<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>ewald.tienkamp.nl &#187; Server</title>
	<atom:link href="http://ewald.tienkamp.nl/category/server/feed/" rel="self" type="application/rss+xml" />
	<link>http://ewald.tienkamp.nl</link>
	<description>Gentoo Linux and whatever else I think needs to be shot into cyberspace.</description>
	<lastBuildDate>Sat, 04 Sep 2010 08:39:02 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.4</generator>
		<item>
		<title>Mounting a remote file system over ssh using sshfs and non-standard settings</title>
		<link>http://ewald.tienkamp.nl/2010/01/19/mounting-a-remote-file-system-over-ssh-using-sshfs-and-non-standard-settings/</link>
		<comments>http://ewald.tienkamp.nl/2010/01/19/mounting-a-remote-file-system-over-ssh-using-sshfs-and-non-standard-settings/#comments</comments>
		<pubDate>Mon, 18 Jan 2010 22:25:55 +0000</pubDate>
		<dc:creator>Ewald</dc:creator>
				<category><![CDATA[Gentoo Linux]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Server]]></category>
		<category><![CDATA[/etc/fstab]]></category>
		<category><![CDATA[fuse]]></category>
		<category><![CDATA[IdentityFile]]></category>
		<category><![CDATA[mount]]></category>
		<category><![CDATA[non-standard]]></category>
		<category><![CDATA[passwordless login]]></category>
		<category><![CDATA[port]]></category>
		<category><![CDATA[remote filesystem mounting]]></category>
		<category><![CDATA[ssh]]></category>
		<category><![CDATA[sshfs]]></category>
		<category><![CDATA[uncommon]]></category>

		<guid isPermaLink="false">http://ewald.tienkamp.nl/?p=93</guid>
		<description><![CDATA[As usual I had the desire to have a non-common set-up, which was presumably more secure or at the very least more fun to get working. In this case, after rebuilding my server, I wanted to recreate the sshfs setup I had going on in the past, but this time while using a separate IdentityFile, [...]]]></description>
			<content:encoded><![CDATA[<p>As usual I had the desire to have a non-common set-up, which was presumably more secure or at the very least more fun to get working. In this case, after rebuilding my server, I wanted to recreate the sshfs setup I had going on in the past, but this time while using a separate IdentityFile, non-common portnumber and incorporated in my /etc/fstab file. Somehow I forgot how I managed to get that working in the past, so for my own sake and the sake of others seeking help with this, I wrote down the steps I took to get this working, below.<br />
<span id="more-93"></span><br />
First of all, make sure you have sshd working on the machine that physically contains the disks you want to mount remotely. For this tutorial I&#8217;ll call that machine <em>REMOTE</em>. In sshd_config on <em>REMOTE</em> you will want to set (for the setup used in this post) a different port to listen on and enable passwordless login or as it should be referred to: logging in with keys. Then, return here.</p>
<p>Fine, now, on your local machine (<em>LOCAL</em>), generate an IdentityFile to be used for mounting the remote filesystem. I suggest that, while root, you execute the following:<br />
<code>ssh-keygen -f /root/.ssh/<em>YOURKEYFILE</em></code><br />
Assure that permissions are set accordingly:<br />
<code>chmod -R 700 /root/.ssh</code><br />
Now, get the /root/.ssh/<em>YOURKEYFILE</em><strong>.pub</strong> file. Yes, the one ending in .pub, not your secret one. Now, on the machine <em>REMOTE</em>, I suggest you add a new user, to be used solely for mounting with sshfs. Give it a catchy name like <em>REMOTEUSER</em>:<br />
<code>useradd -m <em>REMOTEUSER</em><br />
password <em>REMOTEUSER</em> #do not leave this blank!</code><br />
Now make sure that the contents of <em>YOURKEYFILE</em><strong>.pub</strong> get appended or added to /home/REMOTEUSER/.ssh/authorized_keys (which is of course on REMOTE, not on LOCAL). I don&#8217;t know (or care) how, use scp, use another machine, use an USB stick, you&#8217;ll figure it out.</p>
<p>After all this, you should be able to log into <em>REMOTEUSER</em> from <em>LOCAL</em> by executing the following as root:<br />
<code>ssh -i /root/.ssh/<em>YOURKEYFILE</em> -p <em>REMOTEPORTNUMBER</em> <em>REMOTEUSER</em>@<em>REMOTE</em></code><br />
If this does not work, check logfiles or use debugmodes.</p>
