Centroid.EU Blog

I shaved my beard off

Today I got shaving foam and razor at the supermarket. Then in the late morning I shaved it all off. There is a red area on my chin, I may have to seek a skin doctor if this doesn't naturally go away. It was probably the area that I had dandruff on. It won't be snowing on my shirts anymore.

Server replaced after a 48 hour downtime

My provider has replaced the server (except harddrives). I am so sorry for the downtime, but we have more RAM now and overall a speedier server. Hopefully the problem was not software related, but we couldn't even get on console of the old one it was frozen up every time. Time will tell.

Longer outtage on centroid.eu

I just restored the computer, the provider put new RAM in it. Let's hope it stays up now. Sorry for the inconvenience according to my records the box was down since 9:01PM yesterday.

Downtime on centroid.eu

Sorry for any inconvenience this has caused. The server went down at 9:47AM and was restored at 12:49PM in the afternoon, a three hour outtage.

Safari is scary

I was browsing Wetter.com for the weather stats and it automatically downloaded something (a supposed anti-virus) in my Downloads directory. I'm reinstalling my Mac OS come Monday. What a PITA (pain in the ass). Oh yes I immediately turned off javascript.

A week of synfloods

Since about the 16th I've noticed a subtle synflood emanating from up to 160 /24's on mostly cloud providers. For the last day or so this has gone down to a trickle and I assume it's only testing the water or so.

I learned a lot about netfilter and pf this week. For one in pf when you do a os fingerprinting there is no statistics in a pfctl -srules -vv on fingerprinted packets. Finally I applied the synproxy rules on my openbsd servers with:

pass in quick on em0 proto tcp from any to $kite_ip port { 53 }  synproxy state

On Linux the story is a bit different. At first I applied the hosts that were synflooding me with a small script, such as this:

#!/bin/sh

netstat -na | awk '/SYN_REC/ {print $5}' | awk -F: '{a = split($1, b, "."); prin
tf("%s.%s.%s.0/24\n", b[1], b[2], b[3]); }' | sort -u |\
        while read i; do
                iptables -L -v -n | awk '{ print $8 }' | grep -q $i
                if [ $? -eq 1 ]; then
                        iptables -A SYNNERS --proto tcp -s $i  --dport 53 -j DRO
P
                        iptables -A SYNNERS --proto tcp -s $i  --dport 80 -j DRO
P
                        iptables -A SYNNERS --proto tcp -s $i  --dport 443 -j DR
OP
                fi
        done

exit 0

iptables -F INPUT
iptables -F NORMALIP
iptables -A INPUT --proto tcp --dport 53 -m u32 --u32 "0&0x0f000000>>24=5" -j NO
RMALIP
iptables -A NORMALIP --proto tcp --dport 53 -m u32 --u32 "0&0x000000ff=0x28 && 3
2&0x0000ffff=0x7210" -j DROP
iptables -A INPUT --proto tcp --dport 53 --j SYNNERS

While this was a great way to spend time with colleagues and friends on IRC (because they had synfloods as well), I got little delphinusdnsd programming done this week (which I had originally planned). Oh well.. maybe next week!

As far as the synflooder it's hard to know what it is. I suspect it's a worm that uses spectre to break into other cloud hosts and then installs a syn- flooder. But it's only a guess.

EuroBSDCon 2019 in Lillehammer, Norway

In almost exactly one month is Eurobsdcon in beautiful Norway. Unfortunately I won't be going. But I recommend anyone who thinks they are somewhat good with the BSD's to go meet the people that frequent BSDCon's. A lot can still be learned, and getting together in Norway makes a nice setting.

Ice Polar caps an endangered thing

Slashdot turned off it's anonymous coward posting so I'm posting this here. Elon wake up! Polar caps endangered.

RIP MrBill

The news has reached me that mrbill died. Sad. 1990's Efnet IRC is where we all sat and chatted. Best of times! You can compare now with then and back then everyone was just ok. I'm sure someone has logs of those days, but it was one thing to read logs and another to have a socket connected and view things in real time.

Laniakea and the great attractor

In conversation on IRC today I likened the universe like a prairie grass. Going back to youtube I then re-found this good clip (youtube.com) 4 min. Enjoy.