[SOLVED] Avahi mDNS host timeout

I’m at my parents place over Christmas, and they’ve got a lot of devices talking to each other using Avahi/Zeroconf. Avahi starts fine on my laptop, but for some reason the mDNS hostname resolution fails every time. There are no error messages from Avahi, and I can search for, say, HPPrinterModel.local and I can find it. But my own laptop doesn’t show up and just times out; searching by IP or hostname results in a timeout.
I’ve tried opening the required ports on the firewall (5353, 5354,?), I’ve tried reading through everything I can find (the wiki, Google, bug reports, etc), and yet I can’t seem to solve this. Has anyone else had problems like this?
EDIT: Avahi wasn’t configured correctly, and wasn’t publishing enough information. I’d turned it all off to stop my computer announcing itself to the world on public networks.
Last edited by zoqaeski (2013-12-25 16:57:30)

Ok, should have researched this more. This post https://bbs.archlinux.org/viewtopic.php?id=165913 led me to https://www.archlinux.org/news/filesyst … equired-1/
Basically, somehow, my /var/run was no longer symlinked to /run.
I ran the commands here after stopping all the services whose pids were in /var/run.
Then restarted and now avahi works again.

Similar Messages

[SOLVED] Avahi will not start

I had avahi + cups working for a while back, but going to use it today and avahi-daemon will not start:
% ~ sudo systemctl status avahi-daemon
avahi-daemon.service - Avahi mDNS/DNS-SD Stack
Loaded: loaded (/usr/lib/systemd/system/avahi-daemon.service; enabled)
Active: failed (Result: timeout) since Mon 2013-07-15 12:03:33 EDT; 5min ago
Main PID: 2234
Status: "Server startup complete. Host name is air-laptop.local. Local service cookie is 81586563."
CGroup: name=systemd:/system/avahi-daemon.service
Jul 15 12:02:05 air-laptop avahi-daemon[2234]: Service "air-laptop" (/services/ssh.service) successfully established.
Jul 15 12:02:05 air-laptop avahi-daemon[2234]: Service "air-laptop" (/services/sftp-ssh.service) successfully established.
Jul 15 12:03:33 air-laptop systemd[1]: avahi-daemon.service operation timed out. Terminating.
Jul 15 12:03:33 air-laptop avahi-daemon[2234]: Got SIGTERM, quitting.
Jul 15 12:03:33 air-laptop avahi-daemon[2234]: Leaving mDNS multicast group on interface virbr0.IPv4 with address 192.168.122.1.
Jul 15 12:03:33 air-laptop avahi-daemon[2234]: Leaving mDNS multicast group on interface wlan0.IPv4 with address 10.0.1.128.
Jul 15 12:03:33 air-laptop avahi-daemon[2234]: avahi-daemon 0.6.31 exiting.
Jul 15 12:03:33 air-laptop systemd[1]: avahi-daemon.service: Got notification message from PID 2234, but reception only permitted for PID 0
Jul 15 12:03:33 air-laptop systemd[1]: Failed to start Avahi mDNS/DNS-SD Stack.
Jul 15 12:03:33 air-laptop systemd[1]: Unit avahi-daemon.service entered failed state.
All files in /etc/avahi/* appear to be defaults.
/etc/dhcpcd.conf:
# A sample configuration for dhcpcd.
# See dhcpcd.conf(5) for details.
# Inform the DHCP server of our hostname for DDNS.
hostname
# To share the DHCP lease across OSX and Windows a ClientID is needed.
# Enabling this may get a different lease than the kernel DHCP client.
# Some upstream DHCP servers may also require a ClientID, such as FRITZ!Box.
#clientid
# A list of options to request from the DHCP server.
option domain_name_servers, domain_name, domain_search, host_name
option classless_static_routes
# Most distributions have NTP support.
option ntp_servers
# Respect the network MTU.
option interface_mtu
# A ServerID is required by RFC2131.
#require dhcp_server_identifier
# A hook script is provided to lookup the hostname if not set by the DHCP
# server, but it should not be run by default.
nohook lookup-hostname
noipv4ll
noipv6rs
Any ideas for investigation?
Last edited by nibblebot (2013-07-15 17:55:35)

Ok, should have researched this more. This post https://bbs.archlinux.org/viewtopic.php?id=165913 led me to https://www.archlinux.org/news/filesyst … equired-1/
Basically, somehow, my /var/run was no longer symlinked to /run.
I ran the commands here after stopping all the services whose pids were in /var/run.
Then restarted and now avahi works again.

[SOLVED] Kind of Bash-Timeout?

Hello everyone.
First I must say something good about Arch. I love this distribution and in my eyes its one of the (or even THE) best linux you can find.
I've got a strange problem with my Archbox. And since I even don't know how to call it, I can't find a similar post.
When I don't use my PC, for example while hearing music, the screen turns of after about 10 minutes. I recognized this behaviour in runlevel 3 and 5. My desktop is a openbox WM and no screensaver-tool.
I searched a lot in diverse configuration-files, but never found an entry whose name matched this behaviour.
Hope someone knows how to solve.
Big thanks in advantage,
armageddon
PS.: Please excuse my English, I'm a still learning german.
Last edited by the.armageddon (2009-02-11 11:32:00)

Welcome to arch and the forums
Probably you are seeing the "builtin" X screensaver. Try typing
xset q
in a terminal and look in the output for something like
Screen Saver:
prefer blanking: yes allow exposures: yes
timeout: 600 cycle: 600
If you want to deactivate just use "xset s off". Other options to xset allow you to configure the behaviour to your likes.

[SOLVED]Is my hosts file functioning as it should?

I'm using this script to update my hosts file with ad blocking settings.
#!/bin/bash
# Hosts file updater
HFSERVER="http://hostsfile.mine.nu.nyud.net"
HFILE="hosts.zip"
ORIGFILE="/etc/hosts.original"
clear
echo "-------------------------------------------------------------"
echo "This script will update your Hosts file to the latest version"
echo "Your original Hosts file will be renamed to $ORIGFILE"
echo "-------------------------------------------------------------"
echo ""
if [ ! -f "$ORIGFILE" ] ; then
echo "Backing up your previous hosts file.."
cp -v /etc/hosts $ORIGFILE # I like verbose file operations. Can be less verbose if necessary.
fi
echo "Retrieving $HFILE from $HFSERVER"
echo ""
wget -O /tmp/$HFILE $HFSERVER/$HFILE
unzip -p /tmp/$HFILE | dos2unix > /tmp/hosts
if [ 'grep -c "banner" /tmp/hosts' ];then
echo "Downloaded and unpacked $HFILE OK"
echo "Appending host list to original content" # which was probably there for a reason, like to make sure localhost worked, and possibly even more stuff if part of a corporate LAN
#cp -f -u /tmp/hosts /etc/hosts
cat $ORIGFILE >/etc/hosts
echo "" >>/etc/hosts # to make sure the original file ends in a new-line so that 2 entries don't end up on the same line, either causing unexpected behavior or not working at all
cat /tmp/hosts >>/etc/hosts
rm -fv /tmp/hosts* # again, I like verbose file operations. I like to know what my system is doing.
echo "Update process complete"
#echo "-------------------------------------------------------------"
echo "As a side-effect of this script, any changes you wish to make"
echo "persistent in the hosts file should be made to $ORIGFILE"
echo "because /etc/hosts will be respawned from that file and the "
echo "newlist from the server each time this script runs."
exit
else
echo "Update failed"
fi
http://hostsfile.mine.nu/downloads/updatehosts.sh.txt
And my hosts file now looks like this:
# /etc/hosts: static lookup table for host names
#<ip-address> <hostname.domain.org> <hostname>
127.0.0.1 localhost.localdomain localhost pote
# The Hosts File Project http://hostsfile.mine.nu
# Global Advert Servers Blocklist - Personal Edition
# Release 13/09/2008
# Servers Verified as up and running 13/09/2008 (by dns exploration)
# Updated sorted and maintained by Andrew Short (sh0rtie)
# Contact: [email protected]
# A big thank you to all contributers (too many to mention)
# who really have made this project a success, well done :)
# Licensed under the LGPL a copy of the license may be viewed at
# http://www.gnu.org/licenses/lgpl.txt
# WARNING:
# This file is *extremely comprehensive* and some sites might be
# included here that you wish to visit, if this is the case you can
# deactivate the block on that site by placing a # (octothorpe)symbol
# before its entry, this will deactivate blocking on that server
# so for example #127.0.0.1 foobar.com
# will enable you to visit foobar.com or you can just simply delete
# the line that contains the site you wish to visit.
# NB:
# For some computer software updates you may need to disable
# this file in order to perform the update, if you have problems
# rename this file from "hosts" to "hosts.txt" reboot then perform
# the update and then rename this file back to "hosts" to re-enable it
# You must keep the below lines
127.0.0.1 localhost
127.0.0.1 pop3.norton.antivirus
127.0.0.1 pop3.spa.norton.antivirus
# /etc/hosts: static lookup table for host names
#<ip-address> <hostname.domain.org> <hostname>
127.0.0.1 localhost.localdomain localhost pote
# End of file
# The Hosts File Project http://hostsfile.mine.nu
# Global Advert Servers Blocklist - Personal Edition
# Release 13/09/2008
# Servers Verified as up and running 13/09/2008 (by dns exploration)
# Updated sorted and maintained by Andrew Short (sh0rtie)
# Contact: [email protected]
# A big thank you to all contributers (too many to mention)
# who really have made this project a success, well done :)
# Licensed under the LGPL a copy of the license may be viewed at
# http://www.gnu.org/licenses/lgpl.txt
# WARNING:
# This file is *extremely comprehensive* and some sites might be
# included here that you wish to visit, if this is the case you can
# deactivate the block on that site by placing a # (octothorpe)symbol
# before its entry, this will deactivate blocking on that server
# so for example #127.0.0.1 foobar.com
# will enable you to visit foobar.com or you can just simply delete
# the line that contains the site you wish to visit.
# NB:
# For some computer software updates you may need to disable
# this file in order to perform the update, if you have problems
# rename this file from "hosts" to "hosts.txt" reboot then perform
# the update and then rename this file back to "hosts" to re-enable it
# You must keep the below lines
127.0.0.1 localhost
127.0.0.1 pop3.norton.antivirus
127.0.0.1 pop3.spa.norton.antivirus
127.0.0.1 admintds.megatds.com
127.0.0.1 ads.game.net
127.0.0.1 ads.tokgajah.com
127.0.0.1 dl.downloadhosting.com
127.0.0.1 game.treeloot.com
127.0.0.1 gw1.celticfestival.org
127.0.0.1 incestlove.info
127.0.0.1 klickcash.com
127.0.0.1 loomia.cachefly.net
127.0.0.1 pornoexit.com
127.0.0.1 privacy.virtumundo.com
127.0.0.1 redirect.virtumundo.com
127.0.0.1 tds.megatds.com
127.0.0.1 telebizz.org.uk
127.0.0.1 the2all.info
127.0.0.1 treeloot.com
127.0.0.1 ultraload.net
127.0.0.1 ultratds.com
127.0.0.1 v1.cc
127.0.0.1 virtumundo.com
# etc...
The thing i'm unsure of is this section:
# You must keep the below lines
127.0.0.1 localhost
Since localhost is already stated here:
#<ip-address> <hostname.domain.org> <hostname>
127.0.0.1 localhost.localdomain localhost pote
For now I've deleted the redundant localhost entry, since it seems to be there for windows compatability.
Is there any harm in leaving that entry?
Last edited by verve (2008-11-29 04:08:29)

Not as far as I know.
It probably just re-encounters the localhost hostname and either dumbly re-adds it to the internal table or ignores it. In any case, no logically discernible harm done.
-dav7

[Solved] Ping local network timeout 2 times every 20 reply

I just install Windows 8.1 Pro and my internet very slow then I try ping my router and get this result:
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time=1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Request timed out.
Request timed out.
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time=28ms TTL=128
Reply from 192.168.1.1: bytes=32 time=335ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Request timed out.
Request timed out.
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
Reply from 192.168.1.1: bytes=32 time<1ms TTL=128
I've tried:
1) boot into Linux and ping router - 0% loss
2) plug Wireless USB into computer, disable wired network then ping router - 0% loss
3) ping router via wired network by other Windows 8.1 laptop - same problem
4) flash dns and reset winsock not work
Thank you
Solved by change MTU
netsh interface ipv4 set subinterface "Ethernet" mtu=1492 store=persistent

Hi,
Glad to see your problem resolved, Hope your experience was helpful with others.
Roger Lu
TechNet Community Support

[SOLVED] Qemu and host-only networking

Hi,
I want to setup qemu with one Windows 7 guest. This guest should be able to connect to the hosts samba and postgres server, except external networks such the internet. I've read the archlinux qemu wiki page and it seems i need to use a bridge and a tap device to accomplish this. So far i've did as root:
brctl addbr br0
ip tuntap add dev tap0 mode tap user me
ip link set tap0 up
brctl addif br0 tap0
'brctl show' gives
bridge name bridge id STP enabled interfaces
br0 8000.16cad3ab6bda no tap0
When i start the vm as a user i get
qemu-system-x86_64 -enable-kvm -m 1024 -vga std -device e1000,netdev=tap0,mac=DE:AD:BE:EF:96:32 -netdev tap,id=tap0,script=no,downscript=no hdd1.qcow2
qemu-system-x86_64: -netdev tap,id=tap0: could not configure /dev/net/tun: Operation not permitted
qemu-system-x86_64: -netdev tap,id=tap0: Device 'tap' could not be initialized
Ok. Need to handle some permission issues. If i launch the above command as root, the VM (Windows 7) starts, but i don't have any connection to the host (Windows 7 complains about an unindentified network).
With the example scripts 'qemu-ifup', 'qemu-ifdown', the ip forwarding and the sudo configuration as described in the QEMU - ArchWiki - Creating bridge manually section, Windows 7 can indeed connect to the host, but also to the internet, what i simply don't want. The reason might sound silly, but everytime a Windows guest tries to connect to the internet, thus trying to obtain an ip from the dhcp server, the host completely looses its connection to the router. It seems my network hardware doesn't like this.
Anyway, i think i'm only missing one little thing. I would appreciate any help.
Last edited by ulixes (2014-06-09 20:51:52)

Thank you for this, I've tried lots of docs&tutorial, finnaly got this and success.
ulixes wrote:
Ok, found a solution. It's surprisingly simple. I've discarded the libvirt way, because the official archlinux virt-manager package is pretty unusable and configuring a working vlan for libvirt seems pretty complicated. I still couldn't get a working network device on the guest side.
For completeness, here is what i've done. I use a tap and a bridge device and dnsmasq. I did not activate ipv4 forwarding like mentioned in the wiki! The following steps need to be done as root.
First i've created the bridge, set an ip address and started it
brctl addbr br0
ip addr add 192.168.179.1/24 broadcast 192.168.179.255 dev br0
ip link set br0 up
The subnet should differ from any other device. In my case the only other device eth0 has the ip 192.168.178.xxx.
Next i've created the tap device for use by qemu respectively the guest
ip tuntap add dev tap0 mode tap
ip link set tap0 up promisc on
I don't know if 'promics' is really necessary, but there's no need to assign an ip to the tap device.
Now i've connected the tap device to the bridge
brctl addif br0 tap0
Until now this was approximately my first try. I've tried to use static ip on the guest side, but had no succeess. The important point was to run dnsmasq on the bridge
dnsmasq --interface=br0 --bind-interfaces --dhcp-range=192.168.179.10,192.168.179.254
In effect, i finally got working ip on the guest network devices (this may take some seconds). Pinging the host succeded and neither of my guests (SliTaz Linux, Windows 7) were able to connect to external networks, thus the internet.
I've started the guests with
qemu-system-x86_64 -enable-kvm -m 1024 -netdev tap,id=t0,ifname=tap0,script=no,downscript=no -device e1000,netdev=t0,id=nic0 <imagefile>
In my case, i had to omit the automated exection of scripts. This way i was also able to execute the above qemu command as an ordinary user.
Just to finalize this description for samba:
By adding 'br0' to 'interfaces' in smb.conf, guests were able to connect to the host samba service as usual.

[SOLVED] avahi sftp mount problem

greetings,
i hope i'm posting this in the right subforum (the other abvious choice would have been networking), but since this is likely to be a configuration issue, i'll post here. sorry, i'm kind of a newbie here.
sso.. i'm using a thinkpad t42, i've installed arch linux for the second time (please be patient with me, lol), and i've set up everything correctly: i have the latest gnome (2.30), and kernel. uname -a:
Linux YURI 2.6.32-ARCH #1 SMP PREEMPT Mon Mar 15 20:08:25 UTC 2010 i686 Intel(R) Pentium(R) M processor 1.60GHz GenuineIntel GNU/Linux
yesterday, i've messed around a bit with my rc.conf, and now everytime i try to mount a mac share via avahi/sftp, i only see nautilus's 'opening *insert-share-name-here*', and a certain process (gvfsd-sftp) eats all my processor resources. the share never actually gets mounted. i'm guessing some kernel module is not loaded, or there's a problem with the order of my daemons.
i've searched around in on the wiki, on the forums and in google, but to no avail. everything is supposed to be in order. if someone can help, please do.
modules array from rc.conf:
MODULES=(acpi-cpufreq cpufreq_ondemand cpufreq_conservative cpufreq_userspace cpufreq_powersave fuse !slhc !thinkpad-acpi e1000 ipw2100)
daemons array:
DAEMONS=(syslog-ng dbus hal crond alsa !network rpcbind nfs-common nfs-server netfs ntpd avahi-daemon networkmanager gdm)
thank you,
bamdad
Last edited by bamdad (2010-04-03 12:01:35)

update:
it seems, rc.conf has nothing to do with the problem. i'll leave it here for reference, but i tried logging in to gnome as root, and voilá, i could connect without a problem. so there had to be something messed up with my gnome settings. i had a crash yesterday, during which i was logged in to the other computer.
so i popped open Accessories>Passwords and Encryption keys from the gnome menu and deleted the [email protected] and [email protected] (interestingly, there wasn't an [email protected], and the problem was resolved.
my guess is that the crash somehow messed up my stored login information, and thus gvfsd-sftp went crazy trying to authenticate. if you happen to have the same problem, try the solution above.
Last edited by bamdad (2010-04-03 12:07:18)

[SOLVED] Avahi + service-types.db.pacnew

Hi there,
just a quick question: With the latest updates came avahi-0.6.31-6 to my system (Arch_x64). Pacman told me:
Warning: /usr/lib/avahi/service-types.db installed as /usr/lib/avahi/service-types.db.pacnew
Does anybody know, if I have to check something before using the .pacnew? I tried to have a look with meld, but that doesn't work - obviously - because the files in question are binary files
Last edited by swordfish (2013-03-03 11:25:27)

From looking at `$ pacman -Qii avahi`, I gather that /usr/lib/avahi/service-types.db file is marked for backup. Searching the 'net, I found that this (binary) file can be regenerated when you make any local changes to /usr/share/avahi/service-types and reinstall Avahi.
Looking at the changes to the avahi package, I found this change adding it to the list of backup files, apparently related to this bug report: FS#33930 - [avahi] missing backups.
So I guess that unless you have made any local changes, it's OK to replace the original with the .pacnew.
As always, if you don't trust my judgement, ask the package maintainer or the upstream developers :-)
Last edited by ackalker (2013-03-01 17:12:49)

[SOLVED] ping: unknown host

Ok I feel kinda stupid here. Yesterday I decided to make a clean install on my system. After the installation I tried to upgrade the system but couldn't. The pacman -Syu gets me:
error: failed retrieving file 'core.db' from ftp. .. . .. : No address record
error: failed to update core (No address record)
I guess it has to do with this (http://www.archlinux.org/news/hostname- … inetutils/) but I have no idea on how to fix it. The ping command gets me:
ping: unknown host www.google.com
Any help? Thanks.
If I posted this on the wrong section feel free to change it.
Last edited by Aventinus (2011-10-17 06:07:26)

sensei wrote:
Aventinus wrote:I use wired connection, ethernet. If I login via Ubuntu or Windows (triple boot) everything is fine. I have done this procedure many times. The article doesn't help (or I'm missing something).
I can't understand what's the matter.
How do you configure your network?
Here's an article on how to configure a wired network.
Well, that did the trick. All I had to do is to add "eth0" to the interface section on rc.conf. Although I wonder why all the other times when I did a clean install, this procedure was automatic. Anyway, thank you all for your time. :-)

[SOLVED] openssl: REMOTE HOST IDENTIFICATION HAS CHANGED! Hacked?

There's a bit of Windowsisms in here, but one of the main questions is about openssl. As well, this post could help others regardless of the OS involved.
I remote into a Windows 7 workstation at my work using xfreerdp going through Server 2008 R2. RDP is closed at the firewall to all but two IP addresses and neither of those uses port 3389. I'm connecting through NTLM for authentication then the connection is encrypted using TLS. FreeRDP uses openssl to handle SSL/TLS connections.
Last week I remoted in my workstation first thing in the morning as I always do with no problems. I went to work that day and everything was normal. Later that night I went to remote in again and I got the "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" message. I followed the advice in the message and contacted the system admin:
me wrote:skottish, were there any major changes in the system that could cause the RSA fingerprint to change?
skottish wrote:I don't think so skottish. There were no changes made to the system beyond a simple update to the server's spam filters.
There was nothing major that changed on the server and I wasn't anywhere in the system that could have forced a change. The only server-side work that I did was with some accounts in Active Directory and updated Exchange's spam filters.
The way that I see it, and I may be missing something, is that there are four possibilities:
1) A MITM attack. If this is the case then it was successful and I haven't tracked it down yet
2) Someone accidentally changed something in the server
3) Someone intentionally changed something in the server
4) The server made it's own changes (which sadly wouldn't be out of character for a MS server)
We do have an outside partner that has server access, but they told me that they weren't in there and I see no evidence to the contrary.
My first question is am I missing any other possibilities?
The second is how does openssl generate the RSA fingerprint of a computer? I've read many, many pages and so far I'm not finding any answers. If I could verify the fingerprint manually, that would help.
The third is that if it is a MITM attack, what are the appropriate steps to identify it? I went through all of the ARP tables on the server and the workstation looking to see if anything is out of line and everything looks fine. I could run a capture off of our firewall and see if there's anything there, but I don't know Wireshark all that well, so I'm not sure what I would be looking for exactly.
Thoughts?
Last edited by skottish (2012-09-22 03:10:22)

litemotiv wrote:Something like this happened to me before and it was caused by an unforeseen clock/time change, is that somehow possible in your case?
Well, there was a clock change on my end that same day. For some reason openntpd was running about two minutes behind and it had been since I migrated to systemd. I switched to ntpd in order to correct it. I can't imagine why a change on the client side would make a difference though. But, I'm open to the possibility.
--EDIT--
I tried some experiments with openntpd, ntp, and changing clocks and such, but I couldn't trigger the error. I'm still open to the possibility though.
-- RESOLUTION EDIT --
It's not worth bumping this thread over the resolution of this, but someone may be interested in what happened for their own reference later.
I realized that I was looking in the wrong direction and discovered that Windows automatically changed security keys for reasons that I don't understand yet. openssl did it's job perfectly. There was a force that wasn't the system administrator that made changes to the security of the system on a machine that hadn't changed physically. Is it possible that there has been an attack still? Yes, it's just much more unlikely now.
Last edited by skottish (2012-09-22 03:25:31)

[SOLVED] Qemu with host networking space.

Hello, I'm trying to lunch Qemu with host networking, so the VM's can talk to each other, what I did so far is creating the following bridges ( Actually virt-manager did that for me ):
br0, virbr0 -> virbr0-nic ( the interface )
and have the following network interfaces:
br0, lo, virbr0, wlp1s0
What I think I'm missing is something on the code... I'm lunching with:
qemu-system-x86 -kernel kernel -cpu host -m 2024 -hda image.image
I did review the following manuals
https://wiki.archlinux.org/index.php/QE … networking
https://wiki.archlinux.org/index.php/Network_bridge
I'm missing the right command, thanks.
Last edited by abdullah (2015-02-06 18:00:11)

abdullah wrote:
Well, still trying, here is the code that I'm using right now:
./start.sh
#!/bin/bash
bridge=br0
tap=$(sudo tunctl -u $(whoami) -b)
sudo ip link set $tap up
sleep 1s
sudo brctl addif $bridge $tap
qemu-system ..... etc \
-net nic,vlan0,model=virtio,macaddr=00:16:35:AF:94:4B \
-net nic,vlan=0,ifname=$tap,script=no,downscript=no
sudo brctl delif $bridge $tap
sudo ip link set $tap down
sudo tunctl -d $tap
which the reff was in https://activedoc.opensuse.org/book/ope … h-qemu-kvm
any help please?
Sorry if I am late to the party... but here's how I do this with bridged networking.
Let's assume that I have 2 guests, an ArchLinux and Window 7. These are the start scripts:
: cat start-arch.sh
#!/bin/bash
vm_dir="/export/scratch/VMs"
scripts_dir="${vm_dir}/scripts"
. ${scripts_dir}/macaddr-gen.sh
# Generate a random MAC address
gen_macaddr mac
# Start the emulator
qemu-system-x86_64 -enable-kvm -smp 2 \
-net bridge,br=br0 -net nic,macaddr=${mac},model=virtio \
-drive file="${vm_dir}/arch-x86_64-1",if=virtio -nographic
: cat start-win7.sh
#!/bin/bash
vm_dir="/export/scratch/VMs"
scripts_dir="${vm_dir}/scripts"
. ${scripts_dir}/macaddr-gen.sh
# Generate a random MAC address
gen_macaddr mac
# Start the emulator
qemu-system-x86_64 -enable-kvm -m 3G -smp 2 \
-net bridge,br=br0 -net nic,macaddr=${mac},model=virtio \
-drive file="${vm_dir}/win7-x86_64-1",if=virtio \
-usbdevice tablet -vga qxl -spice port=5930,disable-ticketing
: cat macaddr-gen.sh
#!/bin/bash
# Generate a random MAC address
gen_macaddr() {
local str i macaddr _mac=$1
str=$(cat /dev/random | tr -cd '[:xdigit:]' | head -c 12 | \
tr '[:upper:]' '[:lower:]')
i=0
macaddr=""
while [ $i -lt 6 ]; do
macaddr=${macaddr}${str:0:2}":"
str=${str:2}
let i=i+1
done
eval $_mac=\${macaddr%:}
: cat /etc/qemu/bridge.conf
allow br0
Note, that the MAC addresses of virtualized NICs in the VMs must be different. If you now do
: ./start-arch.sh &
: ./start-win7.sh
Assuming that you have already set up a bridge br0, qemu will create several tap? interfaces and insert them into that bridge (using the qemu-bridge-helper suid binary), and you'll have a virtual LAN rooted at br0.
EDIT: Added a slightly faster random MAC generator and comments.
Last edited by Leonid.I (2015-02-09 20:13:50)

[SOLVED] Virtualization, win7 host and 3d acceleration?

Is it possible to get decent 3d acceleration in Arch linux out of the box (just by installing right packages)?
I tried both VMware Workstation 7.1 and VirtualBox 4.08, and i followed steps in the wiki. Glxinfo and logs show that right drivers are loaded, but glxgears run at 60fps both with 3d acceleration enabled and disabled. I know that glxgears are not a real benchmark but i don't see any real acceleration, I can't use kde 4 desktop effects or GNOME 3.
So just first tell me is it possible to get good 3d acceleration with Arch (probably is ), and if you say yes ill post some logs and we will troubleshoot this problem.
P.S. I need 3d acceleration to test graphical applications (games) i develop under win. I need to test just basic functionality...
P.P.S Google revealed that Ubuntu offers easy and fast 3d acceleration, but i really like Arch so please help . I could use dual booting if everything else fails, but it's easier in vm, and it's gonna be necessary when I start testing networking parts.
Last edited by mohjkrtoi (2011-06-14 22:47:59)

Technically you do have "acceleration" but it is all using your CPU so to a first approximation there is no change in performance. When people's GPUs were not in use glxinfo used to say "Direct rendering: No". Now it says "Direct rendering: Yes" but you have to look at the fine print that says Gallium on softpipe. The relevant message in your xorg log is:
[ 34.883] (II) AIGLX: Screen 0 is not DRI2 capable
[ 34.883] (II) AIGLX: Screen 0 is not DRI capable
[ 34.984] (II) AIGLX: Loaded and initialized /usr/lib/xorg/modules/dri/swrast_dri.so
[ 34.984] (II) GLX: Initialized DRISWRAST GL provider for screen 0
Now about VirtualBox and its supposed 3D acceleration capabilities... for some time it has been possible to use hardware directly with a low-level type of virtualization as long as the host and guest OS are the same. So maybe VirtualBox only claims that it works when you run Linux on Linux.
As for Linux on Windows, that only has a chance of working if you are using an IOMMU. AMD and Intel both have specifications for this called AMD-V and VT-d. So you need to make sure your chipset is recent enough to come with this feature (this might be helpful) and make sure it is enabled in the BIOS.
Last edited by ConnorBehan (2011-06-15 00:48:10)

[SOLVED] how do hosts.allow and hosts.deny work?

I understand the basic concepts of hosts.allow and hosts.deny, but I am interested in how it works. What actually blocks access to the services? Do they do it themselves? Or it is something in the kernel that does it?
For example, if I have this in my hosts.allow:
sshd:all
#mysqld: all
And this is my hosts.deny:
ALL: ALL: DENY
This will result in people being able to connect to sshd but not mysqld. Are sshd and mysqld programmed to read these hosts.allow and hosts.deny files? Or is there something stopping the connection before it even gets to the daemon?
The hosts.allow and hosts.deny man pages refer to tcpd, but it is not running on my system. Also, hosts.allow and hosts.deny never show up in the output of `lsof`. hosts.allow and hosts.deny belong to the tcp_wrappers package, but there is nothing else in the package that illuminates my question.
Last edited by partner55083777 (2010-03-15 12:35:51)

Thanks guys.
However most common network service daemons today can be linked against libwrap directly.
Sure enough,
$ ldd /usr/sbin/sshd
linux-vdso.so.1 => (0x00007123451ff000)
libwrap.so.0 => /usr/lib/libwrap.so.0 (0x00007fffbd6d000)
libpam.so.0 => /lib/libpam.so.0 (0x00007f99765f1000)
$
Here is also a little bit more information about libwrap:
http://en.wikipedia.org/wiki/Libwrap
Last edited by partner55083777 (2010-03-15 20:03:11)

How to solve BPM system task timeout issue

Guys,
We have a BPM process with couple of human tasks and system tasks.
One particular SYSTEM task is designed to call a web service method synchronously. Because of the complexity in the method, it takes more than 5 minutes for the particular system process to complete. But the BPM process times out by then.
What are the suggested solution to this problem?
1. Increase BPM time out? possible???
2. can we make this synchronous call to asynchronous call using send and receive task???

Hi,
Don't expect that increasing the BPM time-out is a good idea (i also assume it's actually something in Weblogic which has a default 600 second max).
But we often use Send and Receive task in Oracle BPM to call long-running (some up to weeks) generic components/processes.
It works perfect as long as the component can perform a callback operation.
Hope it helps. J@n

[solved] VirtualBox(Arch host, XP guest): Bridged Adapter

It's fairly easy to enable it in VirtualBox. But whenever I start the xp, VirtualBox gives me:
Failed to start the virtual machine XP.
Failed to open/create the internal network 'HostInterfaceNetworking-eth0' (VERR_SUPDRV_COMPONENT_NOT_FOUND).
One of the kernel modules was not successfully loaded. Make sure that no kernel modules from an older version of VirtualBox exist. Then try to recompile and reload the kernel modules by executing '/etc/init.d/vboxdrv setup' as root (VERR_SUPDRV_COMPONENT_NOT_FOUND).
My VirtualBox version is Version 3.1.4. And this is the first time I try it, so there should be no "older version" exists in my computer...
(I am trying to use it to connet to the vpn server in my department, the default NAT connection won't do it, that's why I need the bridged adapter).
I will really appreciate if anyone can help.
Last edited by horsecool (2010-04-06 16:40:39)

Check that vboxnetflt is loaded if you have already put it in your modules line in rc.conf
lsmod | grep vbox
If not load it manually:
insmod /lib/modules/2.6.32-ARCH/misc/vboxnetflt.ko
You can put this in your /etc/rc.local for a more permanent solution.
http://bbs.archlinux.org/viewtopic.php?id=85990

[SOLVED] Avahi mDNS host timeout

Similar Messages

Maybe you are looking for