<p>From here it&#8217;s not that much work to get to mounting disks or folders which are physically on <em>REMOTE</em> to <em>LOCAL</em>. First, make sure you have sshfs installed. In Gentoo you can simply emerge:<br />
<code>emerge -av sshfs-fuse</code><br />
Do this.</p>
<p>Now, make sure you know your <em>LOCALMOUNTPOINT</em> (and ensure the empty folder exists by using mkdir) on <em>LOCAL</em> and know which <em>REMOTEMOUNTPOINT</em> you want to mount (located on <em>REMOTE</em>). Try mounting it by executing the following as root:<br />
<code>sshfs <em>REMOTEUSER</em>@<em>REMOTE</em>:<em>REMOTEMOUNTPOINT</em> <em>LOCALMOUNTPOINT</em> -p<em>REMOTEPORTNUMBER</em> -o uid=<em>LOCALUSERID</em> -o gid=<em>DESIREDGROUPID</em> -o idmap=user -o IdentityFile=/root/.ssh/<em>YOURKEYFILE</em> -o allow_other</code><br />
Please pay close attention to which value is entered where, and, if in doubt, read man sshfs. The values for <em>LOCALUSERID</em> and <em>DESIREDGROUPID</em> determine with what ownership the <em>REMOTEMOUNTPOINT</em> is mounted on <em>LOCAL</em>. The numbers entered represent uid and gid numbers residing on <em>LOCAL</em>.</p>
<p>If this works as expected, it is a simple matter of reformatting the above command, so /etc/fstab is able to automatically mount your <em>REMOTEMOUNTPOINT</em> at (<em>LOCAL</em>)boot. Or so I thought. Turns out it was slightly more complicated, but after some trial and error and some more searching the web I came up with the following working line for fstab:<br />
<code>sshfs#<em>REMOTEUSER</em>@<em>REMOTE</em>:<em>REMOTEMOUNTPOINT</em>   <em>LOCALMOUNTPOINT</em>   fuse   port=<em>REMOTEPORTNUMBER</em>,uid=<em>LOCALUSERID</em>,gid=<em>DESIREDGROUPID</em>,idmap=user,IdentityFile=/root/.ssh/<em>YOURKEYFILE</em>,allow_other   0 0</code><br />
That should do the trick! You can test this by ensuring you have not mounted your <em>REMOTEMOUNTPOINT</em> on <em>LOCAL</em> at this moment (try fusermount -u <em>LOCALMOUNTPOINT</em>) and then simply entering:<br />
<code>mount <em>LOCALMOUNTPOINT</em> #Yes, the one you just entered in /etc/fstab</code><br />
That&#8217;s it! Any comments or questions can be directed to the comments below and I will attempt to adjust the above as needed.</p>
]]></content:encoded>
			<wfw:commentRss>http://ewald.tienkamp.nl/2010/01/19/mounting-a-remote-file-system-over-ssh-using-sshfs-and-non-standard-settings/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>NTPq refuses to provide info on peers</title>
		<link>http://ewald.tienkamp.nl/2009/12/23/ntpq-refuses-to-provide-info-on-peers/</link>
		<comments>http://ewald.tienkamp.nl/2009/12/23/ntpq-refuses-to-provide-info-on-peers/#comments</comments>
		<pubDate>Wed, 23 Dec 2009 01:56:01 +0000</pubDate>
		<dc:creator>Ewald</dc:creator>
				<category><![CDATA[Desktop]]></category>
		<category><![CDATA[Gentoo Linux]]></category>
		<category><![CDATA[Server]]></category>
		<category><![CDATA[date]]></category>
		<category><![CDATA[NTP]]></category>
		<category><![CDATA[ntpd]]></category>
		<category><![CDATA[ntpq]]></category>
		<category><![CDATA[syslog]]></category>

		<guid isPermaLink="false">http://ewald.tienkamp.nl/?p=87</guid>
		<description><![CDATA[While equipping my fresh Gentoo server with NTP capabilities I was wondering why after a couple of minutes after starting ntpd, ntpq -p (or ntpq -c peers) was shouting &#8220;ntpq: read: Connection refused&#8221; at me&#8230; What is going on? After some reading I found out that this error usually means that ntpd is not running. [...]]]></description>
			<content:encoded><![CDATA[<p>While equipping my fresh Gentoo server with NTP capabilities I was wondering why after a couple of minutes after starting ntpd, ntpq -p (or ntpq -c peers) was shouting &#8220;ntpq: read: Connection refused&#8221; at me&#8230; What is going on?<br />
<span id="more-87"></span><br />
After some reading I found out that this error usually means that ntpd is not running. But why?<br />
<code>tail /var/log/messages</code><br />
&#8230;did not leave me with any information on possible errors.</p>
<p>Yet after some more searching I discovered that <a href="http://www.eecis.udel.edu/~ntp/ntpfaq/NTP-s-trouble.htm#AEN4599">ntpd quits if it discovers that the time offset is too large</a>. As my server time was about 1 hour off, that kind of made sense. Another logfile revealed that this was indeed the issue:<br />
