One of my customers runs an old P3 as a mail-gateway and samba-server
(yeah, I know ...) behind his firewall ...
They simply don't want to swap hardware, they are happy ... until the
following started to happen every week or so:
The server goes offline, you can ping it OK but services like smbd,
postfix, sshd all are not reachable anymore.
I "see" the open ports with nmap from my machine ... but they are shown
as closed.
When the guy there restarts sshd on the server itself I am able to login
again without a problem. There are no bad messages in dmesg and/or
/var/log/messages.
But this seems to be related to the fact that syslog-ng also is inactive
then ... so who should log errors ... ?
Am 20.04.2010 14:01, schrieb Stefan G. Weichinger:
> I thought maybe the NIC has a problem?
>
> Ethernet controller: Realtek Semiconductor Co., Ltd.
> RTL-8139/8139C/8139C+ (rev 10)
>
> but as it doesn't lose its IP and config I think that is not the case here?
I noticed that both relevant kernel-modules were loaded as noted here:
Osamu Aoki wrote:
> Hi,
>
> On Sat, Apr 17, 2010 at 10:49:20AM +0200, Jozsi Vadkan wrote:
>
>> I want to put my server in a "server hotel".
>>
>> But: I don't trust my "server hotel owner".
>>
>> What can I do?
>>
>
> I am no expert on this issue but this is my common sense.
>
> Do not use such untrusted servers for the sensitive data.
>
> You can put measures to remote break-in etc. But whoever have local
> hysical access can get tou your data on the system.
>
> (I do not quite understand what kind of server arrangement ...
> virtualized or rack moiunted dedicated server... either way, it is the
> same thing.)
>
>
>> I can crypt my partition/hdd's that contains the data. Ok.
>> But: then my operating system will not be encrypted. Not Ok.
>>
>
> Well, once booted, and if they have some kind of hardware access before
> you boot into your system, you are doomed. Because they can have
> backdoor access.
>
>
>> If I crypt my operating system too, then when a reboot comes,
>> I have to type a password to decrypt. But my server will be at
>> a "server hotel" I can't directly use a keyboard [no service cpu].
>>
>
> All these methods protect against casual break-in but if system is run
> under some super-server like xen etc., your security measure stopps
> there.
>
>
>> What can I do [on technical side] to ensure a little more security
>> to my server [e.g: crypt my partition/slice/whatever, that has the
>> operating system, but without the "type password" ""problem""]
>>
>
> If they have monitoring system pre-installed, ... even with this
> protection is no good.
>
>
>> Thank you for any tips/help.
>>
>
> Keep sensitive data where you have full trust. The remote untrusted
> servers are good for web gateway only. But even for that, you should
> have some trust to them.
>
> Osamu
>
>
>
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/4BCD9FDE.4090804@ccf.auth.gr
04-20-2010, 10:07 PM
Stroller
gentoo-box stopping services
On 20 Apr 2010, at 13:01, Stefan G. Weichinger wrote:
...
One of my customers runs an old P3 as a mail-gateway and samba-server
(yeah, I know ...) behind his firewall ...
They simply don't want to swap hardware, they are happy ... until the
following started to happen every week or so:
You emphasise how old the hardware is, but this really isn't a
problem. As you say, one increasingly fears the death of a system
which is getting so old, but I have two systems nearly as old running
for years without hardware problems.
The questions I must ask are:
- How uptodate is the Gentoo software?
- Do you run updates regularly?
- Did you run any shortly before this started occurring?
- Have you run revdep-rebuild and stuff?
- Does the system have sufficient swap?
Stroller.
04-21-2010, 07:18 AM
Mick
gentoo-box stopping services
On Tuesday 20 April 2010 13:01:52 Stefan G. Weichinger wrote:
> greetings, gentoo-users ...
>
> One of my customers runs an old P3 as a mail-gateway and samba-server
> (yeah, I know ...) behind his firewall ...
>
> They simply don't want to swap hardware, they are happy ... until the
> following started to happen every week or so:
>
> The server goes offline, you can ping it OK but services like smbd,
> postfix, sshd all are not reachable anymore.
>
> I "see" the open ports with nmap from my machine ... but they are shown
> as closed.
>
> When the guy there restarts sshd on the server itself I am able to login
> again without a problem. There are no bad messages in dmesg and/or
> /var/log/messages.
>
> But this seems to be related to the fact that syslog-ng also is inactive
> then ... so who should log errors ... ?
>
> --
>
> I thought maybe the NIC has a problem?
>
> Ethernet controller: Realtek Semiconductor Co., Ltd.
> RTL-8139/8139C/8139C+ (rev 10)
>
> but as it doesn't lose its IP and config I think that is not the case here?
Have you looked at dmesg in case there is something there that the kernel's
spewed out? Also, you haven't run out of space? df -h
--
Regards,
Mick
04-21-2010, 07:28 AM
"Stefan G. Weichinger"
gentoo-box stopping services
Am 21.04.2010 00:07, schrieb Stroller:
> You emphasise how old the hardware is, but this really isn't a
> problem. As you say, one increasingly fears the death of a system
> which is getting so old, but I have two systems nearly as old running
> for years without hardware problems.
