DOCSLIB.ORG

Openbsd: Firewall Ridondanti Con CARP E Pfsync Chris Gamboni CISSP [email protected] Tilug.Ch, Bellinzona, 9 Aprile 2005 Cos'è Openbsd ?

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Openbsd: Firewall Ridondanti Con CARP E Pfsync Chris Gamboni CISSP Hb9fbl@Gmail.Com Tilug.Ch, Bellinzona, 9 Aprile 2005 Cos'è Openbsd ? OpenBSD: Firewall ridondanti con CARP e pfsync Chris Gamboni CISSP [email protected] TiLug.ch, Bellinzona, 9 aprile 2005 Cos'è OpenBSD ? ● OpenBSD: – Nasce da un fork di netbsd nel 1995 – Secure by default (1 remote exploit in 8 anni) – Progetto basato in Canada, nessuna restrizione sull’esportazione di crittografia – Una release ogni 6 mesi (3.7 al 1.6.2005) – Si finanzia con la vendita di CD e di gadgets – Progetti collegati: OpenSSH, OpenNTPd, OpenBGPd, OpenOSPFd, etc… Alta disponibilità: CARP e pfsync ● Il firewall è un single point of failure – Quando il firewall è fermo nessuno accede ad internet, gli e-mail sono bloccati, ecc… – Non si può fermare il firewall per aggiornarlo ● OpenBSD, dalla versione 3.5, offre CARP e pfsync che permettono di avere firewalls in parallelo. Quando un firewall si ferma, il firewall di backup ne assume l’identità in modo trasparente. CARP (1) ● Common Address Redundancy Protocol: è il protocollo che si occupa di gestire il failover a livello 2 ed a livello 3. ● Ogni gruppo CARP possiede: – Un indirizzo MAC virtuale – Un indirizzo IP virtuale – Una password CARP (2) ● Ogni interfaccia CARP può avere 3 stati: MASTER, BACKUP e INIT (ifconfig) ● Il master manda messaggi Multicast (224.0.0.18) usando il protocollo IP 112 ● La frequenza di invio dei messaggi è configurabile (default = 1 sec) ● Chi invia messaggi più frequentemente diventa master CARP (3) ● CARP funziona sia con IPv4 sia con IPv6 ● CARP ha anche una funzione arp-balance che può servire per load-balancing, ma solo nella rete locale. ● CARP spedisce messaggi cifrati con SHA-1 HMAC ● CARP, a differenza di HSRP e VRRP, è esente da licenze e brevetti. CARP: configurazione ● Configurazione IP reali: – paguro: /etc/hostname.fxp0 ● Inet 10.0.0.2 255.255.255.0 NONE – lemuro: /etc/hostname.xl0 ● Inet 10.0.0.3 255.255.255.0 NONE ● Configurazione IP virtuale: – paguro+lemuro: /etc/hostname.carp0 ● Inet 10.0.0.1 255.255.255.0 10.0.0.255 vhid 1 pass abcd1234 CARP: stato ● paguro# ifconfig carp0 carp0: flags=41<UP,RUNNING> mtu 1500 carp: MASTER vhid 1 advbase 1 advskew 0 inet 10.0.0.1 netmask 0xffffff00 ● lemuro# ifconfig carp0 carp0: flags=41<UP,RUNNING> mtu 1500 carp: BACKUP vhid 1 advbase 1 advskew 100 inet 10.0.0.1 netmask 0xffffff00 Esempio1: servizio ridondante ● paguro ha il numero IP 10.0.0.2, mentre lemuro ha il numero IP 10.0.0.3. ● paguro segnala tramite CARP ogni secondo (configurabile) di avere l’indirizzo 10.0.0.1 ● Dopo 3 mancate segnalazioni di paguro, lemuro diventa MASTER annunciando CARP e rispondendo all’IP virtuale 10.0.0.1 CARP: preemption (1) ● Con CARP preemption è possibile definire chi è MASTER e chi è BACKUP. ● Configurazione per il server di backup: – /etc/hostname.carp0 ● Inet 10.0.0.1 255.255.255.0 10.0.0.255 vhid 1 advskew 100 – In questo caso si aumenta il tempo tra gli annunci CARP (1sec + advskew/255). CARP preemption (2) ● Nei sistemi con diverse interfaccie CARP è auspicabile che in caso di malfunzionamento di un’interfaccia fisica, tutti i gruppi CARP vengano passati al server di Backup ● Con “preempt” in caso di problemi ad un’interfaccia il valore advskew di tutti i gruppi CARP del sistema viene portato a 240, causando un failover generale. Pfsync (1) ● Pfsync si occupa di comunicare ad altri firewall le modifiche alla tabella di stato delle sessioni (annuncia i cambiamenti ed inserisce nella propria tabella i cambiamenti annunciati da altri) ● Al momento pfsync non usa autenticazione, è quindi altamente consigliato l’utilizzo di una rete dedicata Pfsync (2) ● Configurazione dell’interfaccia di sincronizzazione: – /etc/hostname.fxp2 ● Inet 192.168.255.254 255.255.255.0 NONE – /etc/hostname.pfsync0 ● Up syncif fxp2 Integrazione pf+CARP+pfsync ● Le regole dei firewall dovranno lasciare passare i pacchetti pfsync e CARP: – /etc/pf.conf ● Pass quick on { $syncif } proto pfsync ● Pass on { $intif $extif } proto carp keep state Pfctl: visualizzare le sessioni # pfctl -ss self tcp 10.5.0.1:22 <- 10.0.1.168:1168 ESTABLISHED:ESTABLISHED self carp 224.0.0.18 <- 10.5.0.2 NO_TRAFFIC:SINGLE self carp 10.5.0.2 -> 224.0.0.18 SINGLE:NO_TRAFFIC Esempio2: firewall ridondante ● paguro e lemuro hanno 3 interfacce ● paguro è configurato come MASTER ● In caso di problemi a paguro, lemuro diventa master (dopo 2-3 secondi) ● Tutte le sessioni, grazie a pfsync, vengono mantenute poiché già trasferite ad lemuro. ● Quando paguro riparte chiede un “bulk update” della tabella degli stati a lemuro e poco dopo ridiventa master Esempio2: schema Rete esterna carp0 Lemuro Paguro pfsync Backup Firewall Master Firewall carp1 Rete interna Referenze ● OpenBSD: http://www.openbsd.org ● Firewall failover with pfsync and CARP: http://www.cuntersiege.com/doc/pfsync-carp/ ● Italian OpenBSD user group: http://www.opengeeks.it/docs/carpepfsync.pdf ● OpenBSD man pages: man carp, ifconfig, pfsync, pf.conf, ecc….
Load more

Recommended publications
  • Free, Functional, and Secure
    Free, Functional, and Secure Dante Catalfamo What is OpenBSD? Not Linux? ● Unix-like ● Similar layout ● Similar tools ● POSIX ● NOT the same History ● Originated at AT&T, who were unable to compete in the industry (1970s) ● Given to Universities for educational purposes ● Universities improved the code under the BSD license The License The license: ● Retain the copyright notice ● No warranty ● Don’t use the author's name to promote the product History Cont’d ● After 15 years, the partnership ended ● Almost the entire OS had been rewritten ● The university released the (now mostly BSD licensed) code for free History Cont’d ● AT&T launching Unix System Labories (USL) ● Sued UC Berkeley ● Berkeley fought back, claiming the code didn’t belong to AT&T ● 2 year lawsuit ● AT&T lost, and was found guilty of violating the BSD license History Cont’d ● BSD4.4-Lite released ● The only operating system ever released incomplete ● This became the base of FreeBSD and NetBSD, and eventually OpenBSD and MacOS History Cont’d ● Theo DeRaadt ○ Originally a NetBSD developer ○ Forked NetBSD into OpenBSD after disagreement the direction of the project *fork* Innovations W^X ● Pioneered by the OpenBSD project in 3.3 in 2002, strictly enforced in 6.0 ● Memory can either be write or execute, but but both (XOR) ● Similar to PaX Linux kernel extension (developed later) AnonCVS ● First project with a public source tree featuring version control (1995) ● Now an extremely popular model of software development anonymous anonymous anonymous anonymous anonymous IPSec ● First free operating system to implement an IPSec VPN stack Privilege Separation ● First implemented in 3.2 ● Split a program into processes performing different sub-functions ● Now used in almost all privileged programs in OpenBSD like httpd, bgpd, dhcpd, syslog, sndio, etc.
