FIX: ORA-00911: invalid character in c# but seemingly nowhere else

 Wednesday, June 18, 2014
I am not normally a developer who targets Oracle, but something recently required me to go down this rabbit hole. I'm the first to admit that I hate Oracle primarily because I lack experience with their dialect of Sql and ... well, Java (Ask toolbars and security issues, grrr). But I digress.
The world's most useless error message
I write this at least partially as a joke because the specific solution I'm going to propose was a fix for my specific problem but because of the ambiguity of this error message, your problem could be something entirely different. Basically, what the Oracle database query parser is trying to tell us is that out of the hundreds of characters in your command text, at least one of them (maybe more) is not a character that it should be. It is, instead, an invalid one. Most likely, you've smashed two keys at the same time and put an errant underscore after a parenthesis. Maybe it's an obvious problem. Or maybe, like me, your unfamiliarity with Sql*Plus combined with this obtuse error led you down the wrong path a few times.
Bad semicolon
There's something about the Oracle provider in C# that causes it to crap all over your statement if the last character in the command text is a semicolon. Note that I've only tested this in the ODP.NET (DataAccess.dll not ManagedDataAccess.dll) 12.x client. In my case, I assumed it was that strange looking colon in front of the variable names. Nope, colon: Good. Semi-colon: Not so much.
No comments :

Part VI - The Ultimate Linux Home Router - SquidGuard - Internet Filtering

 Wednesday, December 25, 2013

Introduction

It's worth warning that perfect internet filtering is impossible. It's for this reason that parents who have older children often don't bother with it since it tends to filter out benign things. That said, I have young children with tablets that Santa bought them for Christmas. I've locked the tablets down rather thoroughly on their own--prohibiting the use of the browser without a password and using a simple tool to restrict YouTube access. I know, however, that there will be times that they'll need the browser and when they do, they'll be using a browser with most controversial subjects filtered out. Don't get me wrong, I'm not interested in Nerf(tm)ing up the internet and preventing them from seeing some of the realities of life. But when they need unrestricted access, I will be there supervising directly. When I can't, most of the internet will be blocked.

Run an update

Since it's been a few days since this was posted, it's worth making sure we're running the latest versions of everything. Run the following and follow any onscreen instructions. 
$ sudo zypper up

Installing SquidGuad

$ sudo zypper in squidguard

Restricting Tablets - DHCP Reserved Addresses

One option (and certainly not the most bulletproof) is to set the tablets up with static IP addresses. This is really simple to get around if your children have any basic understanding of IP networking (or know how to wield google in their favor). In a later post, I'll be adding authentication to the proxy server, but until then, I wanted to at least force DHCP to assign the same address. The settings panel on my tablets is password protected, so one of the kids changing the settings is not a huge concern of mine. In addition, assigning the IP via DHCP ensures that I won't need to make other configuration changes when the tablet moves to different networks.
Reserved addresses are assigned when the DHCP server sees a client with a specific MAC address. Since it's easier to retrieve the current IP address on my tablets, I've written down the two addresses: 192.168.0.121 and 192.168.0.127, and we'll look up the host details on the server.
The following command will display all of the current leases
$ cat /var/lib/dhcp/db/dhcpd.leases | egrep "(^lease)|(hardware)"
This will display all of your current leases and their MAC addresses. Find the one that matches what was assigned to the tablets and copy the hardware address. 
$ sudo nano /etc/dhcpd.conf
Find the subnet that corresponds to your network. It'll look something like this: 
subnet 192.168.0.0 netmask 255.255.255.0 {
  range 192.168.0.100 192.168.0.200;
  default-lease-time 14400;
  max-lease-time 172800;
}
Modify it: 
subnet 192.168.0.0 netmask 255.255.255.0 {
  range 192.168.0.100 192.168.0.200;
  default-lease-time 14400;
  max-lease-time 172800;
  host girlstablet {
    fixed-address 192.168.0.30;
    hardware ethernet xx:xx:xx:xx:xx:xx;
  }
}
I've added a host 'girlstablet', which has the MAC address "xx:xx:xx:xx:xx:xx" assigned it the address 192.168.0.30. I'll be putting all of the restricted devices on the 192.168.0 subnet in the range 192.168.0.30-39. Do the same with any other addresses, assigning them an IP address outside of the normal lease range.
Save and Exit, then run: 
$ sudo rcdhcpd restart

