devil-linux-discuss Mailing List for Devil-Linux (Page 399)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Bjørn Rasmussen wrote:
| Perhaps the floppy can be used for this home-directory and then made
| write-protected?

It's easy!
You have to modify the file /sbin/save-config to include /home, that's all.
The best is to place the modified file into the /etc folder (suggestion:
/etc/scripts/save-config).

Heiko
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6-2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAj0ZDLEACgkQzRJAyNsjWPnOSwCfUnbD2ipgK1N03tL5Ywtg42jz
eE8AoMGxnjV/d6ZAA/6HvR3ySM97bcOd
=7kOz
-----END PGP SIGNATURE-----

Hi!

Is there a way to quickly check versionnumbers of software included on=20
the Devil-Linux CD-ROM?

This would be nice, because every time I receive info regarding security=
=20
issues, I wonder if I have an allready updated version in Devil-Linux.

I see the "/cdrom/packages/packages.lst" contains some numbers, but they=
=20
don't seem like versionnumbers.



--=20
Bj=F8rn Rasmussen                         Tel:     +47 38 04 09 55, +47 =
911=20
27367
Bj=F8rn Rasmussen Nettverkstjenester	   E-mail:   bj...@se...
Moneheia 47,
Kristiansand,  4656                     Org.nr.  981 646 770

RHCE:  http://www.redhat.com/rhce/rhce807001641802868.html
MCSE, MCP, MCP+I:  NT 4.0

Hi John, thank you for your very informative info!  You gave me a good=20
idea of how Devil-Linux harddisk option should be managed.  I browsed=20
through your enclosed LVM-instructions and also the LVM-Howto.  Yet=20
another exciting Linux aspect.

Unfortunately my question wasn't formed precisely enough.  In my=20
particular installation I do not have any hard-drive.  I still want to=20
create a home directory for a service-user, logging in via scp and a=20
script on another machine.  Thus this user needs a ".ssh" directory=20
containing keys for password free log in.  After the ssh configuration i=
s=20
done, the homedirectory will not change.

Perhaps the floppy can be used for this home-directory and then made=20
write-protected?

Another related question:  Using ssh for logging in as root is usually=20
considered as not so good practice.  It's common to remove access for=20
root through ssh, forcing you to log in as an ordinary user, and then=20
"su" to root.  What's the best practice for Devil-Linux, where you don't=
=20
have ".ssh"-directories for this "ordinary user"?

Perhaps ssh keys is the single alternative?


Anybody, appreciate a helping hand!  Thanks!


Bjoern

>>>>>>>>>>>>>>>>>> Original Message <<<<<<<<<<<<<<<<<<

On 24.06.02, 18:17:40, "John van V." <joh...@ya...> wrote regard=
ing=20
Re: [Devil-Linux-discuss] Homedirectories:


> Hi Bjorn (pardon my American keyboard ;)

> Devil-Linux is not meant to preserve anything through reboots.

> Thats kind of the whole point.  For security reasons only two partitio=
ns=20
exist,
> /var and /swap.  I think of Devil-Linux as a vehicle for IPTABLES,=20
FreeSwan,
> and other front line protection systems for networks.

> /var exists for logging and /swap exists to accomdate the SHMFS type o=
f
> ramdisk.

> Personally, I think logging should go trough an encrypted tunnel.  /va=
r=20
can be
> wrapped with ssh for instance or messages can be transferred via a an =

encrypted
> signalling system similar to syslogd.

> This would make /swap the only DL disk component.

> About eLSD... (optional, you can skip to next paragraph)
> eLSD, The enhanced Linux Society Distro, is a user environment built o=
n=20
top of
> Devil-Linux.  At some point eLSD will have to compile its own kernel, =
use=20
GCC3,
> possibly make other enhancements which deviate far from the purpose of=

> Devil-Linux.  Ideally, we at the linux society want to create a platfo=
rm=20
for
> developing truly de-bloated server systems deployable to the 6 billion=
=20
humans
> out there.  In our enhancement, DL will be buildable under DL... =20
Ultimately
> the concept of an application will dissappear, the only application wi=
ll=20
be the
> OS and the OS will simply recognise datasets, addressed by URLs, and t=
hen=20
load
> the proper libraries (methods) so that the user can use the data.  Thi=
s=20
is the
> ThinMan model, and our favorite target is the cell phone.  The OS will=
=20
one day
> become a library written for the hardware further increasing efficency=
=20
and
> battery life.

> Having said all that, let me say that I have added /opt and plan to bu=
ild=20
a
> whole /usr type directory there, including its own "enhaced root" ther=
e=20
called
> sys_adm.

