Forums - All Forums

ipv6 bind config

Mon, 23 Jan 2012 22:29:22 -0700

; bind config:
zone "e.f.a.c.7.0.6.2.ip6.arpa" {
type master;
file "zones/reverse/e.f.a.c.7.0.6.2.ip6.arpa.dns";
}

; Delegates 2607:cafe::/48 to dns1.customer.com and dns2.customer.com

; zone file:
$TTL 1d
@ IN SOA isp.com. helpdesk.isp.com. (
2012012300 ; serial
1h ; refresh 1hour
15m ; retry 15m
30d ; Expire
10m ) ; negative caching

IN NS dns01.isp.com.
IN NS dns02.isp.com.

2.0.0.0 IN NS dns1.customer.com.
IN NS dns2.customer.com.

My 851w home router config

Tue, 29 Jun 2010 11:48:49 -0600

Now with WPA2!!

Code:

!

! Last configuration change at 10:10:29 MST Tue Jun 29 2010 by rbaxter

! NVRAM config last updated at 10:10:30 MST Tue Jun 29 2010 by rbaxter

!

version 12.4

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

service password-encryption

service sequence-numbers

!

hostname 851baxterit

!

boot-start-marker

boot-end-marker

!

logging buffered 4096

enable secret xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

!

aaa new-model

!

!

aaa group server radius rad_mac

!

aaa group server radius rad_acct

!

aaa group server radius rad_admin

!

aaa group server tacacs+ tac_admin

!

aaa group server radius rad_pmip

!

aaa group server radius dummy

!

aaa group server radius rad_eap

 server 10.10.10.1 auth-port 1645 acct-port 1646

!

aaa authentication login local_authen local

aaa authentication login eap_methods group rad_eap

aaa authentication login mac_methods local

aaa authorization exec local_author local 

aaa authorization ipmobile default group rad_pmip 

aaa accounting network acct_methods start-stop group rad_acct

!

!

aaa session-id common

clock timezone MST -7

!

crypto pki trustpoint TP-self-signed-3527475230

 enrollment selfsigned

 subject-name cn=IOS-Self-Signed-Certificate-3527475230

 revocation-check none

 rsakeypair TP-self-signed-3527475230

!

!

crypto pki certificate chain TP-self-signed-3527475230

 certificate self-signed 01

umm no

      quit

dot11 syslog

!

dot11 ssid baxterIT

   vlan 1

   authentication open 

   authentication key-management wpa

   wpa-psk ascii 7 xxxxxxxxxxxxxxxxxxxxxxxx

!

no ip source-route

no ip dhcp use vrf connected

!

ip dhcp pool sdm-pool

   import all

   network 10.10.10.0 255.255.255.0

   default-router 10.10.10.1 

   domain-name baxterit.net

   dns-server 129.128.5.233 129.128.76.233 

!

!

ip cef

no ip bootp server

no ip domain lookup

ip domain name baxterit.net

!

parameter-map type regex sdm-regex-nonascii

 pattern [^\x00-\x80]

!

!

!

spanning-tree portfast bpduguard

username rbaxter privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

! 

!

archive

 log config

  hidekeys

!

!

ip tcp synwait-time 10

!

bridge irb

!

!

interface Tunnel0

 description Hurricane Electric IPv6 Tunnel Broker

 no ip address

 tunnel source 96.51.7.208

 tunnel destination 216.218.226.238

!

interface FastEthernet0

 description Linksys SD2008

!

interface FastEthernet1

 description Popcorn Hour

 spanning-tree portfast

!

interface FastEthernet2

 description Unused

 spanning-tree portfast

!

interface FastEthernet3

 description Unused

 spanning-tree portfast

!

interface FastEthernet4

 description Telus

 ip dhcp client update dns

 ip address dhcp hostname gw.baxterit.net

 ip nat outside

 ip virtual-reassembly

 duplex auto

 speed auto

!

interface Dot11Radio0

 description Wireless

 no ip address

 no ip redirects

 no ip unreachables

 no ip proxy-arp

 ip flow ingress

 ip flow egress

 no ip route-cache cef

 ip route-cache flow

 beacon period 20

 beacon dtim-period 1

 !

 encryption vlan 1 mode ciphers aes-ccm 

 !

 ssid baxterIT

 !

 speed basic-36.0 basic-48.0 basic-54.0

 station-role root

 world-mode dot11d country CA both

 no cdp enable

 bridge-group 1

 bridge-group 1 subscriber-loop-control

 bridge-group 1 spanning-disabled

 bridge-group 1 block-unknown-source

 no bridge-group 1 source-learning

 no bridge-group 1 unicast-flooding

!

interface Dot11Radio0.1

 encapsulation dot1Q 1 native

 no cdp enable

 bridge-group 1

 bridge-group 1 subscriber-loop-control

 bridge-group 1 block-unknown-source

 no bridge-group 1 source-learning

 no bridge-group 1 unicast-flooding

!