Installing Blacklists

I'm going ot use Shalla's Blacklists for this example, but there are several others available. Shalla's is for private, non-commercial use only. If you're using it for a business, consult their web site to ensure you are compliant. Creating a script to download the filter list: 
$ sudo nano /usr/sbin/update_squidguard_blacklist
Paste in the following and Save/Exit. 
#!/bin/sh

cd /var/lib/squidGuard/db
rm -r *
wget 'http://www.shallalist.de/Downloads/shallalist.tar.gz'
tar -xvf shallalist.tar.gz
cd BL
mv * ..
cd ..
rmdir BL
/usr/sbin/squidGuard -C all
chown -R squid *
chown -R squid /var/log/squidGuard
rm shallalist.tar.gz
squid -k reconfigure
Run the following: 
$ sudo chmod 750 /usr/sbin/update_squidguard_blacklist.sh
$ sudo ln -l /usr/sbin/update_squidguard_blacklist.sh /etc/cron.daily/update_squidguard_blacklist.sh
$ sudo nano -w /etc/squidguard.conf
Remove all lines from the file below "logdir /var/log/squidGuard" and paste in the following: 
dest adv {
     domainlist adv/domains
     urllist    adv/urls
}

dest aggressive {
        domainlist      aggressive/domains
        urllist         aggressive/urls
        log             aggressiveaccess
}

dest alcohol {
        domainlist      alcohol/domains
        urllist         alcohol/urls
        log             alcoholaccess
}

dest anonvpn {
        domainlist      anonvpn/domains
        urllist         anonvpn/urls
        log             anonvpnaccess
}

dest costtraps {
        domainlist      costtraps/domains
        urllist         costtraps/urls
        log             costtrapsaccess
}

dest dating {
        domainlist      dating/domains
        urllist         dating/urls
        log             datingaccess
}

dest drugs {
        domainlist      drugs/domains
        urllist         drugs/urls
        log             drugsaccess
}

dest gamble {
        domainlist      gamble/domains
        urllist         gamble/urls
        log             gambleaccess
}

dest hacking {
        domainlist      hacking/domains
        urllist         hacking/urls
        log             hackingaccess
}

dest porn {
        domainlist      porn/domains
        urllist         porn/urls
        log             pornaccess
}

dest redirector {
        domainlist      redirector/domains
        urllist         redirector/urls
        log             redirectoraccess
}

dest sexeducation {
        domainlist      sex/education/domains
        urllist         sex/education/urls
        log             sexeducationaccess
}

dest sexlingerie {
        domainlist      sex/lingerie/domains
        urllist         sex/lingerie/urls
        log             sexlingerieaccess
}

dest spyware {
        domainlist      spyware/domains
        urllist         spyware/urls
        log             spywareaccess
}

dest violence {
        domainlist      violence/domains
        urllist         violence/urls
        log             violenceaccess
}

dest webmail {
        domainlist      webmail/domains
        urllist         webmail/urls
        log             webmailaccess
}

dest webtv {
        domainlist      webtv/domains
        urllist         webtv/urls
        log             webtvaccess
}

dest warez {
        domainlist      warez/domains
        urllist         warez/urls
        log             warezaccess
}
acl {
        admins {
                pass all
        }
        restricted {
                pass !weapons !warez !webtv !webmail !sexlingerie !sexeducation !redirector !porn !hacking !violence !aggressive !alcohol !anonvpn !costtraps !dating !drugs !gamble all
        }
        default {
                pass !spyware all
        }
}
Run the following command: 
$ sudo echo 'redirect_program /usr/sbin/squidGuard' >> /etc/squid/squid.conf
$ sudo /usr/sbin/update_squidguard_blacklist.sh
No comments :

Part V - The Ultimate Linux Home Router - Services: SSH, Squid, Privoxy - Advertisement Blocking Network Wide

 Saturday, December 21, 2013

Secure Shell Server (SSH)

A Secure Shell server is a great utility to have accessible externally. At home, I use port forwarding through my SSH server for a variety of uses. On public Wi-Fi networks, I fire up my SSH client on my phone and setup my browser to use my home proxy so that I can surf encrypted on a public network. When I'm visiting my children's school, I use the secure shell server to bypass the exceptionally restrictive firewalls installed at US public schools (and not for evil things ... simple things like Facebook don't work!). By opening one port to SSH, I am able to access my entire home network and all of its services. I can remote into my desktop or laptop via RDP. I can issue commands to my Roku. I can copy files (using WinSCP) to and from the public or family PC I'm working on to any PC on my home network.

Securing Secure Shell

Running a Secure Shell server doesn't come without risks. It's a high value target for hackers. Brute force attacks are extremely common, and are even done in ways that reduce the probability of detection (such as very slowly trying multiple common passwords). I allow password authentication for Secure Shell and am not providing steps on eliminating that (because I simply don't care enough about it). I strongly recommend using a very complex passphrase (multiple words, punctuation, with numbers mixed in) to ensure a brute force attack is unsuccessful.

