ZABBIX_1.8 TWEAKS

Playing with Sharememory (OpenBSD) Style

kern.shminfo.shmmax=204800000
kern.shminfo.shmall=40960000

FreeBSD Tweak for ZABBIX-1.8
kern.ipc.shmall=40960000
kern.ipc.shmmax=204800000

took me a while to see zabbix running =)

Ruby 1.8.7 iconv issue

successfully build ruby 1.8.7 on OpenBSD 4.5

./configure && make && make test && sudo make install

Installed RubyGems -

running ruby I got the following error:


WARNING: No database support: LoadError no such file to load -- iconv

After doing some googling i found the following fix:

$ cd ruby-1.8.7-p174/ext/iconv/
$ ruby extconf.rb --prefix=/usr/local --with-iconv-dir=/usr/local
checking for iconv() in iconv.h... no
checking for iconv() in -liconv... yes
checking for const of iconv() 2nd argument... no
creating Makefile
$ make
gcc -I. -I. -I/usr/local/lib/ruby/1.8/i386-openbsd4.5 -I. -I/usr/local/include -fPIC -g -O2 -c iconv.c
gcc -shared -fPIC -o iconv.so iconv.o -L. -L/usr/local/lib -Wl,-R/usr/local/lib -L/usr/local/lib -Wl,-R/usr/local/lib -L. -Wl,-E -liconv -lm -lc
$ sudo make install
/usr/bin/install -c -m 0755 iconv.so /usr/local/lib/ruby/site_ruby/1.8/i386-openbsd4.5


I'm using ruby for metasploit so having the following fix really save me a lot of trouble.

OpenVPN on OpenBSD

I'm running OpenBSD 4.5 (Stable) on this setup

1.) download openvpn package through ports-tree or PKG_PATH
2.) cp -R /usr/local/share/example/openvpn/easy-rsa /etc/openvpn
3.) cd /etc/openvpn/easy-rsa/1.0 (freaking 2.0 is broken ./vars goes bonkers)
4.) . ./vars
5.) ./clean-all
6.) ./build-ca <-- this will build ca.crt
7.) ./build-key-server your-server-name <-- this will build server.crt/server.key
8.) ./build-dh

Adding Certificates:
1.) /etc/openvpn/easy-rsa/1.0
2.) . ./vars
3.) build-key your-client-name

Revoking Certificates:
1.) /etc/openvpn/easy-rsa/1.0
2.) . ./vars
3.) ./revoke-full your-client-name

== server ==
server.conf

local IP-TO-LISTEN
port 1194
proto udp
dev tun0
ca ca.crt
cert server-name.crt
key server-name.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0 <-- this is default you can change it
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
max-clients 50
user _openvpn
group _openvpn
persist-key
persist-tun
status /var/log/openvpn-status.log
log /var/log/openvpn.log
log-append /var/log/openvpn.log
verb 9
mute 10

== client ==
follow the intstructions on
http://www.openvpn.net/index.php/open-source/downloads.html
Mac Users Like me: use "viscosity"


And your done!
NOTE vpn-keys are without a passphrase, you can change them at any time with the openvpn gui (change password)

enjoy... it was a smooth setup just don't get excited with the options.. the lesser the options the better chances of deploying it quickly .. once you have a working vpn server .. then you can play Little Einstein. =)

Engine-X

Building Engine-X (nginx) on OpenBSD 4.5

nginx-0.7.62

./configure \
--prefix=/var/nginx \
--user=_nginx \
--group=_nginx \
--with-rtsig_module \
--with-select_module \
--with-poll_module \
--with-http_ssl_module \
--with-http_realip_module \
--with-http_addition_module \
--with-http_xslt_module \
--with-http_sub_module \
--with-http_dav_module \
--with-http_flv_module \
--with-http_gzip_static_module \
--with-http_random_index_module \
--with-http_secure_link_module \
--with-http_stub_status_module \
--with-http_perl_module \
--http-log-path=/var/nginx/logs/access.log \
--error-log-path=/var/nginx/logs/error.log \
--http-client-body-temp-path=/var/nginx/client \
--http-proxy-temp-path=/var/nginx/proxy \
--http-fastcgi-temp-path=/var/nginx/fastcgi \
--with-cpp_test_module \
--with-pcre \
--with-md5-asm \
--with-sha1-asm

make
sudo make install

pretty cool huh?

