Syntax checker working crazy with cisco

Hi there,

I'm trying to verify only two commands for cisco IOS ACL Extendend.

They are:

access-list 101  deny   any 192.168.0.0/23 any

access-list 101  permit udp 192.168.1.1 any 

For this i`m using a syntax checker avaliable on the internet located in http://techie.devnull.cz/aclcheck

But when i execute the software for checking, it gives me a error in line 1 saying "destination specification ?". I've read many guides for ACL syntax on the internet but i simply don`t get it, i just cant find this error. The destination is specified in the any keyword.

Is there errors in those commands? Or maybe a more reliable way to validate cisco IOS commands?

Regards

Edit: new commands are

access-list 101  deny   ip 192.168.0.0/23 any

access-list 101  permit udp host 192.168.1.1 any 

Same error.

Notice i've maintained the /23 notation on purpose, check the comments. Will try out with your guys suggestion but if that is the right notation it will break my translators work hehe

From serverfault jaderanderson

• access-list 101 deny ip any 192.168.0.0 0.0.1.255 any
  access-list 101 permit udp host 192.168.1.1 any

  You had a few problems in here. FIrst, you have to specify a protocol, even if that protocol is just IP. Second problem, you have to use wildcard masks to specify your subnet. Third problem, you must designate either a wildcard mask, any, or preface the host ip address with the word host. Hope this helps.

  I'm not sure about a syntax checker. I just wear out the ? key on my keyboard.

  From Jason Berg

• In your first line the error comes from

  1. /23, you can't write this ACL like that, you should use wildcard mask
  2. any after deny, this is the protocol field, any is not valid

  In the second line, host is missing before the IP address

  Right syntax is :

  access-list 101 deny ip 192.168.0.0 0.0.1.255 any
  access-list 101 permit udp host 192.168.1.1 any
  

  I will recommend you to use named access-list if possible, writing ACL as you did is a bit old school, harder to manage and more sensitive to errors. A better way to do this is :

  ip access-list extended SOMETHING
    deny ip 192.168.0.0 0.0.1.255 any
    permit udp host 192.168.1.1 any
  

  jaderanderson : ok, the host missing i`ve already fixed but the /23 should work. check http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml#topic2 i`ve changed the any to ip too. will redo the syntax check again

  jaderanderson : Just to clarify, the 101 and 102 notation i`m using only because its standard input output ACL's. Right now i have no intention on testing them on a true cisco but i need to know if they will work. I`ve designed a web app that translates commands for different firewalls and stuff. Thanks for the help

  Zypher : @jader you might not be at the right IOS rev to get the use of the 'slash' notation

  jaderanderson : hummmm... maybe its right zypher. Can you tell me when slash notation was accepted? The aclcheck program was last updated in 2005, with the mask as suggested the program works fine

  radius : @jaderanderson nothing in the URL you provide tells that /X should work, it only tells that it can be *represented* like that but not that you can use this represention in an ACL. As far as I know the /X representation on IOS is only supported for prefix-list.

  jaderanderson : Well, guess you`re right radius. I'll have to implement a reverse mask by myself then since the 0.0.1.255 worked on aclcheck
  From radius

Linux DHCP 2 networks

I have 2 networks (192.168.1.0/24 & 192.168.2.0/24), and 1 DHCP server.
I need to serve DHCP for 2 networks, but it doesn't work. Second network (192.168.2.0/24) (PC & Notebook) always gets IP from 192.168.1.0/24 range despite that it has 2 ranges. How I should to configure it?

Router OS: Ubuntu Server 10.04
Client OS: Ubuntu 10.04

See UML

From serverfault Alex Ivasyuv

• The problem with two subnets is, how the dhcp server should decide which one to provide. I would give defined host entries for you computers:

  host notebook {
      hardware ethernet 00:AB:CD:EF:GG:GG;
      fixed-address 192.168.2.10;
  }
  

  Chris S : No, the DHCP server will give an address that corresponds with the NIC where the request was received. This applies by extension to DHCP Proxies, using the NIC where the original DHCP Discover was received.
  From TooAngel

• Is the DHCP server dual-homed (has an IP address on both networks)? Your DHCP server should have an interface listening on each subnet: one listening to the 192.168.1.0/24 network and the other listening to the 192.168.2.0/24 network. The startup for dhcpd should be configured to listen on each interface.

  Dhcpd also has the option to create a shared network containing both subnets, but I think this will essentially pool your addresses and you won't be able to control which machines receive addresses for a particular subnet.

  Chris S : +1, You can also use a DHCP proxy if the server isn't on the subnet you want to serve, but it's generally not the best idea.
  From David Smith

nginx rewrite not working?? it simply ignores it

hi all, i have a wierd problem with nginx, it doesn't want to rewrite...