    [Show full text]
  • Current Status of Openbsd / Openbgpd
    Current Status of OpenBSD / OpenBGPd Peter Hessler [email protected] OpenBSD 27 October, 2015 openbsd 20 year anniversary on October 18th 5.8 released on that date, last week the berlin u2k15 hackathon is happening right now everything mentioned is committed in either in 5.8 or in -current openbsd projects openssh pf opensmtpd mandoc libressl ... and many others openbsd outside of openbsd pretty much everyone uses openssh pf is in all apple devices, the *bsds, a windows port, and even solaris! a rather large part of the android libc is from openbsd and a huge amount of people are switching to libressl software defined operations devops ... it’s a unix system, i know this ... atomic config reloads ... automated deployments (ansible, salt, chef, puppet, etc) sdn compatible ... networking on a full unix-like environment ... triggers on network states ... carp / ifstated / relayd router / perl openntpd ntp time keeping ... simple and (reasonably) accurate ... network and/or timedelta sensors driven ... a portable version also exists mostly cve free routing daemons bgp ldp ospf (v2 and v3) eigrp rip, routed openbgpd been around a long time (2004-present) massive improvements have been made in the last years openbgpd all the features you need ... edge router ... ibgp ... route reflector ... route server and many features you want ... multi-RIB ... mrt dumps ... mpls (vrf) ... mpls vpn (vpls / pseudo-wire) ... looking glass openbgpd scaling hundreds of peers many full-feeds more than 8 million prefixes 1500+ nexthops openbgpd config configuration language ... templates ... groups ... macros openbgpd config group "IXP-Peers" { transparent-as yes enforce neighbor-as no passive max-prefix 1000 neighbor 2001:db8:42::/48 neighbor 2001.db8:42::6939 { max-prefix 120000 } } deny from any allow from group "IXP-Peers" match from any community 1234:666 \ prefix ::/0 prefixlen = 128 set nexthop 2001:db8:42::666 openbgpd as an edge router works great as a client router at my day job, we use it in production ..
    [Show full text]
  • Pipenightdreams Osgcal-Doc Mumudvb Mpg123-Alsa Tbb
    pipenightdreams osgcal-doc mumudvb mpg123-alsa tbb-examples libgammu4-dbg gcc-4.1-doc snort-rules-default davical cutmp3 libevolution5.0-cil aspell-am python-gobject-doc openoffice.org-l10n-mn libc6-xen xserver-xorg trophy-data t38modem pioneers-console libnb-platform10-java libgtkglext1-ruby libboost-wave1.39-dev drgenius bfbtester libchromexvmcpro1 isdnutils-xtools ubuntuone-client openoffice.org2-math openoffice.org-l10n-lt lsb-cxx-ia32 kdeartwork-emoticons-kde4 wmpuzzle trafshow python-plplot lx-gdb link-monitor-applet libscm-dev liblog-agent-logger-perl libccrtp-doc libclass-throwable-perl kde-i18n-csb jack-jconv hamradio-menus coinor-libvol-doc msx-emulator bitbake nabi language-pack-gnome-zh libpaperg popularity-contest xracer-tools xfont-nexus opendrim-lmp-baseserver libvorbisfile-ruby liblinebreak-doc libgfcui-2.0-0c2a-dbg libblacs-mpi-dev dict-freedict-spa-eng blender-ogrexml aspell-da x11-apps openoffice.org-l10n-lv openoffice.org-l10n-nl pnmtopng libodbcinstq1 libhsqldb-java-doc libmono-addins-gui0.2-cil sg3-utils linux-backports-modules-alsa-2.6.31-19-generic yorick-yeti-gsl python-pymssql plasma-widget-cpuload mcpp gpsim-lcd cl-csv libhtml-clean-perl asterisk-dbg apt-dater-dbg libgnome-mag1-dev language-pack-gnome-yo python-crypto svn-autoreleasedeb sugar-terminal-activity mii-diag maria-doc libplexus-component-api-java-doc libhugs-hgl-bundled libchipcard-libgwenhywfar47-plugins libghc6-random-dev freefem3d ezmlm cakephp-scripts aspell-ar ara-byte not+sparc openoffice.org-l10n-nn linux-backports-modules-karmic-generic-pae
