Search Results

Search found 13332 results on 534 pages for 'compatibility level'.

Page 283/534 | < Previous Page | 279 280 281 282 283 284 285 286 287 288 289 290  | Next Page >

• How to open a server port outside of an OpenVPN tunnel with a pf firewall on OSX (BSD)

  - by Timbo

  I have a Mac mini that I use as a media server running XBMC and serves media from my NAS to my stereo and TV (which has been color calibrated with a Spyder3Express, happy). The Mac runs OSX 10.8.2 and the internet connection is tunneled for general privacy over OpenVPN through Tunnelblick. I believe my anonymous VPN provider pushes "redirect_gateway" to OpenVPN/Tunnelblick because when on it effectively tunnels all non-LAN traffic in- and outbound. As an unwanted side effect that also opens the boxes server ports unprotected to the outside world and bypasses my firewall-router (Netgear SRX5308). I have run nmap from outside the LAN on the VPN IP and the server ports on the mini are clearly visible and connectable. The mini has the following ports open: ssh/22, ARD/5900 and 8080+9090 for the XBMC iOS client Constellation. I also have Synology NAS which apart from LAN file serving over AFP and WebDAV only serves up an OpenVPN/1194 and a PPTP/1732 server. When outside of the LAN I connect to this from my laptop over OpenVPN and over PPTP from my iPhone. I only want to connect through AFP/548 from the mini to the NAS. The border firewall (SRX5308) just works excellently, stable and with a very high throughput when streaming from various VOD services. My connection is a 100/10 with a close to theoretical max throughput. The ruleset is as follows Inbound: PPTP/1723 Allow always to 10.0.0.40 (NAS/VPN server) from a restricted IP range >corresponding to possible cell provider range OpenVPN/1194 Allow always to 10.0.0.40 (NAS/VPN server) from any Outbound: Default outbound policy: Allow Always OpenVPN/1194 TCP Allow always from 10.0.0.40 (NAS) to a.b.8.1-a.b.8.254 (VPN provider) OpenVPN/1194 UDP Allow always to 10.0.0.40 (NAS) to a.b.8.1-a.b.8.254 (VPN provider) Block always from NAS to any On the Mini I have disabled the OSX Application Level Firewall because it throws popups which don't remember my choices from one time to another and that's annoying on a media server. Instead I run Little Snitch which controls outgoing connections nicely on an application level. I have configured the excellent OSX builtin firewall pf (from BSD) as follows pf.conf (Apple App firewall tie-ins removed) (# replaced with % to avoid formatting errors) ### macro name for external interface. eth_if = "en0" vpn_if = "tap0" ### wifi_if = "en1" ### %usb_if = "en3" ext_if = $eth_if LAN="{10.0.0.0/24}" ### General housekeeping rules ### ### Drop all blocked packets silently set block-policy drop ### all incoming traffic on external interface is normalized and fragmented ### packets are reassembled. scrub in on $ext_if all fragment reassemble scrub in on $vpn_if all fragment reassemble scrub out all ### exercise antispoofing on the external interface, but add the local ### loopback interface as an exception, to prevent services utilizing the ### local loop from being blocked accidentally. ### set skip on lo0 antispoof for $ext_if inet antispoof for $vpn_if inet ### spoofing protection for all interfaces block in quick from urpf-failed ############################# block all ### Access to the mini server over ssh/22 and remote desktop/5900 from LAN/en0 only pass in on $eth_if proto tcp from $LAN to any port {22, 5900, 8080, 9090} ### Allow all udp and icmp also, necessary for Constellation. Could be tightened. pass on $eth_if proto {udp, icmp} from $LAN to any ### Allow AFP to 10.0.0.40 (NAS) pass out on $eth_if proto tcp from any to 10.0.0.40 port 548 ### Allow OpenVPN tunnel setup over unprotected link (en0) only to VPN provider IPs ### and port ranges pass on $eth_if proto tcp from any to a.b.8.0/24 port 1194:1201 ### OpenVPN Tunnel rules. All traffic allowed out, only in to ports 4100-4110 ### Outgoing pings ok pass in on $vpn_if proto {tcp, udp} from any to any port 4100:4110 pass out on $vpn_if proto {tcp, udp, icmp} from any to any So what are my goals and what does the above setup achieve? (until you tell me otherwise :) 1) Full LAN access to the above ports on the mini/media server (including through my own VPN server) 2) All internet traffic from the mini/media server is anonymized and tunneled over VPN 3) If OpenVPN/Tunnelblick on the mini drops the connection, nothing is leaked both because of pf and the router outgoing ruleset. It can't even do a DNS lookup through the router. So what do I have to hide with all this? Nothing much really, I just got carried away trying to stop port scans through the VPN tunnel :) In any case this setup works perfectly and it is very stable. The Problem at last! I want to run a minecraft server and I installed that on a separate user account on the mini server (user=mc) to keep things partitioned. I don't want this server accessible through the anonymized VPN tunnel because there are lots more port scans and hacking attempts through that than over my regular IP and I don't trust java in general. So I added the following pf rule on the mini: ### Allow Minecraft public through user mc pass in on $eth_if proto {tcp,udp} from any to any port 24983 user mc pass out on $eth_if proto {tcp, udp} from any to any user mc And these additions on the border firewall: Inbound: Allow always TCP/UDP from any to 10.0.0.40 (NAS) Outbound: Allow always TCP port 80 from 10.0.0.40 to any (needed for online account checkups) This works fine but only when the OpenVPN/Tunnelblick tunnel is down. When up no connection is possbile to the minecraft server from outside of LAN. inside LAN is always OK. Everything else functions as intended. I believe the redirect_gateway push is close to the root of the problem, but I want to keep that specific VPN provider because of the fantastic throughput, price and service. The Solution? How can I open up the minecraft server port outside of the tunnel so it's only available over en0 not the VPN tunnel? Should I a static route? But I don't know which IPs will be connecting...stumbles How secure would to estimate this setup to be and do you have other improvements to share? I've searched extensively in the last few days to no avail...If you've read this far I bet you know the answer :)

