not loaded - CF drive not accessible."
> echo "Did you forgot to SCP the files to /lib/modules?"
> fi
>
> #######

--
Mike Noyes <mhnoyes at users.sourceforge.net>
http://sourceforge.net/users/mhnoyes/
SF.net Projects: leaf, sourceforge/sitedocs

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

Re: Write Protect

2009-08-11T01:39:59Z

Gordon Bos wrote:

> Victor McAllister wrote:
>
>> Write protected hardware requires physical access to the LEAF box. A
>> software write protect has the advantage that you can set and unset the
>> read and write access to the boot media with putty, ssh. I use two
>> scripts loaded by local.lrp. Granted this is a little cumbersome because
>> you have to keep a copy of three modules on your desktop machine and
>> scp / winscp them over as needed. If you command a reboot, the machine
>> is restored to read write status since the scripts are only run manually
>> via ssh.
>>
>
> I'm kind of puzzled why you would not run the delete script at boottime.
> How can you be sure that the system won't reboot without you knowing it?
>

uptime 473 days

if I do an uptime and it says 1 day - I will investigate why.
(I use a WRAP with a 12 volt battery connected via diodes in parallel
with the power supply. The dsl modem and switches are on a UPS. If the
AC goes down, my network connection stays up for several hours so
laptops can still have access. That is why the LEAF stays up even when
the power goes down several times a year.).

I only need to SCP the modules over to back up a configuration change.
The files necessary for boot are still on the boot media, just not in
ram. As you say, no security is perfect. Someone who reads this post, if
they could break in, could figure out what modules to bring along. They
would need SSH access which is only open to specific public IPs.

> Statements as to computer security have been around since the early
> days. "No system is ever really secure". "If you want to make a system
> completely secure, you should enclose it in concrete and drop it in the
> ocean". "All barriers fail if someone can get physical access to the
> system".
>
> Which roughly translates in that the highest level of security is
> reached by a system that is console operated only (and not connected to
> other computers, but that's not an option in this case). In regards to
> LRP and LEAF I've always respected that rule and never added any remote
> access to the box. No ssh, no https.
>
> Gordon
>

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/