KCLUG

kclug@kclug.org

10 participants
3254 discussions

RE: BitTorrent + INDUCE Act + Linspire 5.0
by Brian Densmore 08 Oct '04

08 Oct '04

Have patience, Congress will get around to matches and lighters soon enough. Seriously though, these new laws dealing with P2P and Software patents, and copyright are all very dangerous and will be used as big sticks to beat down competition from small entrepreneurs. This outflux of talent from major corporations to small start-up companies is starting to rattle some of the people in power. After all they *need*, to keep a certain amount of slave labor close at hand. <dons tin foil hat, nervously looks left and right> > -----Original Message----- > From: David Nicol > > Oh please. Are matches illegal beccause of arson? > > > This week's Michael's Minutes talked about how Linspire 5.0 might be > > illegal because it incorporates BitTorrent/P2P. The INDUCE > Act is trying > > to make all P2P software illegal, but it could have a lot > broader effect > > than just a bunch of copyrighted music.

1 0

Re: Bittorrent
by Brian Kelsay 08 Oct '04

08 Oct '04

Azureus (http://freshmeat.net/projects/azureus/ ) is a Java Bit Torrent client for the viewers at home. Rich, why would you want UPnP to be able to run a BT client? I mentioned Bit Tornado ( http://freshmeat.net/projects/bittornado/ ) because it ran on Windows and Linux as Azureus should and it is a smaller download, although to build the Windows installer yourself you need Python installed and the Nullsoft installer. There is even a BUILD.Windows.bat that will build it for you after you have the pieces. Under Linux you need wxpython. There are prebuilt Windows Bit Tornado binaries out there. The readme for Bit Tornado gives all the info you need to build it and install under either platform. There are about four lines required to install either one. Then, as I've said several times, you open a range of ports. The default is 6881-6889, but you can change this after it is running. How hard is that Johnathan? All within about 3 pages max of readme and FAQ. All the extra pieces you might need for building are easily acquired from Google in a few minutes. If you choose the Java route, good luck. You may have Java installed already, so that may be an easier route for you. For some it has been troublesome. The last time I installed Java, I got a dead easy j2re installer from java.com. You run from the CLI and just have to agree to the license. You will probably have to change some permissions along the way, but I have already digressed too much. Get Bit Tornado here: http://freshmeat.net/redir/bittornado/52212/url_tgz/BitTornado-0.3.7.tar.gz only 173Kb Get Azureus here: http://freshmeat.net/redir/azureus/50968/url_bz2/Azureus_2.1.0.4_linux.GTK.… 4.3Mb Brian Kelsay >>> "Richard A. Franklin" <> 10/07/04 06:33PM >>> Brian Kelsay wrote: >With Bittorrent and its brother BitTornado, getting a file becomes as easy as double clicking on it and choosing where to save. That is pretty easy if you ask me. Now for those with a firewall, there are simple instructions on the BitTornado site. You do need to know how to login to and alter your firewall. I opened a range of ports quite easily on IPCop, which I then disable after I finish getting the torrent and serving for a while. > > > Okay, I continue to glean useful hints, and actual instruction, by opening kclug mail ... and curiosity overcomes total laziness. Besides, I just bothers me to use Windows to latch onto a Linux distro ISO torrent to feed to my finicky laptop. After reinstalling Azureus (azureus-2.1.0.4-0.gbv.3.i586.rpm ... using SUSE 9.1 PRO), I received "NAT Error" when testing my setup with the config wizard ... after checking a couple of router "how to" sites, it seemed that I perhaps needed to adjust my router settings. Like, maybe enable UPnP? I still did not know for sure, so I toyed with it a bit. Enabling UPnP had no effect; however, all is well after disabling the SUSE firewall (DUH?) ... Azureus opens little info windows, indicating which ports are being opened, and for what purposes, and it just works, regardless of whether I have checked, or unchecked the UPnP box in my router setup.

