https://www.chrisk.de/blog/ Recent content in Blogs on Christian Kildau Hugo -- gohugo.io Sat, 09 Mar 2024 10:17:42 +0100 https://www.chrisk.de/blog/2024/03/mpls-backbone-for-fun-using-frr-mpls-ldp-vxlan/ Sat, 09 Mar 2024 10:17:42 +0100 https://www.chrisk.de/blog/2024/03/mpls-backbone-for-fun-using-frr-mpls-ldp-vxlan/ Intro Some bad weather weekend plays… building an MPLS/LDP Backbone for fun using open-source software. The idea was to improve my knowledge in software / open-source routing stacks. Decided to try and setup an IP/MPLS Backbone similar to what I run in day-to-day operations using open-source. And while I’m at it I also wanted to expand on NetBox an Ansible skills. This topic actually wouldn’t be worth a post if it wasn’t for the struggles… and learnings. https://www.chrisk.de/blog/2023/10/haproxy-unifi-controller-reverse-proxy-apps/ Tue, 03 Oct 2023 14:05:01 +0200 https://www.chrisk.de/blog/2023/10/haproxy-unifi-controller-reverse-proxy-apps/ Getting the Unifi controller working behind a reverse-proxy isn’t that hard (if you manage to reverse-proxy 8443 on http and 8080 on tcp to your controller). At least not if you only want your APs to be able to register and access the webinterface from a Browser. However, getting it to work with the iOS App caused me some headache. The iOS App just kept reconnecting forever and no changes went through. https://www.chrisk.de/blog/2023/06/haproxy-syslog-promtail-loki-grafana-logfmt/ Sun, 04 Jun 2023 16:28:44 +0100 https://www.chrisk.de/blog/2023/06/haproxy-syslog-promtail-loki-grafana-logfmt/ This little blog got quite a few DDoS attacks in the past months. Most of them were Layer7 so I decided to gather some statistics. Tool of choice was Grafana. HAProxy has native syslog capabilites. Easiest choice was to forward syslog, process+enrich and build a dashboard in Grafana. To store syslog I checked out promtail+loki. Since I failed quite badly at parsing HAproxy “httplog” log format using regex see below my config-snippets using logfmt log_format in HAProxy for the export and native logfmt support in loki. https://www.chrisk.de/blog/2019/07/ios-xr-ios-bfd-igp-examples/ Tue, 09 Jul 2019 22:48:55 +0100 https://www.chrisk.de/blog/2019/07/ios-xr-ios-bfd-igp-examples/ IOS-XR BFD configuration guide is quite long. The IGP part is not, but you should understand intervals and multipliers. Legacy IOS BFD configuration is also available, but was lacking sane values for my favourite legacy platform Catalyst 6500 / SUP720. As a quick start for BFD for OSPF between IOS-XR and IOS see: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 IOS router ospfv3 200 bfd all-interfaces router ospf 200 bfd all-interfaces interface TenGigabitEthernet3/1 bfd interval 50 min_rx 50 multiplier 7 IOS-XR router ospf 200 bfd minimum-interval 50 bfd multiplier 7 area 0 interface TenGigE0/0/2/1 bfd fast-detect https://www.chrisk.de/blog/2019/02/exabgp-advanced-usage/ Tue, 12 Feb 2019 16:28:44 +0100 https://www.chrisk.de/blog/2019/02/exabgp-advanced-usage/ Since I started using ExaBGP for automatic DDoS filtering/mitigation a few years ago and my own blog post about getting started with ExaBGP 4.0 I’ve had some follow ups drafted for quite some time now. In the meantime Jon Langemak from dasblinkenlichten.com created some very good content on most of my own topics :-) Working with ExaBGP 4 Building static routes with ExaBGP ExaBGP - handling route withdrawal https://www.chrisk.de/blog/2019/01/new-year-new-website-new-goals/ Tue, 01 Jan 2019 14:43:15 +0100 https://www.chrisk.de/blog/2019/01/new-year-new-website-new-goals/ 2018 already was in it’s finals when Wordpress 5 came out and gave the already dated website it’s kiss of death by breaking the layout. Instead of