@Psycogeek I heard popcorn should be eaten when if movie you are to watch, is action packed and doesn't require thinking from you I.e. turn off your brain movie.
@Boris_yo ahh i got the whole bucket gone before they get done announcing all the productions companies and distribution logos, and the next releace trailers.
you want the Linux box to go out on the public internet, connect to a VPN owned by someone else ("the cloud"), then connect to that VPN from elsewhere?
Eventual goal: the user won't be able to tell the difference between being inside the main network and being at their network, in regards to shared drives in the My Computer window
OpenVPN is an open source project that's just a source code tarball that you download and install, and configure files in /etc, like any other open source project
OpenVPN Access Server is a web admin interface (and client connection interface) wrapper around the OpenVPN open source project, with a per-client licensing fee per year, but all of the software is still hosted on your server(s)
Private Tunnel is an OpenVPN cloud based solution where the VPN tunnel itself is hosted on the infrastructure of the company that maintains the OpenVPN open source project
OpenVPN (the open source project) has a CLI version for Windows, Mac and Linux, and you should be able to compile the client on Tomato... it also has a rudimentary GUI for Windows clients
also, the client and server use the same executable file, the only difference being that you use different options in the configuration file to tell it whether to be a client or server, so don't get tripped up by "where's the server?"
Alright. And assuming that it's put into the router as the client, then everything behind the router should be able to see the main network's servers, correct?
the configuration is less painful than some other projects.... one big reason is that there's really only one configuration file (unless you count the client/server SSL certificates), whereas some projects, ahem Postfix, ahem Asterisk, have like 1000000 configuration files
@CanadianLuke well you will probably have to set up layer 3 routing rules for that particular activity, meaning, you'll have to use iptables to tell your router that it needs to forward packets destined for the main network's servers
I've set it up for simple client/server use cases, but not bridging networks... however, I think I know what would be required to set it up in your particular use case
once you configure iptables appropriately and the openvpnclient on each Tomato router, then basically, what will happen is, if your private OpenVPN subnet is for example 192.168.16.0 with a netmask of 255.255.255.0 (meaning valid IPs 192.168.16.1 through 192.168.16.254), you would be able to hit an IP like 192.168.16.17 from a client connected to that Tomato router
and when you hit that IP address, the IP layer routing rules in iptables will forward the packets on through the VPN tunnel to the appropriate destination
if you need to join a whole LAN network with multiple subnets to the VPN, that's also possible, but you'll have to use layer 2 bridging on the server side, meaning, the VPN server will need to put the connecting clients into the same subnet as the clients in your LAN
so if your local LAN where you have all your internal company servers is on 192.168.18.0/20 or something like that, you'd have to assign IP addresses within that range to each connecting Tomato router when they connect to the VPN server
you'd still have to do the layer 3 routing on the Tomato routers though, that part is a given, unless you want to also bridge the remote clients into your LAN subnet
which is possible too. that way you would have remote clients in the same IP space as your local clients
meaning, 192.168.1.81 could be the guy sitting next to you and 192.168.1.82 could be a computer in Singapore
ok, that's doable too, you'd have to set up a local DHCP server on the OpenVPN server box, or use an existing DHCP server within your LAN, and in the OpenVPN configuration, tell the clients that they need to hit that DHCP server to get an IP address
and basically think of it this way: you'll have two layer 2 bridges going on.. or actually, one bridge between the LAN and the VPN server, and one bridge for each Tomato router
the LAN<->VPN server layer 2 bridge pulls the VPN's own subnet into the subnet of your LAN, and the Tomato Router<->client layer 2 bridge pulls each client connecting to a router into your local LAN's IP space
the main difference between IP masquerading (layer 3 routing) on the Tomato routers and Layer 2 is, that, with Layer 3, you wouldn't be able to directly route inbound to one of the remote clients
but if you Layer 2 bridge the remote clients in, then you can hit them directly by IP
by the way this should be fairly efficient and performant, especially if you use the UDP version of OpenVPN's protocol; it has both UDP and TCP; TCP is generally reserved for cases where an ISP disallows UDP
and depending on the number of clients you might want to have a reasonably big pipe and decent CPU power on the main OpenVPN server
oh, one more thing -- are you wanting to do split tunneling? split tunneling is where your remote clients will only tunnel through the VPN if they are hitting a box within your LAN
the opposite of split tunneling is full tunneling, where every single IP connection except localhost goes through your VPN
as far as OpenVPN configurations go, this one definitely ranks in the moderate to difficult range, since it's not just a point to point thing where you have one box connecting to one client for full tunneling, which is the simplest possible network
by the way, OpenVPN is about 100,000 times simpler than IPsec/FreeSwan/Radius, so if you hear anyone mention the word "Radius", tell them "Too complicated"; if they insist, run away / quit your job / go to another planet
Actually, I'm finding out who my true work friends are right now, so I don't know how long I'll be there... But I want to at least help the people who have supported me
Hopefully, one big issue that came up is resolved in a HAPPY way though, cause otherwise I love the job
Apparently, permissions got changed on the server and opened up sensitive information to other teachers and students, should they have decided to be snoopy... But of course, when I'm running around fixing stuff all summer for the few staff members that are there, I don't have time to rush through all the folder permissions that the last guy set
So, I've been a bit paranoid about setting permissions these last few days
I'm in a, uh, let's say, extremely customer-focused white collar job where a customer is basically paying my entire salary as part of a contract, so my bosses within my company are extremely careful about what we say to the customer to avoid the perception of any issues or weaknesses on our part
one time when I was a newbie I said something to a customer that made it seem like my managers weren't really taking care of my stuff -- it wasn't rude or offensive in any way, but I was basically asking the customer for info that my managers should've provided me, that got me a talking to lol
I'm waiting for the committee meeting to determine what will happen, but my main boss says that he made that mistake before and he turned out fine, so I feel better
I hate when that happens!