Haklam VS Level 10,000

I always thought that I'm messed up... but it looks like there are more people that are far more messed up than me...

http://www.facebook.com/people/Haklam-Aikiliz/614011748

http://www.facebook.com/people/Marcin-Misztal/774651903

Boo Hoo ISA proxy Crap.. Squid can talk with AD

This Post should serve as a reference, for someone who wants to build a proxy server using squid and is tied up with (bureaucracy, politics, Layer's 8 and 9, etc.) to play nice with Active Directory.

NOTE to Readers: I made this in order to serve as a guide, If it doesn't work you can ask out real questions through (squid-users at squid-cache.org). who knows i might see it there. anyways let the fun begin.

OS: OpenBSD 4.5 (Stable on HS20 IBM Blade Center)

Grab a Fresh Copy of the following:

- Squid (squid-3.0.STABLE16.tar.gz) - my favorite Proxy Cache
- Samba (samba-3.3.5.tar.gz) - used to make windows AD like our *nix box
- Berkeley DB (db-4.7.25.tar.gz) - needed by SquidGuard
- SquidGuard (squidGuard-1.4.tar.gz) - my favorite keyword filter

I have the following output on my pkg_info:

autoconf-2.59p3 automatically configure source code on many Un*x platforms
autoconf-2.61p3 automatically configure source code on many Un*x platforms
bison-2.3 GNU parser generator
bzip2-1.0.5 block-sorting file compressor, unencumbered
cyrus-sasl-2.1.22p4 RFC 2222 SASL (Simple Authentication and Security Layer)
gettext-0.17p0 GNU gettext
gmake-3.81p0 GNU make
gnutls-2.6.2 GNU Transport Layer Security library
help2man-1.29p0 GNU help2man
libgcrypt-1.4.3p0 crypto library based on code used in GnuPG
libgpg-error-1.5 error codes for GnuPG related software
libiconv-1.12 character set conversion library
libltdl-1.5.26 GNU libtool system independent dlopen wrapper
libtasn1-1.5 Abstract Syntax Notation One structure parser library
libtool-1.5.26p0 generic shared library support script
libutf8-0.8p0 provides UTF-8 locale support
lzo-1.08p1 portable speedy lossless data compression library
m4-1.4.11 GNU m4
metaauto-0.9 wrapper for gnu auto*
mutt-1.5.18-sasl-sidebar-compressed tty-based e-mail client, development version
ntp-4.2.4pl6p0 Network Time Protocol reference implementation
openldap-client-2.3.43 Open source LDAP software (client)
popt-1.7p0 getopt(3)-like library with a number of enhancements
qdbm-1.8.77 high performance embedded database library
rsync-3.0.5 mirroring/synchronization over low bandwidth links
tcl-8.5.6 Tool Command Language
wget-1.11.4 retrieve files from the web via HTTP, HTTPS and FTP

-- i have a lot of packages because some of them i build using the ports tree. --

create user = _squid (options: nologin, daemon, no password)

1.) Build Squid

./configure --prefix=/var/squid \
--enable-xmalloc-statistics \
--enable-icmp \
--enable-delay-pools \
--enable-useragent-log \
--enable-referer-log \
--enable-kill-parent-hack \
--enable-ssl \
--enable-pf-transparent \
--enable-ntlm-fail-open \
--enable-cpu-profiling \
--enable-auth="ntlm,basic" \
--enable-external-acl-helpers="wbinfo_group"
--with-default-user=_squid

gmake
sudo gmake install
sudo chown -R _squid:_squid /var/squid
gmake clean

2.) Build Samba

tar zxvf samba-3.3.5.tar.gz
cd samba-3.3.5
source/./configure --prefix=/var/samba3 --with-winbind --with-ads (you can remove the --with-ads option but me I just like it! =P )
make && sudo make install
gmake clean

ldconfig -m /var/samba3/lib <-- you may need to add this on /etc/rc.local


3.) Build Berkeley DB

cd build_unix
../dist/configure --prefix=/usr/local/BerkeleyDB
make
sudo make install
make clean

ldconfig -m /usr/local/BerkeleyDB/lib

4.) Build squidGuard (the newest version of BerkeleyDB completely works with squidGuard 1.4 (tested)

