/dev/chat - 2022-08-08

« first day (4321 days earlier) ← previous day next day → last day (616 days later) »

12:26 PM

@fra-san Is it wrong to add the entire block? For example, I did:

mdadm --add /dev/md1 /dev/sdf

and it was accepted and reports that it is rebuilding.

That new SSD has no /dev/sdf1. Do I need to create it?

It seems to be building the raid array directly on top of the disk without an intervening partition. I.e. looks like:

sdf 8:80 0 465.8G 0 disk
└─md1 9:1 0 465.8G 0 raid1
├─debian-boot 253:8 0 952M 0 lvm
├─debian-root 253:9 0 46.6G 0 lvm
├─debian-home 253:10 0 93.1G 0 lvm
├─debian-swap 253:11 0 8G 0 lvm
├─debian-video 253:12 0 200G 0 lvm /home/faheem/video
├─debian-data 253:13 0 20G 0 lvm /data
└─debian-local_src 253:14 0 80G 0 lvm /usr/local/src

@FaheemMitha It’s fine to use the whole device, that’s what I tend to do.

@StephenKitt Oh, is it? I was about to try to abort it.

In superuser.com/a/383021

appears the paragraph.

> The reason for making a single partition is so that the drives don't appear to be empty to other operating systems and utilities - some will mess up a drive that looks like has no partitions.

@StephenKitt Comments ^^ ?

@StephenKitt Just to be clear, you mean /dev/sdf in this case, right?

@FaheemMitha yes, that’s what I mean. If you only intend to use your drive in a Linux system, the fact that Windows tools may mess things up isn’t all that relevant (and while I’ve seen that claim quite a lot, I’ve never run into problems with Windows and partitionless drives).

@StephenKitt I see. Thank you very much for the reassurance. I was about to abort and try to partition the drive. So you are saying it's not necessary?

And I think it's unlikely I'll use this drive in a Windows system. It hasn't happened in 20 years or more.

1 hour later…

1:39 PM

The newly rebuilt raid array is saying:

> Consistency Policy : resync

But my other raid arrays say:

> Consistency Policy : bitmap

Why the difference?

resync is the process a raid array does to sync the required redundant data to all disks. It can take several days

it will happen to a new raid or if you add/replace a drive in an existing array

@FaheemMitha Not wrong, but I can't say if it would work fine had you to boot off that drive given your configuration

However, I'd assume Stephen has taken this into account before answering you

That’s a good point, you can’t boot off a non-partitioned drive.

2 hours later…

3:24 PM

TIL that GNU sort can sort month names natively: unix.stackexchange.com/a/712821/117549

3 hours later…

6:09 PM

@fra-san Happily I didn't need to boot of those drives.

@jesse_b Yes, but it's listed as a "Consistency Policy", which implies something permanent.

@FaheemMitha Good. I mentioned that because I saw boot, root etc. among the logical volume names in the block you posted. But then I realized those volumes were not mounted

@fra-san Yes, that's the legacy of an older system.

I probably should remove those filesystems.

7:01 PM

@FaheemMitha tl;dr iptables uses a bunch of hard-to-maintain hooks in the kernel and is slow and suffers lots of code duplication. The alternative is nftables which is built on top of a virtual machine in the kernel (in the technical sense, not the "bloated OS running within a bloated OS" sense), which is slightly more performant.

But eBPF can be used to implement pretty much all of this, either via a change to the netfilter backend where eBPF is used internally rather than the nft-specific virtual machine, or via the dedicated bpfilter interface. Its performance is vastly better, it is significantly more flexible, it is easier to audit (kinda), and the filtering can be offloaded to hardware.

7:20 PM

@forest I'd be happy if it was easier to understand, but it sounds like that is not the case.

@FaheemMitha That's only if the bpfilter tool is what is used. I'm hoping that it'll be transparently used as the backend.

@forest Frontends tend to be quite limiting for things like packet filtering.

We're all always using frontends.

No one uses raw netfilter.

@forest OK. So do you do a lot of networking stuff?

Not a lot, but some.

And some stuff I know would be more relevant to people with extreme use-cases. For example, did you know iptables can't atomically add, remove, change, or insert rules? The iptables frontend can, but it does that by opening a socket and downloading the entire ruleset from the kernel, modifying it memory, then flushing the kernel ruleset and uploading the new one.