spending time fixing the old dinosaur based on php, mysql and apache I figured it was time for starting something new. And so I started a little christmas project: building a new Website with modern tools. When I started this blog in 2007 my intention mostly was to use it for documenting my travels for friends and family. https://www.chrisk.de/blog/2018/11/macos-touchid-support-in-sudo/ Fri, 16 Nov 2018 20:48:55 +0000 https://www.chrisk.de/blog/2018/11/macos-touchid-support-in-sudo/ I just recently got a shiny new Apple MacBook Pro 2018 including TouchID. iTerm2/sudo won’t support TouchID out of the box. Here’s what you need to do: 1 2 3 sudo sed -i '' '2i\ auth sufficient pam_tid.so ' /etc/pam.d/sudo https://www.chrisk.de/blog/2016/05/exabgp-4-0-getting-started/ Tue, 31 May 2016 08:57:44 +0000 https://www.chrisk.de/blog/2016/05/exabgp-4-0-getting-started/ Welcome back to my little tech blog. It’s been a few years since I last posted here.. :) I’ve been playing around a lot with several DDoS mitigation techniques, be it in house or as a service and used many BGP implementations like classic Cisco IOS, Cisco IOS-XR(v), Bird and ExaBGP. ExaBGP is a nice little BGP injector ExaBGP for things like s/dRTBH and injection of FlowSpec rules. As I’ve had some starting issues with ExaBGP I thought I’d share just a very basic config to save others some time and will probably share some more complex examples later. https://www.chrisk.de/blog/2011/07/how-to-disable-time-machines-mobilebackup/ Sun, 24 Jul 2011 11:13:56 +0000 https://www.chrisk.de/blog/2011/07/how-to-disable-time-machines-mobilebackup/ Starting with Lion I noticed that Time Machine is running even when my Time Capsule is not available. I also noticed that Finder shows a different amount of used disk space than df. My MacBook Pro’s SSD also got somewhat slow. Turned out it’s Time Machines MobileBackup function. If you want to disable MobileBackup and free up the abused disk space, simply run the following command and reboot. 1 sudo tmutil disablelocal https://www.chrisk.de/blog/2011/07/how-to-fix-ssh-utf-8-issues-in-mac-os-x-lion/ Sun, 24 Jul 2011 09:29:32 +0000 https://www.chrisk.de/blog/2011/07/how-to-fix-ssh-utf-8-issues-in-mac-os-x-lion/ After upgrading from Snow Leopard to Lion, ssh connections to remote servers using iTerm2 have issues with non ascii characters. Luckily that’s easy to fix. Simply comment SendEnv LANG LC_* in /etc/ssh_config out. 1 2 3 4 5 Host * # SendEnv LANG LC_* # ForwardAgent no # ForwardX11 no ... No other changes are needed. You could also permanently change your locale to UTF-8. Just place export LANG=en_US. https://www.chrisk.de/blog/2011/07/how-to-activate-serial-console-on-debian-squeeze/ Wed, 06 Jul 2011 10:13:10 +0000 https://www.chrisk.de/blog/2011/07/how-to-activate-serial-console-on-debian-squeeze/ Activating a Serial Console starting at the bootloader all the way up to a tty login requires just a few steps, but it took me some time to figure out all the knobs. Here’s how to do it with Debian Squeeze: To have configruation changes persistent in Debian, you may not edit /boot/grub/grub.cfg directly, but need to edit/add the appropiate lines in /etc/defaults/grub: 1 2 3 GRUB_CMDLINE_LINUX_DEFAULT="console=tty0 console=ttyS0,9600n8" GRUB_TERMINAL=console GRUB_SERIAL_COMMAND="serial --speed=9600 --unit=0 --word=8 --parity=no --stop=1" Now run update-grub and you’ll get the Bootloader and all Kernel and Init messages on your serial console the next time you boot. https://www.chrisk.de/blog/2011/04/intel-320-series-vs-ocz-vertex-2-vs-apple/ Fri, 29 Apr 2011 10:19:52 +0000 https://www.chrisk.de/blog/2011/04/intel-320-series-vs-ocz-vertex-2-vs-apple/ Actually this post should be called NO OCZ NO or something like that… I already wrote about the OCZ Vertex 2 E once or twice with somewhat mixed feelings. Now after 6 months with the first one, and 3 months with the second one, I wouldn’t recommend buying any of these again. Well, at least not if you’re using Apple. 