interface Vlan1

 description default

 no ip address

 ip tcp adjust-mss 1452

 bridge-group 1

!

interface BVI1

 description $ES_LAN$

 ip address 10.10.10.1 255.255.255.0

 ip nat inside

 ip virtual-reassembly

!

ip forward-protocol nd

ip route 67.10.232.0 255.255.255.0 Null0

ip route 72.51.48.0 255.255.255.0 Null0

!

ip http server

ip http access-class 3

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

ip nat inside source list 1 interface FastEthernet4 overload

ip nat inside source static tcp 10.10.10.4 22 174.0.147.140 22 extendable

ip nat inside source static tcp 10.10.10.4 53 174.0.147.140 53 extendable

ip nat inside source static udp 10.10.10.4 53 174.0.147.140 53 extendable

ip nat inside source static tcp 10.10.10.4 2086 174.0.147.140 2086 extendable

ip nat inside source static tcp 10.10.10.4 2087 174.0.147.140 2087 extendable

ip nat inside source static udp 10.10.10.1 161 174.0.147.140 9161 extendable

ip nat inside source static tcp 10.10.10.4 10161 174.0.147.140 10161 extendable

ip nat inside source static udp 10.10.10.4 10161 174.0.147.140 10161 extendable

!

ip access-list extended SDM_HTTPS

 remark SDM_ACL Category=1

 permit tcp any any eq 443

ip access-list extended SDM_SHELL

 remark SDM_ACL Category=1

 permit tcp any any eq cmd

ip access-list extended SDM_SSH

 remark SDM_ACL Category=1

 permit tcp any any eq 22

!

access-list 1 remark SDM_ACL Category=3

access-list 1 permit 10.10.10.0 0.0.0.255

access-list 2 remark HTTP Access-class list

access-list 2 remark SDM_ACL Category=1

access-list 2 permit 10.10.10.0 0.0.0.7

access-list 2 deny   any

access-list 3 remark HTTP Access-class list

access-list 3 remark SDM_ACL Category=1

access-list 3 permit 10.10.10.0 0.0.0.7

access-list 3 deny   any

access-list 102 remark VTY Access-class list

access-list 102 remark SDM_ACL Category=1

access-list 102 permit ip 10.10.10.0 0.0.0.7 any

access-list 102 deny   ip any any

access-list 103 remark SDM_ACL Category=0

access-list 103 permit ip any host 10.10.10.3

access-list 106 remark SDM_ACL Category=0

access-list 106 permit ip any host 10.10.10.3

access-list 107 remark SDM_ACL Category=0

access-list 107 permit ip any host 10.10.10.3

access-list 108 remark SDM_ACL Category=0

access-list 108 permit ip any host 10.10.10.3

access-list 111 remark SDM_ACL Category=0

access-list 111 permit ip any host 10.10.10.3

access-list 166 deny   ip 207.46.0.0 0.0.255.255 any log

snmp-server community xxxxxxxxxxxxxxx RO

snmp-server location Sylvan Lake, AB

snmp-server contact burn

no cdp run

radius-server attribute 32 include-in-access-req format %h

radius-server vsa send accounting

!

control-plane

!

bridge 1 protocol ieee

bridge 1 route ip

banner login 

Authorized access only!

alias exec spc show proc cpu | exclude 0.00

!

line con 0

 access-class 1 in

 login authentication local_authen

 no modem enable

 transport output telnet

line aux 0

 access-class 1 in

 login authentication local_authen

 transport output telnet

line vty 0 2

 access-class 1 in

 privilege level 15

 password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

 authorization exec local_author

 login authentication local_authen

 transport input ssh

line vty 3 4

 access-class 102 in

 password 7 xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

 authorization exec local_author

 login authentication local_authen

 transport input ssh

!

scheduler max-task-time 5000

scheduler allocate 4000 1000

scheduler interval 500

sntp server 216.194.70.2

end

ip2asn

Mon, 14 Dec 2009 05:58:20 -0700

ip2asn.tcl

Code:

set ip2asn_trigger "!"

set ip2asn_ver "0.0.1"

set ip2asn_script "|/home/devil/scripts/ip2asn.pl"

bind pub - ${ip2asn_trigger}ip2asn pub:ip2asn

proc pub:ip2asn {nick uhost hand chan arg} {

        global ip2asn_trigger ip2asn_ver ip2asn_script

        set option [string tolower [lindex [split $arg] 0]]

        set fh [open "$ip2asn_script $arg" "r"]

        while {![eof $fh]} {

                set line [gets $fh]

                if {[string length $line] > 0} {

                        putserv "PRIVMSG $chan :$line"

                }

        }

        close $fh

}

putlog "TCL loaded: ip2asn.tcl v$ip2asn_ver by Popdog "

ip2asn.pl

Code:

#!/usr/bin/perl

#

# Protected under the PopGPL License version 2.2.4.popdog-r8

# Copyright March 2, 2006

#

# Written by Popdog

# Popdog 

#

#

# Some useful query flags:

#

#       Whois   Netcat          Action

#       -p      prefix          include matching prefix

#       -q      noprefix        disable matching prefix (default)

#       -c      countrycode     include matching country code

#       -d      nocountrycode   disable country codes (default)

#       -n      asname          include asnames (default)

#       -o      noasname        disable asnames

#       -r      registry        display matching registry

#       -s      noregistry      disable registry display (default)

#       -a      allocdate       enable allocation date

#       -b      noallocdate     disable allocation date (default)

#       -t      truncate        truncate asnames (default)

#       -u      notruncate      do not truncate asnames

#       -v      verbose         enable all flags (-c -r -p -a -u -a)

#       -h      help            this help message

#

use warnings;

use strict;

if (@ARGV != 1 && $ARGV[0] !~ /^\d+\.\d+\.\d+\.\d+$/) {

    print STDERR "usage: ip2asn A.B.C.D\n";

    exit 1;

}

print `/usr/bin/whois -h whois.cymru.com " -u -a $ARGV[0]"`;

#

servermanager.pl

Thu, 19 Nov 2009 14:49:55 -0700

Code:

#!/usr/bin/perl

$filename = "serverlist.txt";

# $username = 'admin';

$username = 'root';

menu();

#execute();

sub menu {

        print "Enter root password: ";

        chomp($password = );

        print "Choose an option:\n\n";

        print "1) Generate list of servers to act on.\n";

        print "2) Execute a command on all servers in $filename.\n";

        print "3) Copy some files over to all servers in $filename.\n";

        print "\n";

        print "9) Exit\n";

        print "\n";

        print "Your choice: ";

        chomp($menuitem = );

        if ($menuitem == 1) {

                genlist();

        } elsif ($menuitem == 2) {

                execute();

        } elsif ($menuitem == 3) {

                copy();

        } elsif ($menuitem == 9) {

                return;

        } else {

                print "ERROR: That menu item is not available.\n";

                menu();

        }

}

sub genlist {

        print "Choose an option:\n\n";

        print "1) All RaQ Servers\n";

        print "2) All Ensim Servers\n";

        print "\n";

        print "Your choice: ";

        chomp($menuitem = );

        if ($menuitem == 1) {

                gen_all_server(1);

        } elsif ($menuitem == 2) {

                gen_all_server(2);

        } else {

                print "ERROR: That menu item is not available.\n";

                genlist();

        }

}

sub gen_all_server {

        $servertype = $_[0];

        if ($servertype == 1) {

                $OSID = 1;

        } elsif ($servertype == 2) {

                $OSID = '4 OR OSID = 10 OR OSID = 11';

        } else {

                die "ERROR: Unknown server type.\n";

        }

        use DBI;

        $dbh = DBI->connect('DBI:mysql:STEGGI', 'steggi', "");

        $sql = "select Hostname from HostServer where (OSID=$OSID) and Active='yes'";

        $res=$dbh->prepare($sql);

        $res->execute;

        while (@line=$res->fetchrow_array) {

                $servername = $line[0];

                # print $servername . "\n";

                $tofile .= "$servername\n";

        }

        open (SERVERLIST, ">$filename");

        print SERVERLIST $tofile;

        print "$filename written to.\n";

        close (SERVERLIST);

}

sub execute {

        if (!-e $filename) {

                die "$filename does not exist.  Create it first.\n";

        } else {

                open (SERVERLIST, "$filename");

                @f = ;

                close (SERVERLIST);

                $numservers = @f;

                print "$numservers servers to act on.\n";

                print "What command? ";

                chomp($command = );

                # Log the command.

                open (HISTORYFILE, ">>serverhistory.txt");

                print HISTORYFILE "$command\n";

                close (HISTORYFILE);

                use MIME::Base64;

                use Net::SSH::Perl;

                $params{'options'} = ([ "UserKnownHostsFile .ssh/known_hosts" ]);

                # Using user and pw from above

                open (SESAME, ">serveroutput.txt");

                foreach (@f) {

                        chomp;

                        $hostname = lc($_);

                        $fqdn = $hostname . "";

                        my $ssh = Net::SSH::Perl->new("$fqdn", %params);

                        $ssh->login("$username", "$password");

                        my($stdout, $stderr, $exit) = $ssh->cmd("$command");

                        $out .= "\n|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|\n";

                        $out .= "Hostname:$fqdn\n";

                        $out .= "stdout is:\n";

                        $out .= "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\|";

                        $out .= $stdout;

                        $out .= "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\|";

                        $out .= "stderr is:\n";

                        $out .= "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\|";

                        $out .= $stderr;

                        $out .= "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\|";

                        $out .= "exit is:\n";

                        $out .= "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\|";

                        $out .= $exit;

                        $out .= "\n=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\|";

                        print $out;

                        print SESAME $out;

                        $out = '';

