Catégorie : Geek

Got plenty of query (cache) 'isc.org/ANY/IN' denied in your bind9 logs? Like about 1 query per second from several IPs? Want to tell them to get lost? This entry may interest you then.

No extensive writing needed here, there is the essential:

$IPT -A INPUT -i $MAIN_IF -p udp --dport 53 -m recent --set

$IPT -A INPUT -i $MAIN_IF -p udp –dport 53 -m recent –update –seconds 30 –hitcount 10 -j DROP

$IPT -A INPUT -p udp –dport 53 -j ACCEPT

I put these rules before other INPUT rules, and restarted my firewall.

Now DNS access on my public IP is limited to 10 separate queries within a 30 seconds timeframe. It seems acceptable for the moment, and DNS fsckers generally get dropped within the first 15 seconds, which is correct for me. But feel free to experiment different values according to your needs.

I hope this will help :)

I found this feature this morning, and the irc folks being enthusiastic, I decided to blag about it.

I use GNU screen on a daily basis for almost three years. Not only able to provide an almost complete terminal emulation, with detach and reattach abilities, extensive keyboard bindings, tabs (a.k.a windows) management, Gnu screen is a versatile tool, although surprisingly more than often ignored by a lot of people.

There is a little reminder of what GNU screen consists in.

Requirements, or at least highly recommended setup

It is highly recommended to have a screenrc that provides a hardstatus line, the only practical way to distinguish one screen from another.

Here is mine:

shell /bin/zsh
attrcolor b ".I"
termcapinfo xterm 'Co#256:AB=\E[48;5;%dm:AF=\E[38;5;%dm' 
defbce "on"
term screen-256color
maptimeout 5
termcapinfo xterm* ti@:te@
hardstatus alwayslastline
hardstatus string '%{= kG}[%{G}%H%{g} %l][%=%{= kw}%?%-Lw%?%{r}(%{W}%n*%f%t%?(%u
)%?%{r})%{w}%?%+Lw%?%?%=%{g}][%{B}%d/%m %{W}%c%{g}]'
defnonblock 5

Of course, you should adapt this to fit your needs, only the lines beginning with hardstatus are relevant there.

Now that your GNU screen is properly configured, I can highlight the bullet point of this howto :)

Pictures are said to help comprehension. I say LIES!

My X terminal emulator is Terminator. Combined with GNU screen, you can obtain … that…thing:

(click on the thumbnail to maximize)

Please bear with me, even if this caused some eye-melting :P

Some explanations: each zone delimited by light grey borders are in fact splits in Terminator. Gnu screen sessions are contained in the numbered splits.

1: err… not really a screen, I guess I’m tired and too lazy to correct the picture.

2: lwatch on dresda

3: lwatch on pandora

4: htop on dresda

5: htop on pandora

6: irssi on dresda

The only thing I had to do is to execute screen -e ^ee on pandora, therefore rebinding all default ^a (Ctrl+a) bindings to ^e (Ctrl+e).

Then you control the main screen with the default binding, while controlling the inner screen with these new binds (i.e ^ac to create a new window in the main screen, ^ec to do the same in the inner screen :)

Finally, the relevant part in man screen:

       -e xy
            specifies the command character to be x and the character generat‐
            ing a literal command character to y (when typed after the command
            character).  The default is "C-a" and `a', which can be  specified
            as  "-e^Aa".  When creating a screen session, this option sets the
            default command character. In a multiuser session all users  added
            will  start off with this command character. But when attaching to
            an already running session, this option changes only  the  command
            character  of  the  attaching  user.  This option is equivalent to
            either the commands "defescape" or "escape" respectively.

I really enjoy it, it’s like a Christmas present for all BOFHs, blinking like a Christmas Tree when some jerk is trying to mess with your servers/networks :D