Stupid computer questions; server edition!

Is the purpose to increase productivity or to decrease BSA visits?

Definitely the former -- hell, I'll use pirated server software if it works! The main problem I want to knock out is all of us having the same fonts, but in a version that's just different enough to crash InDesign 50 times a day so that we can barely edit each other's files.

Are there good reasons not to accomplish this with NFS? You should share the font repository to all the Mac clients, mounted in one of the 4 locations OS X looks for fonts. Linotype's FontExplorer does auto-activation, hence you could keep them mostly unactivated except when requested, so's to keep things from slowing down horribly.

could share, not should share.

I'm not sure what to say if you have PCs that need fonts, tho. Maybe FontExplorer for Windows can do something similar, say using SFU.

Just sharing among the Macs will do... yeah, I had dismissed NFS after an outside networking consultant (read: cool friend who knows his shit) explained that it was insecure, has only one level of permissions, etc. But he was talking about our file backup server. So, yeah, you're right, this is just a bunch of fonts for five or six people.

NFS on the public Internet is a bad idea, yes, but in the context of a crunchy-exterior-smooth-interior philosophy, it's not bad at all, and it can far outperform SMB. You can kick the security up a teensy weensy notch with SMB, or you can go whole-geek by kerberizing NFS or AFS. Really, though, NFS is fine if you don't have any insecure WAPs or allow strangers to plug inna yr network.

When I ran NFS, only my trusted subnet could hit it and we had that rpc server that did uid mappings etc. It does perform amazingly though. I hate SMB.

Yes, well. First we fix our font issues, but next on the list is turning the big file server into an AFS box, because SMB just ain't cutting it for moving giant files like raw photos to and from the server often and with multiple users. The PC people have no reason to access that server anyway. (*saving this post for the next meeting*)

To riff on Jon's point, ACLs++. Always a good idea. Hardcode IPs on the DHCP server too and restrict scopes accordingly, if you want to be a bit more careful. Or hardcode on the Macs.

Always a good idea. Hardcode IPs on the DHCP server too and restrict scopes accordingly

Or hardcode on the Macs.

You mean hardcore the client's OUIs on the server? Better, but I can defeat it. I used restricting routing trusted ips to a trusted physical lan segement.

Also, http://en.wikipedia.org/wiki/Arpwatch is awesome if you're an admin

I'm obviously not, but nobody else is either, so I'm getting a kind of thrown-to-wolves style education in networking.

Who needs college, amirite?

college doesn't teach you anything practical about networking or security

everybody who does this shit for a living learned it by being "thrown to the wolves" and if they didn't learn it that way their odds of even getting through a phone interview are slim

Yes, I realize that the suggested measures are not the best. It's more like hiding the cookie jar. If you really want filesharing with good security, use kerberized NFS or AFS.

that doesn't help anything when your users' client machines all get rooted because one guy falls for the "download storm video codec to view this content" link at the bottom of a page hosted from the .ws TLD

but I digress

xposts Yeah, it's a strange situation here because not a single soul who put this network together still works here, and the IT department is stretched way thin (real estate industry maybe not pulling in scads of cash right now) and they all also tend to get a 50-yard stare when confronted with anything other than a Windows machine. And our Macs need maintenance in a big way, and I guess I get to do it at least on a low level, because I already know amazing shit like how to correctly put ram into one of our metal boxes. But shit, good for me, I'll leave this place with some job skills I certainly didn't have coming in. Or at least a distant idea of what that involves.

http://www.matasano.com/i/g-bad.gif

college doesn't teach you anything practical about networking or security

-- El Tomboto, Wednesday, April 23, 2008 2:54 PM (17 minutes ago) Bookmark Link

or software engineering / project management

At some point, you really need to stop worrying about bored 14-year-old boys sneaking into yr office and plugging stealth lappies into yr secured ports and realize that the guys who are gonna perp the sabotage/espionage/fuckupipage either have all the root/admin passwords already or are dim enough to carry around CDRs full of social security numbers. Threats cannot be eliminated, but only managed: If you do this right, you don't have to be the fastest gazelle in the pack, just not the slowest.

I rooted an ivy league school & the human genome project through dumpster diving and finding an admin's password list.

/etc/motd on HGP was a REALLY COOL ascii of a double helix

The point being that said school couldn't afford a $100 shredder?