2 1

RE: firewalls and webservers request for comments
by Brian Kelsay 08 Oct '04

08 Oct '04

Wow. I felt too crappy last night to respond to this one, but I have to say, Dustin said most of what I intended to say. A definite separation of firewall and webserver is needed *IF* you are careful about security. As Dustin said, if an Apache vulnerability is found and someone cracks your webserver, as has already happened to you once, then you only need to rebuild your webserver. When running an enterprise you normally build separate boxes for each service available, for this reason, as well as for distributing load until you start needing clustering or load balancing of some sort. Read what the IPCop site has to say about adding services to your firewall and you may change your mind. http://www.ipcop.org/1.4.0/en/install/html/overview.html The docs that came with IPCop 1.3.0 has an even scarier message, "Here there be dragons...". Also, if your webserver is running on your home network, like mine is, you eventually want the externally available servers in a DMZ to protect your other home machines. I've been very happy with my IPCop 1.3 box and will soon upgrade to 1.4.0, but for now I'm too busy. 1.4.0 has a cool wireless DMZ added on, the Blue interface. I recently bought a PCI wireless card that will be tried out in this mode. Dustin, as always, your $.02 is well appreciated. Nice post. Brian Kelsay >>> "Dustin Decker" <> 10/07/04 06:07PM >>> > -----Original Message----- > From: On Behalf Of Brian Densmore > > Well, actually I already have iptables running. > I have only the ports open that need to be open > and only running the services that are needed. > I was really looking for what people thought about > firewalls protecting webservers and such. I mean > not just iptables but the whole ball of wax, the > tools for monitoring, etc. > > Ports I use: > > SMTP 25 > WWW ports 80 and 443 > IMAPS port 993 > and the SSH ports I would say one of the primary benefits of a dedicated firewall is found in the very clear separation of duties across hosts. For example, I make use of IPCop frequently with clients. If I need a port open for them (which isn't always the case) then I can forward it. In those cases where I have a handful of Windows users, I have the added benefit of using proxy services, tuned to the satisfaction of management, etc. My personal favorite is intrusion detection. In the case of IPCop, I make use of idabench to log all packets in/out of the network in binary format, farm it out to my analysis units, and replay through snort. Any of this type of activity, if performed on the web server, mail server, or what have you, adds an unnecessary load to that system. In addition, with extra services floating on the box, the odds that I will drop packets increases - and I only have to miss one to miss the Really Bad Packet(tm). One other concern I would have is for vulnerable software. If I have an apache server behind a firewall, and a new vulnerability is discovered, exploitation of it doesn't place my firewall at risk, where as root access gained through [insert hack of the week here] quickly gains the ability to disable iptables entirely. I guess this is one of those rare instances in which I don't entirely agree with Frank. (Oh, and my hang up on "bastion hosts".) Just for fun, while looking at the ports you have listed above, I wonder if you even need port 993 open. You mentioned in a previous post that you use webmail. If this is the _only_ method you use to check your mail, 993 needn't be open. That's only required if you have a mail client that fetches mail that way. (Squirrelmail, for example, can connect on loopback [127.0.0.1] to reach the mail server.) My $.02 on this thread.

2 1

RE: firewalls and webservers request for comments
by Brian Densmore 08 Oct '04

08 Oct '04

> -----Original Message----- > From: Dustin Decker > > I would say one of the primary benefits of a dedicated > firewall is found in > the very clear separation of duties across hosts. For > example, I make use > of IPCop frequently with clients. If I need a port open for > them (which > isn't always the case) then I can forward it. In those cases > where I have a > handful of Windows users, I have the added benefit of using > proxy services, > tuned to the satisfaction of management, etc. Separation is good, but can be costly too. > > My personal favorite is intrusion detection. In the case of > IPCop, I make > use of idabench to log all packets in/out of the network in > binary format, > farm it out to my analysis units, and replay through snort. > Any of this > type of activity, if performed on the web server, mail > server, or what have > you, adds an unnecessary load to that system. In addition, with extra > services floating on the box, the odds that I will drop > packets increases - > and I only have to miss one to miss the Really Bad Packet(tm). I guess the question is what kind of load does iptables and idabench and snort place on a machine? Is it big enough to cause dropped packets? What about processor speed and memory? Does intrusion detection cause a problem only on machines below a certain CPU speed and/or below a certain memory limit? > > One other concern I would have is for vulnerable software. > If I have an > apache server behind a firewall, and a new vulnerability is > discovered, > exploitation of it doesn't place my firewall at risk, where > as root access > gained through [insert hack of the week here] quickly gains > the ability to > disable iptables entirely. This is of course the primary reason I can think of for separation, but by the firewall forwarding doesn't that leave the webserver vulnerable anyway? Of course it would still keep the firewall intact and thus prevent the compromised machine to be wide open. Or would it? > > Just for fun, while looking at the ports you have listed > above, I wonder if > you even need port 993 open. You mentioned in a previous > post that you use > webmail. If this is the _only_ method you use to check your mail, 993 This is correct. I don't need that port because most of the time I use the webmail interface, but occasionally I use an IMAPS client. I could do away with that, but wanted to do the IMAPS server and client just to do it. PS Anyone notice the KCStar ad in last Sunday's paper for a Linux tech?

