My boss has recently been pushing me to take up stuff and try gain visibility across the organisation.
I just do not understand the idea behind this.
Why is it important to gain visibility? If I can write awesome code, why should I care about having visibility? The work I am doing rocks, then wh...
@JennyD There are a couple of times where I've been present for someone getting a good burn. Stupid things like an arm coming in contact with a 400F gas grill lid.
Inside-to-inside NAT aka NAT loopback solves hairpin NAT issues when accessing a web server on the external interface of an ASA or similar from computers on the internal interface. This prevents DNS admins from having to maintain a duplicate internal DNS zone that has the corresponding RFC1918 ad...
Because if your server is getting hacked, then the attacker is right in your local network with your fileservers, printers, clients, etc etc.
Check http://www.shorewall.net/FAQ.htm#faq2 for different approaches, but from the time I learned about NAT and networking, it is BAD BAD BAD :-)
@MDMarra For some reason that I can't figure out, our notwork staff won't give us inside-to-inside NAT, even though it would make all our lives a lot easier. And they won't tell us why. I wish someone would answer your question with an actual reasonable answer.
I think we need to get our cron canonical question a bit higher in the cron rankings. If someone has time/inclination to review cron and wants to flag/v-t-c any that are applicable as a dupe of serverfault.com/questions/449651/… I'll be happy to hammer them while I can
@JennyD i was spoiled. At my first job that had a large deployment we had it configured on juniper gear. I just assumed it was the way of the world. It worked fine and I used it for years. It existed there for well over a decade. Now I can't convince people to turn it on anywhere
On an ASA a client on the internal interface can't communicate with a server being NATted on the external interface via the public IP unless you do inside-to-inside NAT or maintain a separate view/zone with internal addresses
I'm saying why don't people just turn that shit on and stop messing with a second zone that has internal addresses
Some DSL routers prevent NAT loopback. Security is sometimes cited as the reason. Is NAT loopback really a security issue? And if so, how is this exploited?
NAT loopback... where a machine on the LAN is able to access another machine on the LAN via the external IP address of the LAN/router (with...
@David19801 There are hundreds, if not thousands, of websites and blog posts about using ssh as a SOCKS proxy. In the end, it's really pretty simple. The trick is finding the proxy settings for your browser.
questions I have...Where do I put the username and password for my server in the ssh line? do I need to use the root username on the server? do I need to close the ssh thing when I am finished or will it close when I close the terminal?
@David19801 Short answer (if you just want to use it as a proxy) is it doesn't really freaking matter. Long answer will require you to learn TCP/IP networking.
can you give me an example of what the ssh command would be with a username and password? I currently have: ssh -D 8080 187.44.34.223 and how do I close it when finished please?
right, so, when I do the ssh command in terminal that sets up a permanent change in my mac sending all traffic to my server right? and that stays until I type exit, but until then it is permanent?
@David19801 "No proxy for" is because usually you would have another remote server as your surf proxy, but if you e.g. have your own development web server on your own mac, you wouldn't go through a remote surf proxy to get to your local webserver. That's localhost.
@David19801 And the tunnel thing is you are opening a tunnel with one end on your mac, and the other end on your server in the US. You want the traffic to enter the tunnel through the entrance on your mac, and exit through the server in the US. So that's why you're setting localhost as your proxy.
@MDMarra Oh I didn't know that. @Iain well i think it would be good since there are quite a few questions about tcpdump , but since it's out of date well, ok :)
@David19801 I think the problem you're running into is that the questions you're asking require a much stronger technical networking background than I think you have. It makes it hard to give good answers without tremendous amounts of background material. :/
I’ve built my test network with three computers: Windows 7 Ultimate, Windows 7 Enterprise and Windows XP. Each computer has a fixed IP-address. There are no error messages on the Windows XP computer, but on the both Windows 7 computers the following error message is shown:
The dns-server isn’t ...
I turn it on at the firewall level, but why not take care of it at the DNS level? That's how I was taught. It was always expressed to me as a limitation/feature of the Cisco firewall.
If you can just specify a subnet for inside-inside NAT translation and be done with it, why is that wrong compared to curating a completely disjoint and separate DNS zone internally for resources that already have valid resource records published publicly?
I know you're approaching the question from produce companies and whatnot that just need 2-3 boxes on the Internet. But I'm approaching it from places with 50+ boxes behind that external interface
At that scale and with more than one cook in the kitchen, maintaining more than one DNS zone for the same set of servers seems silly and error prone when it can be handled by a couple of NAT statements on the firewall
For a school project I need to create an ubuntu diskless client. I'm using vmware fusion. I've encountered various problems that took me a while to solve, but now I'm at a standstill.
I've been using this guide to help me: https://help.ubuntu.com/community/DisklessUbuntuHowto
I arrived at the p...
Hi Mark,
I stumbled upon your web site while google searching for an upcoming project that I have coming up for a client. BTW, great article on not using the .local for a domain name....very intuitive!
Anyway, I'll make this brief and hope you can shed some light unto this matter that I am dealing with:
My client is on windows and Exchange 2003 with multiple locations, each being on a subdomain. So, there are no root domains. They would like to merge all of these domains unto a single domain as well as migrate to windows 2008.
@David19801 Any port scanner is going to see the SSH banner on 2000 and adapt their attack. All you're doing it reducing brute-force dumb script kiddie attacks, which won't be successful anyway if you use something like fail2ban or SSH Keys or even just a good password.
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
Edit:
I should also mention that I am using iptables rules to limit brute forcing attacks, only 5 l...
ok, I removed the little letter things, now it says the connection was refused. which is correct because i use a non standard port...so! how do I make this talk to port 2000 on my server? ssh -D 8080 [email protected]
I used to have openvpn set up and only had sshd listening on the private IP address, but I ended up switching out servers and it was more trouble than it was worth.
It's true that David needed a lot of help, but he was at least being nice about it and not being a jerk when people didn't respond immediately. Which is the only reason I spent the time.
@NathanC There was a discussion on one of the swedish IT mags web site once, about spam. One of our customers wrote "Don't spam from Algonet/Telenordia. Our postmaster has got an axe."
@NathanC The company had had a very bad rep as a spammer haven; they hired me because I was at that point somewhat known in the anti-spam community. Seeing that comment made me feel that I'd succeeded.
Dev on SU asking how to move data from S3 to MySQL: superuser.com/questions/596703/… anyone want to give him some help since he will never get an answer there?
Because if your server is getting hacked, then the attacker is right in your local network with your fileservers, printers, clients, etc etc.
Check http://www.shorewall.net/FAQ.htm#faq2 for different approaches, but from the time I learned about NAT and networking, it is BAD BAD BAD :-)
For a school project I need to create an ubuntu diskless client. I'm using vmware fusion. I've encountered various problems that took me a while to solve, but now I'm at a standstill.
I've been using this guide to help me: https://help.ubuntu.com/community/DisklessUbuntuHowto
I arrived at the p...
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
Edit:
I should also mention that I am using iptables rules to limit brute forcing attacks, only 5 l...
