Archive for Misc

5 results.

Strongswan GRE IPSec and OSPF (Bird)

Oct17
by Frank on October 17, 2017 at 07:17
Posted In: Misc, Professional / IT

OK, so I finally got Strongswan with a GRE over IPSec tunnel and OSPF (BIRD) running on Centos 6

Two remote sites are connected to the main site via Metro-Ethernet. In case of the Metro failing, the idea is to establish backup connectivity over the Internet via secure VPN tunnels. That poses a few problems: IPSec alone doesn’t play well with routing protocols (OSPF in my case), which is why we need GRE over IPSec. I chose “Strongswan” for IPSec on Centos 6 – the Centos 6 was already in place and I didn’t want to first update everything to Centos 7.

Note, Centos 6 uses iproute2, which does not support VTI interfaces 🙁

A “few” caveats that the usual how-to docs don’t quite seem to address:

  • make sure your ipsec.conf is in “transport” mode, not “tunnel”, or you’re in a world of pain nailing your GRE on it. Mind you, GRE will still come up if you do things wrong, but it won’t be encrypted! And of course the only way to see that is via packet capture on/past the switch port (yay switch port mirrors!)
  • The above will also help solve the issue of “left/rightsubnet” being “0.0.0.0/0” in both tunnels – you don’t need to specify left/rightsubnet in the conn section of ipsec.conf
    (Two “tunnel” tunnels with left/rightsubnet 0.0.0.0/0 easily results in that you can only ping across the tunnel that came up last. And I couldn’t get the mark/key options of ‘tunnel’/’ipsec.conf’ to work right)
  • Once your tunnel is up and you can ping across it, OSPF might still not come up at all. I saw “OSPF HELLO” packets leave, but they never arrived at the other side. Wireshark to the rescue (via mirrored switch port) and lo and behold – the TTL is “1”, which is a tad small. Bring up your tunnel interface with “ip tunnel add… ttl=64“

    • While all this might be “obvious” to people who’ve “been there” before, it wasn’t obvious to me and my google-fu totally failed for quite a while. I hope this helps others (and future-me).

    2 Comments

    Cisco ASA “minimal” config

    Oct06
    by Frank on October 6, 2015 at 10:03
    Posted In: Misc, Professional / IT

    I’m currently trying to make friends with Cisco ASAs, and I keep forgetting things. Here’s a “minimal” config – create a key for future ssh access, a user/pass for any type of access, and enable http (and from where you accept https connections) for ASDM access

    crypto key generate rsa modulus 1024
    username password privilege 15
    http server enable
    http (for instance: http 10.1.2.3 255.255.255.255 outside)

    Once you’re in with ADSM, don’t forget
    Config -> Device Management -> Users/AAA -> AAA Access
    – Authentication Tab: check ‘Enable’ in the ‘Require auth to allow use’ at the top
    – Authentication Tab: check ‘SSH’
    – Authorization Tab: check ‘Enable Server Group…’

    Configuration > Device Management > Management Access > ASDM/HTTPS/Telnet/SSH
    – add “asdm/https” and “ssh” IP/netmask as needed

    And don’t forget to hit “Apply” and then also “Save”

     Comment 

    NTP Reflector DoS

    Jan02
    by Frank on January 2, 2014 at 05:51
    Posted In: Misc

    Oh come on!!! After we finally start to fix the DNS reflector exploits, we now have to deal with NTP?!

    In a nutshell, to test, enter this command:
    ntpdc -n -c monlist 127.0.0.1
    If you get anything useful as a reply, you should fix your server.

    To fix, add this to your /etc/ntp.conf:
    disable monitor

    Full article:
    https://isc.sans.edu/forums/diary/NTP+reflection+attack/17300

    Scary part: It seems that possibly Juniper routers enable an old ntp server together with the ntp client. Yes… that means exactly *that* 🙁

     Comment 

    OMSA, CentOS 6.4 64 bit, and Perc4 controller

    Sep19
    by Frank on September 19, 2013 at 12:17
    Posted In: Misc

    I have a few Dell 2850s at work, happily installed CentOS 6.4 64-bit, but want to also install Dell’s OpenManage so I can see if the Perc4 controller acts up or if drives die. First off, the latest version of OMSA (7.x) doesn’t support Perc4 controllers anymore. Older versions sure ain’t using 64 bit. Google pretty much tells me that you can’t do it.

    This is an attempt at documenting how to do it. It may not work for you, it may not work for future Centos/RHEL releases.