Yes, it does what it should do.
It's just that it gets more probable to have some strange and hidden
defects *maybe*.
But it would show other symptoms then, I assume.
> The questions I must ask are:
>
> - How uptodate is the Gentoo software? - Do you run updates
> regularly? - Did you run any shortly before this started occurring? -
> Have you run revdep-rebuild and stuff? - Does the system have
> sufficient swap?
OK, a bit more RAM wouldn't hurt here.
But I am compiling stuff right now.
-
ad updates:
I was rather defensive there, I have to admit ..
Just like "never touch a running system" ...
I updated the relevant pkgs like postfix, samba, clamav ... but there
are around 60 pkgs to update today.
Stuff like glibc, udev, pam .... I will apply them now step by step ...
revdep-rebuild was OK before, I had checked that after the last updates
a few days ago.
My first idea was to upgrade the kernel to maybe catch some relevant
fixes, that was about a week ago.
There was no specific update triggering this, in fact I hadn't touched
that box for weeks when the responsible man called me to tell me about
the new problems ...
Stefan
04-21-2010, 09:09 AM
Stroller
gentoo-box stopping services
On 21 Apr 2010, at 08:28, Stefan G. Weichinger wrote:
... Does the system have sufficient swap?
swap should be OK:
# free -m
total used free shared buffers
cached
Mem: 501 484 17 0 16
241
-/+ buffers/cache: 226 275
Swap: 494 288 205
OK, a bit more RAM wouldn't hurt here.
But I am compiling stuff right now.
I would add more.
Services mysteriously dying, surely that could be because the kernel
is killing them off due to an out-of-memory condition?
Maybe you have changed to a different compiler version in the past,
and this creates larger binaries?
That seems a bit tenuous, I don't know, but you can use a swapfile on
Linux (i.e. you can add to the current swap without having to create
an additional partition), and I doubt if it is hard to set up.
ad updates:
I was rather defensive there, I have to admit ..
Just like "never touch a running system" ...
I seem to get into more trouble when I'm cautious with updates than I
do when I just let 'em rip as often as possible. More frequent updates
means fewer updates.
Stroller.
04-21-2010, 08:50 PM
"Stefan G. Weichinger"
gentoo-box stopping services
Am 21.04.2010 09:18, schrieb Mick:
> Have you looked at dmesg in case there is something there that the kernel's
> spewed out? Also, you haven't run out of space? df -h
checked both before even posting here:
nothing stinky in "dmesg", "df -h" shows enough free space on the
partitions.
Thanks, S
04-22-2010, 03:31 PM
"Stefan G. Weichinger"
gentoo-box stopping services
Am 21.04.2010 11:09, schrieb Stroller:
>> OK, a bit more RAM wouldn't hurt here.
>> But I am compiling stuff right now.
>
> I would add more.
>
> Services mysteriously dying, surely that could be because the kernel is
> killing them off due to an out-of-memory condition?
Shouldn't the kernel *swap* then ?
I suggested adding RAM there, sure ...
> Maybe you have changed to a different compiler version in the past, and
> this creates larger binaries?
current version of gcc: 4.3.2-r3 (04:13:52 18.04.2009)
So it is about one year old, no changes since then. The symptoms only
started some week ago or two ...
I rather wonder about that f-secure scanner "fsav" ... I had to manually
fiddle it onto the system and it takes quite much ram and cpu.
But it is installed since june 2009 as well.
> I seem to get into more trouble when I'm cautious with updates than I do
> when I just let 'em rip as often as possible. More frequent updates
> means fewer updates.
I have to find some sweet spot here. I have quite many servers out there
at customers sites ... noone so far pays me for regularly emerging world
there ... this has to change, you are right ;-)
Stefan
04-22-2010, 03:50 PM
Alan McKinnon
gentoo-box stopping services
On Thursday 22 April 2010 17:31:33 Stefan G. Weichinger wrote:
> Am 21.04.2010 11:09, schrieb Stroller:
> >> OK, a bit more RAM wouldn't hurt here.
> >> But I am compiling stuff right now.
> >
> > I would add more.
> >
> > Services mysteriously dying, surely that could be because the kernel is
> > killing them off due to an out-of-memory condition?
>
> Shouldn't the kernel *swap* then ?
No, the OOM killer kicks in when the kernel has no more virtual memory,
including swap. Either way, more RAM is the answer. Or fidn the app with the
memory leak if you are unlucky enough to have one of those running around.
[snip]
--
alan dot mckinnon at gmail dot com
04-22-2010, 04:24 PM
"Stefan G. Weichinger"
gentoo-box stopping services
Am 22.04.2010 17:50, schrieb Alan McKinnon:
>> Shouldn't the kernel *swap* then ?
>
> No, the OOM killer kicks in when the kernel has no more virtual memory,
> including swap. Either way, more RAM is the answer. Or fidn the app with the
> memory leak if you are unlucky enough to have one of those running around.
The added swapfile with one GB won't help here for a start?
gentoo-box stopping services