> You create your /home diretories on your harddrive using LVM (doing th=
is=20
makes
> us DL admins proud); very good instructions exist on the DL site.

> You then edit /etc/init.d/mountfs (on your floppy) to create your moun=
t=20
point
> (mine is /opt, yours is /home)  before the mount -a command.

> I tried to hack many of the init.d scripts but bash as it exists in DL=
=20
seems to
> seems be broken in many ways.. could it be busy box ??  Dont know.

> My advice is to keep it simple.  Here are the changed lines in my=20
mountfs:

> ## /etc/init.d/mountfs

> # Walk through /etc/fstab and mount all file systems that don't have
>                 # the noauto option set in the fs_mntops field (the 4t=
h=20
field.
> ee
>                 # man fstab for more info)
>                 #
>                 echo -n "Making other mount points..."
> #Here >>>>>     mkdir /opt
>                 evaluate_retval
>                 echo -n "Mounting other file systems..."
>                 /bin/mount -a
>                 evaluate_retval

> ##
> ### /etc/fstab ###

> # Begin /etc/fstab

> # location of filesystem        mount point     fs-type         option=
s

> #/dev/*LFS-partition device*    /               *fs-type*       defaul=
ts=20
1 1
> /dev/devil-linux/swap          swap             swap            defaul=
ts=20
0 0
> /dev/devil-linux/opt           /opt             reiserfs        defaul=
ts=20
0 0
> #proc                           /proc           proc            defaul=
ts=20
0 0
> # End /etc/fstab

> Attached are instructions for creating LVMs....

> Hope this helps, John



> =3D=3D=3D=3D=3D
> John van Vlaanderen

>       #############################################
>       #    CXN, Inc. Contact:  jo...@th...   #               #
>       #      Proud Sponsor of The Linux Society   #
>       #        http://www.thelinuxsociety.org     #
>       #############################################

> __________________________________________________
> Do You Yahoo!?
> Yahoo! - Official partner of 2002 FIFA World Cup
> http://fifaworldcup.yahoo.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Bjørn Rasmussen wrote:
| How to preserve homedirectories for added users through  reboots?
| (/home/xxx not saved to floppy).

The next release (0.6, already working on it) will have support for home
directories on a harddisk.
Currently we didn't plan to save it on the floppy, only /root and /etc
will be there.

| B.t.w., this is a great project! :-)

Thanks

Heiko
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6-2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAj0XVUcACgkQzRJAyNsjWPkE5gCeJ3IbCF23CjEb+QZGhePXFPIv
hi8AoNlYB1mZyr9NwBUZmxIFshUZ4LnA
=gEOg
-----END PGP SIGNATURE-----

The last one was meant for the Linux Society list.

Sorry, John



=====
John van Vlaanderen

      #############################################
      #    CXN, Inc. Contact:  jo...@th...   #               #
      #      Proud Sponsor of The Linux Society   #
      #        http://www.thelinuxsociety.org     #                 
      #############################################

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

Hello everybody,
Bjorn Rasmussen asked on the Devil Linux discuss list how to create more
directories on Devil-Linux, seemingly impossible since a CD is read-only.

I answered to add a mkdir /home to the /etc/init.d/mountfs file.  But I also
addressed the purpose of DL as opposed to the enhanced Linux Society Distro
whichis to build a debloated development environment on top of DL.

### Here is the forward ####

Hi Bjorn (pardon my American keyboard ;)

Devil-Linux is not meant to preserve anything through reboots.

Thats kind of the whole point.  For security reasons only two partitions exist,
/var and /swap.  I think of Devil-Linux as a vehicle for IPTABLES, FreeSwan,
and other front line protection systems for networks. 

/var exists for logging and /swap exists to accomdate the SHMFS type of
ramdisk.

Personally, I think logging should go trough an encrypted tunnel.  /var can be
wrapped with ssh for instance or messages can be transferred via a an encrypted
signalling system similar to syslogd.

This would make /swap the only DL disk component.

About eLSD... (optional, you can skip to next paragraph)
eLSD, The enhanced Linux Society Distro, is a user environment built on top of
Devil-Linux.  At some point eLSD will have to compile its own kernel, use GCC3,
possibly make other enhancements which deviate far from the purpose of
Devil-Linux.  Ideally, we at the linux society want to create a platform for
developing truly de-bloated server systems deployable to the 6 billion humans
out there.  In our enhancement, DL will be buildable under DL...  Ultimately
the concept of an application will dissappear, the only application will be the
OS and the OS will simply recognise datasets, addressed by URLs, and then load
the proper libraries (methods) so that the user can use the data.  This is the
ThinMan model, and our favorite target is the cell phone.  The OS will one day
become a library written for the hardware further increasing efficency and
battery life.