                }

                print "\n|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|:|\n";

                close (SESAME);

        }

}

sub copy {

        open (SERVERLIST, "$filename");

        @servers = ;

        close (SERVERLIST);

        $numservers = @servers;

        print "$numservers servers to act on. ( ";

        foreach (@servers) {

                chomp;

                print $_;

                print " ";

        }

        print ")\n";

        print "Enter all the filenames, separated by a space: ";

        chomp ($filenames = );

        @filename_array = split ' ', $filenames;

        # using pw from above

        use MIME::Base64;

        use Net::SSH::Perl;

        $params{'options'} = ([ "UserKnownHostsFile .ssh/known_hosts" ]);

        $params{'debug'} = true;

        $params{'compression'} = true;

        foreach (@servers) {

                chomp;

                $hostname = lc($_);

                $fqdn = $hostname . "";

                print "Doing $fqdn\n";

                my $ssh = Net::SSH::Perl->new("$fqdn", %params);

                $ssh->login("$username", "$password");

                # Iterate over each file to be copied.

                foreach (@filename_array) {

                        $nameoffile = $_;

                        open FH, $nameoffile or die "Can't open $nameoffile: $!";

                        my $c = do { local $/;  };

                        close FH or die "Can't close $nameoffile: $!";

                        my($out, $err, $exit) = $ssh->cmd("umask 177; cat - >$nameoffile", $c);

                        die "Can't write file $nameoffile: $err" if $err;

                }

        }

}

index generator

Thu, 19 Nov 2009 14:48:34 -0700

Code:

#!/bin/sh



# Description: script that creates index.html files for use with publicfile

# Author: petre rodan 



ROOT_DIR=/home/burn/web/eggdrop

INDEX="index.html"



###########################################



cd ${ROOT_DIR}



add_header() {

        cat << EOF > ${1}/${INDEX}





eggdrop files repository














 `basename ${1}` 


EOF

}



add_dirs() {



        echo '
/
../
' >> ${1}/${INDEX}

        find ${1} -maxdepth 1 -xdev -type d -exec bash -c 'echo \{}\\' \; | sed "s|${1}/||g"| sed "s|${1}||g"| sort --dictionary-order --ignore-nonprinting >> ${1}/${INDEX}



}



add_files() {



        find ${1} -maxdepth 1 -xdev -type f -exec bash -c 'echo \{}\\' \; | sed "s|${1}/||g"| sed "s|${1}||g"| grep -v htaccess | grep -v ${INDEX}| sort --dictionary-order --ignore-nonprinting >> ${1}/${INDEX}



}



add_footer() {

        cat << EOF >> ${1}/${INDEX}








 `du -S --max-depth=0 -h ${1} | cut -f1` in `cat ${1}/${INDEX} | grep href | grep -v 'class="dir"' | grep -v ${INDEX} |wc -l` files 






EOF

}





create_index()

{



        [ `ls -1 --sort=time ${1}/* | head -n1 | grep "${INDEX}"` ] && return 0



        echo " * $1: refreshing"

        add_header $1

        add_dirs $1

        add_files $1

        add_footer $1

}



for dir in `find ${ROOT_DIR} -type d`; do

        create_index $dir

        chmod 644 ${dir}/${INDEX}

done

pidlock.sh

Thu, 19 Nov 2009 14:29:20 -0700

stop recurring cron jobs from crashing into each other. =)

Code:

need a pid for a running app?

have a cron that may take some time and you don't want a buttload of them running at the same time? then this may be of some use to you. =)

[code]#!/bin/bash

if [ "$1" == "-l" ]; then

        PIDDIR="${2}"

        shift 2

else

        if [ -z "${USER}" ]; then

                if [ -n "${LOGNAME}" ]; then

                        USER="${LOGNAME}"

                else

                        echo "\$USER is not set!"

                        exit -2

                fi

        fi

        PIDDIR=/tmp/${USER}

        mkdir -p ${PIDDIR}

        ERR=$?

        chmod 700 ${PIDDIR}

        ERR=$((${ERR}+$?))

        if [ "${ERR}" -gt 0 ]; then

                echo "Some error in creating the PIDDIR!"

                exit -3

        fi

fi

if [ -z "$1" ]; then

        echo "Error! You need to specify a command to run!"

        exit -1

fi

MYPID=$$

MYNAME=`basename $0`-`basename $1`

PIDFILE=${PIDDIR}/${MYNAME}.pid

if [ -f "${PIDFILE}" ]; then

        OLDPID=$(< ${PIDFILE})

        INUSE=`ps -ef |  grep $OLDPID | grep -v "grep $OLDPID" | xargs | cut -d' ' -f2`

        if [ -z "${INUSE}" ]; then

                #echo "Stale pidfile detected. Removing"

                rm ${PIDFILE}

        else

                #echo "ERROR! Running already!"

                echo "Warning! '$MYNAME' is running already!"

                exit 0

        fi

fi

#echo "Not running already, putting PID in pidfile"

echo ${MYPID} >${PIDFILE}

CMD="$*"

#echo "Doing something (${CMD})"

eval ${CMD}

#echo "Cleaning up ${PIDFILE}"

[/code]

named.conf / bind.conf

Thu, 19 Nov 2009 14:25:20 -0700

Well, after hours of searching google and fucking around with my own name server, I've come to the conclusion that either A: google blows goats or B: no one has posted a decent named.conf that makes sense. I'm leaning towards B as google is god.
On that note, here is my named.conf. Some things to consider, I run named in a chroot, so some things may differ if your not doing the same. (nothing should but it's worth mentioning.)