./configure --prefix=/var/squidGuard --with-db=/usr/local/BerkeleyDB --with-squiduser=_squid
gmake
sudo gmake install
gmake clean

5.) Add the Configs

smb.conf

[global]

netbios name = KRAKEN
workgroup = DOMAIN
realm = DOMAIN.LAN
server string = Proxy Server
encrypt passwords = yes
security = ADS
password server =
log level = 3
log file /var/log/samba/%m.log
max log size = 50
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
printcap name = /etc/printcap
preferred master = no
dns proxy = no
ldap ssl = no
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind use default domain = yes
cups options = raw

krb5.conf

[libdefaults]
default_realm = DOMAIN.LAN
clockskew = 300
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes
default_tgs_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
default_tkt_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMA
preferred_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC

[realms]
CORP.PLC = {
default_domain= DOMAIN.LAN
kdc =
admin_server =
}

[domain_realm]
.DOMAIN.LAN = DOMAIN.LAN

[kdc]
profile =/etc/kerberosV/kdc.conf

[kadmin]
# This is the trickiest part of a Kerberos installation. See the
# heimdal infopage for more information about encryption types.

# For a k5 only realm, this will be fine
# default_keys = v5

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/ksadmin.log
kadmind = FILE:/var/heimdal/kadmind.log

kadm5.acl

*/KRAKEN@DOMAIN.LAN *

kdc.conf

[kdcdefaults]
acl_file = /etc/kerberosV/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /etc/kerberosV/krb5.keytab
v4_mode = noreauth

[libdefaults]
default_realm = DOMAIN.LAN

[realms]
DOMAIN.LAN = {
master_key_type = des-cbc-crc
supported_enctypes = des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal des-cbc-crc:v4 des-cbc-crc:afs3
}

krb5.keytab <-- we'll create this later.

As soon as all the configs are in, it's time to fire up samba (start smbd,nmbd,winbindd).

sudo kinit KRAKEN@DOMAIN.LAN

sudo klist
sudo /var/samba3/bin/net ads join -U KRAKEN -d1

If there are no errors then tap yourself in the back.. you just added your squid box into AD.

--- AD Certificate part --- This is through windows okei?

ktpass -out c:\temp\KRAKEN.keytab -princ host/KRAKEN.PROXY@DOMAIN.LAN -mapuser myhost -pType KRB5_NT_PRINCIPAL +rndpass

this key will let your squid box logged into AD automagically. As soon as it generates the key. copy it to your squid box and run the following command:

ktutil copy /path/to/KRAKEN.keytab /etc/kerberosV/krb5.keytab

delete the KRAKEN.keytab file from AD.

for the rest of the squid.conf config please refer to

http://wiki.squid-cache.org/ConfigExamples/Authenticate/WindowsActiveDirectory (you don't think that I'll just spoon fed you guys the entire time huh, bub? besides RTFM your using squid. not ISA crap.

after the config change run:

sudo /var/squid/sbin/squid -z (this will generate the cache file folders)
sudo /var/squid/sbin/squid (squid goes daemon mode. put this into /etc/rc.local)

OpenBSD doesn't like winbind

I just found out from ports that winbind doesn't go into the ports FLAVOR for samba due to it's nature of talking with nsswitch.conf which obsd folks don't support. but .. not all hope is lost. some cool folks at ports send out this patch that you can add into the samba ports to build winbind