    [Show full text]
  • Open Source Software Notice
    OPEN SOURCE SOFTWARE NOTICE This product incorporates various open source software packages that are distributed under license terms as described further below. 1. Linux Kernel, GNU C library and Toolchain, Busybox, dsnmasq, ethtool, iproute, iptables, sftpd, smcroute, mtdutils, gdb, uboot, cgi-c, jQuery Library, bootloader are licensed under the GNU General Public License, V2.0, which may be viewed at http://www.gnu.org/licenses/gpl-2.0.html. Copies of the source code for the above may be obtained at the following URLs: https://www.kernel.org https://gcc.gnu.org/ http://www.busybox.net/ http://www.thekelleys.org.uk/dnsmasq/doc.html https://www.kernel.org/pub/software/network/ethtool/) http://developer.osdl.org/dev/iproute2 (now- http://www.linuxfoundation.org/) http://www.cschill.de/smcroute/ http://git.infradead.org/mtd-utils.git http://www.gnu.org/software/gdb/ http://www.denx.de/wiki/U-Boot/SourceCode http://sourceforge.net/projects/cgi-c/ http://jquery.com/ Wolfgang Denk, DENX Software Engineering, [email protected]. Copies of the modified source code for BusyBox, cgi-c, boot loader, and Linux may be requested in writing by contacting: ViaSat, Inc., attn: General Counsel / Source Code Request, 6155 El Camino Real, Carlsbad CA 92009 USA. Your request should clearly identify the product and open source software component(s) to which your request relates. Your request must be sent within three (3) years of the date you received the Viasat product that included the binary that is the subject of your request. 2. OpenNTPD This is a summary of the licences for the files that make up Portable OpenNTPD.
    [Show full text]
  • Limits and the Practical Usability of Bsds, a Big Data Prospective
    Limits and the Practical Usability of BSDs, a Big Data Prospective Predrag Punosevacˇ [email protected] The Auton Lab Carnegie Mellon University June 11, 2016 1 / 22 Thanks Thanks to organizers for this great meeting and for giving me the op- portunity to speak. note 1 of slide 1 Intro ❖ Intro ● Who am I? ❖ Chronology ❖ Chronology II ❖ Genealogy Tree ❖ General Limitations ❖ Scientific Computing ❖ Continuation ❖ misc issues ❖ NetBSD ❖ OpenBSD ❖ pf.conf and pfctl ❖ OpenBSD cons ❖ FreeBSD ❖ TrueOS ❖ TurnKey Appliance ❖ FreeNAS ❖ pfSense ❖ DragonFly BSD ❖ HAMMER ❖ Dark Clouds ❖ References 2 / 22 Intro ❖ Intro ● Who am I? ❖ Chronology ❖ Chronology II ❖ Genealogy Tree ● What is the Auton Lab? ❖ General Limitations ❖ Scientific Computing ❖ Continuation ❖ misc issues ❖ NetBSD ❖ OpenBSD ❖ pf.conf and pfctl ❖ OpenBSD cons ❖ FreeBSD ❖ TrueOS ❖ TurnKey Appliance ❖ FreeNAS ❖ pfSense ❖ DragonFly BSD ❖ HAMMER ❖ Dark Clouds ❖ References 2 / 22 Intro ❖ Intro ● Who am I? ❖ Chronology ❖ Chronology II ❖ Genealogy Tree ● What is the Auton Lab? ❖ General Limitations ❖ Scientific ● Why don’t we just use SCS computing facilities? Computing ❖ Continuation ❖ misc issues ❖ NetBSD ❖ OpenBSD ❖ pf.conf and pfctl ❖ OpenBSD cons ❖ FreeBSD ❖ TrueOS ❖ TurnKey Appliance ❖ FreeNAS ❖ pfSense ❖ DragonFly BSD ❖ HAMMER ❖ Dark Clouds ❖ References 2 / 22 Intro ❖ Intro ● Who am I? ❖ Chronology ❖ Chronology II ❖ Genealogy Tree ● What is the Auton Lab? ❖ General Limitations ❖ Scientific ● Why don’t we just use SCS computing facilities? Computing ❖ Continuation ❖ misc issues ● How did
    [Show full text]
  • Authenticated Network Time Synchronization