Having said all that, let me say that I have added /opt and plan to build a
whole /usr type directory there, including its own "enhaced root" there called
sys_adm.

You create your /home diretories on your harddrive using LVM (doing this makes
us DL admins proud); very good instructions exist on the DL site.

You then edit /etc/init.d/mountfs (on your floppy) to create your mount point
(mine is /opt, yours is /home)  before the mount -a command.

I tried to hack many of the init.d scripts but bash as it exists in DL seems to
seems be broken in many ways.. could it be busy box ??  Dont know.

My advice is to keep it simple.  Here are the changed lines in my mountfs:

## /etc/init.d/mountfs

# Walk through /etc/fstab and mount all file systems that don't have
                # the noauto option set in the fs_mntops field (the 4th field. 
ee
                # man fstab for more info)
                #
                echo -n "Making other mount points..."
#Here >>>>>     mkdir /opt
                evaluate_retval
                echo -n "Mounting other file systems..."
                /bin/mount -a
                evaluate_retval

## 
### /etc/fstab ###

# Begin /etc/fstab

# location of filesystem        mount point     fs-type         options

#/dev/*LFS-partition device*    /               *fs-type*       defaults 1 1
/dev/devil-linux/swap          swap             swap            defaults 0 0
/dev/devil-linux/opt           /opt             reiserfs        defaults 0 0
#proc                           /proc           proc            defaults 0 0
# End /etc/fstab

Attached are instructions for creating LVMs....

Hope this helps, John



=====
John van Vlaanderen

      #############################################
      #    CXN, Inc. Contact:  jo...@th...   #               #
      #      Proud Sponsor of The Linux Society   #
      #        http://www.thelinuxsociety.org     #                 
      #############################################

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

Hi Bjorn (pardon my American keyboard ;)

Devil-Linux is not meant to preserve anything through reboots.

Thats kind of the whole point.  For security reasons only two partitions exist,
/var and /swap.  I think of Devil-Linux as a vehicle for IPTABLES, FreeSwan,
and other front line protection systems for networks. 

/var exists for logging and /swap exists to accomdate the SHMFS type of
ramdisk.

Personally, I think logging should go trough an encrypted tunnel.  /var can be
wrapped with ssh for instance or messages can be transferred via a an encrypted
signalling system similar to syslogd.

This would make /swap the only DL disk component.

About eLSD... (optional, you can skip to next paragraph)
eLSD, The enhanced Linux Society Distro, is a user environment built on top of
Devil-Linux.  At some point eLSD will have to compile its own kernel, use GCC3,
possibly make other enhancements which deviate far from the purpose of
Devil-Linux.  Ideally, we at the linux society want to create a platform for
developing truly de-bloated server systems deployable to the 6 billion humans
out there.  In our enhancement, DL will be buildable under DL...  Ultimately
the concept of an application will dissappear, the only application will be the
OS and the OS will simply recognise datasets, addressed by URLs, and then load
the proper libraries (methods) so that the user can use the data.  This is the
ThinMan model, and our favorite target is the cell phone.  The OS will one day
become a library written for the hardware further increasing efficency and
battery life.

Having said all that, let me say that I have added /opt and plan to build a
whole /usr type directory there, including its own "enhaced root" there called
sys_adm.

You create your /home diretories on your harddrive using LVM (doing this makes
us DL admins proud); very good instructions exist on the DL site.

You then edit /etc/init.d/mountfs (on your floppy) to create your mount point
(mine is /opt, yours is /home)  before the mount -a command.

I tried to hack many of the init.d scripts but bash as it exists in DL seems to
seems be broken in many ways.. could it be busy box ??  Dont know.

My advice is to keep it simple.  Here are the changed lines in my mountfs:

## /etc/init.d/mountfs

# Walk through /etc/fstab and mount all file systems that don't have
                # the noauto option set in the fs_mntops field (the 4th field. 
ee
                # man fstab for more info)
                #
                echo -n "Making other mount points..."
#Here >>>>>     mkdir /opt
                evaluate_retval
                echo -n "Mounting other file systems..."
                /bin/mount -a
                evaluate_retval

## 
### /etc/fstab ###

# Begin /etc/fstab

# location of filesystem        mount point     fs-type         options

#/dev/*LFS-partition device*    /               *fs-type*       defaults 1 1
/dev/devil-linux/swap          swap             swap            defaults 0 0
/dev/devil-linux/opt           /opt             reiserfs        defaults 0 0
#proc                           /proc           proc            defaults 0 0
# End /etc/fstab

Attached are instructions for creating LVMs....