    First off, “be root”, then yum install rsync createrepo
    Then rsync Dell’s OMSA6.1 repo. OMSA 6.1 works for me, I don’t know if 6.2/6.3 would work as well.
    Find a place for the repo. I chose “/root/DellRepo”. As root:
    cd
    mkdir DellRepo
    cd DellRepo
    rsync -avHz linux.dell.com::repo/hardware/OMSA_6.1 .

    Get rid of the suse folders. I don’t know enough about how yum works, but it WILL try to install from them. Also, create the repodata stuff.
    find . -name *suse1*_64 -exec rm -rf {} \;
    cd OMSA_6.1
    createrepo --verbose `pwd`

    Get coffee. This might take a bit.

    Create a repo entry for yum.
    vi /etc/yum.repos.d/local-dell.repo

    [local-6.1]
    name=local Dell OMSA repository – Hardware independent
    #type=rpm-md
    baseurl=file:///root/DellRepo/OMSA_6.1
    gpgcheck=1
    enabled=1

    We need libcurl, 32 bit version. We actually need version 3, but we can’t get that anymore, so we’ll have to fake it. I suggest installing the 64 bit version so we know the name of the current version – and then we can derive the 32-bit package name for it. As of this writing, I had libcurl-7.19.7-37.el6_4.x86_64, therefore I did
    yum install libcurl-7.19.7-37.el6_4.i686

    Now we fake having curl3:
    cd /usr/lib
    ln -s libcurl.so.4.1.1 libcurl.so.3
    ln -s libcurl.so.4.1.1 libcurl.so.3.0.0

    If you were to do a “yum install srvadmin-all”, it would still not work. Boo. Dependency issues. It doesn’t “see” our libcurl. I don’t care 😉

    I force-install what fails (remember, I have a 2850 – you may need to go to a different directory). One of the failures is srvadmin-wsmanclient, but I also want to yum-install the dependencies that actually do install properly before I do an “rpm -Ihv –nodeps”. basically I do a “yum install srvadmin-wsmanclient” followed by “yum install ” until nothing is shown in the dependencies other than the failing libcurl.
    cd ~/DellRepo/OMSA_6.1/pe2850/rh50_64/srvadmin
    yum install srvadmin-omcommon srvadmin-omauth
    yum install libsepol.i686 openssl098e.i686
    rpm -Uhv --nodeps ./srvadmin-wsmanclient-6.1.0-648.rhel5.i386.rpm

    There’s another similar beast, srvadmin-ssa and cimserver:
    cd ~/DellRepo/OMSA_6.1/platform_independent/rh50_64/extra_deps
    yum install srvadmin-omhip srvadmin-omacore srvadmin-isvc srvadmin-syscheck srvadmin-hapi srvadmin-deng

    Be careful, if “rpm -Uhv sblim-sfcb-1.3.2-17.1.rhel5.i386.rpm” tells you about conflicts with the 64 bit version because you have it installed from back when you trusted the Dell installer script, just don’t bother re-installing it. Looks like it’s the same stuff anyway. “yum install srvadmin-ssa” should only depend on it and the libcurses by now.
    rpm -Uhv sblim-sfcb-1.3.2-17.1.rhel5.i386.rpm --nodeps
    cd ~/DellRepo/OMSA_6.1/pe2850/rh50_64/srvadmin
    rpm -Uhv srvadmin-ssa-6.1.0-648.rhel5.i386.rpm --nodeps

    And NOW, FINALLY you can do
    yum install srvadmin-all
    yum install OpenIPMI (that should be the CentOS/RHEL version!!!)

    cd /etc/rc.d/init.d/
    ./instsvcdrv start
    ./dataeng start
    ./dsm_om_connsvc start
    ./dsm_om_shrsvc start
    ./mptctl start
    firefox https://localhost:1311/

    “dataeng” takes forever to come up. Do not despair. Patience…

    Time for a drink. Sadly, as I’m at work, it’ll be lunch instead.

    iptables floods /dev/console

    Jul19
    by Frank on July 19, 2012 at 12:28
    Posted In: Misc

    I finally dug into why iptables’ LOG option floods /dev/console. Of course it also logs to /var/log/messages, but that’s what I want.

    The trick seems to be to tell klogd to not regurgitate everything to the console.
    In CentOS/Fedora/etc:
    vi /etc/sysconfig/syslog and add these to the "-c 1" to KLOGD_OPTIONS

    My line now reads: KLOGD_OPTIONS="-x -c 1"

     Comment