    Authenticated Network Time Synchronization Benjamin Dowling, Queensland University of Technology; Douglas Stebila, McMaster University; Greg Zaverucha, Microsoft Research https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/dowling This paper is included in the Proceedings of the 25th USENIX Security Symposium August 10–12, 2016 • Austin, TX ISBN 978-1-931971-32-4 Open access to the Proceedings of the 25th USENIX Security Symposium is sponsored by USENIX Authenticated Network Time Synchronization Benjamin Dowling Douglas Stebila Queensland University of Technology McMaster University [email protected] [email protected] Greg Zaverucha Microsoft Research [email protected] Abstract sends a single UDP packet to a server (the request), who responds with a single packet containing the time (the The Network Time Protocol (NTP) is used by many response). The response contains the time the request was network-connected devices to synchronize device time received by the server, as well as the time the response with remote servers. Many security features depend on the was sent, allowing the client to estimate the network delay device knowing the current time, for example in deciding and set their clock. If the network delay is symmetric, i.e., whether a certificate is still valid. Currently, most services the travel time of the request and response are equal, then implement NTP without authentication, and the authen- the protocol is perfectly accurate. Accuracy means that tication mechanisms available in the standard have not the client correctly synchronizes its clock with the server been formally analyzed, require a pre-shared key, or are (regardless of whether the server clock is accurate in the known to have cryptographic weaknesses.
    [Show full text]
  • Building Embedded Linux Systems with Buildroot
    Embedded Linux Conference Building embedded Linux systems with Buildroot Thomas Petazzoni Free Electrons http://free-electrons.com/ 1 Free Electrons. Kernel, drivers and embedded Linux development, consulting, training and support. http//free-electrons.com Rights to copy © Copyright 2009, Free Electrons [email protected] Document sources, updates and translations: http://free-electrons.com/docs/buildroot Corrections, suggestions, contributions and translations are welcome! Attribution ± ShareAlike 3.0 Latest update: Apr 28, 2009 You are free to copy, distribute, display, and perform the work to make derivative works to make commercial use of the work Under the following conditions Attribution. You must give the original author credit. Share Alike. If you alter, transform, or build upon this work, you may distribute the resulting work only under a license identical to this one. For any reuse or distribution, you must make clear to others the license terms of this work. Any of these conditions can be waived if you get permission from the copyright holder. Your fair use and other rights are in no way affected by the above. License text: http://creativecommons.org/licenses/by-sa/3.0/legalcode 2 Free Electrons. Kernel, drivers and embedded Linux development, consulting, training and support. http//free-electrons.com Leveraging free software Thousands of free software packages are available and can be leveraged to build embedded systems With free software You have control over the source Bugs can be fixed New features can be added Your system can be customized In theory, the system designers and developers have a lot of flexibility thanks to free software However, leveraging the existing free software packages may not be very easy.