Mitnick also got 99% of his access from human engineering.

Also most of the kiddie shit i did was:

1) get shell via sniffing / stealing cached ftp login / remote overflow of daemon
2) elevate privs via local exploit of syscall / suid binary
3) install sniffer, trojan'd ssh/telnet/ftp, repeat

The CS department in college (long after my kiddie days) was hit by Mitnick and was using an S/KEY gateway ( one time passwords) to get into ssh or telnet on anything in the CS net until openssh was widely deployed.

And then you complain about the security measures on ILX.

It was really annoying when you ran out of fresh S/Keys and you had a project due.

Sorry, are you trying to be snarky?

Just connecting the dots, dude.

I'm not sure what you're getting at. That I complain that the "security" measures on ILX are fascist? No, I complain that they're fucking annoying and stupid.

I think jon has identified what you actually do learn in college.

(not me, lol liberal arts)

I was pretty good at being condescending and rude already.

Please report back on how well whatever you decide to do goes, kenan.

What is a more appropriate title for someone who has comprehensive web control for a company but wants to emphasize that they're not a designer/webmaster but are more focused on hard ITish stuff (cache servers, ssl stuff)

technical architect
infrastructure leader
systems adminstrator/architect
cto

Comprehensive web controller

shut-in aspie rube

senior shut-in aspie rube

MASTER CONTROL PROGRAMmer

What is difference between CTO and CIO?

The CIO goes to more meetings.

Not really joking about that, actually -- if your company has both, the CTO is the more hands-on go-to tech guy, and the CIO makes sure that it's all making money.

kenan have you ever worked for a technology company

no sir i have not.

i only know what they tell me.

Ok, hi. I was hoping I would not be the only one asking stupid questions around here. This one's not only stupid but also vague. WTF do I do with ssh? I can't connect to my server even locally -- "Read from socket failed: Connection reset by peer" -- and it seems on every forum I check online, the answers come in two flavors: 1) "Ok do this one thing and BOOM! What? It still doesn't work? Well... it oughta!" or 2) "Here are leather-bound volumes I-XVII of the SSH Manual, which one did you have in mind today?"

Grrr.

Really I'm just looking for a place to vent a little. I'll get it someday. :(

First, start off with ssh -v. If it's not clear at that point, do sshd -d -p 1234 and then ssh -p 1234 localhost.

More than likely, sshd is shutting down because of something it views as insecure. Perhaps perms on some file or a bad config.

yeah, i appreciate it, but I suspect that there's some basic concepts of networking/permissions/users/groups/owners/etcetc that I just plain don't have. But I'll post the results of -v, maybe they're clear as day to someone else.

OpenSSH_4.7p1, OpenSSL 0.9.7l 28 Sep 2006

debug1: Reading configuration data /etc/ssh_config

debug1: Connecting to 192.168.1.107 [192.168.1.107] port 22.

debug1: Connection established.

debug1: identity file /Users/kenanhebert/.ssh/identity type -1

debug1: identity file /Users/kenanhebert/.ssh/id_rsa type -1

debug1: identity file /Users/kenanhebert/.ssh/id_dsa type -1

debug1: Remote protocol version 2.0, remote software version OpenSSH_4.7p1 Debian-8ubuntu1

debug1: match: OpenSSH_4.7p1 Debian-8ubuntu1 pat OpenSSH*

debug1: Enabling compatibility mode for protocol 2.0

debug1: Local version string SSH-2.0-OpenSSH_4.7

debug1: SSH2_MSG_KEXINIT sent

Read from socket failed: Connection reset by peer

the original spec sounds like you have no money to spend if you can't spring for an old g4 and copy of 10.3! so... are you actually buying font licenses to cover all the people who can connect to the system?

Nothing out of the ordinary with that ssh -v. Try the next step.

check the logs on the server. could be something like tcp wrappers rejecting you for not having a reverse resolving ip address

The ssh problem was about the known hosts file. No biggie, fixed it. Thanks, guys.

Ok, so, Ms. Server has been running pretty rock-like for over a week, and I'm proud as a new daddy. I have a rfi re: routers, though. Do I need an upgrade? I have the ubiquitous Linksys WRT54G Wireless-G, which is just dandy for home networking, but are there routers that are more specifically geared toward a buncha people trying to download big files from you at the same time?