Index: Makefile
===================================================================
RCS file: /cvs/ports/net/samba/Makefile,v
retrieving revision 1.105
diff -N -u -p -u Makefile
--- Makefile 30 Jun 2009 21:38:38 -0000 1.105
+++ Makefile 30 Jun 2009 23:20:08 -0000
@@ -60,7 +60,7 @@ CONFIGURE_ARGS= --disable-fam \
CONFIGURE_ENV= CPPFLAGS="-I${LOCALBASE}/include" \
LDFLAGS="-L${LOCALBASE}/lib -Wl,--export-dynamic"

-FLAVORS= cups ldap ads
+FLAVORS= cups ldap ads winbind
FLAVOR?=

MULTI_PACKAGES= -main -docs
@@ -93,6 +93,12 @@ CONFIGURE_ARGS+= --without-ads

.if ${FLAVOR:L:Mads}
WANTLIB+= crypto
+.endif
+
+.if ${FLAVOR:L:Mwinbind}
+CONFIGURE_ARGS+= --with-winbind
+.else
+CONFIGURE_ARGS+= --without-winbind
.endif

PKG_ARCH-docs= *
cvs server: Diffing inside files
cvs server: Diffing inside patches
cvs server: Diffing inside pkg
Index: pkg/PFRAG.winbind-main
===================================================================
RCS file: pkg/PFRAG.winbind-main
diff -N -u -p -u pkg/PFRAG.winbind-main
--- /dev/null 30 Jun 2009 17:20:08 -0000
+++ pkg/PFRAG.winbind-main 30 Jun 2009 23:20:08 -0000
@@ -0,0 +1,6 @@
+@comment $OpenBSD$
+bin/wbinfo
+include/wbclient.h
+lib/libwbclient.so
+lib/libwbclient.so.0
+libexec/winbindd
Index: pkg/PLIST-main
===================================================================
RCS file: /cvs/ports/net/samba/pkg/PLIST-main,v
retrieving revision 1.9
diff -N -u -p -u pkg/PLIST-main
--- pkg/PLIST-main 14 May 2009 17:05:46 -0000 1.9
+++ pkg/PLIST-main 30 Jun 2009 23:20:08 -0000
@@ -133,3 +133,4 @@ share/swat/include/footer.html
share/swat/include/header.html
@sample /var/spool/samba/
%%SHARED%%
+%%winbind%%

enjoy =)

Get your kicks on route CVS

CVS just makes life easier, makes the blame game a bit more accurate. but overall simplifies the maintenance of everything that's text.

here's how i did it:

mkdir /cvs-server1
chmod 1770 /cvs-server1
export CVSROOT=/cvs-server1
cvs -d /cvs-server1 init
chown -R _cvs /cvs-server1
chgrp -R cvsgroup /cvs-server1

that's it.. ssh to the box

to import:

export CVS_RSH=/usr/bin/ssh
cvs -d:ext::/cvs-server1 import -m "desc"

to checkout:

export CVS_RSH=/usr/bin/ssh
cvs -d:ext::/cvs-server1 co


I used OpenBSD 4.5 sweetest operating system on the planet. comes with cvs =)

i used _cvs user to tagged the folder as "cvs" it's locked
i used cvsgroup as a group to put in all the cvs-users i have in mind.

it's a simple setup all in all, i didn't even bother to chroot the box since i use this box for one thing. CVS nothing more.

All UID's should be accounted for their actions

I got this off my copy of the openbsd list, this clearly shows how openbsd's state of mind with regards to security.. which makes perfect sense.


from Theo de Raadt
to patrick keshishian
cc ports@openbsd.org
date Mon, Jun 1, 2009 at 11:20 PM
subject Re: user and syslog question for pptp client
mailed-by openbsd.org

hide details 11:20 PM (5 hours ago)


Reply

Follow up message
> Hmm.. kinda feels like a waste to create a new user/group.
> The app doesn't write to any files nor does it have any
> config files (ATM).
>
> How about I stick with nobody?

How about everyone just share the root account?

What are you afraid of, that we'll run out of users and groups?