I've been there too, but I also told that particular manager that unless I'm the one responsible for a system getting setup, I'm not taking responsibility for the previous administrator
If I see something wrong, I will fix it, but I'm not hunting for irregularities when other people are not able to do their job for unrelated matters
then there was that one damn email that got forwarded to like, the customer's boss's boss's boss's boss, and it contained a one-paragraph micro-rant about the capabilities or competencies of certain members of a department within the customer's organization which we ... don't particularly love (and to be honest, the guy I sent the email to 100% agrees with me on that point; that's why I felt OK sending that to him)
but he forwarded it up the chain because 90% of the email was literally "we have a huge issue and this needs to be dealt with ASAP"
and once people started re-reading the email, then the shit hit the fan
at first everyone was super thrilled that I identified the problem and that we were able to get it fixed
reaction 1 was just a pure, blind panic to stop the app from going to production with that particular issue
I think I handled the email-discipline well that I had before this incident... I closed a ticket cause the user was no longer with the company, and the computer had already been swapped out... Got in big shit, but explained that I was following what the previous techs did. No more trouble on that one
well I'm extremely careful about what I write in emails addressed to the customer now
when I'm talking to people within our company, I can pretty much say anything in an email that isn't a personal attack and it will have zero consequences
but if I'm talking to the customer I have to put on my "what would happen if this got forwarded to the boss's boss's boss's boss" face
sometimes when I really need to lay out a complicated email to the customer, I'll send it to a team lead or my boss and get them to clear it first before I even send it to the customer
the thing is, the people I work with on the customer side on a daily basis really like me, and I have a great rapport with them, but even so, the customer relationship is a much more formal one than it could be, and the overt formality is sometimes a barrier to frank and useful communication
I feel like things sometimes end up being sub-optimal because I don't have the ability to speak to them as I would a coworker within my company, like, offering suggestions and opinions, or asking them why certain things are a certain way, because maybe I have ideas for doing things better
I prefer business relationships where people can speak their mind, as long as it isn't hate speech or personal attacks
I have lots of great ideas! If I express them to the customer, I'm likely to get fired... if I express them to my managers, I'm likely to get pat on the head and then promptly ignored
there are a few cases where there are opportunities to sneak things through, but usually they are very minor cases, and the opportunities are a special case
I'd say that the #1 reason why I like my job is that some of the customer folks I work with are cooperative, easy to get along with, and share my interests
oh -- I mean, suggesting things to the customer is generally left to formal documents that have to go through all kinds of bureaucracy... only the most minor things can just be flat-out suggested like "it'd be nice if..." etc
our management doesn't like it because they always want to be in charge of coming up with the best way to "sell" an idea
I like to meet the customer in-person though (it happens occasionally; I work in a building about 2 miles away from where they are).. if I'm there with one of my "buddies" on the customer side, and none of my own management are there, I can pretty much say whatever and they won't tell my management I said it, lol
that much is really nice because I get to let them know how I see things from my perspective, even if nothing comes of it, at least they know
customer wanted to hire me as a direct employee working for them at one point, but the job req came and went before I even knew about it, and the guy who asked me to apply didn't let me know about it until it was too late
so that says something: they want me to stick around... lol
I definitely learn from teh Googles, but I like to think that I arrived at SE over a year ago with pretty much a fairly comprehensive computer literacy overall, despite all I've learned since
I learn more about programming from SO than anywhere else these days, but for non-programming tech knowledge, it's all in my brain, most of the time
SO never fails to amaze me in how a well crafted google search will yield a question that's already been asked and answered about exactly what I need, with an accepted answer and at least 4 upvotes
I rarely have to ask (or answer) questions there anymore because there's so much already there, and all I can do is laugh, copy and paste the answer, and upvote the damn thing
I have a 2012 Honda Civic EX (4 Cyl Automatic, 5-speed transmission, Regular Gasoline). I get it serviced regularly and it has around 28k miles. The engine light has never come on.
I am noticing this summer, in moderate to high humidity weather, 70 - 85 F, in the morning (when the car has been o...
yeah, I end up asking questions on sites where I am not a domain expert, and answering questions on sites where I know my shit -- basically, I use the site correctly, lol
and the OpenVPN client is the "Site 1 switch" (same computer/box)
basically you'll use Linux's bridge-utils to create a "br0" device that bridges between tap0 (the OpenVPN interface) and eth0 (or eth1, whichever eth is the internet interface)
When doing a game of Telephone with my cadets during a leadership weekend, I gave that quote... I can't remember what, but I think "How many" was all that was left at the end
@CanadianLuke Welcome to Root Access chat for Super Users! Please don't ask if you can ask or if anyone's around; just ask your question, and if anyone's free and interested they'll help.