The reason I ask -- it seems that any time there's internet traffic to or from the router and I also do something seemingly innocuous like move a file from one machine to another on the local network, this router has a tendency to freeze. It just locks up, the little lights keep blinking like mad but nothing can connect to the internet or anything else, and I have to power cycle it to get it back. It's also been known to do this with nothing happening but downloading a torrent. Lately more and more it likes to drop chat connections. The speed seems adequate, but try to do one thing too many, or occasionally even just one thing, and it pisses the rug. It seems to groan under some unseen weight all the time. I don't know enough about routers to even begin to point at the problem, and googling "router [model number] stops working" isn't much help.

The setup here is: one iMac, one PC running Linux, one PC made into a server and also running Linux, all wired to the router. One Powerbook, wireless. One internal drive in the server, two in the linux box, and two external drives hooked to the iMac, one USB drive that's 100% dedicated to music, and one Firewire monster for Time Machine backups of the Imac and the music drive. The iMac, server, and music drive are all mounted at startup on the Linux machine, which I use to administer the server, listen to music off the music drive, really most "control center" kinda stuff.

SO. THE QUESTION: should I drop almost $200 bucks on an AirPort Extreme? Or would that just be paying for ease of use when there's some other way to get this tortuous and increasingly break-y setup under a little more control?

The problem here is that Linksys = crap, always has been crap, and probably always will be crap. The Airport Extreme would be a good choice, but you'd have to get a switch, since it doesn't have enough wired ports. I have two AEs at home which I use in WDS mode, and they're fairly reliable, but not 100% bulletproof.

If you want to save money but not buy total shit, get a Netgear all-in-one "blue box" or spend a little more on an AE. If you want to be geeky and spread the risk around, get an airport and a firewall. Netgear ain't perfect, but their blue boxes are reasonably reliable.

This is good firewall option if you are feeling the geek lately.

The AE has four ethernet ports and one USB, right? So three machines wired, one wireless or maybe not, and one USN external drive (the music one) in the usb port for network-wide lovin'. That's what I was thinking, anyway. I'm curious how AE sets itself up -- from what I skimmed, it acts as a server itself, with its own usernames and access privileges?

I don't hook up storage to my AE, so I dunno how well that works. I guess the new AEs have 3 LAN ports, so you could get by. The 4th is WAN, so you'd have all ports full.

Looks like you can't use an AE in Leadville, CO.

Ah yes, you are correct. I would have the minimum number of needed ports.

("Minimum" I suppose meaning that I'm the type that could buy another computer at a moment's notice for no damn good reason, and that's maybe something I need to consider well apart from how many ports the AE provides. Hell... what do I need with FOUR machines, even? I'm like one of those people that won't stop having kids.)

xpost what?

Leadville is above 10,000 ft, the max operating condition for the AE.

Well, lucky for me I'm about 9500 feet below that. PHEW!

There's another thing I'm thinking that I'm trying hard not to think too much -- that airport extreme shure is sexy-looking. Man, that would look sweet on one side of my iMac, with the iOmega hard drive on the other side. A perfect matched set of rounded rectangles and squares. I might have to get a mac mini, too, and go for a magic-number-three set of identical 6.5" squares.

See where this kind of thinking leads? I should take a walk or something.

The AE has been mine for a week or so, but I'm struggling with it. The ftp connection is a real issue that I can't seem to get around. It locks up in passive mode, that seems to be pretty major, it just won't let you in. The PASV box is checked; I thought that was all there was to it. The Apple firewall is turned off, near as I can tell.

229 Entering Extended Passive Mode (|||18983|)
200 EPRT command successful. Consider using EPSV.

...and that's it, that's all you get. No errors, but it won't do anything else. Stay like that forever if you leave it there.

Active mode does work, but obviously has its own problems, and I don't want to run it that way.

Passive FTP is problematic only when the server is behind a NAT firewall unable or unwilling to handle the dynamically-assigned high-numbered port redirect. In other words, it's a hazy reflection of the active FTP problem; a canny firewall (e.g., Pix 506, mentioned earlier?) can handle the situation admirably.

This cluster of issues is one reason I marshal my firewalling in a functional realm distinct from that of my WAPs.

Although I don't use H.323, a nice Pix selling point is its transparency in the face of such an overengineered protocol.