I have this configuration and i need to pass a hash (40 chars) to a php file it works with apache mod_rewrite but with nginx it isn't i even tried to do simple rewrites, it simply doesn't work

server {
.........
        location / {
            rewrite ^aa$ /downloadTORRENTZ.php break;
            root   /usr/share/nginx/html;
            index  index.html index.htm;
            rewrite  "^([A-Z0-9]{40})$" /file.php?ddl=$1 break;
        }
}

From serverfault PartySoft

• 1. request usually start with / so your regexp should look like

     rewrite "^/([A-Z0-9]{40})$" /file.php?ddl=$1 break;

  2. Is your hash ALLCAPS? Maybe you should use [a-zA-Z0-9]

  3. 40 characters... It looks like sha1 hash. May be you should simplify regexp to [0-9A-F]

  From SaveTheRbtz

Process runs slower as a scheduled task than it does interactively

I have a scheduled task which is very CPU- and IO-intensive, and takes about four hours to run (building source code, if you're curious). The task is a Powershell script which spawns various sub-processes to do its work. When I run the same process interactively from a Powershell prompt, as the same user account, it runs in about two and a half hours. The task is running on Windows Server 2008 R2.

What I want to know is why it takes so much longer to run as a scheduled task - more than an hour longer. One thing I noticed is that the task scheduler runs at Below-Normal priority, so when my task starts, it inherits the same lowered priority. However, I've updated the script to set the Powershell process priority back to Normal, and it still takes just as long.

Anybody have an idea what could be different between the two scenarios? I've ruled out differences in processor and IO load - this task is the only thing the system is used for, so there's nothing else running that could be competing for resources.

From serverfault Charlie

• Maybe scheduled tasks run at a lower priority by default.

  Use prio to force higher priority.

  Charlie : You're right that they run at lower priority, but as I mentioned, I've already accounted for that. Unless there's some priority other than process priority that I don't know about.
  From mcandre

• If you set it to run as a scheduled task as User X, and then login as User X before it's supposed to run, it should open a window in your session when it runs, it'll be running in your session.

  If you do this, does it take the longer, or shorter, period of time? I don't know what this will mean, but it may be a useful differentiator. Could there be some network access that the user account has when logged in, but not when running as a scheduled task, that needs to timeout and fail? Is the behavior different if you create a new user account and have it run as a scheduled task under that account?

  Another idea: When running it as a scheduled task - now that you've fixed the priority on your script do the sub-processes all run as Normal, or Below-Normal?

  Charlie : The subprocesses definitely run as Normal, as verified by procexp/taskman. I think the network thing isn't it, because it doesn't do any substantive network access, but I'll double-check that. The idea about running the task as interactive is interesting too, I'll give it a try.

  mfinni : The process itself doesn't have to do any network access that you know of for this to be a problem. Read this post from Sysinternals and see how something seemingly unrelated can cause hangs/slowness. http://blogs.technet.com/b/markrussinovich/archive/2005/08/28/the-case-of-the-intermittent-and-annoying-explorer-hangs.aspx
  From mfinni

• at first - you can use more than normal priority (High for example)

  at second - you have to understand, than foreground session takes some resources, mainly hard disk IO and memory so scheduled task gets less. for clear benchmark you have to logoff while you powershell script running

  and also you can try add more memory / use ramdrive / split work on several hard disk to speed up processes

  Charlie : Thanks for the ideas. The machine has plenty of memory and IO capacity, the problem is just that things run slower as scheduled tasks than they do interactively. When the scheduled task is running, there is usually no interactive logon session, so I think that's not the issue either.
  From evg345

• It appears that there is more than just "regular" process priority at work here. As I noted in the question, the task scheduler by default runs your task at lower than normal priority. This question on StackOverflow describes how to fix any task to run at Normal priority, but the fix still leaves one thing slightly different: memory priority. Memory priority was a new feature for Windows Vista, and is described in this Technet article. You can see memory priority using Process Explorer, which is a must-have tool for any administrator or programmer.

  Anyway, even with the scheduled task priority fix, the memory priority of your task is set to 4, which is one notch below the normal setting of 5. When I manually boosted the memory priority of my task up to 5, the performance was on par with running the process interactively.

  For info on boosting the priority, see my answer to a related StackOverflow question about IO priority; setting memory priority is done similarly, via NtSetInformationProcess, with PROCESS_INFORMATION_CLASS set to ProcessMemoryPriority (the value of this is 39 or 0x27). I might make a free utility that can be used to set this, if others need it and don't have access to programmer tools.

  EDIT: I've gone ahead and written a free utility for querying and setting the memory priority of a task, available here. The download contains both source code and a compiled binary.

  MadBoy : Glad you found it, thanks for sharing.
  From Charlie

• I don't have sufficient rights to comment so I'm commenting here.

  Charlie, I'd be very interested in a utility like you descibe above for setting memory priority.

  Thanks,

  Tom

  Hi Charlie,

  I looked at the utility and it seems to work great. If possible, I'd love to see one more feature added. Hey, I know beggers can't be choosers but I thought I'd ask anyway ;-)

  As I usually run batch files from the scheduler, it woyuld be great if when I didn't specify a PID, it could use the PID that it was called from. Or, some token like $$ could be used to tell the program to use the calling PID. This way, I wouldn't ever have to know the PID and, since what I'm really executing inherits the priority from the DOS shell, it would run as normal priority as well. So my syntax in the batch file could be something like

  ProcessPriority set $$ normal

  myProgramName parameters

  While it's possible to get the current PID in a batch file, it's awkward.