@CanadianLuke it's complicated -- I have a Debian server too, a dedicated server, running various workloads. up until today, it was running OpenVZ as a virtualization platform, but I magically migrated all the guests over to Linux-VServer
the problem with OpenVZ is that it's basically a fork of Linux kernel version 2.6.32, and they aren't upgrading to a newer kernel... like, ever (until Red Hat Enterprise Linux 7 is out)
@CanadianLuke VM to VM transferring is usually a royal pain in the ass, but OpenVZ and Linux-VServer are similar enough in their implementation that migrating from one to the other is not so difficult
basically, OpenVZ is this enterprise-grade, moderate-overhead (3 to 10%) container virtualization where everything runs on the host kernel, and all the guests have to be Linux, but it's way faster than, say, VMware because it doesn't do full OS virtualization
Linux-VServer is more of a hobbyist / enthusiast project that aims to be better than OpenVZ, but it has less enterprise backing, although its main advantages are lower overhead (more like 0.5 - 1%), as good or better security and guest isolation, and you can run new Linux kernels with it
OpenVZ is like, 20 kernel releases behind mainline. Linux-VServer is one kernel release behind mainline. Both kernels require a third-party patch and rebuild of the kernel unless your distro ships it, though.
long story short, I wanted gigabit port speeds on my dedicated server, and the ability to start up a working KVM guest as a build server, because OpenSUSE 12.3 requires full virtualization thanks to damn systemd
@Bob On IRC, I talked to the Linux-VServer kernel patch maintainer and lead developer, Herbert Potzl, from Austria, and he helped me through the migration from OpenVZ, then I donated $25 to him over PayPal because I was feeling generous because he was so nice, and then we talked about various things
it was pretty neat.
that guy is way smarter than me -- I mean, every time Linus Torvalds releases a stable kernel, he ports several thousand SLOC of kernel C code to the new kernel, tests it, updates based on any ABI changes, etc.
They'll be useable if you haven't created any new electrical paths. That means:
no corrosion which created new paths
no leftover liquid (which would be conductive)
To address the first, you'll have wanted to make sure you cleaned them quickly and thoroughly, especially as you mentioned you s...
@CanadianLuke ciphers? try in verbose mode to see if it's a cipher mismatch
and ... er... make sure the certs all match up :P
@Bob once he does this on his work network, the end result will be that every computer is going to belong to the same subnet for LAN communication purposes, but for public Internet access, they'll just go directly through their local default gateway (Internet traffic won't be routed through the VPN).
> Microsoft could've done this with UAC by sub-classifying their UAC Alerts, and if it was specifically a virus, then disabling close for a few seconds when the window opens, and having gigantic type that says Hey, so you know, you're getting a virus.
To the question of:
How do I keep the user aware of important events without innundating them?
Make sure your updates are meaningful.
UAC, TOS', and EULA's are constantly skipped over because they don't provide meaningful content to their user. UAC, for many, is simply annoying - users fee...
also, Windows Defender on Windows 8 will by default quarantine any virus files to begin with, so they won't even get the chance to load into a process, much less request elevation
you won't even get that far without extracting your virus-ridden file from Windows Defender with tweezers
Windows Defender can quarantine with no file size limit (why the fuck does Norton care how big it is?!) and it'll definitely let you know that it quarantined it
unfortunately, it seems to think that everything from cheathappens.com is a virus -- which I guess is fair because online game companies consider trainers to be hacks and can get you banned if you login with an online achievement account or whatever, even if you're playing singleplayer
but I'm pretty sure that cheathappens trainers aren't like, trying to steal your data or be malicious, aside from messing with the game you downloaded it to mess with
i wonder if it scans plain text files for scripting language lines that do trainer-like things.... XD
in Ruby you could redefine the functions to different names and it'd be none the wiser, haha
oh no; what have I unleashed? I think I've created a new monster.... now Norton will take 7 minutes to scan a 30 kb text file for heuristics that look like virus-y ruby script, when it's just a note to your professor
shhhh, don't tell Norton's engineers that Ruby can call arbitrary win32 APIs and therefore makes for a very sneaky virus vector (with a ruby runtime, of course)
For those finding this question off the MultiCollider-SuperDropdown, stick around! We have many more interesting questions here. The environment is friendly, and our mods don't usually poke people with sharp sticks. — Undo10 hours ago
They'll be useable if you haven't created any new electrical paths. That means:
no corrosion which created new paths
no leftover liquid (which would be conductive)
To address the first, you'll have wanted to make sure you cleaned them quickly and thoroughly, especially as you mentioned you s...
To the question of:
How do I keep the user aware of important events without innundating them?
Make sure your updates are meaningful.
UAC, TOS', and EULA's are constantly skipped over because they don't provide meaningful content to their user. UAC, for many, is simply annoying - users fee...
