bsd.m3th.org
Yet another *nix admin blog

I was playing with Alfresco on FreeBSD 6.3 with no success. With mysql 5 and jdk1.5 installed from the FreeBSD ports, I downloaded alfresco community version 2.1.0 which bundled with tomcat and mysql-java-connector 5.0.3. Alfresco ran fine with default setup with minimum configuration for data, index and logging paths.

If I changed db to MySQL and restarted the alfresco tomcat, it failed to start alfresco web client. It complains of missing modules. Too bad I don’t speak much of Java. Seymores, the Java guy, advised me to give it a try on Linux and I managed to get it running within 20 minutes. Everything works like charm.

Anyone has had experience with Alfresco on FreeBSD? Please shed some light.

Thanks to the whole HeX development team for continuous effort to make HeX possible! HeX System 1.0.3 is finally released. See official announcement. Grab it while it’s hot now!

Main Download
- http://bsd.ipv6.la/hex-i386-1.0.3.iso
- http://bsd.ipv6.la/hex-i386-1.0.3.iso.md5
- http://bsd.ipv6.la/hex-i386-1.0.3.iso.sha256

In my previous post, FreeBSD : Compaq Presario V3417AU, I could not get broadcom wifi running with FreeBSD 7. Luckily, just before the Chinese New Year, I managed to get it working again. It’s timely for the CNY break. Sweet!!!!!

Project Evil

# fetch ftp://ftp.hp.com/pub/softpaq/sp34001-34500/sp34152.exe
# cabextract -F 'bcmwl5*' sp34152.exe
# ndisgen bcmwl5.inf bcmwl5.sys
# cp bcmwl5_sys.ko /boot/modules/
# kldxref /boot/modules
# kldload bcmwl5_sys

Using ndis0 with wpa_supplicant

Set up /etc/wpa_supplicant.conf with your WIFI network information (an example of WEP protected WLAN with DHCP enabled). You may enable wpa_supplicant automatically by setting /etc/rc.conf with ifconfig_ndis0="WPA mywifi DHCP". To initialise it, run /etc/rc.d/netif start ndis0

Additional configurations

i) /boot/loader.conf

if_ndis_load="YES"
bcmwl5_sys_load="YES"
wlan_scan_sta_load="YES"
wlan_scan_ap_load="YES"
wlan_wep_load="YES"
wlan_ccmp_load="YES"
wlan_tkip_load="YES"
wlan_xauth_load="YES"
wlan_acl_load="YES

ii) /etc/rc.conf

ifconfig_ndis0="WPA mywifi DHCP"

iii) /etc/wpa_supplicant.conf

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
ap_scan=1
network={
ssid="mywifi"
scan_ssid=1
key_mgmt=NONE
wep_tx_keyidx=1
wep_key1=your_104bit_wep_key
}

If you are on FreeBSD 7.0 and have problem booting up HeX LiveCD with qemu, try this

kldload aio

and add -std-vga option to qemu command line. For example:-

qemu -boot d -cdrom hex-i386-1.0.2.iso -localtime -std-vga

Have fun!

I have been using FreeBSD on Compaq Presario V3417AU notebook for quite sometimes and did not bother/forgot to post the setup notes and until few of my blog visitors dropped me query emails on Compaq presario V3000 series + FreeBSD 7. If you are looking for post on Compaq Presario V3010AU, you can find it here.

Like Compaq V3000 series, V3417AU comes with a layer lamination, subtle looking pinstripe patterns on the chassis, which ensures greater protection from scratches. As usual, I don’t pay for M$ Windows licence as the unit comes with FreeDOS preinstalled.

(more…)

Merry Christmas. HeX development team would like to present you HeX 1.0.2 – The Christmas Release!!!!! Grab it from :-

http://bsd.ipv6.la/hex-i386-1.0.2.iso
http://bsd.ipv6.la/hex-i386-1.0.2.iso.md5
http://bsd.ipv6.la/hex-i386-1.0.2.iso.sha256

Details of release announcement can be found at Hex googlegroup and geek00l’s blog

We are pleased to release Hex LiveCD 1.0.1 to address boot performance and javascript issue on firefox. This build should be perfect version for FreeBSD 6.2-stable based Hex LiveCD. We will go 7.x and unionfs (hopefully) for next release.

Download link:

http://bsd.ipv6.la/hex-i386-1.0.1.iso
http://bsd.ipv6.la/hex-i386-1.0.1.iso.md5
http://bsd.ipv6.la/hex-i386-1.0.1.iso.sha256

Please let us have your feedback if you tried it out.

Official site and details:
http://www.rawpacket.org/
http://groups.google.com/group/HeX-liveCD

That’s right. Today is the big day for us at Rawpacket to release our Network Security Monitoring & Network Based Forensics Centric liveCD – HeX version 1.0 Release. See details on geek00l’s blog.

Our (xwings and I) poor, _soon_to_be_removed_ webserver box at Brickfields netmyne datacentre was under DDOS attacked this morning around 11:30am MYT. The box with 512MB of RAM running FreeBSD survived the attack. However, system resources were running extremely low. More than 100 instances of httpd were running! The system was extremely busy and lag. It barely responded to my ssh connection request.

My pf rule’s stateful tracking limit seemed to be too lenient and not suitable for the box with low system resource.

pass in quick on $netif inet proto tcp from any to ($netif) port {80, 443}
   \ keep state(source-track, max-src-states 100, max-src-nodes 999}

I have decided to head on to more aggressive approach, with use of pf max-src-conn-rate, table and filtering.

table  persist
block in quick on $netif from 
pass in quick on $netif inet proto tcp from any to ($netif) port {80, 443}
   \ keep state(max-src-conn 100, max-src-rate 15/5, overload  flush}

After stopping all httpd instances, I loaded new pf rule. pfctl -f /etc/pf.conf. It worked nicely. table was full of sons/daughters of bitch’s IP addresses.

pfctl -t dos -T show
221.194.136.38
220.181.19.176
72.232.190.82
61.135.162.18
202.190.250.2
64.26.63.19


Happy and back to sleep again. Grow up, kids! Shame on you. You couldn’t even kill a poor little box with 512MB of RAM! But thanks anyway for helping me to test area where I overlooked.

White Papers for Success
Decisions related to web hosting should be taken after going through the current web hosting review. Having an old record of past webhosting review magazines might help a bit. For services like ix web hosting and powweb however, one does not need to go through reviews.

Another way of fighting images spam is by Realtime Black List lookup. This tactic is probably one of method which is inexpensive to server resource.

With postfix, you could just add reject_rbl_client images.rbl.msrbl.net to smtpd_client_restrictions section of postfix’s main.cf.

For instance:

smtpd_client_restrictions = permit_mynetworks,
    reject_rbl_client images.rbl.msrbl.net,
    ....

For qmail, you could just add -r images.rbl.msrbl.net as tcpserver option of your qmail smtp startup script.

Note : images.rbl.msrbl.net – Hosts found sending mail contaning spam images. Check out MSRBL for more info.