Perfect Forward Secrecy

Perfect Forward Secrecy

The NetworkManager client on Linux supports VPNs with PFS, however, the GUI wizard doesn't allow it to be specified. The workaround for this is to open the gconf editor and go to:

/system/networking/connections/n/vpn

where "n" is the connection number for the VPN. Add a key titled "Perfect@32@Forward@32@Secrecy" of type "String". Then just specify the pfs: "nopfs" or "dh0" or such.

SSH Login without Password

It's nice to log into frequently used servers without a password:

Generate an ssh rsa key with an empty paraphraze:

ssh-keygen -t rsa

Make sure user directory is private

chmod 700 .ssh

Create the .ssh in the user directory of the server (mode is important or server won't authenticate)

ssh user@server mkdir -m 700 .ssh

Append the new public key to the athorized_keys file (mode is important)

cat ~/.ssh/id_rsa.pub | ssh user@server 'cat >> ~/.ssh/authorized_keys'

On the server, add the following to /etc/ssh/sshd_config

PubkeyAuthentication yes

Automount USB Drive in Runlevel 3

On a server at runlevel 3 (i.e. no monitor and X isn't running), it's sometimes nice to have usb drives automatically mounted.

A rule needs to be added to run a script whenever udev detects that a new drive has been inserted. Create the file /etc/udev/rules.d/99-usb-automount.rules containing:

KERNEL=="sd[a-z]?", RUN+="/usr/local/bin/usb_mount",
ENV{REMOVE_CMD}="/usr/local/bin/usb_mount"

Then add the script file /usr/local/bin/usb_mount containing:

#!/bin/bash
# $Id$
#
# Script to automaticlly mount usb devices.  This script is designed to work
# with udev
#

#commands used in the script
MOUNT="/bin/mount"
UMOUNT="/bin/umount -l"
MKDIR="/bin/mkdir -p"
RMDIR="/bin/rmdir"

#the root of where all auto mouted devices will be mounted to.
MOUNT_ROOT=/media
MNT_POINT=$MOUNT_ROOT/${DEVNAME##/dev/}

if [ -z "$ID_FS_TYPE" ]
then
logger "unidentified fs type: '$ID_FS_TYPE'"
exit 0
fi

logger "running $0"
logger "ACTION=$ACTION ID_BUS=$ID_BUS DEVNAME=$DEVNAME ID_FS_TYPE=$ID_FS_TYPE"

# check we are adding a usb device
if [ "$ID_BUS" != "usb" ]
then
logger "ignoring non usb device"
exit 0
fi

# check the action to process

case "$ACTION" in

add )

    logger "mounting new device"

    #create the directory we will mount to
    $MKDIR "$MNT_POINT"

    #
    #mount the usb device with the following options
    #
    #  ro           - read only
    #  noexec       - Do not allow direct execution of any binaries on the mounted file system
    #  nodev        - Do not interpret character or block special devices on the file system
    #
    #$MOUNT -t $ID_FS_TYPE $DEVNAME $MNT_POINT -o ro,noexec,nodev
    $MOUNT -t $ID_FS_TYPE $DEVNAME $MNT_POINT -o noexec,nodev

    #check if mount suceeded
    if [ $? -eq 0 ]
    then
    # sucess, we mounted ok.
      logger "mounted $DEVNAME at $MNT_POINT"
    else
    # we failed to mount so remove the mount point
      logger "failed to mount $DEVNAME at $MNT_POINT"
      $RMDIR "$MNT_POINT"
    fi
    ;;

remove )

    logger "unmounting existing device"

    # check if the device is really mounted
    #if [ (grep -q "^$DEVNAME" /proc/mounts || grep -q "^$DEVNAME" /etc/mtab) ]
    #then
    # logger "$DEVNAME not mouted"
    #endif

    #unmount the device.  We will refer using the mount point not the device name
    #becase there is a posibility the device could be removed before we
    #do the umount.
    $UMOUNT "$MNT_POINT"

    #remove the mount point
    $RMDIR "$MNT_POINT"

    logger "unmounted $DEVNAME and removed $MNT_POINT"
    ;;

* )
    logger "ignoring unkown action"
    ;;

esac

Broken VMware keys

There was a problem in my VMware Windows XP guest OS running under Fedora 10 where all of the arrow keys plus page up/down and windows key were all fubar. I found a simple solution:

add the following to /etc/vmware/config

xkeymap.nokeycodeMap = true

Asynchronous PPPoE

A month ago I had problems with my bridged PPPoE DSL connection. Every few minutes the connection would crash and I'd be reassigned an IP. It seems to be a problem only when under a heavy load with lots of open connections. Some of the errors I was seeing looked like this:


Dec 17 08:43:03 server pppd[7005]: Protocol-Reject for unsupported protocol 0xee0a
Dec 17 08:43:35 server pppd[7005]: Protocol-Reject for unsupported protocol 0xe6bd
Dec 17 08:44:00 server pppd[7005]: Protocol-Reject for unsupported protocol 0xb615
Dec 17 08:46:04 server pppoe[7006]: too few characters read from PPP (syncReadFromPPP)
Dec 17 08:46:04 server pppoe[7006]: Sent PADT
Dec 17 08:46:04 server pppd[7005]: Modem hangup
Dec 17 08:46:04 server pppd[7005]: Connect time 4.9 minutes.
Dec 17 08:46:04 server pppd[7005]: Sent 283984133 bytes, received 222851068 bytes.
Dec 17 08:46:04 server pppd[7005]: Connection terminated.
Dec 17 08:46:04 server pppoe-connect: PPPoE connection lost; attempting re-connection.


The simple solution was to turn off the synchronous flag. I use Fedora so I added
SYNCHRONOUS=no
to /etc/sysconfig/network-scripts-ifcfg-ppp0. Now everything works great!

[Update] It looks like this is caused by a bug in Fedora 10.