Hope this helps, John



=====
John van Vlaanderen

      #############################################
      #    CXN, Inc. Contact:  jo...@th...   #               #
      #      Proud Sponsor of The Linux Society   #
      #        http://www.thelinuxsociety.org     #                 
      #############################################

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

Hi!

How to preserve homedirectories for added users through  reboots? =20
(/home/xxx not saved to floppy).


B.t.w., this is a great project! :-)



--=20
Bj=F8rn Rasmussen                         Tel:     +47 38 04 09 55, +47 =
911=20
27367
Bj=F8rn Rasmussen Nettverkstjenester	   E-mail:   bj...@se...
Moneheia 47,
Kristiansand,  4656                     Org.nr.  981 646 770

RHCE:  http://www.redhat.com/rhce/rhce807001641802868.html
MCSE, MCP, MCP+I:  NT 4.0

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I wrote you an answer, but it seems that the mail didn't go through.

- ---- snip ----
We were thinking about adding this feature, but don't know when we will
implement it.
Currently you would have the download the build system and create your
own ISO. You would have to modify the file linuxrc (in the build system:
build/config/etc/initrd/linuxrc ) within the InitRD.
On the other hand, this feature would currently only work for IDE CD-ROMs.

When you want to add this feature, I can give you some more information
how we planned to implement this.

Heiko
- ---- snap ----

Balazs \"Otto\" Czifra wrote:
| This is a re-post after getting no response to the first posting. Is there
| any way to run DL w/o a floppy drive? IE. could I burn the floppy config
| files to a cd/rw and then have DL look there instead of /mnt/floppy? I
| have a dead floppy controller on my motherboard, so i'm kinda outta luck,
| and it (not surprisingly) didn't pick up the ISA floppy controller I
| tried. Suggestions very welcomed.
|
| THanks,
| Otto
|
|
|
| -------------------------------------------------------
| Sponsored by:
| ThinkGeek at http://www.ThinkGeek.com/
| _______________________________________________
| Devil-linux-discuss mailing list
| Dev...@li...
| https://lists.sourceforge.net/lists/listinfo/devil-linux-discuss
|


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6-2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAj0XEUsACgkQzRJAyNsjWPknnACfdKG/LKAcGewOjJsg7sXGL9yU
GxoAoMQRd5QXPajjPrLFM+xF1/ou6l3p
=3AUh
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

a couple of month ago, I used DL for a VPN experiment.
I had an IPSec Tunnel with X.509 Authentication and through this one a
PPTP Tunnel with 40 Bit Encryption. The throughput was on a Celeron 800
about 40 MBit/s.

So you shouldn't have any problems.

Heiko
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6-2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAj0XEOIACgkQzRJAyNsjWPnDBACgnK0TZSEgOLNOMgPBdJF1b6Uj
+g8An2kXX7u04Aw+2I6he+fuWxzv6pVM
=1KHI
-----END PGP SIGNATURE-----

This is a re-post after getting no response to the first posting. Is there
any way to run DL w/o a floppy drive? IE. could I burn the floppy config
files to a cd/rw and then have DL look there instead of /mnt/floppy? I
have a dead floppy controller on my motherboard, so i'm kinda outta luck,
and it (not surprisingly) didn't pick up the ISA floppy controller I
tried. Suggestions very welcomed.

THanks,
Otto

We are considering rolling out DL as a routing firewall for our internal
network (with VPN use too). I wondered if anyone else was doing this, and
had any comments about capacity and throughput. I realise this is to some
extent dependent on firewall complexity  - as a rough guide, our IPtables
firewall script is about 894 lines, of which over half is comment.

We're looking to handle 50 users with significant email and web traffic, but
not a great deal else. A maximum of probably 5 VPN users at any one time. 

The hardware would be 400 MHz Pentium III with 512MB RAM and two Intel 100
Pro cards. This is ultimately connected externally to a 512k leased line.

I don't envisage any significant problems, but it would be nice to hear from
someone else that they are doing the same thing.
Thanks,
Moray

------------------------------------
Moray McConnachie, IT Manager
Oxford Analytica http://www.oxan.com 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chad Martin wrote:
| Without lugging my monitor over to my DL box, could you tell me if
| there's a program in DL to check to see how much memory is free so I
| know how much I can commit to a DNS cache?

