yaleman.org

Frosty the snow man!

A laser turret, ready to defend our forces!

A B2 Super Battle Droid

This is the second B2 Super Battle Droid we’ve been given, the first one was on Day 21 of the 2012 Star Wars Advent Calendar 🙂

A young man off to the post office

So, the last couple of years I’ve been posting the Advent Calendar set of the day from the LEGO Star Wars and LEGO City box sets. The most mind-numbing part of this was creating the page and tagging it each day, so this year I decided to pre-populate the system with the posts ahead of time.

I leveraged some information on the net and a terrible PHP script, listed below. Whatever you do, I wouldn’t recommend using this on a production system without FIRMLY understanding what’s going on 🙂

In the process of locking down our servers we’ve been setting up host-based firewalls on one of our internal FTP servers.

The default thing was to deny access to everything but ICMP and SSH, good start.

Our first command was to only allow a given host access to port 21, FTP:

sudo iptables -I INPUT 1 -s 10.1.2.3 -p tcp -m tcp --dport 21 -j ACCEPT

This allows the client to connect:

Here’s an annoying one when building a custom splunk search command using the python SDK:

"Error in 'script': Getinfo probe failed for external search command 'testscript'"

This mean you have:

1. "supports_getinfo = true" set in commands.conf for that particular command
2. failed to set a docstring for one of the splunk elements within the command.
   1. Check your instances of Option and set doc=""
   2. Set a docstring for the class itself, but you already did that anyhow, didn’t you? 🙂

Another issue that may occur is this one:

So, when you have services available to the world through your external address/hostname, it’s nice to be able to access them via that as well. “Hairpinning” or Hairpin NAT is the term for the NAT redirection required to make this work.

Update 14/3/16: It’s been raised to me that it’s best to use split-DNS for this particular example, but it’s designed to be a simple one for documentation purposes. There’s much better ways of solving the problem, but:

1. you don’t always control DNS,
2. the service might be entirely IP-based - like IPsec,
3. the service might have different internal ports to what’s externally facing (and can’t be reconfigured)

Amongst a whole host of other reasons. Just trust me 😉