Centroid.EU Blog

(this blog is mostly encrypted - adults only)
  

Previous Page


New VPS at Hub.org

November 22nd, 2009

I started turning my home computer (uranus) off at nights since the fans are pretty loud and it's right beside my bed. This meant that for the centroid.eu zone there was a single point of failure since centroid.eu has 2 nameservers one of them being uranus.

So then I looked for a cheap VPS one that also allows me to do the TTLPATCH testing on wildcarddnsd and I've found one at hub.org. The server which I call dione is located in Panama of all places, which is far enough for a good TTL balancing.

0 comments

Windows 7 and IPv6

November 15th, 2009

I had some time tonight to get IPv6 in windows working, and it does work like a charm. See picture for the config (in german).

The IPv6 addresses are statically set and are behind a firewall. I can see the dancing KAME turtle with IE8.

0 comments

5 Euros donated to Wikipedia

November 13th, 2009

I use wikipedia quite often. Especially when it gets a little boring. I hope the five euros will cover my bandwidth charges, and it just wouldn't be the same with flashing banners greeting me everytime I go there.

0 comments

Random Hackepedia

November 13th, 2009

Todays random hackepedia is Symlinks.

0 comments

Configuring a Dovecot POP3 server

November 12th, 2009

Here is the config file:

protocols = pop3 pop3s
protocol pop3 {
        listen = 62.75.160.180:110
        ssl_listen = 62.75.160.180:995
}
auth default {
        mechanisms = plain 
        passdb pam {
                args = *
        }
        userdb passwd {

        }
}
ssl = yes
ssl_cert_file = /etc/ssl/certs/dovecot.pem
ssl_key_file = /etc/ssl/private/dovecot.pem
mail_location = mbox:~/mail:INBOX=/var/mail/%u
disable_plaintext_auth = yes
I had to install the pam-devel stuff for opensuse and add a certificate file that can be generated by a script in dovecots build_directory/doc.

0 comments

1993 Berlin wall pictures

November 9th, 2009

Pics from 1993.

0 comments

A theoretical attack on WildcardDNS and the Internet

November 7th, 2009

This attack theorizes on an attack on caching recursing nameservers. Pretend someone runs wildcarddnsd and thus wildcards the entire spectrum of their domain (zone).

this.is.valid.domain.com
stupid.little.tricks.domain.com
what.dns.is.not.domain.com
These are all valid A replies if domain.com has an A record set. Only problem is that when someone uses up the entire 255 characters of a valid domain name then the other recursing nameserver theoretically stores all this in memory for at least the time to live. So if someone looks up:
abcdef...a.domain.com (255 characters)
defghi...b.domain.com (255 characters)
.. then there is an awful lot that is stored in RAM on a nameserver.

If a botnet looks up these long domain names they can cause economic damage by wasting many many many bytes on an aggregate of foreign nameservers. And the nameserver that does wildcardding will get the bandwidth bill for all those lookups, although there is many "root servers" that have unlimited bandwidth for 60 euros a month. It'll look like a DOS but it's not (yet it can lead to a DOS).

To save the Internet some pain I've implemented the -W flag on my wildcarddnsd's and to basically save my ass the bandwidth charges.

Something to read that put me up to the idea:

PS: you don't need a botnet to do some damage. If you have a link that allows spoofing you can spoof into networks that don't have ingress spoofing filters on their routers and fake a question to DNS servers that would otherwise refuse to answer you. With the amount of bandwidth one can get 50/10 Mbps a considerable amount of damage can be done. So the protection against this is to have solid networks out there that don't allow spoofing of any kind.

0 comments

Upgrade (Hell)

November 6th, 2009

This week I purchased and installed 3 things. One, Windows 7 Home Premium edition. Two, VMware Workstation 7 and finally F-Secure 2010 Anti-Virus. I've never had an anti-virus program before so this was a first install for me.

I also downloaded Kubuntu 9.10 and installed it as my VMware host operating system. That was necessary because my old Redhat lacked some libraries that I needed for good sound support with the VMware Workstation.

So I had to move some OS's out of my active host team that I keep in the on state in VMware, in order to accomodate the 1 GB footprint of Windows 7. Windows 7 was a pain to install because vmware has crappy dvd support and using a sparse file for the dvd didn't work due to some copyright protection.

When I install Windows I compartment a superuser and a regular user. This way if there is a virus when I use windows, it can't write over system files and install a root-kit or whatever. I usually name the superuser admin. Only when installing Windows it asks to install a user and I didn't name it admin but "pjp" my usual acronym. So when I learned that I wanted to install "pjp" as a user with less privileges I had to rename the admin account. It left the home directory as "pjp" and gave my pjp user the directory of "pjp_2".

Activating the one year subscription for the anti-virus was pretty easy and I hope everything is protected now. I set it so that it scans files that I download through the web (real-time).

These were just some experiences I had with this years upgrade, I probably won't upgrade for at least another year unless something blows up badly.

0 comments

Random Hackepedia

November 6th, 2009

This weeks hackepedia article is Multicast. Enjoy.

0 comments

WildcardDNS bug fix

November 3rd, 2009

I fixed a bug in wildcarddnsd that caused zones to be 'lost'. Everyone who uses wildcarddnsd should upgrade to the latest version or tag "BETA_3". In the CVS log there is more detail on what went in since BETA_2.

0 comments

Next Page

Search

RSS Feed

Click here for RSS

On this day in

Other links

Have feedback?

By clicking on the header of an article you will be served a cookie. If you do not agree to this do not click on the header. Thanks!

Using a text-based webbrowser?

... such as lynx? Welcome back it's working again for the time being.

Older Blog Entries


Powered by BCHS