  Thanks,

  Tom

  Charlie : I'll look at doing this over the weekend; I'll post here when I have it done.

  Charlie : See comments on my answer above for a link to the utility I described.

  Charlie : Unfortunately it's not terribly easy to get the PID of the parent process, but you might consider switching to Powershell (instead of Batch), in which case you can get the script process ID using this expression: `[Diagnostics.Process]::GetCurrentProcess().Id`.
  From

Linux boot: Can I prevent the loading of a module using a boot parameter?

Hello, everyone!

I know that I can blacklist a module in /etc/modprobe.conf or /etc/modprobe.d/blacklist, but I have a nasty module which loads before the filesystems are mounted (except /boot of course), so I assume, /etc will not yet be read by then.

Can I prevent a module from loading using a kernel boot parameter?
(I'm using GRUB)

Or are there other ways to do this?

Thank you!

From serverfault java.is.for.desktop

• This Ubuntu site has a nice breakdown of options:

  https://help.ubuntu.com/community/BootOptions#Common%20Boot%20Options

  While there aren't any ways to tell the kernel to not load a module at boot time, you can get in the way later on down the road. Take a look at the break= optionss, that change initrd behavior. If you don't know the exact module, you can perhaps use these to further isolate it.

  From sysadmin1138

• Modules that load that early in the boot sequence are built into the initramfs; it seems likely that you can run update-initramfs -c -k your_kernel_version to ensure that the blacklisted module isn't loaded in that initramfs image.

  jrod : *I don't actually use Ubuntu.
  From jrod

What is the best approach for setting up a good, secure smtp server on Debian?

Which server do you recommend? (postfix?) Which configuration for authenticating users for sending mail? Which setups for making it inbox friendly (dkim, spf, domainkey etc)?

Is there some detailed guide to walk a newbie through all or most of these?

Any advice would be much appreciated.

From serverfault Inshim

• Setting up an SMTP server is not for the faint of heart - especially so if you are a newbie.

  If this is for real production use, I would recommend out-sourcing your SMTP needs to some online service. However, if it is for personal/hobby use, you can look up a tonne of online tutorials on how to do things.

  In my experience, the easiest mail server to setup on Debian is Citadel. Straightforward apt-get, provides a web-based interface and command-line interface for configuration and mail access. Supports all kinds of features.

  Good luck.

  From sybreon

Why is Syslog Not Writing Logs To The Designated Files?

I've been trying to route Apache's logs through Syslog (for some reason log rotation had stopped, and using Syslog and logrotate seemed a reasonable solution).

I have sent Apache's error logs to local7 and piped the access logs to local6 via the logger program.

I want Syslog to write the error and access logs to /var/log/apache2/error.log and /var/log/apache2/access.log respectively.

To that end I have added the following to /etc/syslog.conf:

# Logging for Apache using local7 facility for error messages
# and local6 for access log
# Added 20/06/2010 by Chris Bunney
local7.*                        /var/log/apache2/error.log
local6.*                        /var/log/apache2/access.log

I know that the error and access logs are being sent to Syslog correctly because they are showing up in /var/log/syslog, however they are not being written to the files I want.

The original file permissions of the target files:

-rw-r----- 1 root adm       0 2010-06-20 23:01 access.log

The current file permissions of the target files that I have been using to try and rule out such things causing issues:

-rw-rw-rw- 1 syslog adm       0 2010-06-20 23:01 access.log

Everything looks fine to me, so why aren't the messages Syslog is receiving being written to the files I want? Have I missed something simple?

---

Full Output of cat /etc/syslog.conf:

#  /etc/syslog.conf     Configuration file for syslogd.
#
#                       For more information see syslog.conf(5)
#                       manpage.

#
# First some standard logfiles.  Log by facility.
#

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
cron.*                          /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

# Logging for INN news system
#
news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice

# Logging for Apache using local7 facility for error messages
# and local6 for access log
# Added 20/06/2010 by Chris Bunney
local7.*                        /var/log/apache2/error.log
local6.*                        /var/log/apache2/access.log

#
# Some `catch-all' logfiles.
#
*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg                         *

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#       news.=crit;news.=err;news.=notice;\
#       *.=debug;*.=info;\
#       *.=notice;*.=warn       /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole

From serverfault chrisbunney

• Did you restart syslogd? You can also use lsof -f -p <pid-of-syslogd> to see what log files it has open. The syslog.conf looks right, you might want to post your apache configuration.

  chrisbunney : Yep, I missed something simple. I must have restarted everything *but* syslog. Restarted Syslog and it worked fine. Sorry, but I don't have the rep for an upvote. Now, I think I ought to go to bed, the lack of sleep is obviously having negative effects...
  From delimiter