Layer 7 filtering
by Ovidiu Lixandru
Hello.
I've got a RedHat Linux 9 router which provides net for a LAN via DNAT.
On this machine I plan to use layer 7 filtering in order to get rid of
some unwanted instant messaging and p2p protocols for some of the
internal IP's. So far, I've found l7-filter which seems to provide what
I need.
I've rebuilt the iptables-1.2.9-2.3.1 srpm including the l7-filter patch
and it worked nicely.
The ugly part comes with the kernel (2.4.20-8). I've deployed the srpm
and modified the spec to include the l7-filter patch. However, when it
comes to rebuilding the rpm (rpmbuild -bb --clean --target i686
kernel-2.4.spec), I get:
Connection state match support (CONFIG_IP_NF_MATCH_STATE) [M/n/?]
Connection tracking match support (CONFIG_IP_NF_MATCH_CONNTRACK) [M/n/?]
Unclean match support (EXPERIMENTAL) (CONFIG_IP_NF_MATCH_UNCLEAN) [M/n/?]
Owner match support (EXPERIMENTAL) (CONFIG_IP_NF_MATCH_OWNER) [M/n/?]
Layer 7 match support (EXPERIMENTAL) (CONFIG_IP_NF_MATCH_LAYER7)
[N/m/?] (NEW) Buffer size for application layer data (256-65536)
(CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN) [2048] (NEW)
CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN:
Size of the buffer that the application layer data is stored in.
Unless you know what you're doing, leave it at the default of 2048
Bytes.
Buffer size for application layer data (256-65536)
(CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN) [2048] (NEW)
CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN:
...and the message keeps repeating.
At this point, I'm pondering whether to switch to a recent RHEL 2.6
kernel and try patching that or get some other layer 7 filtering
software which may work nicely with the RH 2.4.20 kernel (is there any
other?).
Any ideas and suggestions are welcome.
Thanks.
--
Ovidiu Lixandru
linux360
18 years, 10 months
eject command for CD's in FC4
by Joachim Backes
Hi,
having in FC4 sometimes the problem that ejecting a CD after unmounting
it fails with the message:
eject: unable to eject, last error: Invalid argument
If doing "sleep 2" after unmount, then eject is accepted.
Any issues?
--
Best regards
Joachim Backes <backes(a)rhrk.uni-kl.de>
University of Kaiserslautern,Computer Center [RHRK],
Systems and Operations, High Performance Computing,
D-67653 Kaiserslautern, PO Box 3049, Germany
--------------------------------------------------
Phone: +49-631-205-2438, FAX: +49-631-205-3056
http://hlrwm.rhrk.uni-kl.de/home/staff/backes.html
18 years, 10 months
Install/activate selinux on FC3 after upgrade
by Richard England
As I understand it, since I upgraded from FC2 to FC3 (as opposed to doing
a fresh install), the selinux features were not installed/activated (?).
Is there a source for information or even a HowTo available that will
explain, step by step, what has to be done to bring the selinux features
up on FC3 after and upgrade? Are there RPMs that have to be added? I
know that selinux.conf needs to be defined but not what it needs to
contain.
I'd rather not reload FC3 unless it's absolutley necessary.
Thanks for any pointer.
--Richard
18 years, 10 months
Segmentation violation in nested functions with kernel 1.35
by Vincent De Groote
Hello,
I've just switched from kernel 2.6.11_1.27_FC3 to 2.6.11_1.35_FC3.
The following program makes a segmentation violation when I use the new
kernel. When I switch back to the previous one, the program runs
without problems.
The problem occurs when the callback function is called (in
process_datas function). Calling such a nested function should be ok,
when I read the gcc documentation.
Did I miss something ?
Thanks for your help.
#include <stdio.h>
struct context_t {
int (*write_callback) ( FILE * output, char * buffer );
};
int process_datas ( struct context_t * context ) {
return ( context->write_callback ( stdout, "write call back
datas" ));
}
int test ( void ) {
struct context_t context;
int write_callback ( FILE * output, char * buffer ) {
return (fprintf ( output, "%s\n", buffer ));
}
context.write_callback = write_callback;
return (process_datas ( &context ));
}
int main ( int argc, char ** argv ) {
printf ("test result = %d\n", test());
return (0);
}
18 years, 10 months
japanese input
by eric dan
hi anybody know how i can add japaense support after installation?
i need to be able to type japanse with the session itself being english.
is that possible? to just change the input method?
thanks
18 years, 10 months
Gtk emacs-style key bindings
by msowka＠rogers.com
Hello Folks,
It seems that there is something missing in
FC4/Gnome2.10. My favorite: gtk emacs-style
keybindings.
The part of the Keyboard Shortcuts that enabled this
is missing, and the gtk-key-theme-name="Emacs" in
~/.gtkrc-2.0 doesn't seem to work.
Has this feature been removed from FC4/Gnome2.10?! And
if not, how do I enable this?
Thank You,
Mike
P.S. The gnome documentation in Yelp still makes
reference to this feature!! :|
18 years, 10 months
Re: Recommened Tape Backup software
by David G. Miller (aka DaveAtFraud)
Julian Underwood <mailings(a)underwoods.net> wrote:
>Subject: Recommened Tape Backup software
>
>Dear List,
>
>I'm pretty frustrated with Tape Backup software at the moment. I simply
>want an easy to use/install, program which will allow me to backup my
>server to multiple DLT tapes.
>
>I tried BRU, and it worked OK, but it's not free, so I couldn't restore.
>I checked out Networker from Legato, and it seems a bit much for a
>single server--which is also not free.
>
>Could someone recommend a good backup software which can handle this
>task? I understand that Amanda is quite good, but doesn't support
>appending to multiple tapes "out of the box."
>
>Thanks in advance,
>
>Julian
>
I think you'll find that amanda supports backups that span multiple
tapes. Amanda requires that the drive be non-rewinding (from its
perspective). This means that tapes are used once until they come back
up in the cycle. This is a function of how long do you want to be able
to "go back"; not amanda.
Amanda is somewhat of a pain to configure but once you get it working
it's pretty much just keep feeding tapes to your tape drive. I'm using
a 6x12GB Sun tape changer that I picked up used and amanda just keeps
asking for tapes. The few restores I've needed to do have been fairly
painless.
Dave
18 years, 10 months
FC4 x86_64 dies with heavy SATA RAID load
by Mark Miksis
I have the 3Ware 9500S-4LP (running RAID5) installed in a Dell Poweredge
1800 (dual EM64T Xeon, 7520 chipset). With Fedora Core 4 installed,
everything seems fine at first glance. However, after a period (many
minutes) of heavy disk I/O operations, the machine begins to slow and
then becomes completely unresponsive. I get "APIC error on CPUn:
00(40)" in dmesg which may or may not be related. Nothing is logged to
syslog when the failures occur. I have tried booting with noapic and
using the uP kernel. Some of these configurations make the APIC error
go away, but the hangs still occur. This machine will run fine for days
or more at high CPU loads as long as the I/O load to the RAID card is low.
Any thoughts? Anyone running this configuration?
18 years, 10 months