  Read the article

• Installing FreeNAS 8.3 problems

  - by osij2is

  I'm trying to install FreeNAS 8.3 on some desktop-level hardware (AMD Phenom + 890FX + 16GB) and I've been unsuccessful. I initially tried using a USB stick and followed the instructions on the FreeNAS site here. Making the USB was simple as the instructions laid out, but as soon as the USB is detected (during the boot process) some text appears and quickly vanishes and my machine reboots infinitely. After trying several different was to make the USB, I tried using a DVD-ROM but again, I had the same issue as the USB stick. This leads me to conclude that either a BIOS setting is incorrect but I have no idea which one. I've changed the BIOS to not "fast" boot per se, and I've correctly configured the boot order per USB stick and the DVD-ROM drive so I know that it's working. Have I missed anything that might be causing this problem? I'm not a FreeBSD/FreeNAS expert by any means.

  Read the article

• No blocked ports on internal interface of ASA

  - by blsub6

  I have a cisco ASA 5505 with three interfaces: Internal (100), DMZ (50) and External (0). The internal has a IPSEC VPN tunnel to my internal network I couldn't log in to my domain because of all of the port restrictions and such. I tried monitoring the traffic through the interface, seeing what it's blocking and then unblocking those ports but even then it didn't work completely correctly I finally just added a rule to permit any ip traffic from any network to any network on the internal interface and, of course, it worked fine But is that good security practice? Should I be blocking ports on an interface that's internal and over a VPN with the highest security level?

  Read the article

• Unable to get to remote samba share

  - by tubaguy50035

  I have a remote VPS that I would like to setup samba on and only allow my IP access to it. I currently have in my smb.conf: [global] netbios name = apollo security = user encrypt passwords = true socket options = TCP_NODELAY printing = bsd log level = 3 log file = /var/log/samba/log/%m debug timestamp = yes max log size = 100 [hosting] path = /hosting/ comment = Hosting Folder browseable = yes read only = yes guest account = yes valid users = nick I have the ports (137,138,139,445) open in iptables (they're open to everyone right now while I debug) and I see nothing in the syslog about iptables blocking my requests. When I try to open a file browser to my address \\ipaddress, it hangs for a good thirty seconds, and then opens a log in box. I enter my user name and password for the server, hit okay. It then opens the same box, I enter my credentials again and hit enter. Windows then tells me it could not connect. My user account is added to Samba already. Anybody have any suggestions what I can do to get this working?

  Read the article

• Delegation Permissions to admins in Active Directory/Taskpads

  - by user1569537

  I am trying to provide taskpads to few admins to operate on few tasks delegated to them at OU level.I ran into the following problem; lets say i delegated access to the admin on OU X and which is ability to modify groups such as sample group X1 , he must be able to add any users from OU X to the group X1. The issue here is while testing i found out the admin can do the above but also can add a user Y1 from the OU Y(which he doesnt have delegated permissions) to the group X1.What am i missing? how to restrict admin from adding users out of OU to the groups he has modify access to? Please ask me if any more details/clarification required.