"free" is what you're looking for.

Heiko
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6-2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAj0WOPAACgkQzRJAyNsjWPnE0wCfeYF2x+gRxBJol02eRRzNpvy3
QEcAoIfs+mlJ4XFjAVKoLEwY87fl4OMz
=PWWT
-----END PGP SIGNATURE-----

Heiko Zuerker wrote:
 > | Problem:  When loading the firewall during the DL bootup, DL gives
 > | the following error:  ip: command not found (or whatever).  I
 > | don't know enough about shell scripts to determine whether the
 > | script would exit at that error or not.
 >
 > You need to install the package "IPROUTE2".

and

> You have 2 options:
> 
> 1) Use masquerading (I think you will anyway) and setup the computers in
> your LAN to use the ISPs DNS Servers (not really good)
> 
> 2) Setup a DNS Cache. You can either use the DNSCACHE package from D.J.
> Bernstein (doku: http://cr.yp.to ) or you use BIND. Both programs are
> available on DL.

Heiko, you are the man with all the answers!  Dizamn.

I'll probably give this stuff a shot next weekend or something.  Right 
now everything is working just fine, so I can afford to put off the 
tweaking.

Right now I'm running under option 1 for the DNS issue.  I'm not sure 
why you label it as "not really good," but it seems to work.  I'll 
probably set up a DNS cache later.  The only issue is that either 
DNSCACHE or BIND seem to be fairly memory intensive when the amount of 
DNS info increases, and I'm running DL on a Pentium 75 with 80 MB of RAM.

Without lugging my monitor over to my DL box, could you tell me if 
there's a program in DL to check to see how much memory is free so I 
know how much I can commit to a DNS cache?

Thanks again,

Chad

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

You have 2 options:

1) Use masquerading (I think you will anyway) and setup the computers in
your LAN to use the ISPs DNS Servers (not really good)

2) Setup a DNS Cache. You can either use the DNSCACHE package from D.J.
Bernstein (doku: http://cr.yp.to ) or you use BIND. Both programs are
available on DL.

Heiko
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6-2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAj0WC7oACgkQzRJAyNsjWPkASACfaSWlMxvCcOu3Gt65LMXOOFkC
s2AAn2DXeYTjjqKgyURVd7UvscjMZ/GW
=vm5a
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chad Martin wrote:

| Problem:  When loading the firewall during the DL bootup, DL gives the
| following error:  ip: command not found (or whatever).  I don't know
| enough about shell scripts to determine whether the script would exit at
| that error or not.

You need to install the package "IPROUTE2".

Heiko
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6-2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAj0WCd0ACgkQzRJAyNsjWPnx/QCdHWwMG7F5z/lXrxTLBt9+1wf2
/h8An3dCQL6nlCsI+fmeBANj9uJfjqE3
=4GaB
-----END PGP SIGNATURE-----

I encountered the following problems with setting up my DL firewall 
with Firewall Builder:

Problem:  The install script wanted access to the following 
directories in etc.tar.gz which are, by default, set to deny 
permission to the directory.  The directories are: /etc/postfix 
/etc/ipsec.d /etc/sysconfig/jail

Solution: chmod u+wx those directories and repack the tar.gz file.  I 
don't know why the permissions are set this way, but it causes a fatal 
error with the fwbuilder DL install script.

--------

Problem:  When loading the firewall during the DL bootup, DL gives the 
following error:  ip: command not found (or whatever).  I don't know 
enough about shell scripts to determine whether the script would exit 
at that error or not.

Solution:  This isn't a solution, really.  I just commented out the 
lines in the .fw file after I compiled the firewall in Firewall 
Builder, but before I installed it onto the floppy.  The lines were:

#ip -f inet addr flush dev eth1 scope link
#ip -f inet addr flush dev l0 scope link

I got the impression from some web searches that these weren't vital, 
and everything seems to work, so I don't know if you want to add the 
ip command in future versions of DL or what.

Chad Martin

Chad Martin wrote:
> I'm trying to get my DL installation running properly, and I seem to be 
> very close, but I don't seem to be getting the DNS goodies to my 
> internal network.

After some poking around, I found a IP masq howto on www.tldp.org that 
claimed that I *needed* to give my ISPs DNS servers to my local host 
machines.  I know that my RT311 didn't need that, and that I could 
configure it as the DNS server on my host machines.  I suppose that 
would mean that it ran an internal DNS server, would it not?

Good news is that this email will very shortly be sent through my 
fully functional DL box to you guys.

Woot!