Code:

acl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12; };

options {

        directory "/var/bind";

        version "umm, how about no";

        //forward first;

        forwarders {

                127.0.0.1;

        };

        listen-on {

                216.194.67.33;

                127.0.0.1;

        };

        // to allow only specific hosts to use the DNS server:

        //allow-query {

        //      127.0.0.1;

        //};

        pid-file "/var/run/named/named.pid";

        statistics-file "/var/log/named.stats";

        zone-statistics yes;

        blackhole { bogusnets; };

        allow-recursion { 127.0.0.1; };

};

zone "." IN {

        type hint;

        file "named.ca";

};

zone "localhost" IN {

        type master;

        file "pri/localhost";

        allow-update { none; };

        notify no;

};

zone "127.in-addr.arpa" IN {

        type master;

        file "pri/127.zone";

        allow-update { none; };

        notify no;

};

Now for the explanation of what the above is.
You can setup bogus networks, (ip blocks that aren't/shouldn't be in use) this I have done with acl, courtesy of imbezol.
version will will give that exact response if someone checks to see which bind version you are using.
The rest is pretty standard. The above zone format is what i consider the long format, and it's a pain in the ass to add/manage multiple domain names in one shot if you need to make a change. Below is an easier way of setting up zones:

Code:

zone "bluedevil.ca" IN { type master; file "pri/bluedevil.ca"; allow-transfer { 142.179.195.171; 68.147.154.85; }; };

zone "euphoric.ca" IN { type master; file "pri/euphoric.ca"; allow-transfer { 142.179.195.171; 68.147.154.85; }; };

Much simpler in my opinion.
BIND is incredibly anal when it comes to the format of it's config files. Which is a good thing. I always use named-checkconf to check my config before reloading named. It works fairly well.

Samba: no username/password - public share config.

Thu, 19 Nov 2009 14:22:47 -0700

Seeing as I lost mine and spent a significant portion of time rewriting the fucking thing trying to get it to work, and google really sucked in this case. Here is my config, some things here and there have been removed for security, but it's mostly all the same shiz. Oh, and I've included a rough description of what each tidbit does, well, here and there, the odd ones anyway

Questions/comments? let me know.

Code:

[global]

        workgroup = Lego

        netbios name = reverb

        server string =

        log file = /var/log/samba/log.%m

        max log size = 250

        #Allow which IP's to see the samba server. 192.168.1. allows 192.168.1.0/24

        hosts allow = 192.168.1.

        hosts deny = ALL

        #this server will be the master for the LEGO workgroup

        local master = yes

        wins support = no

        preserve case = yes

        security = user

        username map = /etc/samba/smbusers

        encrypt passwords = yes

        smb passwd file = /etc/samba/private/smbpasswd

        socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192

        #Specify which interface samba will run on, this can also be specified as an ip address

        interfaces = eth0

        #Binds to the specified interface only, this is not needed if you only have one interface

        bind interfaces only = yes

        dns proxy = no

        map to guest = Bad User

        guest account = guest

        load printers = No

        #Will stomp other servers that attempt to be the preferred master

        preferred master = yes

        os level = 255

[homes]

        browseable = no

        writable = yes

        guest ok = no

        create mask = 644

[server]

        comment = file server

        guest ok = yes

        printable = no

        browseable = yes

        path = /srv

        public = yes

        writable = no

the smbusers file contains this:
nobody = guest pcguest smbguest
for the guest account mapping

make sure to add the guest user as well, otherwise this won't work at all
smbpasswd -a -n guest

That's it, you should have a working samba config with no username or password required to access /srv (change this to whatever it is your sharing) and anyone that accesses this share can't write anywhere, it's meant to be that way, if you want an uploads dir or something, make one :shock:

gentoo rsyncd in a ramdrive

Thu, 19 Nov 2009 14:21:18 -0700

here's all da code for running a gentoo rsync in a ramdrive. kernel requirements are not included.