Reducing attack surface of SSH

We're going to do the following: Pick a non-standard port for SSH. You have two options, each with pros and cons:
  • Option 1 - Pick a common port, such as Port 80 or 443. This will not reduce your attack surface that much, since these ports are also commonly attacked, but since SSH will be running on that port and not the service the hacking tool is looking for, it may render the tool ineffective (probably not). The pros of picking a common port like 80 or 443 is that they're unlikely to be blocked egress on a firewall. Pick a common port if the most important thing to you is being able to access your SSH server from anywhere.
  • Option 2 - Pick an uncommon, random port like 3154 (well, don't use that now that I put it in this post ... actually, it probably won't matter, the traffic to this site is pretty miniscule).
I chose option 2 because, lately, I've rarely ran into a scenario where I couldn't access a random port egress on even Public School WiFi.
We're going to eliminate root logon. Allowing root login is a very bad idea. This ensures that the attacker needs to not only guess the password, but also the ID in order to log into your server.
Run the following: 
$ sudo nano /etc/ssh/sshd_config
Replace: 
#Port 22
#PermitRootLogin yes
#MaxAuthTries 6
With: 
Port xxxx
PermitRootLogin no
MaxAuthTries 1
Where xxxx is the number of the port you selected above. Save and Exit.
Run the following: 
$ sudo nano -w /etc/sysconfig/SuSEfirewall2.d/services/sshd
Change TCP="22" to TCP="XXXX" where XXXX is the port you selected above, then run: 
$ sudo rcsshd restart
$ sudo rcSuSEfirewall2 restart
Replace xxxx with the port you selected above.

Reducing attack surface with DenyHosts

Denyhosts is a script that trolls the logs looking for authentication failures. When it finds a certain threashold of them from a particular host, it adds that host to the hosts.deny file which prevents the server from accepting connections from that host in the future. We're going to set the threshold pretty low, so you may end up locking yourself out by accident. If that happens, simply login from a different host and remove the host from hosts.deny. 
$ sudo zypper ar --refresh http://download.opensuse.org/repositories/network:/utilities/openSUSE_13.1/ 'openSUSE 13.1 Network Utilities'
$ sudo zypper in denyhosts
(be sure to answer "a" when prompted)
$ sudo chkconfig --level 3 denyhosts on
Worthy Note: Because DenyHosts is running on your router, having too many login failures on a machine within your network will not only block you from logging in with SSH, it'll block you from connecting to anything (including the internet). So login with caution!

Proxy Servers

I'm debating, for the time being, precisely which proxy to install. I've used Squid for years, but there are alternatives out there and, in fact, we're going to be using one of them -- privoxy. There's no reason they all can't coexist on the same machine, however, it may not be necessary to run more than one. We'll chain squid and privoxy together and later, when we want to child-proof certain things on our network, we'll add squidGuard to the mix.
Run the following: 
$ su
(enter your password)
# zypper in squid privoxy privoxy-doc
# systemctl enable squid
# systemctl enable privoxy
# nano /etc/squid/squid.conf
Replace 
http_port 3128
With 
http_port 3128 transparent
# nano /etc/sysconfig/SuSEfirewall2
Hit CTRL+W and type "FW_REDIRECT" to get to the line.
Replace 
FW_REDIRECT=""
With 
FW_REDIRECT="192.168.0.0/24,0/0,tcp,80,3128"
# rcsquid start
# rcSuSEfirewall2 restart
Browse to something on the internet on Port 80 within your local network and you can "cat /var/log/squid/access.log" to see that the proxy is working properly. Once you're sure that's up and solid, we'll chain privoxy.

Configuring Privoxy for Advertisement blocking for your whole network

I won't get into the ethical arguments around blocking ads. I would love to trust publishers to give me advertisements that weren't filled with malware, but at present, I can't. It pains me even more that the two or three affiliate links I may use on this site won't work after you follow these instructions, but I won't be a hypocrite and complain about that. Here's a longer discussion on the subject This is why I adblock and you should too. If you feel evil doing this, you can simply skip this section. This is one of a few methods we're going to use to eliminate ads on our network. This will also reduce the ability of web sites to track your behavior. Occasionally, privoxy gets it wrong and blocks something useful, but I've been running it for months now and it works brilliantly. There are some things as of this writing that are broken about the privoxy package provided in the 13.1/Tumbleweed repositories. We're going to tweak the service definition and load the service to correct this. First we'll modify the configuration: 
# nano /etc/privoxy/config
Locate the following lines (hint: CTRL+W) 
logdir /log
confdir /etc
Replace them with: 
logdir /var/lib/privoxy/log
confdir /etc/privoxy
Locate the following lines: 
#debug 4096
#debug 8192
Replace it with: 
debug 4096
debug 8192
# nano /usr/lib/systemd/system/privoxy.service
Remove all lines in that file and replace it with: 
[Unit]
Description=Privoxy Web Proxy With Advanced Filtering Capabilities
After=network.target

[Service]
Type=forking
PIDFile=/var/run/privoxy.pid
WorkingDirectory=/var/lib/privoxy
ExecStart=/usr/sbin/privoxy --user privoxy --pidfile /var/run/privoxy.pid /etc/privoxy/config
ExecReload=/bin/kill -USR1 $MAINPID

[Install]
WantedBy=multi-user.target
Run the following commands 
# systemctl daemon-reload
# systemctl start privoxy

Chaining Squid and Privoxy

Run the following commands: 
# echo 'cache_peer 127.0.0.1 parent 8118 7 no-query' >> /etc/squid/squid.conf
(configures privoxy as a parent to squid)
# echo 'acl ftp proto FTP' >> /etc/squid/squid.conf
# echo 'always_direct allow ftp' >> /etc/squid/squid.conf
(skips privoxy for FTP requests)
# echo 'never_direct allow all' >> /etc/squid/squid.conf
(uses privoxy for all other requests)
# squid -k reconfigure
To test, simply fire up a browser that doesn't have Adblock installed and visit a page (non-SSL) that has lots of ads. You'll also notice some of the ads are gone from your phone as well.

Blocking Ads via BIND DNS

As I mentioned earlier, privoxy is not fool proof. It does land itself into false positives from time to time. While putting this together, I discovered one of those cases. We'll need to get some files from a site for our BIND DNS blocking, but in order to do that, we have to first configure privoxy to whitelist the site. 
# echo "{ -block }" >> /var/lib/privoxy/etc/default.action
# echo "pgl.yoyo.org" >> /var/lib/privoxy/etc/default.action
In a browser somewhere on your network, click this link and make sure it's not blocked. Then run the following commands: 
# nano /usr/sbin/addownloader.sh
Paste the following: 
#!/bin/sh
wget 'http://pgl.yoyo.org/as/serverlist.php?hostformat=bindconfig;showintro=0' -O /etc/named.ads.downloaded.conf
cat /etc/named.ads.downloaded.conf | egrep '^zone' > /etc/named.ads.conf
rcnamed restart
Save and exit, then run: 
# chmod 750 /usr/sbin/addownlodaer.sh
# ln -s /usr/sbin/addownloader.sh /etc/cron.daily/addownloader.sh
# addownloader.sh

Updates

Corrected DNS ad blocking section. Added cron job for downloading DNS list.
No comments :

Part IV - The Ultimate Linux Home Router - DHCP and Routing
Here's where we put it all together and finally replace our existing router. You might want to print this out because some of these steps will be done without internet connectivity.

Other things you may need to purchase

If your existing router also provided wireless access and you want that wireless access to remain behind the firewall (strongly recommended!), you'll need to buy a wireless access point. I love the Buffalo line of wireless routers because they run DD-WRT, an open-source, linux based router firmware. It's inexpensive -- $39 on Amazon, and with the routing capabilities disabled, you'll have a 4-port switch with wireless access. If your existing router allowed you to plug more than one device into it (and you're currently doing just that), you'll need to purchase a switch (unless you elected to buy the wireless access point with a switch). Here's the one I purchased

Preparing to replace your existing router - Figuring out the external side of the network

Option 1: Get rid of your existing router. Obviously you can't do this if your existing router is also your cable or DSL modem.
Option 2: Disable your existing cable or DSL modem's routing capability.
Option 3: Leave your existing router in place, disable all firewalling and setup your new router as a DMZ host.
You'll want to pick one of these. The steps for doing this vary depending on your existing hardware. I (currently) use Comcast Business internet and short of purchasing a static IP, I'm stuck with option #3. I've been running this way for some time now and it's not caused any problems other than having to remember I have one added bit of network complexity.

Setting up the External network

If you are using a USB external network adapter and have not yet plugged it in, plug it in (but leave the network cable disconnected). 
$ su
(enter your password)
yast
We could have sudo'd that, but we're going to be doing a lot as root to get this ready, so let's live dangerously.
Select Network Devices and Network Settings Select your external network adapter and choose Edit. On my setup, my external USB adapter is eth1. I'll be referring to eth1 a bit in the future as we issue commands from the shell. If yours has a different name (as it does on my other device), remember it and substitute it whenever you see eth1 in a command. If you picked option 3 above, you'll follow the directions for assigning a static, non-routable, IP address. If you picked option 1 or 2, you probably want to leave the external side as DHCP unless you were assigned or pay for a static IP from your ISP.

Getting the existing network settings

Determine the network that your existing router assigns addresses. If you have a windows box behind the firewall, you can drop to a command prompt and type "ipconfig /all". Locate the IP address assigned and the subnet mask to determine the address. In my case, the IP address is 192.168.0.70 and subnet mask is 255.255.255.0 (/24). This means that my existing router's network is 192.168.1.0/24. Write down your DNS settings. Go to your router's configuration and locate the DHCP and LAN settings.

For Option 3 folks, only

Since we're already using an IP address on your router's existing internal network, we need to change the network that the existing router uses. I've switched mine to use 192.168.1.0/24 (192.168.1.x network with a subnet mask of 255.255.255.0) as the network and 192.168.1.1 as the router's address. I've also disabled DHCP since I'll be assigning the external network address statically. Consult your router's manual on how to make these changes, it'll be different for everyone. Oh, and when you make these changes, you're going to disconnect yourself from the internet. Your current PC will have an address on a different network and won't know how to get to the gateway, so before you save your settings, make sure you're positive they're right. If you screw it up, consult your router manual on how to hard reset the router and try again.

Assigning a Static IP

If you have paid for a routable, static IP address from your ISP, find the documentation they gave you to identify the correct DNS, Gateway and IP address and Subnet Mask to assign here. If not, use the values you discovered from the previous section.
Select Statically assigned IP address, put in the address from your ISP or from what you selected above.
Select ubnet Mask, enter the value from your ISP or from what you discovered above.
Select Hostname. Use the same hostname you used during installation, but add a "-ext" to signify that this IP points to the external side of the router.
Select General and tab over to Firewall Zone. Select External Zone. This will cause the firewall to filter all unsolicited traffic that you haven't explicitly allowed. We'll be doing a lot more customization later.
Hit F10 to save these values.
Select Routing.
Under Default IPv4 Gateway, enter the value from your ISP or from what you discovered above. This is the dumb "if there is no other explicitly assigned route, use this one" route.
Put an [X] in the box next to Enable IP Forwarding.
Hit F10 to save these values.
Select Security and Users and then Firewall. Select Masquerading.
Put an [X] in the box next to Masquerade Networks.

DHCP

Run the following: 
# zypper in dhcp yast2-dhcp-server dhcp-server
# yast
Select Network Services then DHCP Server.
Select your internal network adapter, choose Select.
Make sure there's an X only next to the internal network adapter.
Select Open Firewall for Selected Interfaces. Choose Next.
On the next screen, choose Domain Name and enter the Active Directory domain name (yourdomain.net).
For Primary Name Server, Secondary Name Server, Default Gateway, and NTP Time Server, enter the IP address of the internet network adapter on your new router. Leave the rest blank.
For IP Address Range, select a range you'd like to assign to the pool. I used 192.168.1.100 - 192.168.1.200.
Under Service Start, select When Booting. Select "Next" and Quit.

Plug it all in

At this point, you need to unplug all of the ethernet cables from your router (If your router has an internet side that is Ethernet, unplug all ethernet cables except that one). Plug your external network adapter into the existing router. Plug the cables that were going to your existing router into a switch and plug that switch into the new router. If you have a relatively simple network and your ISP provided you with a router, your existing network probably looked something like this: 
               /--------\
[INTERNET]=====| Router |=======[Computer]
               |  from  |=======[Computer]
               |  your  |=======[Xbox]
               |  ISP   |=======[Wireless Access Point]
               \--------/
It's now going to look something like this. 
               /--------\    /---------\   /--------\
[INTERNET]=====| Router |====| Awesome |===| Switch |===[Computer]
               |  from  |    |   new   |   | or WAP |===[Computer]
               |  your  |    |  Linux  |   | with   |===[Xbox]
               |  ISP   |    | Router  |   | switch |===[Roku]
               \--------/    \---------/   \--------/
It's a little more complex. If you purchased a pure wireless access point that isn't a router and doesn't include a switch, you'll plug that into the switch. If you picked a combined unit that is switch and wireless, you'll have something similar to the above.

Refreshing your internal devices

The easiest way is to simply reboot. However, for Windows boxes, you can drop to a Administrator command prompt and type "ipconfig /release" followed by "ipconfig /renew". You should see that you've now been assigned an address from your linux router.

On the off chance you're using an AX88179 USB 3.0 Ethernet Adapter

The kernel module that supports this device is a little flaky, so we're going to install the reference driver. It can be found by searching here. Run the following: 
$ su
(enter your password)
# zypper in kernel-default-devel kernel-devel kernel-source
# cd ~
# wget http://www.asix.com.tw/FrootAttach/driver/AX88179_178A_LINUX_DRIVER_v1.8.0_SOURCE.tar.bz2
# tar -xfv AX88179_178A_LINUX_DRIVER_v1.8.0_SOURCE.tar.bz2
# cd AX88179_178A_LINUX_DRIVER_v1.8.0_SOURCE.tar.bz2
# make
# make install

Tuning the Router

By default, Linux isn't tuned for routing large amounts of traffic. Most of the default settings are fine, however, if you use BitTorrent or any P2P, you'll discover right away the limitations of the default settings. Here are some settings I have applied to my router to improve streaming video and applications that create large numbers of connections. Most of these settings were adapted from sources that I googled. Some may be wildly wrong and may show my ignorance of the Linux networking stack. 
$ su
(enter your password)
# echo 'ifconfig eth0 txqueuelen 10000' >> /etc/rc.d/after.local
(If your adapter isn't called eth0 and eth1, replace these with what the adapters are actually called)
# echo 'ifconfig eth1 txqueuelen 10000' >> /etc/rc.d/after.local
# nano /etc/sysctl.conf
Add the following to the bottom of the file (adapted primarily from Linux Network Tuning for 2013: 
# Increase system file descriptor limit
fs.file-max = 100000

# Discourage Linux from swapping idle processes to disk (default = 60)
vm.swappiness = 10

# Increase ephermeral IP ports
net.ipv4.ip_local_port_range = 10000 65000

# Increase Linux autotuning TCP buffer limits
# Set max to 16MB for 1GE and 32M (33554432) or 54M (56623104) for 10GE
# Don't set tcp_mem itself! Let the kernel scale it based on RAM.
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 16777216
net.core.wmem_default = 16777216
net.core.optmem_max = 40960
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# Make room for more TIME_WAIT sockets due to more clients,
# and allow them to be reused if we run out of sockets
# Also increase the max packet backlog
net.core.netdev_max_backlog = 50000
net.ipv4.tcp_max_syn_backlog = 30000
net.ipv4.tcp_max_tw_buckets = 2000000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 10

# Disable TCP slow start on idle connections
net.ipv4.tcp_slow_start_after_idle = 0

# If your servers talk UDP, also up these limits
net.ipv4.udp_rmem_min = 8192
net.ipv4.udp_wmem_min = 8192

# Log packets with impossible addresses for security
net.ipv4.conf.all.log_martians = 1
Save and Exit. 
# nano /etc/security/limits.conf
Add the following to the bottom of the file: 
* soft nofile 100000
* hard nofile 100000

Very Optional - Map IRQ of Network Adapter to Specific Core

I was having some network problems related to UDP performance over a double NAT (though I didn't discover that until I did a myriad of packet captures). This was one of the steps I attempted while troubleshooting. It was a shot in the dark, and ultimately I left it out of my configuration. In case you're in the same spot, I thought I'd leave the instructions. After completing this section, you'll add a line to /etc/rc.d/after.local to run the script with the network adapter name and the core of the CPU you wish to tie it to. More comprehensive instructions are available here. 
# nano /usr/local/bin/myri-irq-bind.sh
Paste in the following: 
#!/bin/sh
#set -x

if [ $# -eq 0 ]; then
   echo "usage: msixbind.sh INTERFACE [CPU#]"
   exit 1;
fi

eth=$1
mask=$2

echo "Binding interface $eth"
pid=`pgrep irqbalance`
   if [ $? -eq 0 ];
   then
       echo "irqbalance is running! Pid = $pid"
       echo "it will undo anything done by this script"
       echo "Please kill it and re-run this script"
       exit
   fi

done=0
i=0
slice=0
start=0
num_slices=`grep "${eth}" /proc/interrupts | wc -l`
while [ $done != 1 ]
do
# one of the following, depending on which version of the driver is installed
   irq_data=`grep "${eth}:slice-${slice}" /proc/interrupts`

   if [ $? != 0 ];
   then
       if [ $i != 0 ];
       then
           exit
       fi
       irq_data=`grep "${eth}" /proc/interrupts`
       if [ $? != 0 ];
       then
           exit
       fi
   fi
   irq=`echo $irq_data |  awk '{print $1 ; }' | sed -e 's/://g'`
   file="/proc/irq/${irq}/smp_affinity"
   printf "Binding slice %2d to CPU %2d: writing mask 0x%08x to $file\n" $slice $mask $mask
   printf "%x" $mask > $file
   i=`expr $i + 1`
   slice=`expr $slice + 1`
   if [ $slice -eq $num_slices ];
   then
       exit
   fi
done
Save and exit.
Run the following: 
# chmod 750 /usr/local/bin/myri-irq-bind.sh
No comments :

Part III - The Ultimate Linux Home Router - Active Directory on openSUSE using Samba 4.1

 Friday, December 20, 2013

Compiling the Latest Version of Samba 4

Samba 4 is the first version of Samba to adequately host Active Directory without the need for an expensive Windows Server. Though it's been in the wild for a while now, it's still got some rough points. I've been using it for a few months now and the only issues I've run into have been centered purely around Microsoft applications that require schema updates to function. I'm running it with a single domain controller, so I've not tried to get replication functional (this is, after all, just a home network).
There are samba packages in the Tumbleweed repository, but at this point in time they are not at the version I needed, so we'll be compiling from the source. Parts of this entry were adapted from Conrad Jones blog. Much thanks to him for publishing that. Run the following commands (make, gcc and binutils will already be present if you opted to install fish): 
# zypper install make gcc binutils autogen krb5-devel krb5-client nano libacl-devel acl attr python python-devel
You may get a message indicating that python conflicts with patterns-openSUSE-minimal_base-conflicts, select to deinstall if this pops up. 
# reboot
We need to reboot to ensure that the filesystem is mounted with ACL support. After reboot, login: 
$ su
(Enter your password)
# cd ~
# wget http://www.samba.org/samba/ftp/stable/samba-4.1.3.tar.gz
# tar -xvf samba-4.1.3.tar.gz
# cd samba-4.1.3/
# ./configure; and make; and make install
You may want to visit Samba's Website to find the latest version rather than using 4.1.3. They move pretty quickly over there (a samba server I just installed two weeks ago was 4.1.1).
After about ten minutes, you should be compiled and ready to start configuring Samba and creating your new Active Directory domain.
Note: If you're wondering why the compile command issued was ./configure; and... instead of ./configure &&..., && is one of a handful of things fish shell doesn't support. If you're going to switch your shell to fish long-term, keep that in mind when viewing articles that have linux commands embedded. The syntax above will work in fish and bash.

Creating Samba Service Definition

# nano /usr/lib/systemd/system/samba.service
Copy and paste the following into the editor: 
[Unit]
Description=Samba AD Daemon
After=syslog.target network.target
 
[Service]
Type=forking
PIDFile=/usr/local/samba/var/run/samba.pid
LimitNOFILE=16384
EnvironmentFile=-/etc/sysconfig/samba
ExecStart=/usr/local/samba/sbin/samba $SAMBAOPTIONS
ExecReload=/usr/bin/kill -HUP $MAINPID
 
[Install]
WantedBy=multi-user.target
Hit Ctrl+O (Write Out) and Ctrl+X (Exit).
Now we'll create a symbolic link to the service and configure it to run at startup 
# ln -s /usr/lib/systemd/system/samba.service /etc/systemd/system/samba.service
# systemctl enable samba

Installing BIND 9 (Optional, use BIND 9 backend)

Personally, I prefer to stick with BIND over the default SAMBA DNS. It's rock solid, configurable, and there's a ton of information on how to tweak it because it's so widely used. You can stick with the internal DNS implementation if you want (and it's certainly a lot fewer steps), but I elected to use BIND. 
# zypper in bind

Edit the configuration files

Now we need to add some parameters to the existing named.conf. 
# nano /etc/named.conf
Directly beneath options {, put the following lines: 
        # BEGIN ---- Configuration Modifications
        auth-nxdomain yes;
        # NOTE: These are the opendns.org DNS servers. I choose to use them instead
        #       of the ones provided by my ISP. They're available globally so they
        #       should work fine, however, if your ISP or router adds their own split-brain
        #       DNS (U-Verse typically does this to make it easy to connect to your
        #       router information page), you will not be able to connect to their
        #       custom DNS entries.
        forwarders { 208.67.222.222; 208.67.220.220; };
        allow-transfer { none; };

        # IMPORTANT: Change the below to point to values appropriate for YOUR home network.
        #            I used 192.168.0.0 for my wired internal network and 192.168.2.0 for
        #            my guest wireless restricted internal network.
        allow-query {
                127.0.0.0/24;
                192.168.0.0/24;
                192.168.2.0/24;
        };

        # IMPORTANT: You should only EVER let hosts sitting on the non-internet side
        #            of your router allow recursion even if you allow queries from
        #            external networks!
        allow-recursion {
                127.0.0.0/24;
                192.168.0.0/24;
                192.168.2.0/24;
        };

        pid-file "/var/run/named/named.pid";
        empty-zones-enable no;
        # END   ---- Configuration Modifications
A note about some ISP networks: I have an ISP that provides me with an actual router. Ideally, we want to set up that router to pass all traffic to this router and do nothing else with it (disabling all firewall features). Sometimes this is done in a way that results in your external network card receiving your actual public routable IP. Sometimes this is done by setting the external interface as a DMZ host. The difference between them is negligible. With my ISP, if I want to have this box actually get the public IP address, I have to pay for a static IP. So I opted to use the DMZ method. This matters for only one reason NEVER include the network that is internal to your ISP provided router in the allow-query or allow-recursion section.. If you do that, you're actually allowing the entire internet to query and recurse on your DNS server. If you want to allow querying, simply add the external network zone to the allow-query section, but definitely do not add it to the allow-recursion section.

Modify the localhost Zone Files

# rm /var/lib/named/localhost.zone
# rm /var/lib/named/127.0.0.zone
# nano /var/lib/named/localhost.zone
Paste the following into localhost.zone: 
$TTL 1W

$ORIGIN localhost.

@       1D      IN      SOA     @   root (
                        42              ; serial (d. adams)
                        8H              ; refresh
                        2H              ; retry
                        4W              ; expiry
                        1D              ; minimum
                        )

@       IN      NS      @
        IN      A       127.0.0.1
        IN      AAAA    ::1
# nano /var/lib/named/127.0.0.zone
Paste the following into 127.0.0.zone: 
$TTL 1W

@       IN      SOA             localhost.   root.localhost. (
                                42              ; serial (d. adams)
                                8H              ; refresh
                                2H              ; retry
                                4W              ; expiry
                                1D              ; minimum
                                )

                IN NS           localhost.

1               IN PTR          localhost.
Fix permissions: 
# chown named:named /var/lib/named/*.zone
# chmod 640 /var/lib/named/*.zone
Let's test the configuration: 
# named -u named
Did you see nothing? Good. Otherwise, if you got an error, run through the configuration parts of this section again and make sure you set it up correctly.

Configuring for hosting services on our Internal network

Now that we're actually going to HOST something and we have DNS setup, we need to stop requesting DHCP addresses. We're going to ignore wireless for now. I currently have only one network adapter plugged in since my other is USB based and I don't need it quite yet, so I'll be referring to the only adapter that I have. If you're following along with this from Part I, you should only have one cable plugged in and that should be your plugged into your internal network. 
# yast
Select Network Devices and then Network Settings.

You're on the Overview screen. Select the network adapter that represents your plugged-in Ethernet adapter and choose Edit.
Put an X next to Statically assigned IP Address and hit TAB
Set your IP address to the desired value and hit TAB. I'm using 192.168.0.1 since .1 is commonly the router IP address.
Set your Subnet Mask and hit TAB. I'm using 255.255.255.0.
Set your fully qualified host name. This will be the computer hostname and the domain name that corresponds with your DNS and Active Directory domain. Example: host.somedomain.com
Go to the General tab.
Make sure Assigned Interface to Firewall Zone is set to Internal Zone (unprotected)
Hit F10
Go to Hostname/DNS and select Name server 1
Set it to the IP address you assigned above.
Go to Routing and select Default IPv4 Gateway and set it to your current, functioning router's IP. Do the same for IPv6 if applicable.
Hit F10 and once.
... and ... it hangs (or disconnects)! You just changed your IP address. Reconnect, but use the IP address you just set. 
$ su
(enter your password)
# chkconfig -s named on
# rcnamed start
# rcnamed status
You should see the status as active (running). Now we'll test localhost lookup: 
# host localhost. 127.0.0.1

Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:

localhost has address 127.0.0.1
And reverse lookup: 
# host 127.0.0.1 127.0.0.1
You should see: 
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases: 

1.0.0.127.in-addr.arpa domain name pointer localhost.
And let's nslookup something.
# nslookup google.com
You should get back results. If you do not, "nano /etc/resolv.conf" and make sure the line that says "nameserver" reads "nameserver 192.168.0.1" or whatever the IP address that you used for your server. Yast failed to update it when I updated the network settings. If it's different, change it, save it and try nslookup again

Provisioning our Active Directory Domain

We'll use samba-tool to provision the domain. 
# /usr/local/samba/bin/samba-tool domain provision --use-rfc2307 --interactive
You'll be prompted for values. Most should be the defaults if you've been following the configuration since Part 1. 
Realm [YOURDOMAIN.NET]:
 Domain [YOURDOMAIN]:
 Server Role (dc, member, standalone) [dc]:
 DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: BIND9_DLZ
Administrator password:
Retype password:
Make sure to set the DNS backend to BIND9_DLZ

Updating BIND configuration to include samba entries

# nano /usr/local/samba/private/named.conf
Put a "#" in front of the 'database "dlopen /usr/local/samba/lib/bind9/dlz_bind9.so"' and remove the "#" from 'database "dlopen /usr/local/samba/lib/bind9/dlz_bind9_9.so"'.
Save and exit.
# nano /etc/named.conf
Add the following to the top of the file: 
include "/usr/local/samba/private/named.conf";
Save and Exit.
And finally, we have to prevent BIND from running chrooted so that it can find the dlz_bind9_9.so file. 
nano /etc/sysconfig/named
Change the line that reads NAMED_RUN_CHROOTED="yes" to NAMED_RUN_CHROOTED="no".
# systemctl start samba
# rcnamed restart
# rcnamed status
You should see that the server is running. Now let's check that the samba entries have been created:
# host -t SRV _ldap._tcp.yourdomain.net
You should see: 
_ldap._tcp.diagonactic.net has SRV record 0 100 389 yourdomaincontroller.yourdomain.net.

Configuring Kerberos and testing your new domain

We need to be able to get kerberos tickets, so we're going to configure the kerberos client and give it a test. 
# cp /usr/local/samba/private/krb5.conf /etc/krb5.conf
# kinit administrator@YOURDOMAIN.NET
(enter the password you provided in the samba-tool step above
The capital letters are not optional. You should see a message about your password expiring in several days. Now, let's see if you have a ticket. 
# klist
You should see a ticket in the list with a start date, expiration date and a renew until date that corresponds with the user you entered in the kinit statement above.

Configuring your server to backup your Active Directory environment

Especially since Active Directory support in Samba is relatively new and has bugs being fixed constantly, it's a good idea to have a backup because you'll probably be applying updates. And the fact that an AD domain is something that's usually in a state of flux, it's a good idea to get that started now. 
# cp ~/samba-4.1.3/source4/scripting/bin/samba_backup /usr/sbin
# chown root:root /usr/sbin/samba_backup
# chmod 750 /usr/sbin/samba_backup
# mkdir /usr/local/backups
# chmod 750 /usr/local/backups
# ln -s /usr/sbin/samba_backup /etc/cron.daily/samba_backup
# nano /usr/sbin/samba_backup
Find the part of the script that looks like this: 
                for ldb in `find $relativedirname -name "*.ldb"`; do
                        tdbbackup $ldb
                        if [ $? -ne 0 ]; then
                                echo "Error while backuping $ldb"
                                exit 1
                        fi
                done
Change the "tdbbackup $ldb" line to this (you can also add samba to your path, however, this guarantees the script will execute properly without the path variable set). 
/usr/local/samba/bin/tdbbackup $ldb
Test the backup: 
# /usr/sbin/samba_backup
# ls /usr/local/backups
samba_backup should return silently after running for a second and you should see files "etc..tar.bz2", "samba4_private..tar.bz2", and "sysvol..tar.bz2". If you ever need to restore, follow the instructions on the Samba Wiki.
No comments :
Subscribe to: Posts ( Atom )