More Xbox One Firewall Rules - Elite Dangerous

Elite Dangerous needs UDP 19364 outbound!

SSH Don't offer a key, use a password

This is a problem i've been having more and more as my collection of keys and ~/.ssh.config grows. Sometimes you just need to log in with a password but ssh will try all of your keys and then the server prevents you from trying a password challenge because you've failed too many logins e.g.

Received disconnect from 10.12.66.18: 2: Too many authentication failures for ...

Just use ssh -o PubkeyAuthentication=no 

Disable Anonymous Binds in IPA v3 (and enable them again)

I was not entirely happy with the documentation for this here: 
While correct, It gives me no idea how to check the current configuration or how to turn anonymous binds back on again, or how to test my changes

Here is my approach:

Check the current config with this ldap query (there may be room for optimising this)
ldapsearch -x -u -h ipa.server -b cn=config "(cn=config)" nsslapd-allow-anonymous-access -W -D "cn=Directory Manager" 

That should yield:
...
nsslapd-allow-anonymous-access: on

or
...
nsslapd-allow-anonymous-access: rootdse

I then created two simple ldifs to enable and disable anonymous binds

disable-anonymous-binds.ldif
# disable-anonymous-binds.ldif
dn: cn=config
changetype: modify
replace: nsslapd-allow-anonymous-access
nsslapd-allow-anonymous-access: rootdse

enable-anonymous-binds.ldif
# enable-anonymous-binds.ldif
dn: cn=config
changetype: modify
replace: nsslapd-allow-anonymous-access
nsslapd-allow-anonymous-access: on 

Either of which can be run with
ldapmodify -x -D "cn=Directory Manager" -W -h ipa.server enable|disable-anonymous-binds.ldif

Building Python from Source on OpenSUSE

My very first post on this blog was how to build Python from source.  In 2015 it turns out that this is abit harder that it should be, and having wasted most of the morning working it out I'm posting the solution for future reference.

Building Python in the usual way (in this case Python 3.5)

./configure --prefix=/usr/local/python3.5 
make 
sudo make altinstall 

Installs a Python that is broken. e.g.

/usr/local/python3.5/bin/python3.5 -c "import random" 
... 
ImportError: No module named 'math' 

It turns out that Suse then installs some modules into /usr/local/python3.5/lib64/ which Python does not include in it's sys.path

This is a bit of a hack but the easiest way to fix this (for me) is to

sudo ln -s /usr/local/python3.5/lib64/python3.5/lib-dynload /usr/local/python3.5/lib/

This issues is well known it seems - Python bug reports here and here

Xbox one ScreenOS

Here are my notes on Xbox one firewall ports with ScreenOS.

Contrary to what is posted online, I've found that not all ports need to be opened and certainly in my experience only 2 need be "port forwarded" - I used a VIP for this as I have only one public IP Address :( xbox.com link http://support.xbox.com/en-GB/xbox-one/networking/network-ports-used-xbox-live

Minimum Config
This was enough config for Xbox party and GTA5 online game sessions to work

Outbound Enabled
udp 3544
udp tcp 3074
tcp 443
tcp 80
udp 88 - Never seen traffic with dst port 88 leave so might not be required

VIP ports
3544
3074

This was working fine until I tried playing Forza Horizon 2 online.
I then added:

udp 4500 outbound

And enabled the IKE-NAT service which seems to do some Juniper magic to not translate the src port (keep it 4500 when leaving the src nat ip) and enable udp 500 outbound

See details here: http://kb.juniper.net/InfoCenter/index?page=content&id=KB9243&actp=search

Getting Started With Ansible and Rackspace P2

Introduction
In this post a simple playbook is demonstrated to provision a pseudo DC in Rackspace.

Following on from the previous post, a parametrised playbook is created to:

•  Install a keypair from a file
•  create a management network
•  create a domain name

This playbook will likely only be run once

Create Datacenter Playbook (rs_create_dc.yml)
---
# rs_create_dc.yml

- name: Create Rackspace DC
  hosts: localhost
  connection: local
  gather_facts: false

  vars:
    - region: LON
    - management_net_cidr: 10.45.45.0/24
    - domain_contact: dns@{{ domain_name }}

  tasks:
    - name: Create KeyPair
      rax_keypair:
        name: rs_kp
        region: "{{ region }}"
        public_key: "{{ ssh_key }}"

    - name: Create Management Network
      rax_network:
        label: management
        cidr: "{{ management_net_cidr }}"
        region: "{{ region }}"

    - name: Add Domain Name
      rax_dns:
        name: "{{ domain_name }}"
        email: "{{ domain_contact }}"
        region: "{{ region }}"

The playbook might then be run like this:
ansible-playbook rs_create_dc.yml -e "ssh_key=/home/user/.ssh/publickey.pub domain_name=example.com"

Getting Started With Ansible and Rackspace P1

Introduction
The easiest way to play with an ansible module is from the command line.  This post demonstrates some of the Rackspace modules.

Setup
I started by creating my credentials file and setting the environmental RAX_CREDS_FILE to point to it.  As I was running pyrax from a Python virtual environment I also setup up the rax.py inventory and inventory file to point to a virtual environment.

Add a host key
ansible localhost -m rax_keypair -a "name=rs_kp public_key=/path/to/public_key region=LON" -c local -i inventory/ 
Worth noting that the path to the key will not expand ~ :(

Create a network
ansible localhost -m rax_network -a "region=LON label=alabel cidr=10.1.2.0/24" -c local -i inventory/

Create a VM
ansible localhost -m rax -a "flavor=general1-1 image="3cdcd2cc-238c-4f42-a9f4-0a80de217f7a" group=management name=vpn key_name=rs_kp networks=management,public wait=yes region=LON" 

In this example 2 vm's are created with incrementing numbers i.e vpn01, vpn02

ansible localhost -m rax -a "flavor=general1-1 image="3cdcd2cc-238c-4f42-a9f4-0a80de217f7a" group=management name=vpn%02d.example.com key_name=rs_kp networks=management,public wait=yes region=LON count=2"

Add DNS Zone
ansible localhost -m rax_dns -a "name=example.com email=hostmaster@example.com region=LON" (email address is required)

Add DNS Record to Zone
ansible localhost -m rax_dns_record -a "domain=example.com name=test1.example.com data=1.1.1.1 type=A region=LON" 

Get facts about a host
ansible localhost -m rax_facts -a name="server01" region=LON"