/opt/gentoo-rsync/rsync-ramfs-gentoo-portage.sh

Code:

#!/bin/bash

RSYNC="/usr/bin/rsync"

OPTS="--quiet --recursive --links --perms --times --devices --compress --delete --timeout=600"

SRC="rsync://masterrsync.gentoo.org/gentoo-portage"

DST="/opt/gentoo-rsync/portage/"

RAMFS_SRC="/opt/gentoo-rsync/portage/"

RAMFS_DST="/opt/gentoo-rsync/portage-ramfs/"

echo "Started update at" `date` >> /var/log/`basename $0`.log 2>&1

logger -t rsync "re-rsyncing the gentoo-portage tree to hard drive"

${RSYNC} ${OPTS} ${SRC} ${DST} >> /var/log/`basename $0`.log 2>&1

echo "Started update at" `date` >> /var/log/`basename $0`.log 2>&1

logger -t rsync "re-rsyncing the gentoo-portage tree from hdd to ramfs"

${RSYNC} ${OPTS} ${RAMFS_SRC} ${RAMFS_DST} >> /var/log/`basename $0`.log 2>&1

echo "End: "`date` >> /var/log/`basename $0`.log 2>&1

# some nasty cleaning stuff to kill stale PIDs

/bin/kill -9 `/bin/ps --no-headers -Crsync -o etime,user,pid,command | /bin/grep "nobody\|rsync" | /bin/grep "[0-9]\{2\}:[0-9]\{2\}:" |/bin/awk '{print $3}'`

ulimit -s unlimited

/etc/init.d/local.start

Code:

mount -t ramfs ramfs /opt/gentoo-rsync/portage-ramfs 1>&2

/opt/gentoo-rsync/scripts/rsync-ramfs-gentoo-portage.sh

/etc/rsync/rsync.conf

Code:

uid = rsync

gid = rsync

use chroot = yes

max connections = 100

pid file = /var/run/rsyncd.pid

motd file = /etc/rsync/rsyncd.motd

transfer logging = no

log format = %t %a %m %f %b

syslog facility = local3

timeout = 300

[gentoo-x86-portage]

#this entry is for compatibility

path = /opt/gentoo-rsync/portage-ramfs

comment = Gentoo Linux Portage tree

dont compress = *

[gentoo-portage]

#modern versions of portage use this entry

path = /opt/gentoo-rsync/portage-ramfs

comment = Gentoo Linux Portage tree mirror

exclude = distfiles

dont compress = *

#end of portage modules

/etc/crontab entry

Code:

0,30 * * * *  root /opt/gentoo-rsync/scripts/rsync-ramfs-gentoo-portage.sh

boot_notify.sh

Thu, 19 Nov 2009 14:19:51 -0700

Code:

#!/bin/bash

    #

    #*******************************************************************

    PATH=/usr/sbin:/usr/bin:/sbin:/bin

    SRVNM=`uname -n`

    # The next variable can be set for multiple addresses

    # (i.e. jsmith at yahoo.com,jsmith at hotmail.com)

    MAILADD=putz@somedomain.com

    mail $MAILADD -s "Boot of $SRVNM" <
    From: $0

    To: $MAILADD

    Subject: Boot of $SRVNM

    $SRVNM has booted up.

    If this is news to you, please investigate.

    `date`

    `/usr/local/bin/sysinfo281.05.pl`

    `ifconfig`

    EOF

    exit 0

vpenis

Thu, 19 Nov 2009 14:11:37 -0700

Code:

#!/bin/sh

echo -n "`hostname`'s vpenis: "

echo `uptime|grep days|sed 's/.*up \([0-9]*\) day.*/\1\/10+/'; cat /proc/cpuinfo|grep '^cpu MHz'|awk '{print $4"/30 +";}';free|grep '^Mem'|awk '{print $3"/1024/3+"}'; df -P -k -x nfs -x smbfs | grep -v '(1k|1024)-blocks' | awk '{if ($1 ~ "/dev/(scsi|sd)"){ s+= $2} s+= $2;} END {print s/1024/50"/15+70";}'`|bc|sed 's/\(.$\)/.\1cm/'

fast-rdns.pl

Thu, 19 Nov 2009 14:10:44 -0700

Code:

#!/usr/local/bin/perl5.8.5

# fast-rdns.pl -  rdns-scan the living shit out of other networks

# V1.0  - 20060729

# V1.01 - 20060731 chop off trailing dot in output of all hostnames

# V1.02 - 20060809 only return PTR records, not CNAME (classless delegations)

# V1.1  - 20070211 accept single IP numbers and entire /8 (was /9) as argument, check sanity of argument

#                  add -b (batch mode) and -w (write-to-file) output modes

# V1.2  - 20070430 new -i and -s options (the latter remains to be tested on machines with multiple IPs)

# V1.3  - 20070810 new -p and -d options

# fast rDNS scanner - (C)2006,2007 Kai Schlichting/spamshield.org

#       no warranties

#       no liabilities

#       this program is a loaded, unsecured firearm with hairline trigger

#       this program will negatively effect or destroy everything it gets in contact with

#          when run - including, but not limited to the universe its presently in

#       you've been warned.

use Net::DNS;   # if you don't have this, you are not the target audience for this program

use Net::CIDR;  # 'perl -MCPAN -e shell' and enter 'install Net::CIDR' if you don't have this

select(STDOUT); $| = 1; # unbuffered output

# DNS resolver parameters

my $retries = 4; # number of tries

my $retrans = 3; # retransmission interval in secs

my $timeout_block = 10; # don't take longer than this for any answer in entire /24

# my $timeout = 6; # UDP timeout

my $interval = 1; # chunking interval

my $block;

local $res;

my $net;

my $prefix;

local $loop_inc = 1; # default

local $verbose = 1; # default

my $Usage = "usage: $0 [-w] [-q] [-i ] [-t ] [-p port] [-d server] [-s src_ip] [-b ] [-f ] [network/prefix]\n" .