<code>tail /var/log/syslog</code></p>
<blockquote><p>time correction of -3635 seconds exceeds sanity limit (1000); set clock manually to the correct UTC time.</p></blockquote>
<p>So how do we do that? Easy:<br />
<code>date MMDDhhmmYYYY #(Month, Day, hour, minute and Year)</code></p>
<p>And presto, problem solved! Do note that some programs may not appreciate sudden jumps in system time which you do cause by manually setting system time.</p>
]]></content:encoded>
			<wfw:commentRss>http://ewald.tienkamp.nl/2009/12/23/ntpq-refuses-to-provide-info-on-peers/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Scanning for Conficker using Nmap under Gentoo Linux</title>
		<link>http://ewald.tienkamp.nl/2009/05/18/scanning-for-conficker-using-nmap-under-gentoo-linux/</link>
		<comments>http://ewald.tienkamp.nl/2009/05/18/scanning-for-conficker-using-nmap-under-gentoo-linux/#comments</comments>
		<pubDate>Mon, 18 May 2009 20:53:08 +0000</pubDate>
		<dc:creator>Ewald</dc:creator>
				<category><![CDATA[Desktop]]></category>
		<category><![CDATA[Gentoo Linux]]></category>
		<category><![CDATA[Mobile]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Server]]></category>
		<category><![CDATA[blog]]></category>
		<category><![CDATA[compile]]></category>
		<category><![CDATA[Conficker]]></category>
		<category><![CDATA[emerge]]></category>
		<category><![CDATA[Google]]></category>
		<category><![CDATA[lua]]></category>
		<category><![CDATA[nmap]]></category>
		<category><![CDATA[package.use]]></category>
		<category><![CDATA[portage]]></category>
		<category><![CDATA[USE flags]]></category>

		<guid isPermaLink="false">http://ewald.tienkamp.nl/?p=8</guid>
		<description><![CDATA[Well, that was what I wanted. I know, Conficker was hot months ago. But hey, I&#8217;m not often around Windows machines and I thought that while I was, I might just as well scan my parents&#8217;s network. So there I was with my little netbook, most recent Nmap (nmap-4.85_beta8) loaded, ready to go. A quick [...]]]></description>
			<content:encoded><![CDATA[<p>Well, that was what I wanted. I know, Conficker was hot months ago. But hey, I&#8217;m not often around Windows machines and I thought that while I was, I might just as well scan my parents&#8217;s network.<br />
<span id="more-8"></span><br />
So there I was with my little netbook, most recent Nmap (nmap-4.85_beta8) loaded, ready to go. A quick Google search taught me the right command.</p>
<p>But it failed.</p>
<p><code>nmap: unrecognized option '--script'<br />
[snip: followed by regular nmap --help output]</code></p>
<p>Eh?</p>
<p>As my thinking was suspended, I went for Google to find me the culprit responsible for this error. No results. What? Ah, well, this is just why I wanted my own blog: to enhance Google with yet unknown knowledge (or knowledge previously only available in obscure languages). Now only to find the solution&#8230;</p>
<p>Turns out it was actually rather simple: compile <a href="http://www.gentoo-portage.com/net-analyzer/nmap/USE#ptabs" title="Gentoo-Portage.com - nmap USE flags">Nmap with the lua USE flag</a>. Yes, that&#8217;s all.</p>
<p><i>OPEN PACKAGE.USE</i><br />
<code>nano /etc/portage/package.use</code><br />
<i>AND INSERT</i><br />
<code>net-analyzer/nmap lua</code><br />
<i>OR ON A TERMINAL ENTER</i><br />
<code>echo "net-analyzer/nmap lua" >> /etc/portage/package.use</code></p>
<p>After this you&#8217;re good to go.</p>
<p>While I&#8217;m at it, let&#8217;s leave you with the recommended scan options at the moment of writing:</p>
<p><code>#Source: <a href="http://nmap.org/changelog.html" title="Nmap changelog">Nmap changelog</a><br />
  o Recommended command for a fast Conficker scan (combine into 1 line):<br />
    nmap -p139,445 --script p2p-conficker,smb-os-discovery,smb-check-vulns<br />
    --script-args checkconficker=1,safe=1 -T4 [target networks]<br />
  o Recommended command for a more comprehensive (but slower) scan:<br />
    nmap --script p2p-conficker,smb-os-discovery,smb-check-vulns -p-<br />
    --script-args checkall=1,safe=1 -T4 [target networks]<br />
</code></p>
]]></content:encoded>
			<wfw:commentRss>http://ewald.tienkamp.nl/2009/05/18/scanning-for-conficker-using-nmap-under-gentoo-linux/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>

