VPN options
by Keith Lofstrom
I am planning on running a Virtual Private Network from my Fedora
firewall out to a UML virtual colo (running RH9) at another site.
That site will be the place I present services to the world;
httpd, ssh, sftp, smtp. This is to comply with the "no servers"
and dynamic ip restrictions on my Comcast connection to the net;
if my firewall always drives an outbound connection to the
colocation site, I am not worried about changes of ip address,
and I am not opening any inbound ports.
There are a number of options for the VPN - the most attractive
are cipe ( http://sites.inka.de/sites/bigred/devel/cipe.html )
and FreeSwan ( http://www.freeswan.org/ ), though I am told that
one can do all this through an ssh tunnel. I would rather have
simple and secure than super-duper; I have plenty of bandwidth,
and will send outbound http and smtp from the firewall, so the
main bandwidth user will be incoming spam/b/b/b/b mail.
Anyone have some experiences to share about setting up VPN? Is
there anything about either cipe or FreeSwan that is likely to
break with FC1 or FC2?
Keith
--
Keith Lofstrom keithl(a)ieee.org Voice (503)-520-1993
KLIC --- Keith Lofstrom Integrated Circuits --- "Your Ideas in Silicon"
Design Contracting in Bipolar and CMOS - Analog, Digital, and Scan ICs
8 months, 1 week
how to correctly log without journald (and its blobs)?
by Franta Hanzlík
In previous Fedora distros was (IMHO) right way to log only to syslog,
without journald and its (for me) unwanted annoying binary logs, by using
configuration as:
*) Set systemd log target to syslog:
systemd.log_target=syslog (syslog-or-kmsg) ---- on kernel cmdline
systemd.default_standard_output=syslog --/
and
LogTarget=syslog ---- in systemd.conf
DefaultStandardOutput=syslog --/
*) configuring rsyslog to listen on /dev/log unix socket:
$SystemLogSocketName /dev/log ------ in rsyslog.conf
$ModLoad imuxsock ----/
$OmitLocalLogging off ---/
$AddUnixListenSocket /run/systemd/journal/syslog --/(legacy directives)
$AddUnixListenSocket /run/systemd/journal/socket -/
$AddUnixListenSocket /run/systemd/journal/stdout /
(not sure when all last three directives needed)
*) prevent to run journald:
systemctl mask systemd-journald.service
(and maybe mask systemd-journal-flush.service)
And it works fine.
But in actual Fedora 24 in systemd man page values syslog-or-kmsg and
syslog are missing in LogTarget option. As systemd/journald man pages
say hardly anything about exact mean of appropriate configuration for
this purpose, then please when someone more knowledgeable can advise:
- where to direct the systemd output? Maybe to kmsg an then read it in
rsyslog via imklog?
(rsyslog should have also imkmsg module, but is not in rsyslog-8.12.0-3.fc24)
- what about /run/log/journal/.../system.journal ?
On my test F24 system it have open rsyslogd, abrt-dump-journal-oops and
abrt-dump-journal-xorg (no need for these last two) processes. Uses it
also something else?
- what about /run/systemd/journal/{dev-log,socket,stdout} unix sockets?
Should rsyslogd listen on them?
- /dev/log seems be now symlink to /run/systemd/journal/dev-log socket
(as defined by systemd-journald-dev-log.socket) Should it be left
(because now something sends to /run/systemd/journal/dev-log), or can
be /run/systemd/journal/dev-log removed?
Thanks in advance for some clarification about this.
Franta Hanzlik
2 years, 3 months
Error building mkvtoolnix-9.6.0-1.fc26.src.rpm
by JD
$ rpmbuild -v -bb mkvtoolnix.spec 2>&1 | tee mkvtoolnix.build.out
.
.
.
WARNING: unable to read lib/avilib-0.6.10/avilib.c: invalid byte
sequence in US-ASCII
WARNING: unable to read lib/avilib-0.6.10/avimisc.c: invalid byte
sequence in US-ASCII
WARNING: unable to read src/common/checksums/adler32.cpp: invalid byte
sequence in US-ASCII
WARNING: unable to read src/common/checksums/base.cpp: invalid byte
sequence in US-ASCII
WARNING: unable to read src/common/checksums/crc.cpp: invalid byte
sequence in US-ASCII
WARNING: unable to read src/common/checksums/md5.cpp: invalid byte
sequence in US-ASCII
WARNING: unable to read src/common/spu.cpp: invalid byte sequence in
US-ASCII
.
.
.
