NZ Tik

Here is a working set of mangle rules for a single Mikrotik router acting as a PPPoE server, and 2 internet gateways. /ip firewall mangle add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no \     in-interface=isp1 new-connection-mark=isp1_conn passthrough=yes add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no \     in-interface=isp2 new-connection-mark=isp2_conn passthrough=yes add action=mark-connection chain=prerouting connection-mark=no-mark disabled=no \     dst-address-type=!local new-connection-mark=isp1_conn passthrough=yes \     per-connection-classifier=src-address-and-port:2/0 src-address=\     10.10.100.0/24 add action=mark-routing chain=prerouting connection-mark=isp1_conn disabled=no \     dst-address-type=!local new-routing-mark=to_isp1 passthrough=no \     src-address=10.10.100.0/24 add action=mark-connection chain=prerou...

Simple eh? if ssh -l user server.example.com 'ls folder' > /dev/null; then echo "fexists"; else mkdir folder; fi

Cisco reflexive acls is a poor mans stateful firewall. If you don't have the luxury of the Advanced Security feature-set, then configuring these are your best bet. Take the above simple example. A name server behind your router is doing a recursive lookup to another name server. By looking at that, you need to allow UDP port 53 in interface e0, as well as the return traffic on port 2033. Unfortunately that port is dynamic, so you could either allow any udp traffic in e0, or use reflexive ACLs. ip access-list extended inbound permit icmp any any evaluate mytraffic ip access-list extended outbound permit udp any any reflect mytraffic interface e0 ip access-group inbound in ip access-group outbound out -------- verification... show access-list mytraffic  permit udp host 111.111.111.111 eq 53 host 192.168.1.100 eq 2033(1 match) (time left 299)      

For my bad memory. du -sk *|sort -nr output in kbytes

To be able to log into a remote linux host without a password, you must generate a public / private key pair on the local host and copy the public key to the remote host. You would do this if you wanted to SCP some files via a script perhaps. First, generate the key pair on the host that you are connecting from. ssh-keygen -t dsa Accept defaults.. can put passphrase if you wish for extra security. Copy id_dsa.pub to the remote host somewhere. Then add it to the authorized_keys file under the home directory of the user that you are trying to log in as. For instance if you are wanting to send a file to the remote server as user 'bob'... copy the id_dsa.pub file to /tmp on the remote server log in to the remote server as bob cat /tmp/id_dsa.pub >> ~/.ssh/authorized_keys Now you should be able to ssh or scp something to the remote host and not be prompted for a password.

If you parse an IP address to this function, it will return whether or not the ip address is private (RFC1918). Not sure if there is a better way of achieving this? $private = DetermineLocal('192.168.1.1'); if ($private) {echo 'This IP address is a private IP address';} else echo 'This IP address is not private'; function DetermineLocal($ip) { $private_ip = array("/^0\./", "/^127\.0\.0\.1/", "/^192\.168\..*/", "/^172\.((1[6-9])|(2[0-9])|(3[0-1]))\..*/", "/^10\..*/", "/^224\..*/", "/^240\..*/"); while (list ($key, $val) = each ($private_ip)) { if (preg_match($val, $ip)) { return true; } } } ?>

I recently migrated a mysql database to a new debian based server, and my radius server was having issues updating the radius database with the AcctStopTime. The radius logs (/var/log/freeradius/radius.log) would say.. Wed Jun 29 15:26:10 2011 : Error: [sql] Couldn't update SQL accounting ALIVE record - Column count of mysql.proc is wrong. Expected 20, found 16. The table is probably corrupted or Thu Jun 30 03:32:01 2011 : Error: [sql] Couldn't update SQL accounting ALIVE record - Cannot load from mysql.proc. The table is probably corrupted The fix was relatively simple once I found it. On the mysql server do this: root@sql-server# mysql_upgrade --force It fixed some issues with the table and after that my freeradius server started updating the acctstoptime again.