LINUX NEWS
RESOURCES & LINKS FROM BRAINBUZZ.COM
Thursday, January 18, 2001TABLE OF CONTENTS
1) Sean’s Notes
2) Linux News
Stand up and Be Counted!
Linux as Least Secure?
Run Ebay on Linux!
Cobalts to use Athlon3) Linux Resources
What's Kerberos Doing Here?
Bugs, Bugs, Bugs
Load Balancing Clusters
Booting off of a RAID-1 Device
The Personal Side of Being a Sysadmin4) App o’ the week
~~~~~~~~~~~~~~~~~~~~~~ ADVERTISEMENT ~~~~~~~~~~~~~~~~~~~~~~~ FREETECHMAIL.ORG
Tired of looking everywhere for newsletters with the technical information you need? FreeTechMail.org can help. It has the largest network of high quality opt-in newsletters on the Net. FreeTechMail’s search engine enables you to find all the newsletters to keep you at the forefront of the IT industry. Subscribe to your IT newsletters today at:
http://ad.brainbuzz.com/?RC06&AI03
For information on how to advertise in this newsletter
please contact mailto:adsales@BrainBuzz.com or visit
http://cramsession.brainbuzz.com/marketing/default.asp
-------------------------
1) Sean's Notes
-------------------------
One of the new features of the 2.4 kernel is an updated
version of the IP packet filtering code. Users of 2.2 are
familiar with IP chains, and should become familiar with IP
tables. Luckily, it's not too much different for basic
packet filtering.
With ipchains and iptables alike, there are three default
chains for filtering:
input - rules on this chain are applied to packets as they
enter an interface
output - rules on this chain are applied to packets as they
leave an interface
forward - rules on this chain are applied to packets that
cross from one interface to another
There are some major differences, however.
iptables capitalizes the name of the default chains, so it's
really INPUT, OUTPUT, and FORWARD.
With ipchains, a packet that was to be routed crossed the
input, forward, and output chains in that order. With
iptables, routed packets hit only FORWARD. INPUT and OUTPUT
are for packets that originate or terminate on that interface.
Instead of DENYing a packet in ipchains, you DROP it in
iptables (more on this later).
If you just want to do basic filtering and masquerading,
those are the differences. Under the hood, however, you have
been given direct access to packets at various stages of
processing known as "tables" (hence iptables). For example,
we'll hook into the NAT table to get address translation.
Modules can also be written to interface with packets.
We'll become acquainted with NAT in a second, but first load
in the module:
modprobe iptable_nat
Those familiar with ipchains will remember that we could
masquerade out our PPP interface via:
ipchains -A forward -i ppp0 -j MASQ
...In iptables, we now run:
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
Say what? -t nat? -A POSTROUTING? What's going on here?
Time to discuss the "filter" table.
INPUT, OUTPUT, and FORWARD chains are part of the "filter"
table, which is the default. This is where packets go before
they're accepted or transmitted. When a new connection is
started, the "nat" table is consulted. It has it's own chains,
namely PREROUTING, POSTROUTING, and OUTPUT. The one we're
interested in, POSTROUTING, is checked before a packet is
sent on the wire (but not before it hits the filter table!)
At this point, we're just sending any packets going out the
ppp0 interface to the MASQERADE chain. Subtle differences
from ipchains here -- the chain is no longer MASQ, and on
the forwarding chain you can specify the incoming (-i) or
outgoing (-o) interface. Previously, you could only specify
the outgoing interface via -i.
That aside, your basic packet filtering is the same:
iptables -A INPUT -s 10.0.0.0/8 -j DROP
This will drop all packets coming from the 10.x.x.x network.
The -j parameter sends the packet matching this rule to
either another chain (you can make up extras to optimize
stuff), or to a built in target, in this case "DROP". Others
are "ACCEPT" and "REJECT". A REJECTed packet causes an ICMP
message to be sent back, while a DROPped packet is ignored.
Those of you who want a bit more time with ipchains (or even
the 2.0 ipfwadm) can opt to have support for that. Load in
the "ipchains" or "ipfwadm" modules instead of the above and
go to town. I encourage you to learn this exciting new way of
handling packets (OK, maybe it's not exciting... My day job
is as a network guy so these kinds of things turn me on).