At end of build, it belched
g++ -Wall -Wno-comment -Wfatal-errors -Wlogical-op
-D_FILE_OFFSET_BITS=64 -DMTX_LOCALE_DIR=\"/usr/share/locale\"
-DMTX_PKG_DATA_DIR=\"/usr/share/mkvtoolnix\"
-DMTX_DOC_DIR=\"/usr/share/doc/mkvtoolnix\" -fstack-protector -fPIC
-std=gnu++11 -Wnon-virtual-dtor -Woverloaded-virtual -Wextra
-Wno-missing-field-initializers -Wno-maybe-uninitialized
-I/usr/include/qt5/QtWidgets -I/usr/include/qt5 -I/usr/include/qt5/QtGui
-I/usr/include/qt5 -I/usr/include/qt5/QtNetwork -I/usr/include/qt5
-I/usr/include/qt5/QtCore -I/usr/include/qt5 -I/usr/include -O2 -g -pipe
-Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong
--param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic
-include src/common/common_pch.h -I. -Ilib -Ilib/avilib-0.6.10 -Isrc -c
-MMD -MF ./rake.d/dependency.d/tmp/src_common_json_o.d -o
src/common/json.o -x c++ src/common/json.cpp
In file included from src/common/json.cpp:19:0:
src/common/json.h:23:76: error: 'nlohmann::json<std::map, std::vector,
std::basic_string<char, std::char_traits<char>, std::allocator<char> >,
bool, long int, double, std::allocator>::parser_callback_t' has not been
declared
nlohmann::json parse(nlohmann::json::string_t const &data,
nlohmann::json::parser_callback_t callback = nullptr);
^
compilation terminated due to -Wfatal-errors.
2 years, 9 months
Scriptlet errors during manual installation of Fedora 23
by Andrej Podzimek
Hi,
Because Anaconda doesn't support my usual partitioning scheme (root on Btrfs in LVM in LUKS in LVM in GPT, /boot on Btrfs, etc.), I created the entire layout manually and tried to install Fedora using dnf. The same layout works perfectly fine in ArchLinux.
I basically followed this howto, with adjustments for s/yum/dnf/ and for EFI/GPT: http://dustymabe.com/2014/05/29/manual-linux-installs-with-funky-storage-...
The initial filesystem installation (dnf install -y --releasever=23 --installroot=/mnt/sysimage filesystem) already got a few glitches of this form:
Non-fatal POSTIN scriptlet failure in rpm package filesystem
This^^^ happened to roughly half of the installed packages. I tried to proceed with the rest (i.e., to install @core @standard kernel grub2 grub2-efi sihm grub2-tools), but it failed with scriptlet errors that prevented a few key packages from getting installed at all:
error: %prein(selinux-policy-targeted-3.13.1-157.fc23.noarch) scriptlet failed, exit status 126
Error in PREIN scriptlet in rpm package selinux-policy-targeted
Packages with those errors are reported as failed after the verify step. What I tried next:
* setenforce 0
* upgrading the installation environment and/or the sysimage with dnf and rpm from rawhide
* --releasever=22 instead of 23
* ...and checking for a few other common points with this bug: https://bugzilla.redhat.com/show_bug.cgi?id=1270663
* a plain sysimage directory with no predefined Btrfs subvolumes in it
* unmounting, remounting, checking that everything has seclabel on, no weirdness in dmesg, etc.
Well, nothing of the above helped; the error is still the same.
How can I diagnose this? Where can I dig out the exact reason why the scriptlets are failing?
Provided that Anaconda actually does some steps that I'm missing and can carry out the installation correctly, is there a way to *force* it to just accept whatever is mounted into /mnt/sysimage at the moment, without trying to make sense of it? I'm pretty sure dracut can handle my partition layout just fine, so the entire issue here is about getting the basic installation done somehow.
Theoretically I could create a simple-and-stupid layout that Anaconda can handle, proceed with the installation and reshuffle the partitions afterwards, but that's sooo cumbersome that I thought I'd first ask whether someone knows a workaround to the scriptlet problems.
Cheers,
Andrej
3 years, 1 month
F25, Electrum and Trezor
by Mark
Hi
I'm testing Electrum on Fedora 25 and I'm missing the support for
hardware wallet that Electrum is supposed to have. Do I need to install
some additional package or has this feature been omitted?
Cheers
Mark
3 years, 1 month
Terrible F25 WiFi Performance
by Christopher
Since I upgraded to Fedora 25, I've had terrible network performance, and
I'm not sure what's causing it.
Any suggestions for troubleshooting or optimization?
Any known issues with the "Intel Wireless 7265D" card or the "iwlwifi"
driver in F25?
Everything worked great in F24, but since F25, I get poor download speeds,
and *REALLY* poor upload speeds. I should get a steady 25/25 Mbps down/up.
Instead, I get an unsteady 6-20 Mbps down, and only ~1 Mbps up. I've ruled
out everything but Fedora 25 (same hardware works fine in F24 and Windows),
and it's making me kinda want to go back to F24. :(
--
Christopher
3 years, 3 months
Google chrome gets deadlocked on F25
by Paul Smith
Dear All,
I have
google-chrome-stable-54.0.2840.100-1.x86_64
running on F25, but it deadlocks so often. Any solutions?