    [Show full text]
  • Integration of Security Measures and Techniques in an Operating System (Considering Openbsd As an Example)
    Integration of Security Measures and Techniques in an Operating System (considering OpenBSD as an example) Igor Bohm¨ Institute for Information Processing and Microprocessor Technology University of Linz 4040 Linz, Austria Email: [email protected] Abstract— This paper covers defensive security technologies – Randomized malloc() and secure programming techniques employed in the OpenBSD – Randomized mmap() operating system. Privilege separation, a secure design pattern – atexit() and stdio protection which is implemented in many privileged processes, is discussed based on the network time protocol daemon OpenNTPD. After- • Privilege separation wards a closer look at address space and memory protection • Chroot jailing techniques like WˆX and the Stack Smashing Protector is taken. • ProPolice (SSP - StackSmashingProtector) Finally the process of gathering entropy in order to produce high • ... quality random numbers is discussed based on examples found in the OpenBSD operating system. The goal of this paper is to take a closer look at some of these topics, explain them in greater detail and present some I. INTRODUCTION strategies for secure software development. OpenBSD believes in strong security and thus has been II. PRIVILEGE SEPARATION chosen to serve as an example for an operating system which is A common problem many daemon processes like NTPD implementing security measures into many areas of the system. (Network Time Protocol Daemon), SMTPD (Simple Mail Their open software development model permits the OpenBSD Transfer Protocol Daemon), HTTPD (Hyper Text Transfer Pro- team to take a more uncompromising view towards increased tocol Daemon) or BGPD (Border Gateway Protocol Daemon) security than Sun, SGI, IBM, HP [5]. There is also a strong share with each other is that they run with extra privileges believe in full disclosure of security problems which means granted to them either by the setuid or setgid bits or by the that security issues do not stay hidden from the users.
    [Show full text]
  • Comptia.Certkiller.LX0-102.V2014-12-06.By.Boris.445Q
    Comptia.Certkiller.LX0-102.v2014-12-06.by.Boris.445q Number : LX0-102 Passing Score : 800 Time Limit : 90 min File Version : 18.5 http://www.gratisexam.com/ Exam Code: LX0-102 Exam Name: CompTIA Linux+ [Powered by LPI] Exam 2 http://www.gratisexam.com/ Exam A QUESTION 1 The legacy program for sending files to the printer queues from the command line is which of the following? A. lpd B. lpr C. lpq D. lpp Correct Answer: B Section: (none) Explanation Explanation/Reference: QUESTION 2 Which of the following statements would create a default route using a gateway of 192.168.1.1? A. netstat -add default gw B. route default 192.168.1.1 C. ip route default 192.168.1.1 D. route add default gw 192.168.1.1 E. ifconfig default gw 192.168.1.1 eth0 Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 3 Which of the following is the purpose of the dig command? A. To adjust a directory's hidden permissions B. To search for files on the filesystem http://www.gratisexam.com/ C. To adjust a file's hidden permissions D. To perform hostname lookups E. To ping all known hosts on the current subnet Correct Answer: D Section: (none) Explanation Explanation/Reference: QUESTION 4 Which of the following configuration files does sudo read when determining if a user is permitted to run applications with root privileges? A. /etc/groups B. /etc/passwd C. /etc/sudoers D. /etc/sudo.conf Correct Answer: C Section: (none) Explanation Explanation/Reference: QUESTION 5 Which of the following commands will set the local machine's timezone to UTC? A.