Chad

I'm trying to get my DL installation running properly, and I seem to 
be very close, but I don't seem to be getting the DNS goodies to my 
internal network.

Here's the setup:
ISP -> DL -> 192.168.0.0 network

DL gets its IP over DHCP from the ISP.  This seems to work fine.  My 
internal network is all static IPs.  I can ping the DL internal 
interface from a computer on the internal network with no problem. 
The problem is that the computers on the host aren't getting their DNS 
requests forwarded on to the ISP's DNS servers, I think.

For example, http://64.12.151.215/ comes up in a browser, but 
www.netscape.com doesn't.  Curiously, pinging that IP address results 
in 100% packet loss.

Do I need to set up a DNS server on DL?  I'd think not, since the 
Netgear RT311 I'm currently using as a router doesn't do that, AFAIK.

In case it's useful, I've appended my firewall script below, generated 
from fwbuilder.  Note that I had to comment out the ip -f commands 
about halfway through, since DL doesn't have the ip command.

Thanks for all the help,
Chad Martin

#!/bin/sh
#
#  This is automatically generated file. DO NOT MODIFY !
#
#  Firewall Builder  fwb_iptables v1.0.2
#
#  Generated Sat Jun 22 19:25:50 2002 EST by chad
#
#
#
#

if [ -x /usr/bin/logger ]; then
   logger -p info "Activating firewall script Devil.fw generated Sat 
Jun 22 19:25:50 2002 EST by chad"
fi

MODULE_DIR="/lib/modules/`uname -r`/kernel/net/ipv4/netfilter/"
MODULES="ip_conntrack ip_conntrack_ftp ip_nat_ftp ip_conntrack_irc 
ip_nat_irc"
for module in $(echo $MODULES); do
   if [ -e "${MODULE_DIR}/${module}.o" -o -e 
"${MODULE_DIR}/${module}.o.gz" ]; then
     modprobe -k ${module} ||  exit 1
   fi
done


FWD=`cat /proc/sys/net/ipv4/ip_forward`
echo "0" > /proc/sys/net/ipv4/ip_forward

echo "1" > /proc/sys/net/ipv4/ip_dynaddr

echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout

echo "1800" > /proc/sys/net/ipv4/tcp_keepalive_intvl

iptables -P OUTPUT  DROP
iptables -P INPUT   DROP
iptables -P FORWARD DROP




cat /proc/net/ip_tables_names | while read table; do
   iptables -t $table -L -n | while read c chain rest; do
       if test "X$c" = "XChain" ; then
         iptables -t $table -F $chain
       fi
   done
   iptables -t $table -X
done


#ip -f inet addr flush dev eth1 scope link
#ip -f inet addr flush dev l0 scope link




iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#
#   NAT Rule #0
#
iptables -t nat -A POSTROUTING  -o eth0 -s 192.168.0.0/255.255.255.0 
-d 0/0 -j MASQUERADE
#
#   Interface Rule #0
#
#    Anti-spoofing rule
#
iptables -N IRULE_0_eth0
iptables -A INPUT -i eth0  -s 192.168.0.0/255.255.255.0 -j IRULE_0_eth0
iptables -A FORWARD -i eth0  -s 192.168.0.0/255.255.255.0 -j IRULE_0_eth0
iptables -A INPUT -i eth0  -s 192.168.0.1 -j IRULE_0_eth0
iptables -A FORWARD -i eth0  -s 192.168.0.1 -j IRULE_0_eth0
iptables -A IRULE_0_eth0  -j LOG   --log-level 6 --log-prefix "RULE 0 
-- Deny "
iptables -A IRULE_0_eth0  -j DROP
#
#   Interface Rule #1
#
#    Anti-spoofing rule
#