Thanks in advance,
Paul
3 years, 3 months
Networkmanagre Refuses to use my Dlink DWA-192 USB Wifi Device in F24
by Stephen Morris
Hi,
Some time ago I was using this device on the 2.4GHz channel (Linux
has always refused to use the 5GHz channel, I say Linux, because Ubuntu
has always refused to use the 5GHz channel as Fedora has always refused
to) and when it was working it was via the ATH9K driver.
I switched the network to using Ethernet devices which are still
working fine, but I wanted to go back to wifi again because the wifi
throughput is potentially faster (the Ethernet devices sends/receives at
500Mbps whereas the 2.4GHz channel on wifi sends/receives at 600Mbps, if
I could ever get the 5GHz channel working it sends/receives at
1300Mbps), but Networkmanager refuses to activate the wifi device now.
How do I identify whether its the 4.8 kernels which are the issue
or whether its Networkmanager and how do I rectify the situation? I am
using kde at the moment and I have cut and pasted the wifi password back
into the Networkmanager definition, and had the new password stored in
Kwallet, but Networkmanager still refuses to recognize that the device
is a device it can connect to. I should also add that the device works
fine under Windows 10.
regards,
Steve
3 years, 4 months
Mount of NAS Ethernet Connect to Router Fails at Boot Time for CIFS
Interface in F24
by Stephen Morris
Hi,
My Nas device now fails to mount at boot time via the CIFS
definition in fstab but the corresponding NFS definition mounts quite
happily. Also after the system comes up and I log into KDE I can
manually mount the CIFS device. As far as I am aware the only difference
between when it was mounting at boot time and now is several system
updates, also the system update I did yesterday morning (which updated
several hundred packages, which included a new kernel) has not rectified
the issue. The systemctl output is below, I have blanked out the userid
and password for security reasons.
Does anyone have any ideas why this has now stopped working?
systemctl status mnt-nas.mount
● mnt-nas.mount - /mnt/nas
Loaded: loaded (/etc/fstab; bad; vendor preset: disabled)
Active: failed (Result: exit-code) since Tue 2017-01-17 06:40:15
AEDT; 40min ago
Where: /mnt/nas
What: //192.168.1.12/Volume_1
Docs: man:fstab(5)
man:systemd-fstab-generator(8)
Process: 1299 ExecMount=/usr/bin/mount //192.168.1.12/Volume_1
/mnt/nas -t cifs -o
username=********,password=********,cache=strict,_netdev,rw
(code=exited, status=32)
Jan 17 06:40:15 localhost.localdomain systemd[1]: Mounting /mnt/nas...
Jan 17 06:40:15 localhost.localdomain mount[1299]: mount error(101):
Network is unreachable
Jan 17 06:40:15 localhost.localdomain mount[1299]: Refer to the
mount.cifs(8) manual page (e.g. man mount.cifs)
Jan 17 06:40:15 localhost.localdomain systemd[1]: mnt-nas.mount: Mount
process exited, code=exited status=32
Jan 17 06:40:15 localhost.localdomain systemd[1]: Failed to mount /mnt/nas.
Jan 17 06:40:15 localhost.localdomain systemd[1]: mnt-nas.mount: Unit
entered failed state.
I have also listed below the fstab definition for the CIFS interface and
the NFS interface.
192.168.1.12:/mnt/HD/HD_a2 /mnt/nfs nfs
users,noatime,nolock,bg,sec=sys,tcp,timeo=1800,_netdev,rw 0 0
//192.168.1.12/Volume_1 /mnt/nas cifs
auto,username=********,password=********,cache=strict,_netdev,rw 0 0
regards,
Steve
3 years, 4 months
ATA2:00: link is slow to respond....
by Angelo Moreschini
Hi,
my computer boot only in emergency mode ...
Looking the journalctl (command journalctl -xb), I found (in thejournalctl
) these lines in red color :
ATA2:00: link is slow to respond....
(and after..)
ATA200: SRST failed (erro 16)
That seem indicate that it is a problem to access the HDs..
I found a possible solution to the problem in this post:
http://codeverge.com/opensuse.org.help.install/-solved-ata1-srst-failed-e...
There is wrote that :...the problem can depend by the physic set up of the
HD (as "master", "slave", "single drive", ...): this set up can be done by
changing the position of a jumper on the HD...
I know that, in the past time, the HDs had to be set physically in this
way.., but recently I never heart anymore that the modern HD need this
operation..
So actually I don't care anymore of the configuration of the HDs
(my HD is Toshiba 1 TB that I bought few mounts ago).
I would like to have a confirmation that what I read in the post is only an
obsolete information and, in any case, I would like to know also what I can
do to go around in my problem..
>From the command line: ls /dev/sd* I get:
give me this input :
/dev/sda /dev/sda1 /dev/sda2 /dev/sda5 /dev/sdb /dev/sdb1
/dev/sdb2
Thank you
regards
Angelo
3 years, 4 months