  Read the article

• Find out the size of a .tar.gz archive in the terminal without unpacking

  - by Sven

  I have a 32GB .tar.gz archive and I'd like to know the size of the files if I unpack this compressed archive. I'd like to avoid unpacking the archive first and than use e.g. du. Is it also possible to find out the size of the contained files without unpacking the compressed archive (on a Linux and/or MacOSX system)? For another archive I know, that it also contains .tar.gz files. Is it also possible to calculate the size of the unpacked archives that are contained within an archive? (for example by setting a level to which the "unpacking" should be simulated?)

  Read the article

• 'Singleton' application - or let the user only launch one instance of a program at the time

  - by Disco

  I'm running a few linux desktops; mainly for kids (yeah, trying to teach them the right OS at early stage) (running Ubuntu 10.10, Gnome) The problem is that they found very funny to make their workstations (actually, old 512 Mb pentium 4) by launching thousands of firefox instances. I'm looking for a way to restrict them to launch 'N' instances of a particular application. Haven't figured yet how. Thought of a monitoring daemon but I think that would be too ressources hungry. Any idea of a script/trick to achieve this ? Note: i might have 1-2 level of users (the kids, and the more grown up kids) so i have also to limit per user; something like user1: 3firefox, user2: 2firefox instances.

  Read the article

• Exchange Activesync policy - can I make it not required for a user?

  - by TheCleaner

  Exchange 2010 sp2. I have a "C" level exec that wants to get his email on his android tablet. Easy enough. However, he doesn't want any Activesync policy applied to his device for remote wipe, etc. not even the default policy, and doesn't want to use OWA. I thought I knew Exchange pretty well, but can't find a Powershell command or anything that will allow a device to connect without enforcing at least some kind of policy. Is he out of luck using Activesync? I can set him up with POP3/IMAP, but would rather not.

  Read the article

• Mobile Intel 965 vs 4 Series chipset speed differences

  - by graham.reeds

  A client of ours is having a problem panning on a mapping application that we write on their panasonic toughbooks (CF-19's). One of their toughbooks the panning is fairly smooth while on the other it is really slow. Doesn't help that they have all the settings turned up, but I would of thought any reasonably new graphics card (even shared memory) would have more than adequate graphic speed. I am pretty sure that the graphic adapter is to blame, but I can't find anything out about either chipset (level of acceleration, non-problems, etc). All I get is the intel data sheets. The faster panning one is on the Mobile Intel 4 Series Express Chipset while the slower is on the Mobile Intel 965 Express Chipset. Is this expected? Does it sound like a driver problem? They both have the same amount of ram and same cpu.

  Read the article

• Building a network at home, what cables to use (if any)?

  - by Faruz

  My house is currently in ruins and am building it. While doing so, I wanted to design a home network. My main objectives are surfing and HD streaming. The house is one-level, 100 sq/m (about 300 sq/ft), and one of the rooms is a safety room with Reinforced concrete walls. About a year ago, when I started planning, I thought about putting Cat 6 STP cables in the walls and create network points in the rooms. Should I use STP or FTP? I heard that STP is a problem regarding connectors and stuff. Is it really beneficial? Will it work OK if I transfer the wire together with the telephone line? Should I maybe go with WLan and count on 802.11n to enable me to stream HD across the house? is 802.11n that good?

  Read the article

• Web log files analyzer

  - by Peter Štibraný

  I already use Google Analytics on my page, but I'd like to get additional info from log files. I've looked at various packages during last days, but nothing impressed me so far. Some requirements: must work on log file level (I use apache combined logs, but can configure apache to produce other types of logs) can generate static reports (windows/linux) or use GUI (windows only) should be easy to add custom user agents, and rerun analysis if it can recognize installation of eclipse plugins from log, that would be big plus understands google serp position referer should not require two days to setup (awstats, I am looking at you) should be still under active developement (i.e. analog isn't good answer) preferrably free, or at not very expensive :-) Any good analyzers programs out there?

  Read the article

• Connect iPad to windows 7 VPN

  - by Linuz

  My iPad keeps spitting out the error: "A connection could not be established to the PPP server." I am trying to connect it to a VPN I set up with Windows 7 as an incoming connection. On the iPad, I went into the VPN settings, added a new PPTP VPN with the following information Server: Windows 7 Computer's IP RSA SecurID: OFF Account: Account Username Password: Account Password Encryption Level: Auto Send All Traffic: ON Proxy: Off Now I know that it is making some connection to the Windows 7 Computer because whenever I intentionally put in the wrong VPN password on the iPad, it makes me put in the correct one before trying to connect again. All the ports are forwarded on my router for PPTP, and my Windows 7 Firewall is even off to try to get this to work. Any help would be greatly appreciated, thanks.

  Read the article

• Why is hosted storage so expensive?