iptables -N F_IRULE_1_eth0
iptables -A FORWARD -o eth0  -j F_IRULE_1_eth0
iptables -A F_IRULE_1_eth0 -o eth0  -s 192.168.0.0/255.255.255.0 -j RETURN
iptables -N O_IRULE_1_eth0
iptables -A OUTPUT -o eth0  -j O_IRULE_1_eth0
iptables -A O_IRULE_1_eth0 -o eth0  -j RETURN
iptables -N IRULE_1_eth0
iptables -A F_IRULE_1_eth0 -o eth0  -j IRULE_1_eth0
iptables -A O_IRULE_1_eth0 -o eth0  -j IRULE_1_eth0
iptables -A IRULE_1_eth0  -j LOG   --log-level 6 --log-prefix "RULE 1 
-- Deny "
iptables -A IRULE_1_eth0  -j DROP
#
#   Interface Rule #0
#
#    allow everything on loopback
#
iptables -N IRULE_0_l0
iptables -A INPUT -i l0  -j IRULE_0_l0
iptables -A FORWARD -i l0  -j IRULE_0_l0
iptables -A OUTPUT -o l0  -j IRULE_0_l0
iptables -A FORWARD -o l0  -j IRULE_0_l0
iptables -A IRULE_0_l0  -j ACCEPT
#
#    Rule #0
#
#    block fragments
#
iptables -N RULE_0
iptables -A OUTPUT  -j RULE_0 -f
iptables -A INPUT  -j RULE_0 -f
iptables -A FORWARD  -j RULE_0 -f
iptables -A RULE_0  -j LOG   --log-level 6 --log-prefix "RULE 0 -- Deny "
iptables -A RULE_0  -j DROP
#
#    Rule #1
#
#    'masquerading' rule
#
iptables -N RULE_1
iptables -A INPUT  -m state --state NEW  -s 192.168.0.0/255.255.255.0 
-j RULE_1
iptables -A FORWARD  -m state --state NEW  -s 
192.168.0.0/255.255.255.0 -j RULE_1
iptables -A RULE_1  -j ACCEPT
#
#  Final rules
#
iptables -A INPUT      -j DROP
iptables -A OUTPUT     -j DROP
iptables -A FORWARD    -j DROP

echo "1" > /proc/sys/net/ipv4/ip_forward

Heiko Zuerker wrote:
> |> For the NE2000 card, you should try adding parameters to the module,
> |> because it's an old ISA card.
> |> MODULE="ne io=200 irq=5"
> |
> | OK.  I was going to ask that.  I found that the ne module wanted at
> | least a specific io address last night, but when I tried insmoding the
> | module after boot, I got a ton of unresolved symbol errors.  Some more
> 
> Do a "depmod -a" and then "save-config", this will resolve that problem.

Indeed it did.  Running depmod -a then trying to insmod the ne module 
didn't work, but everything came up swimmingly after a reboot.

> | net searching resulted in a couple messages from the Linux Router
> | Project mailing list archives saying that I needed to load the 8390.o
> | module first.  I'm assuming I can just put
> |
> | MODULE=8390
> | MODULE="ne io=0x300 irq=10"
> 
> That won't work!

Why?  Is it because DL only wants/looks for one MODULE line in each 
ifcfg file?

> I can't believe that this will fix this problem, but you never know.
> Try to load the stuff manually, to see if it works.

I tried this after running depmod and save-config, and it worked 
perfectly.  Unlike your first solution above, the ne driver loaded 
with the insmod command.  I rebooted immediately afterward, so the 
change was lost, but it did seem to work.  FYI.

In conclusion, for the archives:

NetGear FA311: use MODULE=natsemi in the /etc/sysconfig/nic/ifcfg-eth? 
file.

Linksys Ether16 ISA (non plug and play) and likely other NE2000 clones:
Try MODULE="ne io=0xNNN irq=XX"  If that doesn't work, boot into DL 
and type:

depmod -a
save-config

and reboot.

NE2000 clones that are plug and play need the PnP disabled for Linux 
use.  Use the setup software that comes with your card to disable the 
PnP.  For me, I had to boot into DOS (you can download DOS boot disks 
at www.bootdisk.com), then run A:\UTILITY\SETUP.EXE on the first 
driver disk for the Ether16.  Make sure to write down the IO address 
and the IRQ, since the ne module needs at least the IO address as a 
parameter.

I want to thank Heiko and John for helping out and offering 
suggestions.  I especially want to thank Heiko for putting together 
the distro, and being so attentive to his users' problems.

Chad Martin

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chad Martin wrote:
| Heiko Zuerker wrote:
|
|> For the NE2000 card, you should try adding parameters to the module,
|> because it's an old ISA card.
|> MODULE="ne io=200 irq=5"
|
|
| OK.  I was going to ask that.  I found that the ne module wanted at
| least a specific io address last night, but when I tried insmoding the
| module after boot, I got a ton of unresolved symbol errors.  Some more

Do a "depmod -a" and then "save-config", this will resolve that problem.

| net searching resulted in a couple messages from the Linux Router
| Project mailing list archives saying that I needed to load the 8390.o
| module first.  I'm assuming I can just put
|
| MODULE=8390
| MODULE="ne io=0x300 irq=10"

That won't work!
I can't believe that this will fix this problem, but you never know.
Try to load the stuff manually, to see if it works.