There are very good documented reasons why we have all daemons
use different uids. Much security is failed from seperation.

nspluginwrapper

A bold step, Flash is still Evil from OpenBSD fans alike. I personally get by my regular work without it. but there are some folks that find Flash attractive .. in any case .. here's a good link.

http://openbsd.stanleylieber.com/txt/openbsd_firefox_flash_player_7.txt

TEXT Format: just in case the file goes away

------------------------------------------------------------------------------------------------
.----------------------------------------------------------------------------.
| |
|---------------/ Flash Player 7 and OpenBSD native Firefox 3 /--------------|
| |
`----------------------------------------------------------------------------'
openbsd@stanleylieber.com ================== htt://openbsd.stanleylieber.com


[ Why ]

Flash is a necessary evil. If you disagree, why keep reading?


[ How ]

This document assumes ports/www/firefox3 is already installed and running
on your system.

Install Fedora and the Opera Flash plugin from ports:

# cd /usr/ports/emulators/fedora && make install && make clean
# cd /usr/ports/www/opera-flashplugin && make install && make clean


Add the following to /etc/sysctl.conf:

kern.emul.linux=1


Enable Linux compatibility for the running system:

# sysctl -w kern.emul.linux=1


Unpack port-nspluginwrapper.tgz[1] into /usr/ports/www and install:

# cd /usr/ports/www/nspluginwrapper && make install && make clean


If the package build fails on your machine you will have to manually
copy the relevant files to their proper locations:

# cd /usr/ports/www/nspluginwrapper/w-nspluginwrapper- \
0.9.91.5/fake-i386/usr/local
# cp bin/nspluginwrapper /usr/local/bin/
# cp -R lib/nspluginwrapper /usr/local/lib/


Install Opera's Linux Flash Player in Firefox 3:

# nspluginwrapper -i /usr/local/lib/opera/plugins/libflashplayer.so


Start or restart Firefox to enable the plugin. Enter about:plugins in
the address bar to verify the plugin is installed.


[ Acknowledgments ]

Thanks to Benoit Chesneau[2], seveninety.com[3] and the original authors[4]
for their work on nspluginwrapper.


[ References ]

[1] http://openbsd.stanleylieber.com/ports/www/port-nspluginwrapper.tgz

[2] http://www.nabble.com/-NEW--nspluginwrapper%2C-mozilla-flashplugin \
-td10314619.html#a10314619
http://babilu.metavers.net/openbsd/nspluginwrapper

[3] http://seveninety.com/openbsd/flashplayer9.htm

[4] http://gwenole.beauchesne.info//en/projects/nspluginwrapper


.---------------------------------------------------------------------------.
| |
| -sl |
| |
`---------------------------------------------------------------------------'


EOF
------------------------------------------------------------------------------------------------

Poster's NOTE:

I've tried this on my 4.4 box and i have to do a pkg_delete to take out rpm (RH package manager util) and re-run the opera-flashplugin.

All credits are given to the author of the port nspluginwrapper although the port is not official (based on what I've read *maybe it is*)


Enjoy OpenBSD fans!

Earthquake sa costa rica Jan. 9, 2008

Lindol... ang lakas =)

Sismo1
Cargado por noticias24

New year 2009

It's a rough 2008...

2008's DDoS blues for starters. as well as some random carnage on the hardware part. how i wish I can only play NETWORK guy... life would have been easier.

ohhh .. well... Happy New year 2009

10+hours to go... till 09.

-pfunix

1337 cereal anyone?

A friend of mine sent me this cool picture! lol did some googling and got into a site.


http://pwnagecereal.ytmnd.com/ says on the site "If you eat like a n00b you will be 0wn3d like a n00b LOL ... the hax0r .. style of typing i guess just won't go away ... lol! It's like a white guy that acts like a black guy. awesome!!!

Login!