  - by Mark Henderson

  There are many questions on Server Fault asking why server storage is so expensive. e.g. Why do I have to pay 50 bucks a month per extra gigabyte of storage or Our file server is always running out of space, why doesn't our sysadmin just throw an extra 1TB drive in there? These questions usually come from people who lack an understanding of how enterprise-level storage works and what influences the price. This question is designed to be the "question to end all questions" regarding the price of enterprise storage.

  Read the article

• IIS7 Rewrite rule being duplicated across 2 different websites (unwanted)

  - by Matt

  We have a IIS7 on Windows Server 2008. It is hosting a handful of sites, on a handful of ip addresses. 2 of those sites are actually wildcards on the domain: *.firstdomain.com *.seconddomain.com However, I am finding that any URL Rewrite rules I add for one of these "websites", is automatically in the URL Rewrite section for the other. Similarly, if I disable the rule in in one, it disables in the other. This doesn't happen with the other sites defined on this server, just these two. I look at the parent (top level, the server as a whole), and the rule is not there. Any idea what's going on here?

  Read the article

• Windows Software to Save Arbitrary Application State

  - by ashes999

  VM software does a great job of saving state when you "turn it off," allowing instant and immediate return to that previous state. Is there some application for Windows that allows me to do the same thing, for any arbitrary software? It would allow me to save/restore state, possibly via a shell command or button that it appends to every window. Edit: For clarity, there are two types of apps: those that save their own states, and those that save others' states. Those that save their own state are like Chrome, which on load, reloads the windows you had open last time. That's not what I'm asking about; I'm asking for an app that can save the state of other apps, kind of like VM software does; but for any app. (A trivial test would be load notepad++, type a bunch of stuff, and save-state; on reset-state, you should be able to multi-level undo a lot of what you wrote, as if you never shut down the application.)

  Read the article

• How can I send raw postscript to a remote printer via CUPS?

  - by Ash

  I have an ancient fax device with a printer interface that only accepts postscript level 1 documents formatted in a specific way. I only have access to this printer over the lpd:// protocol. I have some old documents from our previous system that work fine on our Unix machines, but they are altered somehow by CUPS when I use lp on our Linux system. The PDF files that end up in the print queue are significantly modified versions of the original, and although they still render in ghostscript, they don't do anything on the printer. I'm wondering if there's a way to tell CUPS "don't process this, just send it to the printer without modification", or whether there's a lpd client or procedure I could try?

  Read the article

• Linux: Tool to monitor every process, execute-command, shortly, monitor what's happening at the moment

  - by Bevor

  Hello, due to a freeze problem of my Ubuntu 10.10 (it is not isolatable) I though about logging every executable of the kernel somehow in any file to see what happens last when a freeze occures the next time to not lose valuable information. I found acct but this is obviously not what I'm looking for. Actually it logs just user commands and those things. I need something which logs in a much "deeper" level. The best would be some kind of script which records every interrupt. Does anybody know some tool like that?

  Read the article

• Battery notification always showing 'xx% remaining' with Windows 7 on an acer Aspire 5590

  - by dindeman

  My battery level always shows up as something like 55% remaining or 63% remaining ...etc despite that it is in fact charging. Additionally it doesn't go any further than 80% remaining even if I keep it in charge forever. This leads me to a side annoying effect which is that I cannot proceed to install Windows 7 Service Pack 1 as its installer requires the laptop to be plugged with a power cord. My laptop is plugged with the power cord but because of the above issue (it doesn't display anything else than the xx% remaining) Windows thinks that the laptop is using its battery and that the power cord is disconnected. I have installed the original acer ePower Management tool that let you configure the power scheme... etc, I was hoping that this would help me circumvent the 80% issue but it doesn't.

  Read the article

• Binding services to localhost and using SSH tunnels - can requests be forged?

  - by Martin

  Given a typical webserver, with Apache2, common PHP scripts and a DNS server, would it be sufficient from a security perspective to bind administration interfaces like phpmyadmin to localhost and access it via SSH tunnels? Or could somebody, who knew eg. that phpmyadmin (or any other commonly availible script) is listening at a certain port on localhost easily forge requests that would be executed if no other authentication was present? In other words: could somebody from somewhere in the internet easily forge a request, so that the webserver would accept it, thinking it originated from 127.0.0.1 if the server is listening on 127.0.0.1 only? If there were a risk, could it be somehow dealt with on a lower level than the application, eg. by using iptables? The idea being, that if someone found a weakness in a php script or apache, the network would still block this request because it did not arrive via a SSH-tunnel?

  Read the article

• How to "paint" the data layer of a CD using a CD drive?