1 0

RE: firewalls and webservers request for comments
by Brian Densmore 08 Oct '04

08 Oct '04

Well, actually I already have iptables running. I have only the ports open that need to be open and only running the services that are needed. I was really looking for what people thought about firewalls protecting webservers and such. I mean not just iptables but the whole ball of wax, the tools for monitoring, etc. Ports I use: SMTP 25 WWW ports 80 and 443 IMAPS port 993 and the SSH ports > -----Original Message----- > From: Frank Wiles > > On Thu, 7 Oct 2004 17:05:45 -0500 > "aaron hirsch" > > > Why tell anyone here are the ports you will need to have > open when all > > ... > > http/https. Why open the door further than it needs to be? > > I wasn't trying to give him advice on how to run his E-mail setup. > > The listing of the ports was just an example to help illustrate why > running a firewall in front of an E-mail server is typically > pointless. > > I apologize if that wasn't clear.

3 2

Re: OT: ogg file blind, listening test
by Brian Kelsay 08 Oct '04

08 Oct '04

Jeff, I don't know about the .ogg bitrates, but with .MP3 I listen to 128Kb streams and files. My ears can detect a slight difference, but the space savings is worth it. At 256kb on MP3, even the most sensitive ears shouldn't detect the difference. Maybe less than 1% of the population would hear a difference. I seem to recall similar data on this at the Ogg Vorbis site and the WinAmp site. Look here and read down a ways: http://www.vorbis.com/faq.psp#lossy Brian Kelsay >>> jeffslists <> 10/08/04 02:10AM >>> Since someone here has just mentioned .ogg files I was wondering what encoding rate I need to use so that I cannot distinguish my .ogg file from my cd. A couple years back I read about a double-blind (maybe just single blind) study with 256kbit constant bitrate mp3's. The listeners, who were described to have excellent ears, could not distinguish the mp3's from the cd's, though a computer could. I don't care what a computer can distinguish. I have searched the net several times and found no similar study with .ogg files. Aren't there any people who have done a blind study with .ogg files? I want to know the minimum quality settings I can use with .ogg in order to save hd space. I have about 120gb 256kb mp3 music. According to my preliminary research I think I can save at least 30% space.

1 0

tid-bisquet: how to convert every .flac to .ogg
by Jason Clinton 08 Oct '04

08 Oct '04

Just for fun, here's a tiny one liner to turn every .flac file on your system in to a ~150Kb .ogg Vorbis file in the same directory the .flac file lives -- inspired by the Neuros Audio Computer. find / -iregex ^.*\\.flac$ -exec oggenc -q 5 {} \;

1 0

Bittorrent
by Jonathan Hutchins 08 Oct '04

08 Oct '04

Well, I've got to say BitTorrent has come a long way... I installed the optional "shadow" client available on my Mandrake 10.0 system, read up on the firewall requirements, punched through, found a torrent, and nothing happened. "Failed to connect" - real helpful. However, I hunted around, and did manage to find a decent torrent, and sure enough, I got about what I get when I can manage to find a good FTP server, 300+ kB/s. The speed often dropped below that, down under 200, but what the heck, chances of finding a full-speed ftp feed on an iso are pretty poor too. Error reporting could be better. It's likely that that "failed to connect" was actually inability to write to the target directory, which also gives a meaningful "failed" when I know that's the problem. There are still a lot of bogus torrents listed out there. Maybe it's a good idea, but I still say it's not quite there yet. (Oh, and the firewall thing is so basic that it should be easy to code around it, or at least pop up the directions when the cleint detects that it's blocked.)