Password RESET for MacOSX (no disk needed)

Command-key + s - SETS MAC TO BOOT ON SINGLE MODE
fsck -fy
mount -uw /
launchctl load /System/Library/LaunchDaemons/com.apple.DirectoryServices.plist
dscl . -passwd /Users/

:)

OpenBSD Syslogd Centralized Server

I setup OpenBSD 4.2 as a Central Loggin Server. with awesome results (no need for any other 3rd party logging software OpenBSD has it all)

Paranoid Fishies check this out:

my /etc/rc.conf

syslogd_flags= "-u -a "

my /etc/syslog.conf

# $OpenBSD: syslog.conf,v 1.17 2005/05/25 07:35:38 david Exp $
#

*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none /var/log/messages
kern.debug;syslog,user.info /var/log/messages
auth.info /var/log/authlog
authpriv.debug /var/log/secure
cron.info /var/cron/log
daemon.info /var/log/daemon
ftp.info /var/log/xferlog
lpr.debug /var/log/lpd-errs
mail.info /var/log/maillog
local7.debug //
#uucp.info /var/log/uucp

# Uncomment this line to send "important" messages to the system
# console: be aware that this could create lots of output.
#*.err;auth.notice;authpriv.none;kern.debug;mail.crit /dev/console

# Uncomment this to have all messages of notice level and higher
# as well as all authentication messages sent to root.
#*.notice;auth.debug root

# Everyone gets emergency messages.
*.emerg *

# Uncomment to log to a central host named "loghost". You need to run
# syslogd with the -u option on the remote host if you are using this.
# (This is also required to log info from things like routers and
# ISDN-equipment). If you run -u, you are vulnerable to syslog bombing,
# and should consider blocking external syslog packets.
#*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none @loghost
#auth,daemon,syslog,user.info;authpriv,kern.debug @loghost

# Uncomment to log messages from sudo(8) and chat(8) to their own
# respective log files. Matches are done based on the program name.
# Program-specific logs:
#!sudo
#*.* /var/log/sudo
#!chat
#*.* /var/log/chat


touch filename.log
chmod 644 filename.log


now for the Device Part:

Cisco Router: 7200Series

conf te
service timestamps log datetime
logging host transport udp port 514
logging facility local7
logging trap debugging
logging on

nikto scan

i did a test using nikto today and found out a couple of "said" vulnerabilities:

---------------------------------------------------------------------------
- Nikto 2.02/2.03 - cirt.net
+ Target IP: 172.17.4.20
+ Target Hostname: 172.17.4.20
+ Target Port: 80
+ Start Time: 2008-02-12 12:53:41
---------------------------------------------------------------------------
+ Server: Apache
- Allowed HTTP Methods: GET, HEAD, OPTIONS, TRACE
+ OSVDB-877: HTTP method ('Allow' Header): 'TRACE' is typically only used for debugging and should be disabled. This message does not mean it is vulnerable to XST.
+ OSVDB-877: TRACK / : TRACK option ('TRACE' alias) appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details
+ OSVDB-877: TRACE / : TRACE option appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details
+ OSVDB-2117: GET / : Appears to be a default Apache install.
+ OSVDB-2799: GET -evasiondose.pl?daily&somefile.txt&|ls| : DailyDose 1.1 is vulnerable to a directory traversal attack in the 'list' parameter.
+ OSVDB-3268: GET /icons/ : Directory indexing is enabled: /icons
+ OSVDB-3233: GET /icons/README : Apache default file found.
+ 3657 items checked: 8 item(s) reported on remote host
+ End Time: 2008-02-12 13:00:33 (412 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested


enter Mod_Rewrite

RewriteEngine on
RewriteCond %{REQUEST_METHOD} !^(GET|POST|HEAD)$
RewriteRule .* - [F]

RewriteEngine on
ReWriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
ReWriteRule .* - [F]

this needs to be put on the directive. in order to take effect. fixes the issue, happy openbsd :)

learning curve

私輪渡り者です。

I'm getting there ...

hushmail a.k.a NSAmail?

I've been using hushmail for almost a year now, and I use it mostly for inter-hushmail email since It does a pretty good job on encrypting mail... but it's just scares me to know that encryption based email services on the net *might* be owned by those folks that just like watching.... say.. NSA?