My new Compaq laptop's power cord doesn't fit the only eligible 3-prong outlet I have, and the manual says not to use an adapter, lol.

(heading for the support site -- this is gonna cost me extra for an alternate cord, ja?)

Wow. I am embarrassed by everything I ever said on this thread.

v helpful, k.

Morbs: a 3-prong outlet or plug is just power + a ground, so adapting your 3-prong plug to a 3-prong outlet of a slightly different shape is probably not what they meant when they said "Don't use an adapter," assuming that the third prong is the trouble.

OTOH, I have never seen a U.S.-sold 3-prong plug that did not fit into a U.S.-resident 3-prong outlet. So you could be up against something entirely different than what I'm thinking.

How old are these outlets?

Whatever you do, and I have learned this the hard way, NEVER plug a fancy nice new computer into the 100-year-old wiring of your quaint city apartment building without a surge protector in between.

xp: how do I know? my building is prewar.

The eligible 3-prong outlets has horizontal upper slots, whereas the Presario plus's prongs are vertical.

Don't know how I missed the original question/thread, but Linotype FontExplorer isn't free anymore, but it's cheap and the main new feature it's adding is server support. I've used Extensis's various products, both running off the server and not, and pretty much hate them. I've used Font Agent Pro off server, even wrote a little manual for it, and it's pretty good but isn't perfect. It's more picky than suitcase about fonts and won't activate some, some won't auto-activate and need manual activation, and a few I still need to use FontBook, i.e., manual load the font into the Mac system, if Font Agent won't load them.

I've been a big fan of Font Explorer and if I had to set up a Font server, would give that a try.

And you do not ever want to put fonts in any of the places macs look for fonts, outside of the minimum amount of system fonts or whatever annoying fonts Microsoft and Adobe install automatically. Font Explorer and Font Agent Pro will manage the fonts and copy them into their own directory so they can activate/unactivate them.

xxp: surge protector, great. What else? how many other THINGS do I have to get to put between the outlet and the cord?

"WHY DON'T YOU GET A COMPUTER?" people have asked me for ten years... It's a second fucking unpaid job.

Don't use that outlet.

All my others are 2-prong outlets, except for the fridge and I'm not choosing between food and laptop.

How do I find out what kind of plug the surge protector has?

Get your landlord/super to install a grounded outlet.

http://answers.yahoo.com/question/index?qid=20080716123839AAECerw

re: that outlet, if you want to use it, you should check the voltage as it probably isn't standard

well, another stupid question -- how do you check the voltage?

The eligible 3-prong outlets has horizontal upper slots, whereas the Presario plus's prongs are vertical.

That's a specialized wire meant to go to a specific and high-voltage thing, like a washing machine, refrigerator, or lesbian sex toy. You can't plug it in there there because it would be a bad scene for everyone.

And yeah, tell your landlord. You should have a grounded outlet.

is a 2-slot outlet not grounded by definition? i know the previous tenant had a computer...

i'm gonna have to bookmark this. recently got a PC for the first time i nmy entire fucking life. god damn i hate windows.

yeah, the 2-slot will work, and you can put an adapter on it that will plug you right in. The manufacturer of your computer would rather you didn't though, because then you won't have a ground, and you'll be at the mercy of power fluctuations in your wiring, etc. They're being cautious on your behalf. But if you want to plug your computer in, hop to radio shack and spend $3 on an adapter from 3-prong to 2, and you'll be in business.

but I still need a surge protector, you say.

Better yet, buy an adapter from 3 to 2 prongs and also a surge-protecting power strip, plug the power strip into the adapter, the adapter into the wall, and the computer into the power strip.

xpost

k, thx

(I envision myself blacking out the entire borough of Brooklyn)

No, you'll only fry your computer, so don't worry.

whew

kenan OTM

(btw the correct answer to "how do I check the voltage" is "hire an electrician" so that's prob. not a road you want to go down)

yeah, the air-conditioner outlet is obv out of play.

I am having problems with servers and fonts today (no Mac though, Solaris) but my question is too specific and longwinded to expect anyone else to know or care, so I just thought I'd arrive on this thread and shake my fist a bit and then leave again. Bye!

My friend was using my macbook, and activated screen corners, which I just find annoying. He, apparently, can't live without them, but didn't take into account that unlike him I'm not a graphic designer. How in fuck's name do I turn it off?