    [Show full text]
  • PF Openbsd Packet Filter
    PF OpenBSD packet filter Appunti su PF e OpenBSD a cura di Stefano Sasso stefano(at)gnustile.net Versione 0.9 - 24 Febbraio 2008 Indice I PF 1 1 Introduzione a PF 2 1.1 Introduzione . 2 1.2 Abilitare PF . 2 2 Costrutti di PF 4 2.1 Liste . 4 2.2 Macro . 4 2.3 Tabelle........................................... 5 3 Packet Filtering 6 3.1 Regole di filtraggio . 6 3.2 Default deny . 8 3.3 Connection tracking . 8 3.4 Filtraggio ICMP . 9 3.5 I flag TCP . 10 3.6 Lo Scrubbing . 10 3.7 Anti-spoofing . 11 3.8 Skip di interfacce da packet filtering . 11 3.9 OS fingerprinting . 12 4 Network Address Translation 13 4.1 Source NAT . 13 4.2 NAT bidirezionale . 14 4.3 Port Forwading . 14 5 Opzioni Runtime di pf 16 i 6 Packet Queueing e Prioritization 19 6.1 Introduzione agli schedulatori . 19 6.2 Uso del packet queueing . 20 7 Address Pool e Load Balancing 22 7.1 NAT address pool . 22 7.2 Port forwarding con load balancing . 22 7.3 Bilanciamento del traffico in uscita . 22 8 Uso avanzato delle regole di filtraggio 24 8.1 Tagging . 24 8.2 Ancore . 24 8.3 Nat e Filtraggio di connessioni FTP . 26 8.4 Authpf . 26 9 Logging 28 9.1 Log dei pacchetti . 28 9.2 Lettura dei log . 28 9.3 Filtraggio dei log . 29 10 Bridge Firewall 30 11 Cluster di firewall 31 11.1 Introduzione . 31 11.1.1 Il protocollo CARP . 31 11.1.2 Il protocollo PFSYNC .
    [Show full text]
  • Owner's Manual for Console Servers
    Owner’s Manual Console Server Management Switch Models: B096-016 / B096-032 / B096-048 Console Server with PowerAlert Model: B092-016 Console Server Models: B095-004-1E / B095-003-1E-M / B094-008-2E-M-F / B094-008-2E-V PROTECT YOUR INVESTMENT! Register your product for quicker service and ultimate peace of mind. You could also win an ISOBAR6ULTRA surge protector—a $100 value! www.tripplite.com/warranty 1111 W. 35th Street, Chicago, IL 60609 USA • www.tripplite.com/support Copyright © 2016 Tripp Lite. All rights reserved. All trademarks are the property of their respective owners. 1 FCC Information, Class A This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. Note: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at his own expense. The user must use shielded cables and connectors with this equipment.
    [Show full text]
  • The Book of PF Is the PETER N.M
    With a foreword by BUILDBUILD THETHE BOB BECK, NETWORKNETWORK YOUYOU Director of NEEDNEED WITHWITH PFPF the OpenBSD Foundation THETHE BOOKBOOK THE BOOK OF PF OF THE BOOK THE BOOK OF PF OF THE BOOK OpenBSD’s stateful packet filter, PF, offers an amazing • Use PF to create a wireless access point, and lock it OFOF PFPF feature set and support across the major BSD platforms. down tight with authpf and special access restrictions A NO-NONSENSE GUIDE TO THE Like most firewall software though, unlocking PF’s full • Maximize availability by using redirection rules for potential takes a good teacher. OPENBSD FIREWALL load balancing and CARP for failover Peter N.M. Hansteen’s PF website and conference • Use tables for proactive defense against would-be tutorials have helped thousands of users build the attackers and spammers networks they need using PF. The Book of PF is the PETER N.M. HANSTEEN product of Hansteen’s knowledge and experience, • Set up queues and traffic shaping with ALTQ, so your teaching good practices as well as bare facts and network stays responsive software options. Throughout the book, Hansteen • Master your logs with monitoring and visualization, emphasizes the importance of staying in control by because you can never be too paranoid having a written network specification, using macros to make rule sets more readable, and performing rigid The Book of PF is written for BSD enthusiasts and network testing when loading in new rules. admins at any level of expertise. With more and more services placing high demands on bandwidth and Today’s system administrators face increasing challenges increasing hostility coming from the Internet at large, you in the quest for network quality, and The Book of PF can can never be too skilled with PF.
    [Show full text]