                "\tnetwork/prefix example: 192.168.0.0/24 will scan 192.168.0.0 - 192.168.0.255\n" .

                "\t-q : do not print errors like SERVFAIL or TIMEOUT\n" .

                "\t-t  : timeout in seconds for for any given lookup: \(default:$timeout_block\)\n" .

                "\t-i  : wait time before checking for anwers in /24 block \(default:$interval\)\n" .

                "\t-f  : will look up every Nth \(default:1\) IP, only\n" .

                "\t-b  : Batch mode. Implies -w . Read network/prefixes list from  only.\n" .

                "\t-s src_ip : use given source IP for queries\n" .

                "\t-p port : ask resolvers on specified UDP port (default: 53)\n" .

                "\t-d server : IP address of server to use for resolution\n" .

                "\t-w : write output to files in current working directory.\n" .

                "\t     Example: 192.168.0.0/24 will be written to 192.168.0.0_24.rdns\n" ;

use Getopt::Std;

my %opts;

getopts('qf:t:b:ws:i:p:d:', %opts) or die $Usage;

$loop_inc = $opt_f if $opt_f;

$verbose = 0 if $opt_q;

$timeout_block = $opt_t if $opt_t;

$file_in = $opt_b if $opt_b;

# $opt_w is true for -w mode

$interval = $opt_i if $opt_i;

$src_ip = $opt_s if $opt_s;

$dst_server = "67.18.254.5";

$dst_server = $opt_d if $opt_d;

if ($opt_p) {

        $dst_port = $opt_p;

} else {

        $dst_port = 53;

}

my $netblock;

my @lines;

if ($opt_b) {

        # we are in batch mode

        if (-r $file_in) {

                print "Starting in batch mode, reading from file $file_in\n";

                if ( open (FH, "< $file_in") ) {

                        my $line;

                        while ($line = ) {

                                chomp $line;

                                # print "Read from file: $line\n";

                                push @lines, $line;

                        }

                        close FH;

                } else {

                        die "Tried to open, but can't read file $file_in\n";

                }

        } else {

                die "Input file $file_in is not readable for you - permissions?\n";

        }

} else {

        # no batchmode - use netblock given on command line

        if ($#ARGV != 0) {

                print $Usage;

                exit 1;

        }

        push @lines,$ARGV[0] ; # our list is only the command-line argument

}

if ($dst_server) {

        $res = Net::DNS::Resolver->new(

                nameservers => [$dst_server],

                recurse => 1,

                retry => $retries,

                retrans => $retrans,

                # udp_timeout => $timeout,

                persistent_udp => 1,

                srcaddr => $src_ip,

                port => $dst_port,

                );

} else {

        $res = Net::DNS::Resolver->new(

                recurse => 1,

                retry => $retries,

                retrans => $retrans,

                # udp_timeout => $timeout,

                persistent_udp => 1,

                srcaddr => $src_ip,

                port => $dst_port,

                );

}

NETBLOCK:

foreach $netblock (@lines) {

        ($net,$prefix) = split ('/',$netblock);

        unless ($net =~ /^\d+\.\d+\.\d+\.\d+$/) {

                print "$net is not an IP or network number - skipping $netblock\n";

                next NETBLOCK;

        }

        if ($prefix == 0) {

                # it's a host

                $prefix = 32;

                $netblock .= "/32";

        }

        if ($prefix < 8) {

                print "Scanning blocks larger than /8 not supported: $netblock skipped.";

                next NETBLOCK;

        }

        if ($prefix > 32) {

                print "What do you mean, with /$prefix? $netblock skipped";

                next NETBLOCK;

        }

        print "Now working on: $net/$prefix\n";

        if (($opt_b) || ($opt_w) ) {

                # output to file

                my $out_file = $net."_".$prefix.".rdns";

                if (open (FH , "> $out_file")) {

                        print "Writing output to $out_file\n" if $verbose;

                } else {

                        print "Could not open file for output: $out_file - skipping $netblock\n";

                        next NETBLOCK;

                }

                select (FH); $| = 1; # unbuffered output

        }

        print STDOUT "# Stepping through $netblock every $loop_inc IPs\n" if $verbose;

        if ($opt_b || $opt_w) {

                print "# Stepping through $netblock every $loop_inc IPs\n" if $verbose;