60Gb OCZ Vertex 2 E in my Mac Mini (6 Months old): https://www.chrisk.de/blog/2011/03/how-to-check-services-and-restart-using-monit/ Sun, 27 Mar 2011 10:09:16 +0000 https://www.chrisk.de/blog/2011/03/how-to-check-services-and-restart-using-monit/ I have a monitoring service Zabbix which dies every few weeks, because it’s MySQL tables were locked for too long during a backup… Annoying! mostly because it’s then dead unnoticed for not just a few minutes. So, how do you monitor a monitoring service? Or simply… How do you restart any service that has just gone away in a simple way? I recently came across monit. They state it’s up and running in just 15min. https://www.chrisk.de/blog/2011/03/how-to-openbsd-with-huawei-e1750-umts/ Mon, 21 Mar 2011 19:02:20 +0000 https://www.chrisk.de/blog/2011/03/how-to-openbsd-with-huawei-e1750-umts/ Getting my OpenBSD (4.8) box to talk an Huawei E1750 USB UMTS Stick as a backup solution turned out to be not very straight forward, so in case you are in a similar situation… Have a look at man umsm to see which devices are supported by OpenBSD. The UMTS (USB)-Sticks are registered as /dev/cuaUX, where X is the number of your device… You’ll need userland pppd to connect. Place your peer configuration in /etc/ppp/peers/o2 for example: https://www.chrisk.de/blog/2011/03/openvpn-over-tcp-is-bad/ Thu, 17 Mar 2011 14:52:58 +0000 https://www.chrisk.de/blog/2011/03/openvpn-over-tcp-is-bad/ I use OpenVPN in a road-warrior setup over often slow and unreliable wireless connections. That on it’s own makes using interactive applications pretty hard. But if you’re now additionally running OpenVPN in TCP mode over these links things get worse. The reason is, that TCP uses some kind of a three-way handshake to make sure all packets arrive in time and re-transmits those packets that don’t. With OpenVPN over TCP you now have your application’s TCP session encapsulated in your VPN'’s TCP session, doubling your ACKs and re-transmissions (if needed). https://www.chrisk.de/blog/2011/02/how-to-create-your-own-dyndns-service/ Sun, 27 Feb 2011 13:31:59 +0000 https://www.chrisk.de/blog/2011/02/how-to-create-your-own-dyndns-service/ First off: This is not DynDNS as you might know it from dyndns.org. You can’t use clients like ddclient. I’m using DNSSEC and ‘nsupdate’. You’ll need to be familiar with Bind and some shell scripting… Also I only got this working on nix and I don’t have any intention to try it on Windows. Let’s start with what you have to do on your client: 1 $ dnssec-keygen -a HMAC-MD5 -b 512 -n USER -r /dev/urandom host1. https://www.chrisk.de/blog/2011/02/how-to-set-up-a-hidden-primary-dns/ Sun, 27 Feb 2011 09:18:58 +0000 https://www.chrisk.de/blog/2011/02/how-to-set-up-a-hidden-primary-dns/ I just had to guide a friend of mine trough the setup of a ‘hidden primary’ or ‘hidden master’ via mail, so I thought I’d also post a quick summary here to keep my blog alive First off: A ‘hidden primary’ setup, uses one server for all zone-file changes that isn’t listed anywhere and doesn’t get any queries from clients, and two or more ‘slaves’ that do the actual work. Have a look at this example zone-file: https://www.chrisk.de/blog/2011/02/trying-xen-4-0-on-debian-6-0-aka-squeeze/ Fri, 25 Feb 2011 12:53:15 +0000 https://www.chrisk.de/blog/2011/02/trying-xen-4-0-on-debian-6-0-aka-squeeze/ I have a rather mixed history with all these Virtualization techniques… I started with ranting about Xen and Ubuntu here on the blog, migrated to KVM and Ubuntu and am now considering moving back to Xen… on Debian. Recently I needed to install Xen on one of our Machines in our Lab at work. KVM was not an option, because the System (a dual-xeon with HT) didn’t have hardware virtualization support. https://www.chrisk.de/blog/2011/02/macbook-pro-and-the-ocz-vertex-2/ Fri, 18 Feb 2011 22:01:56 +0000 https://www.chrisk.de/blog/2011/02/macbook-pro-and-the-ocz-vertex-2/ Well… I know it’s very silent over here… not just lately. :/ Anyhow… I recently upgraded my 2010’s MacBook Pro with a 120Gb SSD. I already installed a OCZ SSD in my Mac Mini a couple of months ago… Everything runs fast and smooth and the MBP’s battery run time is now even more awesome BUT… the hell! Hibernate is broken! It’s a known bug. Mac OS X just Kernel Oopses on wake-up! https://www.chrisk.de/blog/2010/10/mac-mini-and-the-ocz-vertex-2/ Sun, 03 Oct 2010 06:20:50 +0000 https://www.chrisk.de/blog/2010/10/mac-mini-and-the-ocz-vertex-2/ Last week I upgraded my early 2009 Mac Mini (Core2Duo, 8Gb RAM, 320Gb 7200rpm HDD) with an SSD. I do heavy multitasking, and my HDD was just slowing me down. I did some research and brought it down to the Intel X-25G2 and the OCZ Vertex 2 (A SandForce based SSD, which works quite different than the Intel SSD). I went with the OCZ Vertex 2 E 60Gb… I am no expert in this SSD stuff, but what I’ve figured out so far is that Mac OS X 10. https://www.chrisk.de/blog/2010/08/how-to-fix-the-file-server-has-closed-down-issues-in-mac-os-and-netatalk/ Mon, 23 Aug 2010 17:28:58 +0000 https://www.chrisk.de/blog/2010/08/how-to-fix-the-file-server-has-closed-down-issues-in-mac-os-and-netatalk/ Netatalk versions older than 2.1.3 had some issues with the TCP/IP Stack on Linux which resulted in errors likeLuckily they seem to have fixed this in 2.1.3 as the ChangeLog states: fix a serious error in networking IO code. So the solution is as easy as upgrading. I am running Ubuntu, but two months after netatalk-2.1.3 has been released, they don’t even have it in unstable. Lucky Gentoo users you! I needed to fix this very quickly as it started to disrupt my workflow. https://www.chrisk.de/blog/2010/05/empty-trash-issues-in-snow-leopard/ Sun, 30 May 2010 12:10:56 +0000 https://www.chrisk.de/blog/2010/05/empty-trash-issues-in-snow-leopard/ I recently had many issues with Mac OS X 10.6’s Trash. The problem is that, when you Empty the Trash in Snow Leopard, Finder sometimes can’t erase all items because some of them are still in use. The funny part about this is, that most of the time, it’s the Finder itself that still uses the items! I haven’t found a solution so far, but there are at least two workarounds which don’t require logging out or even rebooting. https://www.chrisk.de/blog/2010/03/nginx-or-apache/ Sun, 21 Mar 2010 18:25:12 +0000 https://www.chrisk.de/blog/2010/03/nginx-or-apache/ I recently discovered nginx when I was thinking about replacing apache2 as a reverse-proxy that adds ssl and authentication to my internal webserver. I finally chose nginx and it’s now running on my freshly installed OpenBSD 4.7 gateway. I chose nginx because of it’s straight-forward configuration syntax and because it has a much smaller codebase, which means it should run faster and has less security flaws. The documentation also is great. https://www.chrisk.de/blog/2010/03/how-to-setup-kvm-on-ubuntu-lucid/ Fri, 19 Mar 2010 21:18:59 +0000 https://www.chrisk.de/blog/2010/03/how-to-setup-kvm-on-ubuntu-lucid/ More than a year ago I wrote an article about Xen on Ubuntu Intrepid with the intention of blaming Ubuntu. I also clearly said, that I wouldn’t use Ubuntu anymore. This article turned out to be the most hit one on my blog. Maybe because the Ubuntu community [directly links to it] (/404.html). Then, last Summer I wrote an article about alternatives to Xen, but I decided to wait and stay with Xen on my homeserver in the meantime. https://www.chrisk.de/blog/2010/03/how-to-openvpn-on-openbsd-as-layer2-vpn/ Fri, 19 Mar 2010 20:34:06 +0000 https://www.chrisk.de/blog/2010/03/how-to-openvpn-on-openbsd-as-layer2-vpn/ Getting OpenVPN running on a recent OpenBSD pretty simple. I run OpenVPN 2.1 on OpenBSD-current as of 2010/03/10 (almost 4.7) with PSK as a layer2 VPN. Layer2 because I have some zeroconf/bonjour stuff running at my LAN and I want to connect to my iTunes shares through the VPN. I’ll make it very short: Install OpenVPN from packages (or ports if you want to), configure a bridge, create a PSK and create a simple config file. https://www.chrisk.de/blog/2010/03/how-to-setup-ubuntu-lucid-as-a-timemachine-server/ Thu, 18 Mar 2010 14:49:26 +0000 https://www.chrisk.de/blog/2010/03/how-to-setup-ubuntu-lucid-as-a-timemachine-server/ I think starting with Lucid, Ubuntu ships netatalk 2.0.5 which makes setting up Linux as a TimeMachine server much easier. You no longer have to compile on you own nor do you have to create the sparsebundle. Just install netatalk and avahi-daemon if you want to, add options:tm to AppleVolumes.default and you’re done. 1 2 aptitude install netatalk echo /home/shared/timemachine "TM" options:tm >> /etc/netatalk/AppleVolumes.default If you want the service to be advertised on your LAN also install avahi-daemon and create /etc/avahi/services/afpd. https://www.chrisk.de/blog/2010/03/openbsd-on-the-intel-d410pt/ Sun, 14 Mar 2010 14:53:55 +0000 https://www.chrisk.de/blog/2010/03/openbsd-on-the-intel-d410pt/ Recently my gateway died. I not even had to replace the cf-card, but the entire unit. The old Intel D945GCLF2 just was unstable after the outtage. Last year Intel came up with some nicer layouts of their Atom boards and they now have totally fanless and pretty green devices. I bought the Intel D410PT because it’s cheap (around 60€), fanless and doesn’t need much energy. Assembled with PicoPSU-90, 1Gb of DDR2-800 RAM, a CF-to-SATA adapter, a 4Gb SanDisk UltraII and a dual-port Intel FastE nic, I installed OpenBSD-current as of 2010/03/09 (aka 4. https://www.chrisk.de/blog/2009/11/how-to-use-google-apps-as-a-mobileme-or-exchange-alternative/ Tue, 03 Nov 2009 10:38:34 +0000 https://www.chrisk.de/blog/2009/11/how-to-use-google-apps-as-a-mobileme-or-exchange-alternative/ I already wrote about Google Apps as a mail-hoster for your own domains. Today I’m going to talk about Google Apps for almost everything else you might need for your office or personal organization. I just set up Google Calendar and Google Address book synchronization on my Google Apps account. Your Gmail account also has the Calendar, Contacts, Sites and Docs features, but you can’t collaborate with other employees or members that good. https://www.chrisk.de/blog/2009/05/how-to-use-google-apps-for-your-domain/ Thu, 21 May 2009 13:28:33 +0000 https://www.chrisk.de/blog/2009/05/how-to-use-google-apps-for-your-domain/ I had this post drafted for some time now and just used some free time to review it… Do you have your own domain and some webspace, but no mail services for that domain? Or do you have a DynDNS account for your home server and want some fast webspace and mail services? You can get all that with Google Apps for Business - Standard Edition. And the good news is: It’s free. https://www.chrisk.de/blog/2009/01/my-backup-strategy/ Sat, 03 Jan 2009 15:30:00 +0000 https://www.chrisk.de/blog/2009/01/my-backup-strategy/ Now that a new year is here I really need to finish some points of my To-Do list! Here we go… As I said few weeks ago, maybe a little bit delayed, here comes how I backup all my stuff. This post is not a how-to. It’s just a configuration example. If you want a howto use this link.Some theory I have a central fileserver, some application servers (Web, Mail, MySQL) and a few workstations (Mac, Win, Linux). https://www.chrisk.de/blog/2008/12/how-to-windows-live-messenger-and-webcam-through-openbsd-and-pf/ Tue, 30 Dec 2008 23:40:21 +0000 https://www.chrisk.de/blog/2008/12/how-to-windows-live-messenger-and-webcam-through-openbsd-and-pf/ Windows Live Messaging is cool! All the others just suck! - At least that’s what almost everyone I know tells me. I mean… it has nice features, but it uses such a complex protocol that I don’t even want to think about security. During the Christmas time I visited my family and one evening I wanted to talk to a cousine using MSN and my Dell XPS M1530’s Webcam, but HELL this crappy SoHo router I was connecting through made it impossible to get a picture of her on my screen or to send her mine. https://www.chrisk.de/blog/2008/12/how-to-run-xen-in-ubuntu-intrepid-without-compiling-a-kernel-by-yourself/ Fri, 12 Dec 2008 21:05:41 +0000 https://www.chrisk.de/blog/2008/12/how-to-run-xen-in-ubuntu-intrepid-without-compiling-a-kernel-by-yourself/ Update: Switch from Xen to KVM. How and why. I got some strange errors when I tried to run OpenSolaris on Hardy as a HVM domain. These errors were fixed in 3.3, but Ubuntu Hardy doesn’t have Xen 3.3 and there were no backports at that time (don’t know if there are ones now) so I upgraded to Ubuntu Intrepid an then noticed that Canonical has dropped Xen Dom0 support. Great! https://www.chrisk.de/blog/2008/11/how-to-encode-videos-for-iphone-or-ipod-on-any-unix-using-ffmpeg/ Thu, 20 Nov 2008 11:04:34 +0000 https://www.chrisk.de/blog/2008/11/how-to-encode-videos-for-iphone-or-ipod-on-any-unix-using-ffmpeg/ Imagine what? I’m a big fan of the iPhone/iPod touch for mobile entertainment and since I’m also a big fan of the commandline, I of course want to use ffmpeg for video conversion. But… I’ve been looking for a working ffmpeg config for serveral months now. There were issues with Medibuntu’s version of ffmpeg for Ubuntu Hardy (or at least I had a lot of issues), there were issues with iTunes' crazy restrictions, there are dozens of (non) working ffmpeg configs on the web… so I just want to share my config with you. https://www.chrisk.de/blog/2008/11/how-to-setup-webdav-and-mysql-authentication-using-apache2/ Sat, 15 Nov 2008 09:20:00 +0000 https://www.chrisk.de/blog/2008/11/how-to-setup-webdav-and-mysql-authentication-using-apache2/ FTP is depracted. It’s been designed back in the days when the Internet consisted only of a few Computers. It’s not Firewall friendly (there are some hacks to get it through today’s Firewalls though) and should not be used any longer. Especially because the standard FTP protocol sends your password in clear-text across the net.So, any alternatives? YES! There are at least WebDAV and SFTP (not to confuse with FTPs). I’m using WebDAV because it’s easier to authenticate my User’s accounts against a MySQL Table. https://www.chrisk.de/blog/2008/11/how-to-backup-mysql-using-automysqlbackup/ Fri, 14 Nov 2008 15:10:00 +0000 https://www.chrisk.de/blog/2008/11/how-to-backup-mysql-using-automysqlbackup/ Have you ever had a hard disk or server failure and lost important docs? Well… I had. I’ve been looking for a MySQL backup solution for a few days now, found many scripts, but only one that fits all my needs (Separated daily/weekly backups of all my databases, automatic backup rotation and network support): AutoMySQLBackup.AutoMySQLBackup is a bash-script of about 700 lines. It has no special depends except mysql-client and Bash of course.