  - by Jens

  I am looking for software to "paint" geometric shapes, dots or lines on the data layer of a writable CD (or DVD) using a standard drive. These do not have to be visible to the naked eye; I'd try to abuse the small dot size on the CD for some scientific measurements. I am aware of the "LightScribe" feature of some drives and that is not what I am looking for. Most of the software available is of course limited to write music or data, on does not offer the low-level "place a dot at this radius, this angle"-functionality. Is there something out there for me?

  Read the article

• powershell indentation

  - by Steve B

  I'm writing a large script that deploys an application. This script is based on several nested functions call. Is there any way to "ident" the output based on the depth ? For example, I have : function myFn() { Write-Host "Start of myfn" myFnNested() Write-Host "End of myfn" } function myFnNested() { Write-Host "Start of myFnNested" Write-Host "End of myFnNested" } Write-Host "Start of myscript" Write-Host "End of myscript" The output of the script will be : Start of myscript Start of myfn Start of myfnNested End of myFnNested End of myFn End of myscript What I want to achieve is this output : Start of myscript Start of myfn Start of myfnNested End of myFnNested End of myFn End of myscript As I don't want to hardly code the number of spaces (since I does not know the depth level in complex script), how can I simply reach my goal ? Maybe something like this ? function myFn() { Indent() Write-Host "Start of myfn" myFnNested() Write-Host "End of myfn" UnIndent() } function myFnNested() { Indent() Write-Host "Start of myFnNested" Write-Host "End of myFnNested" UnIndent() } Write-Host "Start of myscript" Write-Host "End of myscript"

  Read the article

• How can I restrict the backuppc client user as much as possible? (rsync)

  - by jxn

  I have backuppc making full backups of servers, but I'd like to be sure that my set up is as paranoid as possible. BackupPC is set up to backup via rsync, and it is set up to use a specific user on each client to be backed up. Because the backuppc client user has to have access to every file on the client machine and the ability to ssh into the machine without an interactive password, I'm a little nervous about securing the clients, and I'd like to know I haven't overlooked any options. Here's what I have in place: in the client user's authorized_keys file, i've included from="IPTOSERVER",command="/usr/bin/rsync" before the user's public key, so that the user can only login coming from the BackupPC server. Next, in the sudoers file, I've added this line: backuppc ALL=NOPASSWD: /usr/bin/rsync to allow root-level permissions only for the rsync command for that user. Are there other user, policy, or ssh restrictions that I can add while still allowing the backup pc client user to rsync all files?

  Read the article

• ZFS Configuration advice

  - by rbarrette

  I need some advice on configuring ZFS. Here is what I have: Physical Disks: 4x 3 TB 2x 2 TB 2x 1 TB What is the best configuration for my Vdevs and storage pool. I want to maximaze space but still maintain redundancy. Should I just get 2 more 3TB's and just create 2x 3-3TB raid2z storage pools? Create a 1x 4-3TB raidz2 vdev? Can I put redundancy at the pool level and create individual vdevs for each drive and then add 2x 1TB+2TB striped vdevs to keep all vdevs the same size. Keep in mind I do need to migrate data from the smaller drives and am planning on adding more 3tb drives later on. What do you think?

  Read the article

• 5 x 3GB drives and 4 x 1500GB drive best raid setup?

  - by Zen_Silence

  Hello, I am building a file server my plan is the have the Operating system on one raid partition and the data storage on another partition. I currently have 5 x 3GB IDE drives that i would like to put the operating system on theses drives are old but that doesnt matter to me at the moment i have a ton of them so for this raid partition i would probably want to be able to pull out dead a drive and rebuild the array. My file partition is going to consist of 4 x 1.5TB SATA drives I would like the maximum storage with some redundancy. Any suggestions to which Raid level i should use would be greatly appreciated and if you could also suggest a PCI or PCI-e raid controller to handle theses arrays. Thanks in Advance, Zen_Silence

  Read the article

• mount samba share on a vmware instance

  - by Riduidel

  I've a windows machine in which a linux server is run by a "VMWare player". From the windows machine, I want some folders to be mounted on the Linux virtual server. All this is done in a maven build (which is quite irrevelant here, in fact). From what I understand, to make these windows folders available as mountable ones, I have to do the following operations Share the folders as Samba ones using net share, this I have done. Access my virtual server and check which folders are already mounted (which seems to be doable using a less /etc/fstab), this I'll do soon Mount my samba shares using smbmount All that seems to my by far too hackish code. Could the same be done using ... say ... JMX/SNMP or any other high-level technology ?

  Read the article

< Previous Page | 279 280 281 282 283 284 285 286 287 288 289 290  | Next Page >