2 1

Re: Bittorrent
by Brian Kelsay 07 Oct '04

07 Oct '04

With Bittorrent and its brother BitTornado, getting a file becomes as easy as double clicking on it and choosing where to save. That is pretty easy if you ask me. Now for those with a firewall, there are simple instructions on the BitTornado site. You do need to know how to login to and alter your firewall. I opened a range of ports quite easily on IPCop, which I then disable after I finish getting the torrent and serving for a while. As for the Starband users problems, we know it is a problem. Ask someone to download an ISO for you like the dialup users do. It took about 20-30 minutes for me to get Xandros last night. A few minutes to burn. Hope I remember that part when I get home. As was discussed on IRC, it would be nice if the FTP would fail over to torrent if the server has more than a certain amount of requests, but at the least, the tracker could come from the same location as the ISO. It is useful that at least the links to ftp and torrent are usually on the same webserver page. ----------------------------------------------------------------------------------- >>> Oren Beck <oren_beck(a)hotmail.com> 10/05/04 02:00PM >>> Sadly the concept of blaming the user is easier than making things simply work . Making things work simply is the truly non-trivial part we often forget about . Your idea of an alternate protocol is quite well advised . If no other reason than to allow the early adopters some way to GET the Torrent software itself . Even then alternate protocols are smart due to some of us not easily adopting Torrent for several reasons . Forgetting * any* software issues being the problem what then of us on connections totally unfriendly to Torrent. For example Starband and other upload speed restricted users . The core concept of Torrent was never in doubt , it's the deploying that needs work . What is very disturbing to me is that certain un-named players seem to be profiteering on the altar of Torrent ! Charging someone $ 10 for a HTTP download but free as Torrent seems quite extreme . Not mentioning those who as above are disadvantaged in access to Torrent for whatever reason . I could even understand a priority launch of Torrent seeding to FTP or HTTP sites on day zero as Slashdot effect prevention by load balancing thru redundancy in mirrors -THAT seems a good Torrent use . Brian Kelsay

3 2

RE: firewalls and webservers request for comments
by aaron hirsch 07 Oct '04

07 Oct '04

> Ok, y'all know I've got me one of them thar webservers > out there in the WWWild. I run a minimal firewall (aka > iptables). I'm wondering though what the consensus is > on running a full-blown firewall like say IPCop on a > server that is a busy box. My webserver is also a mail > server and naturally a webmail server. What are the benefits > of say adding a second box and running a full-metal jacket > firewall like IPCop, and can you run a webserver/mailserver > on the same box as IPCop (that is without ripping out the > guts of IPCop so it's no longer an IPCop version but some > chopped up hacked up Frankenstein monster)? If you are only running the services you need to be running and have locked down your system fairly well a firewall, either internal or external, is mostly pointless. If you're running an E-mail server and WWW server you'll need the following ports open: 25 SMTP 80 WWW 110 POP3 143 IMAP Possibly some others for SSL encrypted POP, IMAP, WWW and possibly SSHD if you're going to do remote administration. Putting a firewall in front of this box, or using iptables, is mostly a waste of time because you'll need all of these ports open to most every Internet IP address anyway or they can't provide their services. Firewalls aren't a magic bullet. Most every service you run on a Linux box can be IP restricted on it's own or if not you can use iptables to do this. That's all firewalls really do IP restrict who can access what ports. Considering most, if not all, of your services need to accessible from the entire Internet I wouldn't worry about a firewall. Why tell anyone here are the ports you will need to have open when all they have specified is services? Wouldn't it have been better to ask IF they wanted pop3/pop3s/imap/imaps before telling them to open xyz ports? I'm not trying to be a dick, but get the facts before telling someone to open xyz ports. Why should they open pop3 to the world if they are going to use imap, or vice-versa; heck why open them to the world at all if they are going to use webmail and imap and pop3 access are only required from the webserver? I've set up many mail servers where the only service available to the world is smtp, port 25, and http/https. Why open the door further than it needs to be?

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG