The opposite of fail2ban would probably be called auth2allow (authenticate to allow) or fail2allow – but that’s not necessary because fail2ban’s configs can be customized to do exactly what I’m talking about. What am I talking about you ask? Basically what I’ve done and am about to explain how to do is setup fail2ban to look for a successful login on a FTP to allow the authenticated IP to get access to another port that isn’t as secure as FTP so is usually 100% black listed in IPTables. It’s just a hack of a security mechanism to allow your self or others into places securely through obscure means. Like most security it’s not perfect but it seems pretty solid in my mind.

If someone can authenticate on the FTP (could even be anonymous ftp, but I’d recommend using a special username you want to specifically grant access) then fail2ban triggers an ALLOW command for their IP on some port (or all ports), for example SSH (22) or apache https (443) with a private site on it that you want to keep private and totally hidden from the internet at large. This concept could really apply to anything. Any command IPTables can run can be triggered through something fail2ban sees in a log file basically, the possibilities are endless. In my example I’ll use https, port 443, but in real life I’m using an obscure port number and the program running on it that is not very secure by default.

So here are my slightly modified configuration files for setting up a custom fail2ban service that does the opposite of what fail2ban typically does.

(more…)

Not really a tutorial, mostly notes to my self so I remember how it’s done down the road.

(more…)

I made some modifications to my original gnump3d init.d script when I needed more than one instance of GNUmp3d running (for multiple folders completely separated). I still haven’t quite figured out how to get the tag database to work for my second GNUmp3d instance, if anyone can help please leave a comment. Here’s the script and some brief instructions:

(more…)

I like to have interfaces and description, not one or the other. So I do this. Use your favorite editor to open indexmaker: vi /usr/bin/indexmaker

Find this part:

for ($$opt{section}) {
# ...Skip ahead to descr...
/^descr(iption)?$/ &&
do{
$section = "No Description for $item";
$$rcfg{setenv}{$item} =~ /MRTG_INT_DESCR="(.+?)"/ #"
and $section = $1;
$$rcfg{pagetop}{$item} =~
m,<td>Description:</td>\s*<td>\Q$section\E\s*([^< ][^>]+?)

,i
and $section = $1;
last;
};


The first “and $section = $1;” is a catch all to assign the interface name if there’s no description. The second one overwrites it, replacing the int name if it does find a description. So all you need to do is modify the second instance of “and $section = $1;” to:

and $section = $section . " - " . $1;

And your MRTG index is infinitely improved!

Here my chronicle of fixes and tasks I had to go through while setting up my HDTV HTPC / home server.

I upgraded from an older xUbuntu to xUbuntu 8.10 64-bit and the first thing I had to do is restore the windows file share where I backed up configurations, samba shares, and my Adaptec SATA Raid 1210SA. Then I had to conquer ATI’s proprietary drivers and restore my previous install’s server functionality. Next time I’ll be finishing up the HTPC portion by configuring my TV Tuner with mythTV and installing Boxee as well – and maybe integrating the two together if possible.
(more…)