You can get a lot of useful information from the iptables man
page or at http://netfilter.samba.org/
The kind folks at Brainbuzz.com have given us our own board
to sound off on:
http://boards.brainbuzz.com/boards/vbt.asp?b2
Long live the Penguin,
Sean
swalberg@brainbuzz.com
-------------------------
2) Linux News
-------------------------
-------------------
Stand up and be counted!
-------------------
I remember that Slackware used to (and probably still does)
put a link to the Linux counter in root's mail box by
default. Sign up for the Linux counter; you can even see
who else is signed up in your area!
http://counter.li.org
-------------------
Linux as least secure?
-------------------
This is a fun read... Some mainframers decided that the
good 'ol mainframe is the most secure place to store data,
and that Linux is the worst. Their reasoning isn't much
better than "It's too hard to use". Sigh.
http://www.vnunet.com/News/1116290
-------------------
Run Ebay on Linux!
-------------------
Ebay runs on some high-end Sun hardware. As good as the
stuff is, they've had some serious outages in the past.
Would Linux be a good alternative? Lots of cheap hardware
rather than a little expensive gear? One only has to look
at Google to see what four thousand Linux boxes can do...
http://www.internetweek.com/newslead01/lead011101.htm
-------------------
Cobalts to use Athlon
-------------------
I love AMD. For desk tops and low end servers, you can't
beat the price/performance. SUN, after their recent
acquisition of Cobalt, is going to use Athlon chips in the
new appliances. This article points out some interesting
things with regard to scalability of the chips.
http://www.techweb.com/wire/story/OEG20010112S0082
-------------------------
3) Linux Resources
-------------------------
---------------
What's Kerberos doing here?
---------------
I was rebuilding Apache and PHP on a new Red Hat 6.2 box
yesterday. I found out the hard way that the imap packages
in 6.2 are linked against Kerberos, a distributed
authentication architecture. Even though I wasn't going to
use them, I still had to link PHP against the libraries. I
needed kerberos-devel and this handy tip:
http://www.geocrawler.com/archives/3/5/2000/5/50/3818227/
-------------------
Bugs, bugs, bugs
-------------------
I encourage everyone to follow linuxsecurity.com's advisory
watch to keep on top of the latest problems. This week's
advisories include some serious issues, including a bug in
glibc 2.2, the system libraries that ship with Red Hat 7.
http://linuxsecurity.com/articles/forums_article-2287.html
-------------------
Load balancing clusters
-------------------
Most people are familiar with Beowulf, a clustering project
for Linux. Here is Mosix, a general purpose cluster that's
a lot more transparent to applications. It's good for
building web clusters and the like.
http://www.mosix.org/
-------------------
Booting off of a RAID-1 device
-------------------
RAID-1 is otherwise known as mirroring, a process whereby
copies of data are stored (mirrored) on two drives. Lose
one, the other takes over. It's a bit tricky to make your
root partition a mirror, however. This article shows you
the ropes. It also focuses on another aspect of mirroring,
namely backing out of changes. Break the mirror before you
do your work. If something hits the fan, you've got a pre-
change copy of the system.
http://www.samag.com/linux/articles/v10/i01/a7.shtml
-------------------
The personal side of being a Sysadmin
-------------------
System administration isn't easy work... Besides the
technical stuff, you have to deal with people. Here's
some helpful advice for anyone in the system or network
administration role!
http://www.linux.com/sysadmin/newsitem.phtml?sid=1&aid529
-------------------------
4) App o' the week
-------------------------
Looking for some CD writing software for Linux? Look no
further than gcombust. I was up and running within minutes.
Lots of options, helpful troubleshooting, and a clean
interface make it the App o'the week.
http://www.abo.fi/~jmunsin/gcombust/
-------------------------
(C) 2001 BrainBuzz.com. All Rights Reserved.
-------------------------
-------------------------
This message is from BrainBuzz.com.
You are currently subscribed to the
Hottest Linux News and Resources
as: sean@ertw.com
To un-subscribe from this newsletter by e-mail:
send a blank email message to:
mailto:leave-linuxnews-3825955Y@list.cramsession.com
-------------------------------------------------------
To Subscribe to this newsletter by e-mail:
send a blank email message to:
mailto:join-linuxnews@list.brainbuzz.com
-------------------------