Heiko
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6-2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAj0TSncACgkQzRJAyNsjWPmQEwCg0rQh3O7S2lqSc2bUtssE0QRc
F1MAoOF3lsyphkK505tC63+RbfGfWOQq
=L6G/
-----END PGP SIGNATURE-----

Heiko Zuerker wrote:
> For the NE2000 card, you should try adding parameters to the module,
> because it's an old ISA card.
> MODULE="ne io=200 irq=5"

OK.  I was going to ask that.  I found that the ne module wanted at 
least a specific io address last night, but when I tried insmoding the 
module after boot, I got a ton of unresolved symbol errors.  Some more 
net searching resulted in a couple messages from the Linux Router 
Project mailing list archives saying that I needed to load the 8390.o 
module first.  I'm assuming I can just put

MODULE=8390
MODULE="ne io=0x300 irq=10"

in that order in the same ifcfg file and both will be loaded, correct?

> For the Netgear card, do a quick search on the web to find out wich
> module from the 2.4 Kernel should work. I remember that I had such a
> card running under an older version of DL, but can't remember which
> module I used.

Heh.  A net seach is what told me that it used the RTL driver. 
Another search on the NetGear site told me that the natsemi.o module 
was tested to work well, and sure enough, it does.

One NIC down, one to go.

Chad Martin

My netgear ( salvaged from gargabe :) ) is PCI and uses tulip module.

Hope this helps, John
--- Heiko Zuerker <he...@zu...> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Chad Martin wrote:
> | Heiko Zuerker wrote:
> | MODULE=8139too
> |
> | right?  Does it matter which file gets which module, as long as they're
> | different?  Should swapping the two matter?
> 
> Yes that's right.
> 
> For the NE2000 card, you should try adding parameters to the module,
> because it's an old ISA card.
> MODULE="ne io=200 irq=5"
> 
> I'm not sure if I wrote the parameters right.
> 
> For the Netgear card, do a quick search on the web to find out wich
> module from the 2.4 Kernel should work. I remember that I had such a
> card running under an older version of DL, but can't remember which
> module I used.
> 
> Heiko
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6-2 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> 
> iEYEARECAAYFAj0TLyoACgkQzRJAyNsjWPl6XwCeLAnM9DrI7EBfkk5wSgtW/QsF
> v5EAn0uHFXjvNsYCPq0r+plSYCE7qTVE
> =TyQA
> -----END PGP SIGNATURE-----
> 
> 
> 
> -------------------------------------------------------
> Sponsored by:
> ThinkGeek at http://www.ThinkGeek.com/
> _______________________________________________
> Devil-linux-discuss mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-discuss


=====
John van Vlaanderen

      #############################################
      #    CXN, Inc. Contact:  jo...@th...   #               #
      #      Proud Sponsor of The Linux Society   #
      #        http://www.thelinuxsociety.org     #                 
      #############################################

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chad Martin wrote:
| Heiko Zuerker wrote:
| MODULE=8139too
|
| right?  Does it matter which file gets which module, as long as they're
| different?  Should swapping the two matter?

Yes that's right.

For the NE2000 card, you should try adding parameters to the module,
because it's an old ISA card.
MODULE="ne io=200 irq=5"

I'm not sure if I wrote the parameters right.

For the Netgear card, do a quick search on the web to find out wich
module from the 2.4 Kernel should work. I remember that I had such a
card running under an older version of DL, but can't remember which
module I used.

Heiko
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6-2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAj0TLyoACgkQzRJAyNsjWPl6XwCeLAnM9DrI7EBfkk5wSgtW/QsF
v5EAn0uHFXjvNsYCPq0r+plSYCE7qTVE
=TyQA
-----END PGP SIGNATURE-----

Heiko Zuerker wrote:
> Take a look in the folder:
> /lib/modules/2.4.18-xfs-1.1/kernel/drivers/net
> 
> I think you try to use old module names.
> They changed, I think it was with Kernel 2.4.
> 
> | Linksys Ether16 ISA LAN Card (non-PnP)
> |     IRQ 10, I/O 300
> |     Uses ne2000.o
> 
> Try ne.o

That didn't work.  I tried:

insmod ne2.o

as well, but that didn't load either.

> | Netgear FA311 PCI LAN Card
> |     Uses rtl8139.o
> 
> Try 8139too.o

That also didn't work.  I tried:

insmod 8139cp.o

and that failed.  Just to make sure, here, I should be adding the 
following line to the end of the ifcfp-eth file:

MODULE=ne

or

MODULE=8139too

right?  Does it matter which file gets which module, as long as 
they're different?  Should swapping the two matter?

Chad