Anyways either this is true or not. It's a nice read.

http://groups.google.com/group/alt.security.pgp/browse_thread/thread/5171d049f75a2bbc/7fa4d97626043295

Kinda makes you wonder how they can get away with using encryption from the US.GOVT prying eyes.

hushmail owns 1 block of ip's 65.39.178.0/24 and puts on their whoisdb

Peer 1 Network Inc. PEER1-BLK-06 (NET-65-39-128-0-1)
                                65.39.128.0 - 65.39.255.255
Hush Communications USA PEER1-HUSHMAIL-01 (NET-65-39-178-0-1)
                                65.39.178.0 - 65.39.178.255

# ARIN WHOIS database, last updated 2008-01-28 19:10

# Enter ? for additional hints on searching ARIN's WHOIS database.

and indicates that the country of origin is GB(GreatBritain)? look closely though their class is owned by a company called peer1 networks.

OrgName:    Peer 1 Network Inc.
OrgID:      PER1
Address:    75 Broad Street
Address:    2nd Floor
City:       New York
StateProv:  NY
PostalCode: 10004
Country:    US

NetRange:   65.39.128.0 - 65.39.255.255
CIDR:       65.39.128.0/17
NetName:    PEER1-BLK-06
NetHandle:  NET-65-39-128-0-1
Parent:     NET-65-0-0-0-0
NetType:    Direct Allocation
NameServer: NS1.PEER1.NET
NameServer: NS2.PEER1.NET
Comment:    ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate:    2002-06-21
Updated:    2006-09-20

RTechHandle: ZP55-ARIN
RTechName:   Peer1 Network Inc.
RTechPhone:  +1-604-683-7747
RTechEmail:  net-admin@peer1.net

OrgAbuseHandle: NSA-ARIN
OrgAbuseName:   Peer 1 Network AUP Enforcement
OrgAbusePhone:  +1-604-484-2588
OrgAbuseEmail:  abuse@peer1.net

OrgTechHandle: ZP55-ARIN
OrgTechName:   Peer1 Network Inc.
OrgTechPhone:  +1-604-683-7747
OrgTechEmail:  net-admin@peer1.net

# ARIN WHOIS database, last updated 2008-01-28 19:10

# Enter ? for additional hints on searching ARIN's WHOIS database.

US IP block you be the judge.... =D *evil grin*

OpenBSD and PPTP!

It's already been a week now since I've started fiddling my rules and i just ended up with having 1 client ONLY to successfully connect to an external pptp server. the openbsdmail-lists says that, it's pptp's fault. because it's old but i believe it's a challenge.

we'll see what happens next. anyways below are the 2 rules I've come up with. that will let pptp pass-through a PF/Carp box (OpenbSD 4.1 Tested): Just make sure you pass TCP and GRE Traffic.

given setup is (BLOCK in/out ALL)

#Rule Style 1
pass out quick on $ext_if inet proto gre all label "GRE out WAN"
pass in quick on $ext_if inet proto gre all label "GRE in WAN"
pass out quick on $int_if inet proto gre all label "GRE out LAN"
pass in quick on $int_if inet proto gre all label "GRE in LAN"
pass out quick on $int_if inet proto { tcp, udp } from any to any port 1723
pass in quick on $int_if inet proto { tcp, udp } from any to any port 1723
pass out quick on $ext_if inet proto { tcp, udp } from any to any port 1723
pass in quick on $ext_if inet proto { tcp, udp } from any to any port 1723

Rule Style 2
pass in quick on $int_if inet proto { tcp, udp } from any to any port 1723
pass in inet proto gre from any to any
pass out inet proto gre from any to any

frickin is not a good way to pass-pptp. i guess it can be done on the kernel justlike linux's ppt-passthrough.

http://www.internetpulse.net/
http://blogs.interfacett.com/mike-storm/
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a00808d2b72.shtml
http://www.ciscoblog.com/archives/security/pix/configurations/