Which means that you sometimes have problems trying to make changes when there are ~15,000 rules.

7:29 PM

@forest Sounds inefficient.

@forest That's a lot of rules.

Yeah. Obviously most people who have that many rules are just doing it wrong and should be using ipsets, but there are some organizations that need that many rules and can't condense them using hash tables.

@forest I'm not familiar with ipsets. Then again, I'm barely familiar with iptables either.

That's one of the benefits of nftables, being a technically superior replacement for iptables.

But it'd be even better with eBPF as a backend!

@FaheemMitha It's a way to merge a lot of IPs, IP:port combos, etc. into a single rule.

@forest OK.

So if you have 10,000 IPs you want to blacklist, instead of adding 10,000 -s $ip/32 -j DROP rules, you create an ipset with those rules, and do -m set --match-set my-blacklist src -j DROP.

7:33 PM

@forest Yes, I see. That sounds sensible.

while IFS= read ip; do
    iptables -A INPUT -s "$ip" -j DROP
done < huge_ip_list.txt

That's inefficient. A better way is:

ipset create my-blacklist hash:ip
while IFS= read ip; do
    ipset add my-blacklist "$ip"
done < huge_ip_list.txt
iptables -A INPUT -m set --match-set my-blacklist src -j DROP

@forest Is that a common real world use case?

That's the most common real-world use case.

@forest OK.

Blocking IP addresses. It's kind of sad.

I mean, it's not necessarily for blocking. It can also be for forwarding, marking, etc.

And it's not just lists of IPs. You can have IP:port combos, IP:net combos (which is list of IPs with subnets, so a range), IP:mac combos, etc. A quick look on my system shows some options: hash:ip hash:ip,mac hash:ip,mark hash:ip,port hash:ip,port,ip hash:ip,port,net hash:mac hash:net.

7:37 PM

@forest OK.

I guess if you work in security, you would need to know a lot about networking. It must be an essential part of any attack vector, if that's the right term.

I know less about networking than I should, tbh.

There are many aspects of infosec which have nothing to do with networking, of course.

I usually work on those aspects, but I do have to have some network knowledge. But I've really been neglecting learning much about it.

@FaheemMitha Why's that a bad thing?

@forest Well, having to defend oneself from hostile entities on the Net. It wasn't always the case. Or at any rate, not so much the case. I remember when the Net was quite quiet, and spam was virtually unknown.

Ah, yeah...

I find spam a depressing daily reminder of human dysfunction.

Spam is the least of the problems. I'm more upset at government actions than obnoxious unsolicited emails.

7:49 PM

@forest Well, governments are of course much more dangerous than random spammers. But the spammers are still unpleasant.

Indeed. And DDoSers, etc.

@forest Does much of your work involve defending organizations against govt "activities"?

Some of it.

Any kind of "activities", whether government or private, can be part of someone's threat model.

And if someone doesn't want their organization to suffer an act of espionage, it doesn't matter if it's a government or any other rogue entity. Their MOs may be different, but the end result is still that they're trying to steal something.

@forest Well, govts are more dangerous, because they are in a better position to abuse any information they obtain.

Generally, yeah. :(

7:52 PM

Things in India are predictably heading south in that respect, along with much else.

Well, thankfully India doesn't do a whole lot of high-tech espionage or similar.

That's mostly America, Russia, China, and France.

@forest I meant the Indian "government" is weakening privacy rights and so forth in India.

Ah, yeah. :/

Happening in the US and EU as well.

US and EU are trying to find ways to ban encryption because "think of the children!"

Yes, I know.

@forest That's been going on for a long time. Clinton and PGP, for example.

But right now the laws are looking like they might pass.

It's a lot more dire than it used to be. It's Crypto Wars 2.0.

8:02 PM

@forest I haven't been keeping track of that.

8:21 PM

In the US, they call it the EARN IT act. It's quite awful. The EFF has been campaigning against it for years.

9:14 PM

@forest OK. Thanks for the reference.

np

Yes, it does sound quite bad. But these sorts of attacks have been going on for a while.

And usually they follow a standard script. In a word - security.

Not a very sophisticated stalking horse. But then I suppose it doesn't have to be.

« first day (4321 days earlier) ← previous day next day → last day (616 days later) »

Transcript for

Aug '228

/dev/chat

General discussion for unix.stackexchange.com. If you have a q...

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile