Menu
▾
▴
astlinux-users — AstLinux Users Mailing List
You can subscribe to this list here.
| 2006 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(1) |
Jul
(1) |
Aug
|
Sep
|
Oct
(2) |
Nov
(1) |
Dec
(20) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2007 |
Jan
(91) |
Feb
(111) |
Mar
(226) |
Apr
(65) |
May
(197) |
Jun
(202) |
Jul
(92) |
Aug
(87) |
Sep
(120) |
Oct
(133) |
Nov
(89) |
Dec
(155) |
| 2008 |
Jan
(251) |
Feb
(136) |
Mar
(174) |
Apr
(149) |
May
(56) |
Jun
(32) |
Jul
(36) |
Aug
(171) |
Sep
(245) |
Oct
(244) |
Nov
(218) |
Dec
(272) |
| 2009 |
Jan
(113) |
Feb
(119) |
Mar
(192) |
Apr
(117) |
May
(93) |
Jun
(46) |
Jul
(80) |
Aug
(54) |
Sep
(109) |
Oct
(70) |
Nov
(145) |
Dec
(110) |
| 2010 |
Jan
(137) |
Feb
(87) |
Mar
(45) |
Apr
(157) |
May
(58) |
Jun
(99) |
Jul
(188) |
Aug
(136) |
Sep
(101) |
Oct
(100) |
Nov
(61) |
Dec
(60) |
| 2011 |
Jan
(84) |
Feb
(43) |
Mar
(70) |
Apr
(17) |
May
(69) |
Jun
(28) |
Jul
(43) |
Aug
(21) |
Sep
(151) |
Oct
(120) |
Nov
(84) |
Dec
(101) |
| 2012 |
Jan
(119) |
Feb
(82) |
Mar
(70) |
Apr
(115) |
May
(66) |
Jun
(131) |
Jul
(70) |
Aug
(65) |
Sep
(66) |
Oct
(86) |
Nov
(197) |
Dec
(81) |
| 2013 |
Jan
(65) |
Feb
(48) |
Mar
(32) |
Apr
(68) |
May
(98) |
Jun
(59) |
Jul
(41) |
Aug
(52) |
Sep
(42) |
Oct
(37) |
Nov
(10) |
Dec
(27) |
| 2014 |
Jan
(61) |
Feb
(34) |
Mar
(30) |
Apr
(52) |
May
(45) |
Jun
(40) |
Jul
(28) |
Aug
(9) |
Sep
(39) |
Oct
(69) |
Nov
(55) |
Dec
(19) |
| 2015 |
Jan
(13) |
Feb
(21) |
Mar
(5) |
Apr
(14) |
May
(30) |
Jun
(51) |
Jul
(31) |
Aug
(12) |
Sep
(29) |
Oct
(15) |
Nov
(24) |
Dec
(16) |
| 2016 |
Jan
(62) |
Feb
(76) |
Mar
(30) |
Apr
(43) |
May
(46) |
Jun
(62) |
Jul
(21) |
Aug
(49) |
Sep
(67) |
Oct
(27) |
Nov
(26) |
Dec
(38) |
| 2017 |
Jan
(7) |
Feb
(12) |
Mar
(69) |
Apr
(59) |
May
(54) |
Jun
(40) |
Jul
(76) |
Aug
(82) |
Sep
(92) |
Oct
(51) |
Nov
(32) |
Dec
(30) |
| 2018 |
Jan
(22) |
Feb
(25) |
Mar
(34) |
Apr
(35) |
May
(37) |
Jun
(21) |
Jul
(69) |
Aug
(55) |
Sep
(17) |
Oct
(67) |
Nov
(9) |
Dec
(5) |
| 2019 |
Jan
(19) |
Feb
(12) |
Mar
(15) |
Apr
(19) |
May
|
Jun
(27) |
Jul
(27) |
Aug
(25) |
Sep
(25) |
Oct
(27) |
Nov
(10) |
Dec
(14) |
| 2020 |
Jan
(22) |
Feb
(20) |
Mar
(36) |
Apr
(40) |
May
(52) |
Jun
(35) |
Jul
(21) |
Aug
(32) |
Sep
(71) |
Oct
(27) |
Nov
(11) |
Dec
(16) |
| 2021 |
Jan
(16) |
Feb
(21) |
Mar
(21) |
Apr
(27) |
May
(17) |
Jun
|
Jul
(2) |
Aug
(22) |
Sep
(23) |
Oct
(7) |
Nov
(11) |
Dec
(28) |
| 2022 |
Jan
(23) |
Feb
(18) |
Mar
(9) |
Apr
(15) |
May
(15) |
Jun
(7) |
Jul
(8) |
Aug
(15) |
Sep
(1) |
Oct
|
Nov
(11) |
Dec
(10) |
| 2023 |
Jan
(14) |
Feb
(10) |
Mar
(11) |
Apr
(13) |
May
(2) |
Jun
(30) |
Jul
(1) |
Aug
(15) |
Sep
(13) |
Oct
(3) |
Nov
(25) |
Dec
(5) |
| 2024 |
Jan
(3) |
Feb
(10) |
Mar
(9) |
Apr
|
May
(1) |
Jun
(15) |
Jul
(7) |
Aug
(10) |
Sep
(3) |
Oct
(8) |
Nov
(6) |
Dec
(15) |
| 2025 |
Jan
(3) |
Feb
(1) |
Mar
(7) |
Apr
(5) |
May
(13) |
Jun
(16) |
Jul
(1) |
Aug
(6) |
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Michael K. <mic...@ip...> - 2019-12-17 23:59:41
|
I haven’t had a crash yet as ironically Zabbix notifies me that the memory is low and I just hop in and restart the Zabbix agent and its all good.
Yes htop shows the 3 listeners at the top of the list. It was 450M each at one of my sites I checked.
I think there may be only certain events that cause the memory leak as it does not seem to gradually increase although I cant confirm this.
Off to the Zabbix forums ☹
Regards
Michael Knill
On 18/12/19, 10:36 am, "Lonnie Abelbeck" <li...@lo...> wrote:
Hi Michael,
Darrick has seen similar memory-leak behavior for years with Zabbix.
Are you seeing your box running out of RAM and crashing ?
What does "htop" show, is the top "Mem" line slowly getting bigger and bigger ?
Restarting Zabbix every evening might be solution, but not ideal.
It will be interisting what the forums suggest.
Lonnie
> On Dec 17, 2019, at 2:57 PM, Michael Knill <mic...@ip...> wrote:
>
> Hi Group
>
> I am progressively rolling out Zabbix to my sites and I am beginning to experiencing memory leaks or high memory usage on the zabbix_agentd listener processes (all 3).
> Just wondering if anyone has experienced this?
> Any ideas on how I should troubleshoot?
> Could it be one of the scripts I am running although they are pretty basic?
>
> top -m
> Mem total:1935568 anon:668256 map:17612 free:983896
> slab:27716 buf:5036 cache:225908 dirty:16 write:0
> Swap total:0 free:0
> PID^^^VSZ^VSZRW RSS (SHR) DIRTY (SHR) STACK COMMAND
> 2527 2530m 86892 54924 3436 54920 3432 128 /usr/sbin/asterisk -f -p -c
> 9459 222m 190m 191m 2008 191m 2004 132 zabbix_agentd: listener #3 [waiting for connection]
> 9457 221m 190m 191m 2008 191m 2004 132 zabbix_agentd: listener #1 [waiting for connection]
> 9458 221m 189m 190m 2008 190m 2004 132 zabbix_agentd: listener #2 [waiting for connection]
>
> Thnaks
>
> Regards
> Michael Knill
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Lonnie A. <li...@lo...> - 2019-12-17 23:36:24
|
Hi Michael, Darrick has seen similar memory-leak behavior for years with Zabbix. Are you seeing your box running out of RAM and crashing ? What does "htop" show, is the top "Mem" line slowly getting bigger and bigger ? Restarting Zabbix every evening might be solution, but not ideal. It will be interisting what the forums suggest. Lonnie > On Dec 17, 2019, at 2:57 PM, Michael Knill <mic...@ip...> wrote: > > Hi Group > > I am progressively rolling out Zabbix to my sites and I am beginning to experiencing memory leaks or high memory usage on the zabbix_agentd listener processes (all 3). > Just wondering if anyone has experienced this? > Any ideas on how I should troubleshoot? > Could it be one of the scripts I am running although they are pretty basic? > > top -m > Mem total:1935568 anon:668256 map:17612 free:983896 > slab:27716 buf:5036 cache:225908 dirty:16 write:0 > Swap total:0 free:0 > PID^^^VSZ^VSZRW RSS (SHR) DIRTY (SHR) STACK COMMAND > 2527 2530m 86892 54924 3436 54920 3432 128 /usr/sbin/asterisk -f -p -c > 9459 222m 190m 191m 2008 191m 2004 132 zabbix_agentd: listener #3 [waiting for connection] > 9457 221m 190m 191m 2008 191m 2004 132 zabbix_agentd: listener #1 [waiting for connection] > 9458 221m 189m 190m 2008 190m 2004 132 zabbix_agentd: listener #2 [waiting for connection] > > Thnaks > > Regards > Michael Knill > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
|
From: Michael K. <mic...@ip...> - 2019-12-17 21:50:06
|
Other than reporting on the Zabbix forums which I plan on doing soon. Regards Michael Knill From: Michael Knill <mic...@ip...> Reply to: AstLinux List <ast...@li...> Date: Wednesday, 18 December 2019 at 7:58 am To: AstLinux List <ast...@li...> Subject: [Astlinux-users] Zabbix Memory Leak Hi Group I am progressively rolling out Zabbix to my sites and I am beginning to experiencing memory leaks or high memory usage on the zabbix_agentd listener processes (all 3). Just wondering if anyone has experienced this? Any ideas on how I should troubleshoot? Could it be one of the scripts I am running although they are pretty basic? top -m Mem total:1935568 anon:668256 map:17612 free:983896 slab:27716 buf:5036 cache:225908 dirty:16 write:0 Swap total:0 free:0 PID^^^VSZ^VSZRW RSS (SHR) DIRTY (SHR) STACK COMMAND 2527 2530m 86892 54924 3436 54920 3432 128 /usr/sbin/asterisk -f -p -c 9459 222m 190m 191m 2008 191m 2004 132 zabbix_agentd: listener #3 [waiting for connection] 9457 221m 190m 191m 2008 191m 2004 132 zabbix_agentd: listener #1 [waiting for connection] 9458 221m 189m 190m 2008 190m 2004 132 zabbix_agentd: listener #2 [waiting for connection] Thnaks Regards Michael Knill |
|
From: Michael K. <mic...@ip...> - 2019-12-17 20:57:42
|
Hi Group I am progressively rolling out Zabbix to my sites and I am beginning to experiencing memory leaks or high memory usage on the zabbix_agentd listener processes (all 3). Just wondering if anyone has experienced this? Any ideas on how I should troubleshoot? Could it be one of the scripts I am running although they are pretty basic? top -m Mem total:1935568 anon:668256 map:17612 free:983896 slab:27716 buf:5036 cache:225908 dirty:16 write:0 Swap total:0 free:0 PID^^^VSZ^VSZRW RSS (SHR) DIRTY (SHR) STACK COMMAND 2527 2530m 86892 54924 3436 54920 3432 128 /usr/sbin/asterisk -f -p -c 9459 222m 190m 191m 2008 191m 2004 132 zabbix_agentd: listener #3 [waiting for connection] 9457 221m 190m 191m 2008 191m 2004 132 zabbix_agentd: listener #1 [waiting for connection] 9458 221m 189m 190m 2008 190m 2004 132 zabbix_agentd: listener #2 [waiting for connection] Thnaks Regards Michael Knill |
|
From: Lonnie A. <li...@lo...> - 2019-12-09 15:22:25
|
WireGuard VPN update, Over on the WireGuard mailing list: Jason wrote: "WireGuard has been merged into Dave Miller's net-next tree. That means when Linus Torvalds opens up his tree for Linux 5.6, Dave will send a pull request to Linus, and WireGuard will wind up in Linux 5.6. This is big news and very exciting." Additionally, 12 days ago, Jason merged the syncconf command [2] into master, which is significant for us since AstLinux's seamless "WireGuard Reload" for adding/removing/updating peers uses this feature. Finally, somewhat related, over the weekend the interwebs were excited about a possible vulnerability ... [CVE-2019-14899] Inferring and hijacking VPN-tunneled TCP connections. https://seclists.org/oss-sec/2019/q4/122 While this CVE is more client related, AstLinux's AIF firewall (Arno's Iptables Firewall) already mitigates such an attack. Kudos to Arno and his design decisions he made many years ago. Lonnie > On Sep 7, 2019, at 6:02 PM, Michael Knill <mic...@ip...> wrote: > > Thanks Lonnie for the info. Very helpful. I'm a big fan too which is why I asked the question. > > After weighing up the pros and cons, I think that I'm going to start using it. > In not concerned from a security perspective as its all unclassified traffic anyway already running over the public internet. > And I have done enough testing that I feel quite comfortable with its stability. > > The worst case scenario is that if I do have problems, I just need to move the sites over to another VPN technology which would not affect the overall architecture of the solution very much. > > Thanks all. > > Regards > Michael Knill > > On 8/9/19, 12:01 am, "Lonnie Abelbeck" <li...@lo...> wrote: > > > >> On Sep 7, 2019, at 3:25 AM, Michael Knill <mic...@ip...> wrote: >> >> Hi Group >> >> In previous discussions I hinted on wanting to build a full telephony network with softswitch and with our significant growth in the last couple of months, I believe the time has come to kick it off. >> The problem is that although I have had zero issues with Wireguard and its perfect for what I need, its not classified as stable and I'm just concerned about using it in production (even though I already am!). OpenVPN is nice and stable but the failover time is just not as good and it's a dog to set up. >> >> So just wondering what other people think? >> I looking at 100+ sites terminating onto a Softswitch. >> >> Regards >> Michael Knill > > As you know I'm a big fan of WireGuard, and in fact is the only VPN I use anymore, but I will not suggest to make such an important design decision for your business, only my opinion. > > Here is the current status on the various WireGuard repos: > > https://www.wireguard.com/repositories/ > > The Linux kernel repo is noted as "Complete" (completes its goal mostly and is actively maintained). > > From what I read [1], WireGuard would be in the mainline Linux Kernel by now if it weren't for the internal squabbling on how to organize a new "zinc" crypto library WireGuard uses which supersedes some older crypto libraries in the kernel. If not for that, the WireGuard tunnel part would have been in the Linux kernel (officially) for some time now. Hopefully the crypto squabbling will get resolved soon. Linus likes WireGuard. > > WireGuard, OpenVPN and IPsec/NAT-Traversal all provide a VPN tunnel over UDP, but the simplicity and efficiency of WireGuard in the Linux kernel stands out over the others. > > But, also keep in mind that AstLinux's seamless "WireGuard Reload" for adding/removing/updating peers is in Jason's repo [2], but has not yet been merged to WG's master (AstLinux includes it as a patch [3]) ... though this is only a tweak to the "wg" tool and not to the kernel module. > > Lonnie [1] https://lkml.org/lkml/2019/3/25/443 [2] https://git.zx2c4.com/WireGuard/commit/?h=jd/syncconf [3] https://github.com/astlinux-project/astlinux/blob/master/package/wireguard/wireguard-0900-syncconf.patch |
|
From: Lonnie A. <li...@lo...> - 2019-11-27 03:33:04
|
Announcing AstLinux Release: 1.3.7.1 Shortly after we announced AstLinux 1.3.7, three security fixes to Asterisk were disclosed. As such, we generated AstLinux 1.3.7.1 with the security fixes applied to all versions of Asterisk. More Info: AstLinux Project https://www.astlinux-project.org/ AstLinux 1.3.7.1 Highlights: * Asterisk Versions: 13.23.1, 13.29.2, 16.6.2 * Asterisk security patches: AST-2019-006, AST-2019-007, AST-2019-008 Full ChangeLog: https://raw.githubusercontent.com/astlinux-project/astlinux/1.3.7.1/docs/ChangeLog.txt All users are encouraged to upgrade. Previous Asterisk 11.x users are encouraged to switch to the new Asterisk '13se' (stable edition). Some configuration changes will be needed, though minimal. AstLinux Team |
|
From: Michael K. <mic...@ip...> - 2019-11-22 21:44:04
|
The good. It has a serial port!
Regards
Michael Knill
On 23/11/19, 4:06 am, "Lonnie Abelbeck" <li...@lo...> wrote:
A newly released hardware description and configuration has been added to the AstLinux documentation:
Jetway JBC430U941 Quad Core Fanless Celeron N3160
https://doc.astlinux-project.org/userdoc:board_jetway_jbc430u941
I personally purchased a Jetway HBJC430U941-316B (Model: JBC430U941) (No RAM, No SSD) via Amazon:
Jetway HBJC430U941-316B Celeron N3160 Quad Core Fanless Firewall IoT Mini PC, 4X GbE LAN ...
https://www.amazon.com/dp/B07WSJFBZ4/
https://mitxpc.com/products/hbjc430u941-316b (Direct for $269.95 + shipping)
$299.95 USD -- Jetway HBJC430U941-316B Celeron N3160
$ 21.99 USD -- Transcend 32GB SATA III 6GB/S M.2 Type 2242 SSD TS32GMTS400S
$ 19.99 USD -- Kingston Technology 4GB 1600MHz DDR3L PC3-12800 1.35V Non-ECC CL11 SODIMM
$ 0.00 USD -- Shipping (Included)
The Jetway JBC430U941 offers:
-- Small fanless case, 5.1 x 4.3 inch (129 x 109 mm) footprint
-- Intel Celeron CPU N3160 @ 1.60GHz
-- 4x Intel i211 NIC's
-- Supports M.2 Type 2242 SSD
-- Supports Serial (RJ45) or Video (HDMI) Console
-- Piezo speaker
-- Power button
No surprise, line-speed 1Gbps network routing and near line-speed WireGuard VPN endpoint.
This Jetway N3160 appliance makes a fine AstLinux box.
The Good:
* Has a 2 year limited warranty and Long-life Series, Planned Lifecycle Through Q1'2031
* Includes plastic dust plugs for all the ports
* Ethernet MAC OUI's match the hardware manufacturer, imagine that :-)
* Jetway tech support was very responsive
The Bad:
* The CPU temp appears to run 10 C higher (but not excessive) than a similar Qotom box, possibly the extra unused GPU/video SoC circuitry. I contacted Jetway tech support and they did not indicate any BIOS setting that would help, possibly the request planted a seed to investigate more. Possibly the Qotom CPU's have failed but unneeded video circuitry disabled on the die, who knows.
* Price, at $270-$300 USD it currently does not offer a value solution compared to other hardware
The Jetway N3160 appliance has run solidly for a few days, further updates as needed.
Lonnie
Followup, performance comparisons:
I performed some multi-core WireGuard VPN performance tests while noting the CPU temps for 4 similar hardware appliances.
In all cases, a 10 minute WireGuard iperf3 test to a common VM (AstLinux in Proxmox), one at a time.
In all cases, all cores are running at 70-80% .
== Hardware: Jetway JBC430U941 N3160 NIC x4 ==
pbx2 ~ # sensors ; iperf3 -c 10.4.0.15 -P2 -R -t 600 ; sensors
coretemp-isa-0000
Adapter: ISA adapter
Core 0: +49.0 C (high = +90.0 C, crit = +90.0 C)
Core 1: +49.0 C (high = +90.0 C, crit = +90.0 C)
Core 2: +46.0 C (high = +90.0 C, crit = +90.0 C)
Core 3: +46.0 C (high = +90.0 C, crit = +90.0 C)
[SUM] 0.00-600.01 sec 48.5 GBytes 694 Mbits/sec 3255 sender
[SUM] 0.00-600.01 sec 48.5 GBytes 694 Mbits/sec receiver
iperf Done.
coretemp-isa-0000
Adapter: ISA adapter
Core 0: +54.0 C (high = +90.0 C, crit = +90.0 C)
Core 1: +54.0 C (high = +90.0 C, crit = +90.0 C)
Core 2: +48.0 C (high = +90.0 C, crit = +90.0 C)
Core 3: +50.0 C (high = +90.0 C, crit = +90.0 C)
== Hardware: Jetway NF9HG-2930 NIC x4 ==
pbx3 ~ # sensors ; iperf3 -c 10.4.0.15 -P2 -R -t 600 ; sensors
coretemp-isa-0000
Adapter: ISA adapter
Core 0: +47.0 C (high = +105.0 C, crit = +105.0 C)
Core 1: +47.0 C (high = +105.0 C, crit = +105.0 C)
Core 2: +51.0 C (high = +105.0 C, crit = +105.0 C)
Core 3: +51.0 C (high = +105.0 C, crit = +105.0 C)
[SUM] 0.00-600.00 sec 51.9 GBytes 742 Mbits/sec 4703 sender
[SUM] 0.00-600.00 sec 51.9 GBytes 742 Mbits/sec receiver
iperf Done.
coretemp-isa-0000
Adapter: ISA adapter
Core 0: +53.0 C (high = +105.0 C, crit = +105.0 C)
Core 1: +53.0 C (high = +105.0 C, crit = +105.0 C)
Core 2: +56.0 C (high = +105.0 C, crit = +105.0 C)
Core 3: +56.0 C (high = +105.0 C, crit = +105.0 C)
== Hardware: PC Engines APU2 NIC x3 ==
pbx4 ~ # sensors ; iperf3 -c 10.4.0.15 -P2 -R -t 600 ; sensors
k10temp-pci-00c3
Adapter: PCI adapter
CPU Temp: +53.2 C (high = +70.0 C)
(crit = +105.0 C, hyst = +104.0 C)
[SUM] 0.00-600.01 sec 33.7 GBytes 483 Mbits/sec 2413 sender
[SUM] 0.00-600.00 sec 33.7 GBytes 483 Mbits/sec receiver
iperf Done.
k10temp-pci-00c3
Adapter: PCI adapter
CPU Temp: +56.2 C (high = +70.0 C)
(crit = +105.0 C, hyst = +104.0 C)
== Hardware: Qotom Q190G4N CPU J1900 NIC x4 ==
pbx0 ~ # sensors ; iperf3 -c 10.4.0.15 -P2 -R -t 600 ; sensors
coretemp-isa-0000
Adapter: ISA adapter
Core 0: +36.0 C (high = +105.0 C, crit = +105.0 C)
Core 1: +39.0 C (high = +105.0 C, crit = +105.0 C)
Core 2: +39.0 C (high = +105.0 C, crit = +105.0 C)
Core 3: +39.0 C (high = +105.0 C, crit = +105.0 C)
[SUM] 0.00-600.01 sec 52.4 GBytes 750 Mbits/sec 4094 sender
[SUM] 0.00-600.00 sec 52.4 GBytes 750 Mbits/sec receiver
iperf Done.
coretemp-isa-0000
Adapter: ISA adapter
Core 0: +38.0 C (high = +105.0 C, crit = +105.0 C)
Core 1: +41.0 C (high = +105.0 C, crit = +105.0 C)
Core 2: +41.0 C (high = +105.0 C, crit = +105.0 C)
Core 3: +41.0 C (high = +105.0 C, crit = +105.0 C)
--
_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Lonnie A. <li...@lo...> - 2019-11-22 17:06:33
|
A newly released hardware description and configuration has been added to the AstLinux documentation: Jetway JBC430U941 Quad Core Fanless Celeron N3160 https://doc.astlinux-project.org/userdoc:board_jetway_jbc430u941 I personally purchased a Jetway HBJC430U941-316B (Model: JBC430U941) (No RAM, No SSD) via Amazon: Jetway HBJC430U941-316B Celeron N3160 Quad Core Fanless Firewall IoT Mini PC, 4X GbE LAN ... https://www.amazon.com/dp/B07WSJFBZ4/ https://mitxpc.com/products/hbjc430u941-316b (Direct for $269.95 + shipping) $299.95 USD -- Jetway HBJC430U941-316B Celeron N3160 $ 21.99 USD -- Transcend 32GB SATA III 6GB/S M.2 Type 2242 SSD TS32GMTS400S $ 19.99 USD -- Kingston Technology 4GB 1600MHz DDR3L PC3-12800 1.35V Non-ECC CL11 SODIMM $ 0.00 USD -- Shipping (Included) The Jetway JBC430U941 offers: -- Small fanless case, 5.1 x 4.3 inch (129 x 109 mm) footprint -- Intel Celeron CPU N3160 @ 1.60GHz -- 4x Intel i211 NIC's -- Supports M.2 Type 2242 SSD -- Supports Serial (RJ45) or Video (HDMI) Console -- Piezo speaker -- Power button No surprise, line-speed 1Gbps network routing and near line-speed WireGuard VPN endpoint. This Jetway N3160 appliance makes a fine AstLinux box. The Good: * Has a 2 year limited warranty and Long-life Series, Planned Lifecycle Through Q1'2031 * Includes plastic dust plugs for all the ports * Ethernet MAC OUI's match the hardware manufacturer, imagine that :-) * Jetway tech support was very responsive The Bad: * The CPU temp appears to run 10 C higher (but not excessive) than a similar Qotom box, possibly the extra unused GPU/video SoC circuitry. I contacted Jetway tech support and they did not indicate any BIOS setting that would help, possibly the request planted a seed to investigate more. Possibly the Qotom CPU's have failed but unneeded video circuitry disabled on the die, who knows. * Price, at $270-$300 USD it currently does not offer a value solution compared to other hardware The Jetway N3160 appliance has run solidly for a few days, further updates as needed. Lonnie Followup, performance comparisons: I performed some multi-core WireGuard VPN performance tests while noting the CPU temps for 4 similar hardware appliances. In all cases, a 10 minute WireGuard iperf3 test to a common VM (AstLinux in Proxmox), one at a time. In all cases, all cores are running at 70-80% . == Hardware: Jetway JBC430U941 N3160 NIC x4 == pbx2 ~ # sensors ; iperf3 -c 10.4.0.15 -P2 -R -t 600 ; sensors coretemp-isa-0000 Adapter: ISA adapter Core 0: +49.0 C (high = +90.0 C, crit = +90.0 C) Core 1: +49.0 C (high = +90.0 C, crit = +90.0 C) Core 2: +46.0 C (high = +90.0 C, crit = +90.0 C) Core 3: +46.0 C (high = +90.0 C, crit = +90.0 C) [SUM] 0.00-600.01 sec 48.5 GBytes 694 Mbits/sec 3255 sender [SUM] 0.00-600.01 sec 48.5 GBytes 694 Mbits/sec receiver iperf Done. coretemp-isa-0000 Adapter: ISA adapter Core 0: +54.0 C (high = +90.0 C, crit = +90.0 C) Core 1: +54.0 C (high = +90.0 C, crit = +90.0 C) Core 2: +48.0 C (high = +90.0 C, crit = +90.0 C) Core 3: +50.0 C (high = +90.0 C, crit = +90.0 C) == Hardware: Jetway NF9HG-2930 NIC x4 == pbx3 ~ # sensors ; iperf3 -c 10.4.0.15 -P2 -R -t 600 ; sensors coretemp-isa-0000 Adapter: ISA adapter Core 0: +47.0 C (high = +105.0 C, crit = +105.0 C) Core 1: +47.0 C (high = +105.0 C, crit = +105.0 C) Core 2: +51.0 C (high = +105.0 C, crit = +105.0 C) Core 3: +51.0 C (high = +105.0 C, crit = +105.0 C) [SUM] 0.00-600.00 sec 51.9 GBytes 742 Mbits/sec 4703 sender [SUM] 0.00-600.00 sec 51.9 GBytes 742 Mbits/sec receiver iperf Done. coretemp-isa-0000 Adapter: ISA adapter Core 0: +53.0 C (high = +105.0 C, crit = +105.0 C) Core 1: +53.0 C (high = +105.0 C, crit = +105.0 C) Core 2: +56.0 C (high = +105.0 C, crit = +105.0 C) Core 3: +56.0 C (high = +105.0 C, crit = +105.0 C) == Hardware: PC Engines APU2 NIC x3 == pbx4 ~ # sensors ; iperf3 -c 10.4.0.15 -P2 -R -t 600 ; sensors k10temp-pci-00c3 Adapter: PCI adapter CPU Temp: +53.2 C (high = +70.0 C) (crit = +105.0 C, hyst = +104.0 C) [SUM] 0.00-600.01 sec 33.7 GBytes 483 Mbits/sec 2413 sender [SUM] 0.00-600.00 sec 33.7 GBytes 483 Mbits/sec receiver iperf Done. k10temp-pci-00c3 Adapter: PCI adapter CPU Temp: +56.2 C (high = +70.0 C) (crit = +105.0 C, hyst = +104.0 C) == Hardware: Qotom Q190G4N CPU J1900 NIC x4 == pbx0 ~ # sensors ; iperf3 -c 10.4.0.15 -P2 -R -t 600 ; sensors coretemp-isa-0000 Adapter: ISA adapter Core 0: +36.0 C (high = +105.0 C, crit = +105.0 C) Core 1: +39.0 C (high = +105.0 C, crit = +105.0 C) Core 2: +39.0 C (high = +105.0 C, crit = +105.0 C) Core 3: +39.0 C (high = +105.0 C, crit = +105.0 C) [SUM] 0.00-600.01 sec 52.4 GBytes 750 Mbits/sec 4094 sender [SUM] 0.00-600.00 sec 52.4 GBytes 750 Mbits/sec receiver iperf Done. coretemp-isa-0000 Adapter: ISA adapter Core 0: +38.0 C (high = +105.0 C, crit = +105.0 C) Core 1: +41.0 C (high = +105.0 C, crit = +105.0 C) Core 2: +41.0 C (high = +105.0 C, crit = +105.0 C) Core 3: +41.0 C (high = +105.0 C, crit = +105.0 C) -- |
|
From: Lonnie A. <li...@lo...> - 2019-11-19 15:20:18
|
Announcing AstLinux Release: 1.3.7 More Info: AstLinux Project https://www.astlinux-project.org/ AstLinux 1.3.7 Highlights: * Asterisk Versions: 13.23.1, 13.29.1, 16.6.1 * Upgrade to Linux Kernel 3.16.74, including the RUNNIX bootloader, security and bug fixes * OpenSSL, major version bump to 1.1.1d, the new LTS series. The previous 1.0.2 LTS series is EOL at the end of 2019 * Note: Many packages required version bumps or patches to be compatible with the new OpenSSL 1.1 API * acme-client, add upstream patch from 2.8.3 to fix (important) Let's Encrypt CDN changes * php, major version bump to 7.2.23, adds OpenSSL 1.1 compatibility * Web Interface Edit tab, add support for CodeMirror text editing * Fossil, major version bump to 2.9, adds numerous enhancements to the look and feel of the web interface * iprange, new command, version 1.0.4, a tool capable of managing sets of IPs * arnofw (AIF), reload-blocklist-netset cron script, add new netset types * arnofw (AIF), wireguard-vpn plugin, add support for WG->Local TCP/UDP INPUT policy firewall rules * WireGuard VPN, latest development snapshot during its incorporation into the mainline Linux Kernel * Asterisk '13se' (stable edition) version 13.23.1 is older than latest Asterisk 13.x version but more tested, built --without-pjproject * Package upgrades providing important security and bug fixes Full ChangeLog: https://raw.githubusercontent.com/astlinux-project/astlinux/1.3.7/docs/ChangeLog.txt All users are encouraged to upgrade. Previous Asterisk 11.x users are encouraged to switch to the new Asterisk '13se' (stable edition). Some configuration changes will be needed, though minimal. AstLinux Team |
|
From: Michael K. <mic...@ip...> - 2019-11-17 05:47:44
|
Great thanks Lonnie.
Regards
Michael Knill
On 17/11/19, 8:59 am, "Lonnie Abelbeck" <li...@lo...> wrote:
Using a VLAN seems like a good idea when you only have one interface.
Using loopback will never work for a VPN since it is not globally unique.
Lonnie
> On Nov 16, 2019, at 3:42 PM, Michael Knill <mic...@ip...> wrote:
>
> Hi Group
>
> I have set up a raccoon ipsec tunnel to Astlinux from a Mikrotik router while I wait for V7 to come out which supports UDP OpenVPN. Not sure why it has taken Mikrotik this long ☹.
> I am running remote phones which are registering to the hosted Astlinux box which has only a single interface (eth0).
>
> As an ipsec newbie, I wasn't sure what Local-Net to configure in Astlinux so I just added a tagged interface eth0.100 and used that. Is there a better way e.g. could I use a loopback as the Local-Net?
>
> Thanks all.
>
> Regards
> Michael Knill
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Lonnie A. <li...@lo...> - 2019-11-16 21:58:44
|
Using a VLAN seems like a good idea when you only have one interface. Using loopback will never work for a VPN since it is not globally unique. Lonnie > On Nov 16, 2019, at 3:42 PM, Michael Knill <mic...@ip...> wrote: > > Hi Group > > I have set up a raccoon ipsec tunnel to Astlinux from a Mikrotik router while I wait for V7 to come out which supports UDP OpenVPN. Not sure why it has taken Mikrotik this long ☹. > I am running remote phones which are registering to the hosted Astlinux box which has only a single interface (eth0). > > As an ipsec newbie, I wasn't sure what Local-Net to configure in Astlinux so I just added a tagged interface eth0.100 and used that. Is there a better way e.g. could I use a loopback as the Local-Net? > > Thanks all. > > Regards > Michael Knill > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
|
From: Michael K. <mic...@ip...> - 2019-11-16 21:42:18
|
Hi Group I have set up a raccoon ipsec tunnel to Astlinux from a Mikrotik router while I wait for V7 to come out which supports UDP OpenVPN. Not sure why it has taken Mikrotik this long ☹. I am running remote phones which are registering to the hosted Astlinux box which has only a single interface (eth0). As an ipsec newbie, I wasn't sure what Local-Net to configure in Astlinux so I just added a tagged interface eth0.100 and used that. Is there a better way e.g. could I use a loopback as the Local-Net? Thanks all. Regards Michael Knill |
|
From: Michael K. <mic...@ip...> - 2019-11-09 21:32:36
|
Ah cool thanks Lonnie. I'm glad I asked
Regards
Michael Knill
On 10/11/19, 8:21 am, "Lonnie Abelbeck" <li...@lo...> wrote:
Hi Michael,
I use ...
-- /mnt/kd/rc.conf.d/user.conf snippet --
ASTERISK_DAHDI_DISABLE="yes"
--
It keeps Asterisk and DAHDI from starting.
Lonnie
> On Nov 9, 2019, at 1:37 PM, Michael Knill <mic...@ip...> wrote:
>
> Hi Group
>
> I use Astlinux at some sites purely as a firewall.
> I would like to turn off Asterisk on these boxes and wondering the best way of doing it in a standard Astlinux build.
>
> service asterisk stop in rc.elocal?
>
> Yes I know that I can create a custom build without Asterisk but I want to have a single standard build which is easier to manage.
>
> Thanks
>
> Regards
> Michael Knill
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Lonnie A. <li...@lo...> - 2019-11-09 21:21:09
|
Hi Michael, I use ... -- /mnt/kd/rc.conf.d/user.conf snippet -- ASTERISK_DAHDI_DISABLE="yes" -- It keeps Asterisk and DAHDI from starting. Lonnie > On Nov 9, 2019, at 1:37 PM, Michael Knill <mic...@ip...> wrote: > > Hi Group > > I use Astlinux at some sites purely as a firewall. > I would like to turn off Asterisk on these boxes and wondering the best way of doing it in a standard Astlinux build. > > service asterisk stop in rc.elocal? > > Yes I know that I can create a custom build without Asterisk but I want to have a single standard build which is easier to manage. > > Thanks > > Regards > Michael Knill > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
|
From: Michael K. <mic...@ip...> - 2019-11-09 19:37:42
|
Hi Group I use Astlinux at some sites purely as a firewall. I would like to turn off Asterisk on these boxes and wondering the best way of doing it in a standard Astlinux build. service asterisk stop in rc.elocal? Yes I know that I can create a custom build without Asterisk but I want to have a single standard build which is easier to manage. Thanks Regards Michael Knill |
|
From: Graham S. J. <gsj...@pt...> - 2019-10-31 21:27:51
|
Thanks for the pointers. A good start! -Graham- Michael Knill wrote on 29/10/2019 01:51: > Not a large site but I don't see any issues. > Use a SIP based PA vendor that is Asterisk certified e.g.: > Cyberdata - https://www.cyberdata.net/ > 2N - https://www.2n.cz/en_GB/products > > Regards > Michael Knill > > On 29/10/19, 11:28 am, "Graham S. Jarvis" <gsj...@pt...> wrote: > > Hello, > > does anyone have AstLinux connected to a PA system for paging/tannoy on a large > site? > > What hardware is involved? > > Thanks, > -Graham- > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... > > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
|
From: Lonnie A. <li...@lo...> - 2019-10-31 12:22:01
|
Release Candidate2 pre-1.3.7, please report any issues, ASAP. Same as previous "Release Candidate" except for adding a new feature: AstLinux integrated Wiki https://doc.astlinux-project.org/userdoc:tt_web_interface_wiki (Michael Keuter's idea, and he is using it for his customers) ==== The "AstLinux Pre-Release ChangeLog" and "Pre-Release Repository URL" entries can be found under the "Development" tab of the AstLinux Project web site ... AstLinux Project -> Development https://www.astlinux-project.org/dev.html "Development" tab feature for desktop browsers: Guest VM x86-64bit ISO: Download Pre-Release Guest VM Install ISO (Video Console) AstLinux Team |
|
From: Michael K. <mic...@ip...> - 2019-10-29 00:51:45
|
Not a large site but I don't see any issues. Use a SIP based PA vendor that is Asterisk certified e.g.: Cyberdata - https://www.cyberdata.net/ 2N - https://www.2n.cz/en_GB/products Regards Michael Knill On 29/10/19, 11:28 am, "Graham S. Jarvis" <gsj...@pt...> wrote: Hello, does anyone have AstLinux connected to a PA system for paging/tannoy on a large site? What hardware is involved? Thanks, -Graham- _______________________________________________ Astlinux-users mailing list Ast...@li... https://lists.sourceforge.net/lists/listinfo/astlinux-users Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
|
From: Graham S. J. <gsj...@pt...> - 2019-10-29 00:28:12
|
Hello, does anyone have AstLinux connected to a PA system for paging/tannoy on a large site? What hardware is involved? Thanks, -Graham- |
|
From: Lonnie A. <li...@lo...> - 2019-10-20 02:16:50
|
Release Candidate pre-1.3.7, please report any issues, ASAP.
The AstLinux Team is regularly upgrading packages containing security and bug fixes as well as adding new features of our own.
-- Linux Kernel 3.16.74 (version bump), security and bug fixes
-- genx86_64-vm board type, version bump VMware Tools to open-vm-tools 10.3.10
-- Asterisk 13.23.1 ('13se' version)
Older than latest Asterisk 13.x version but more tested, built --without-pjproject
Add json-integer-overflow patches.
Add security patches for: AST-2019-002, AST-2019-003
-- Asterisk 13.29.1 (version bump) and 16.6.1 (version bump)
New modules: app_attended_transfer.so, app_blind_transfer.so
-- OpenSSL, major version bump to 1.1.1d, the new LTS series. The previous 1.0.2 LTS series is EOL at the end of 2019.
Many packages needed version bumps or patches to be compatible with the new OpenSSL 1.1 API.
-- acme-client, version 2.8.1, add upstream patch from 2.8.3 to fix (important) Let's Encrypt CDN changes.
-- php, major version bump to 7.2.23, adds OpenSSL 1.1 compatibility
-- Web Interface Edit tab, add support for CodeMirror text editing.
(Tip: Shift-Reload browser to get the updated CSS style sheet)
Keyboard Actions: (after clicking text edit area)
Note: Windows users, use Ctrl instead of Cmd
Cmd-f -> Find
Cmd-g -> Find Next
Cmd-/ -> Toggle Comment
Cmd-. -> Toggle Comment
Tab -> Toggle between "fullscreen" (full-window) mode and normal
Esc -> Return to normal, "fullscreen" (full-window) mode off
More info: https://doc.astlinux-project.org/userdoc:tt_web_interface_edit_codemirror_key_map
-- Fossil, major version bump to 2.9, adds numerous enhancements to the look and feel of the web interface
-- arnofw (AIF), reload-blocklist-netset cron script, add new netset types
asterisk: Aggregate multiple Asterisk/SIP/VoIP blacklists, including blocklist_de_sip.
custom: Use variable BLOCKLIST_CUSTOM_URLS containing one or more (space/newline separated) URLs.
customv6: Use variable BLOCKLIST_CUSTOMV6_URLS containing one or more (space/newline separated) URLs.
More info: https://doc.astlinux-project.org/userdoc:tt_firewall_external_block_list#updating_netset_blocklists
-- arnofw (AIF), wireguard-vpn plugin, add support for WG->Local TCP/UDP INPUT policy firewall rules.
More info: https://doc.astlinux-project.org/userdoc:tt_wireguard_vpn#wireguard_configuration_options
-- iprange, version 1.0.4, new command, a tool capable of managing sets of IPs
-- WireGuard VPN, version bump to 0.0.20191012
-- Complete Pre-Release ChangeLog:
https://s3.amazonaws.com/beta.astlinux-project/astlinux-changelog/ChangeLog.txt
New Documentation Topics:
Edit tab w/CodeMirror Keyboard Mapping -
- https://doc.astlinux-project.org/userdoc:tt_web_interface_edit_codemirror_key_map
Updated Documentation Topics:
Firewall External Block List -
- https://doc.astlinux-project.org/userdoc:tt_firewall_external_block_list#updating_netset_blocklists
WireGuard VPN Configuration -
- https://doc.astlinux-project.org/userdoc:tt_wireguard_vpn#wireguard_configuration_options
WAN Failover -
- https://doc.astlinux-project.org/userdoc:tt_wan_failover#exit_action_script_optional
Web Interface Display Font -
- https://doc.astlinux-project.org/userdoc:tt_web_interface_font
The "AstLinux Pre-Release ChangeLog" and "Pre-Release Repository URL" entries can be found under the "Development" tab of the AstLinux Project web site ...
AstLinux Project -> Development
https://www.astlinux-project.org/dev.html
"Development" tab feature for desktop browsers:
Guest VM x86-64bit ISO: Download Pre-Release Guest VM Install ISO (Video Console)
AstLinux Team
|
|
From: Lonnie A. <li...@lo...> - 2019-10-13 13:33:21
|
Announcing Pre-Release Version: astlinux-1.3-4409-7d861a
Latest Asterisk and WireGuard updates.
Important Fix:
-- acme-client, version 2.8.1, add upstream patch from 2.8.3 to fix Let's Encrypt CDN changes.
The AstLinux Team is regularly upgrading packages containing security and bug fixes as well as adding new features of our own.
-- Linux Kernel 3.16.74 (version bump), security and bug fixes
-- genx86_64-vm board type, version bump VMware Tools to open-vm-tools 10.3.10
-- Asterisk 13.23.1 ('13se' version)
Older than latest Asterisk 13.x version but more tested, built --without-pjproject
Add json-integer-overflow patches.
Add security patches for: AST-2019-002, AST-2019-003
-- Asterisk 13.29.0 (version bump) and 16.6.0 (version bump)
New modules: app_attended_transfer.so, app_blind_transfer.so
-- OpenSSL, major version bump to 1.1.1d, the new LTS series. The previous 1.0.2 LTS series is EOL at the end of 2019.
Many packages needed version bumps or patches to be compatible with the new OpenSSL 1.1 API.
-- php, major version bump to 7.2.23, adds OpenSSL 1.1 compatibility
-- Web Interface Edit tab, add support for CodeMirror text editing.
(Tip: Shift-Reload browser to get the updated CSS style sheet)
Keyboard Actions: (after clicking text edit area)
Note: Windows users, use Ctrl instead of Cmd
Cmd-f -> Find
Cmd-g -> Find Next
Cmd-/ -> Toggle Comment
Cmd-. -> Toggle Comment
Tab -> Toggle between "fullscreen" (full-window) mode and normal
Esc -> Return to normal, "fullscreen" (full-window) mode off
More info: https://doc.astlinux-project.org/userdoc:tt_web_interface_edit_codemirror_key_map
-- Fossil, major version bump to 2.9, adds numerous enhancements to the look and feel of the web interface
-- arnofw (AIF), reload-blocklist-netset cron script, add new netset types
asterisk: Aggregate multiple Asterisk/SIP/VoIP blacklists, including blocklist_de_sip.
custom: Use variable BLOCKLIST_CUSTOM_URLS containing one or more (space/newline separated) URLs.
customv6: Use variable BLOCKLIST_CUSTOMV6_URLS containing one or more (space/newline separated) URLs.
More info: https://doc.astlinux-project.org/userdoc:tt_firewall_external_block_list#updating_netset_blocklists
-- arnofw (AIF), wireguard-vpn plugin, add support for WG->Local TCP/UDP INPUT policy firewall rules.
More info: https://doc.astlinux-project.org/userdoc:tt_wireguard_vpn#wireguard_configuration_options
-- iprange, version 1.0.4, new command, a tool capable of managing sets of IPs
-- WireGuard VPN, version bump to 0.0.20191012
-- Complete Pre-Release ChangeLog:
https://s3.amazonaws.com/beta.astlinux-project/astlinux-changelog/ChangeLog.txt
New Documentation Topics:
Edit tab w/CodeMirror Keyboard Mapping -
- https://doc.astlinux-project.org/userdoc:tt_web_interface_edit_codemirror_key_map
Updated Documentation Topics:
Firewall External Block List -
- https://doc.astlinux-project.org/userdoc:tt_firewall_external_block_list#updating_netset_blocklists
WireGuard VPN Configuration -
- https://doc.astlinux-project.org/userdoc:tt_wireguard_vpn#wireguard_configuration_options
Web Interface Display Font -
- https://doc.astlinux-project.org/userdoc:tt_web_interface_font
The "AstLinux Pre-Release ChangeLog" and "Pre-Release Repository URL" entries can be found under the "Development" tab of the AstLinux Project web site ...
AstLinux Project -> Development
https://www.astlinux-project.org/dev.html
"Development" tab feature for desktop browsers:
Guest VM x86-64bit ISO: Download Pre-Release Guest VM Install ISO (Video Console)
AstLinux Team
|
|
From: Michael K. <mic...@ip...> - 2019-10-06 20:18:43
|
Thanks Guys for your help.
I think I'm nearly there, I just need some more pieces to the puzzle.
I guess I need to weigh up whether I try to get this working or just build my own firewall in a VM using Astlinux or something else (currently sounds tempting).
Regards
Michael Knill
On 5/10/19, 11:06 pm, "Michael Keuter" <li...@mk...> wrote:
> Am 05.10.2019 um 14:48 schrieb Lonnie Abelbeck <li...@lo...>:
>
> Hi Michael,
>
> Sorry, I can't help much with strongSwan.
>
> You will want to enable NAT-T (UDP transport) and you possibly may not need Virtual IP's as routing the local LAN's from each box may work.
>
> That's all my strongSwan knowledge. Using "IPsec Peers" is easier, but requires static IP endpoints all around unless you use certificates as tunnel identity.
>
> Sadly, internet research is your best option configuring strongSwan.
>
> Lonnie
Hi Michael,
we implemented strongSwan because of the massive distribution of the AVM Fritzbox routers here in Germany (and other parts of Europe) to support their internal IPsec VPN.
But it is quite complicated and no fun - garanteed. If you do need really need it for specific reasons, I would suggest to use OpenVPN or WireGuard instead!
>> On Oct 4, 2019, at 10:04 PM, Michael Knill <mic...@ip...> wrote:
>>
>> Hi Group
>>
>> I need to set up IPSEC tunnels from multiple Astlinux Clients to an Astlinux Server (initial testing). Eventually the server will be VMware NSX.
>> I'm looking at all the config examples and have spent ages trying to understand how it works but I'm still not quite there. Sorry for my inexperience with IPSEC.
>>
>> I want to use strongSwan and the scenario is as follows:
>> • Server is Astlinux (initially for testing) with a static Public IP
>> • Clients require access to the server side LAN to Asterisk servers
>> • There is no connectivity between IPSEC tunnels.
>> • The Client is Astlinux with failover e.g. multiple paths which may or may not be behind NAT
>> • No access to the Client local LAN is required e.g. only to the local Astlinux box itself
>>
>> My assumption is that I will need to use Virtual IP’s but I am not sure how to set this up?
>> They will all need to be static as well e.g. not negotiated.
>>
>> Can anyone kick me off.
>> Thanks so much all.
>>
>> Regards
>> Michael Knill
Michael
http://www.mksolutions.info
_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Michael K. <mic...@ip...> - 2019-10-06 19:35:42
|
Thanks Lonnie
Yes I should have created them as separate certs. Thanks for this.
I understand your point and yes I agree, however I am extremely time poor and this has bought me some of it.
Regards
Michael Knill
On 6/10/19, 11:14 pm, "Lonnie Abelbeck" <li...@lo...> wrote:
Hi Michael,
> Is this all I need to do?
The acme.sh deploy script is here:
https://github.com/astlinux-project/astlinux/blob/master/package/acme/deploy/astlinux.sh#L42
For lighttpd, the values of HTTPSCERT and HTTPSCHAIN can be determined by running this one-line script on your system:
--
( . /etc/rc.conf ; echo "HTTPSCERT=$HTTPSCERT" ; echo "HTTPSCHAIN=$HTTPSCHAIN" )
--
Quite a few services can use ACME certificates, as seen in the astlinux.sh deploy script.
Michael, acme.sh has been fixed upstream and we now include that fix in the AstLinux Github repo and pre-release images.
This situation will not be the last time where an included package needs an immediate update ... it does not happen often, but it does and will happen again.
Lonnie
> On Oct 6, 2019, at 1:59 AM, Michael Knill <mic...@ip...> wrote:
>
> Hi Group
>
> I'm bringing up this thread again in light of the hassle with ACME Cert generation in the current stable release.
> I thought I would try out a cheap Comodo Wildcard SSL Cert as I get 30 days money back guarantee.
>
> It appears to now be working fine with a direct replacement of webinterface.pem & https_ca_chain.pem and a Lighttpd restart.
> Is this all I need to do?
>
> Other than an update in a year, which looks pretty easy to do, does anyone see any issues with this?
> I may even decide to go back to ACME then if things are running ok.
>
> Regards
> Michael Knill
>
> From: Lonnie Abelbeck <li...@lo...>
> Reply to: AstLinux List <ast...@li...>
> Date: Thursday, 11 April 2019 at 12:34 am
> To: AstLinux List <ast...@li...>
> Subject: Re: [Astlinux-users] ACME (Let's Encrypt) Certificates Vs Wildcard SSL certificates
>
> Hi Michael,
>
>
>> but the way I see it is that we could just purchase a Wildcard SSL certificate instead of using ACME which seems a bit of a hassle.
>> Am I correct?
>
>
> IMO, using automatic ACME certs in AstLinux is the least-hassle approach ... after the initial setup.
>
> The hassle with a 1-2 year Wildcard SSL cert (other than the cost) is it needs to be deployed and updated to all the boxes, even if only every 1-2 years. You would need to create some sort of CRON script to do that, and probably with authentication.
>
> If you go through the trouble of creating a Wildcard SSL cert deploy/update system, you just as well mint your own Let's Encrypt Wildcard Certs at a central location, at no cost every two months.
>
> You need to weigh the pros/cons for your situation, I use Cloudflare for my ACME DNS validation, and after many renewals for many boxes using non-wildcard certs, it just works.
>
> Lonnie
>
>
>
>
>
>> On Apr 10, 2019, at 5:34 AM, Michael Knill <mic...@ip...> wrote:
>>
>> Hi Group
>>
>> As I am looking to encourage the use of web portals that we have built into Astlinux, I am having to consider the use of non self signed certificates to stop the browser complaining.
>> The web interface for all our systems is accessible with <customer id>.ibcaccess.net.
>> Forgive me for my ignorance but I'm not that good with SSL certificates but the way I see it is that we could just purchase a Wildcard SSL certificate instead of using ACME which seems a bit of a hassle.
>> Am I correct?
>>
>> Regards
>> Michael Knill
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li...
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Lonnie A. <li...@lo...> - 2019-10-06 12:14:07
|
Hi Michael, > Is this all I need to do? The acme.sh deploy script is here: https://github.com/astlinux-project/astlinux/blob/master/package/acme/deploy/astlinux.sh#L42 For lighttpd, the values of HTTPSCERT and HTTPSCHAIN can be determined by running this one-line script on your system: -- ( . /etc/rc.conf ; echo "HTTPSCERT=$HTTPSCERT" ; echo "HTTPSCHAIN=$HTTPSCHAIN" ) -- Quite a few services can use ACME certificates, as seen in the astlinux.sh deploy script. Michael, acme.sh has been fixed upstream and we now include that fix in the AstLinux Github repo and pre-release images. This situation will not be the last time where an included package needs an immediate update ... it does not happen often, but it does and will happen again. Lonnie > On Oct 6, 2019, at 1:59 AM, Michael Knill <mic...@ip...> wrote: > > Hi Group > > I'm bringing up this thread again in light of the hassle with ACME Cert generation in the current stable release. > I thought I would try out a cheap Comodo Wildcard SSL Cert as I get 30 days money back guarantee. > > It appears to now be working fine with a direct replacement of webinterface.pem & https_ca_chain.pem and a Lighttpd restart. > Is this all I need to do? > > Other than an update in a year, which looks pretty easy to do, does anyone see any issues with this? > I may even decide to go back to ACME then if things are running ok. > > Regards > Michael Knill > > From: Lonnie Abelbeck <li...@lo...> > Reply to: AstLinux List <ast...@li...> > Date: Thursday, 11 April 2019 at 12:34 am > To: AstLinux List <ast...@li...> > Subject: Re: [Astlinux-users] ACME (Let's Encrypt) Certificates Vs Wildcard SSL certificates > > Hi Michael, > > >> but the way I see it is that we could just purchase a Wildcard SSL certificate instead of using ACME which seems a bit of a hassle. >> Am I correct? > > > IMO, using automatic ACME certs in AstLinux is the least-hassle approach ... after the initial setup. > > The hassle with a 1-2 year Wildcard SSL cert (other than the cost) is it needs to be deployed and updated to all the boxes, even if only every 1-2 years. You would need to create some sort of CRON script to do that, and probably with authentication. > > If you go through the trouble of creating a Wildcard SSL cert deploy/update system, you just as well mint your own Let's Encrypt Wildcard Certs at a central location, at no cost every two months. > > You need to weigh the pros/cons for your situation, I use Cloudflare for my ACME DNS validation, and after many renewals for many boxes using non-wildcard certs, it just works. > > Lonnie > > > > > >> On Apr 10, 2019, at 5:34 AM, Michael Knill <mic...@ip...> wrote: >> >> Hi Group >> >> As I am looking to encourage the use of web portals that we have built into Astlinux, I am having to consider the use of non self signed certificates to stop the browser complaining. >> The web interface for all our systems is accessible with <customer id>.ibcaccess.net. >> Forgive me for my ignorance but I'm not that good with SSL certificates but the way I see it is that we could just purchase a Wildcard SSL certificate instead of using ACME which seems a bit of a hassle. >> Am I correct? >> >> Regards >> Michael Knill >> _______________________________________________ >> Astlinux-users mailing list >> Ast...@li... >> https://lists.sourceforge.net/lists/listinfo/astlinux-users >> >> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
|
From: Michael K. <mic...@ip...> - 2019-10-06 07:00:24
|
Hi Group I'm bringing up this thread again in light of the hassle with ACME Cert generation in the current stable release. I thought I would try out a cheap Comodo Wildcard SSL Cert as I get 30 days money back guarantee. It appears to now be working fine with a direct replacement of webinterface.pem & https_ca_chain.pem and a Lighttpd restart. Is this all I need to do? Other than an update in a year, which looks pretty easy to do, does anyone see any issues with this? I may even decide to go back to ACME then if things are running ok. Regards Michael Knill From: Lonnie Abelbeck <li...@lo...> Reply to: AstLinux List <ast...@li...> Date: Thursday, 11 April 2019 at 12:34 am To: AstLinux List <ast...@li...> Subject: Re: [Astlinux-users] ACME (Let's Encrypt) Certificates Vs Wildcard SSL certificates Hi Michael, but the way I see it is that we could just purchase a Wildcard SSL certificate instead of using ACME which seems a bit of a hassle. Am I correct? IMO, using automatic ACME certs in AstLinux is the least-hassle approach ... after the initial setup. The hassle with a 1-2 year Wildcard SSL cert (other than the cost) is it needs to be deployed and updated to all the boxes, even if only every 1-2 years. You would need to create some sort of CRON script to do that, and probably with authentication. If you go through the trouble of creating a Wildcard SSL cert deploy/update system, you just as well mint your own Let's Encrypt Wildcard Certs at a central location, at no cost every two months. You need to weigh the pros/cons for your situation, I use Cloudflare for my ACME DNS validation, and after many renewals for many boxes using non-wildcard certs, it just works. Lonnie On Apr 10, 2019, at 5:34 AM, Michael Knill <mic...@ip...> wrote: Hi Group As I am looking to encourage the use of web portals that we have built into Astlinux, I am having to consider the use of non self signed certificates to stop the browser complaining. The web interface for all our systems is accessible with <customer id>.ibcaccess.net. Forgive me for my ignorance but I'm not that good with SSL certificates but the way I see it is that we could just purchase a Wildcard SSL certificate instead of using ACME which seems a bit of a hassle. Am I correct? Regards Michael Knill _______________________________________________ Astlinux-users mailing list Ast...@li... https://lists.sourceforge.net/lists/listinfo/astlinux-users Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... _______________________________________________ Astlinux-users mailing list Ast...@li... https://lists.sourceforge.net/lists/listinfo/astlinux-users Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
63 messages has been excluded from this view by a project administrator.