        }

        my $s_time = time;

        &explode_range($netblock); # recursive explosion of CIDR block

        my $elap = (time) - $s_time;

        print STDOUT "# Took $elap seconds to scan $netblock with stepsize $loop_inc\n" if $verbose;

        if ($opt_b || $opt_w) {

                print "# Took $elap seconds to scan $netblock with stepsize $loop_inc\n" if $verbose;

        }

        if ($opt_b || $opt_w) {

                select (STDOUT); # switch back

                close FH;

        }

} # foreach $netblock

exit 0;

##############

sub explode_range {

 my $block = $_[0];

 my ($network,$prefix) = split ('/',$block);

 my @list;

 my $net;

 my $loc;

 my $ans;

 my @query;

 my @query_in;

 my $out;

 my $data;

 my $start;

 my $loop_x;

 if ($prefix < 17) {

        # getting a list of "A.B" (/16) prefixes out of this

        @list = Net::CIDR::cidr2octets($block);

        foreach $net (@list) {

                # print "Exploding block $block to /24's\n";

                &explode_range("$net.0.0/17"); # that'll get us /24's

                &explode_range("$net.128.0/17"); # that'll get us /24's

        }

        return 0;

 }

 if ($prefix < 24) {

        # getting a list of "A.B.C" (/24) prefixes out of this

        @list = Net::CIDR::cidr2octets($block);

        foreach $net (@list) {

                # print "Exploding $block to /24's\n";

                &explode_range("$net.0/24"); # that'll get us /24's

        }

        return 0;

 }

 if ($prefix == 24) {

        # generate list of 256 /32's

        if ( $network =~ /^(\d+\.\d+\.\d+)\.(\d+)$/ ) {

                my $net = $1; # the first 3 octets: A.B.C

                @list = Net::CIDR::cidr2octets("$net.0/25");

                push @list, Net::CIDR::cidr2octets("$net.128/25");

        }

 } else {

         # ok, we are at the lowest level (/25 or longer prefix - will get all /32's

         @list = Net::CIDR::cidr2octets($block);

 }

 # send all queries in background /w async DNS

 $loop_x = 1; # skip possible IPs

 QUERY:

 foreach $net (@list) {

        $loop_x -= 1;

        if (! $loop_x) {

                # do this run, reset counter

                $loop_x = $loop_inc;

        } else {

                # skip this run

                next QUERY;

        }

        if ( $net =~ /^(\d+\.\d+\.\d+)\.(\d+)$/ ) {

                $loc = $2; # last octet

                # print "working: octet $loc, sending query $net\n";

                $query_in[$loc] = $net;

                $query[$loc] = $res->bgsend($net);

        } else {

                print "# could not extract last octet from IP $net\n" if $verbose;

        }

 }

 $start = time;

 # now retrieve DNS answers - sending hopefully took at least as long to get the answers

 $loop_x = 1; # skip possible IPs

 RESOLVE:

 foreach $net (@list) {

        $loop_x -= 1;

        if (! $loop_x) {

                # do this run, reset counter

                $loop_x = $loop_inc;

        } else {

                # skip this run

                next RESOLVE;

        }

        $net =~ /^(\d+\.\d+\.\d+)\.(\d+)$/ ;

        $loc = $2;

        while (! $res->bgisready($query[$loc]) ) {

                # print "Still waiting for query $loc\n";

                if ( ( ( (time) - $start ) ) >= $timeout_block ) {

                        # print "aborting wait for query $net\n";

                        print "$net  (ERROR:TIMEOUT)\n" if $verbose;

                        next RESOLVE;

                }

                sleep $interval;

        }

        $ans = $res->bgread($query[$loc]);

        # $ans->print; # debug from hell

        if (defined $ans) {

                my $had_any = 0;

                foreach $out ($ans->answer) {

                        my $type = $out->type;

                          # print "$loc: type: $type\n";

                          # @txt = $out->string;

                        unless ($type eq "PTR")  {

                                # it's a CNAME record (classful delegation) - skip this, we get the PTR as the next answer

                                next;

                        }

                        my @txt = $out->rdatastr;

                        foreach $data (@txt) {

                                # print "$query_in[$loc]: type: $type data: $data\n";

                                $data =~ s/\.$// ;

                                print "$net  $data\n";

                                $had_any = 1;

                        }

                }

                unless ($had_any) {

                        my $err = $res->errorstring;

                        if ($err eq "NXDOMAIN") {

                                # print "$net\n";

                        } else {

                                print "$net  (ERROR:$err)\n" if $verbose;

                        }

                }

        } else {

                my $err = $res->errorstring;

                if ($err eq "NXDOMAIN") {

                        # print "$net\n";

                } else {

                        print "$net  (ERROR:$err)\n" if $verbose;

                }

                # print "$net  (SRVFAIL)\n";

        }

 }

}

########################

My 1811w home router config

Thu, 19 Nov 2009 14:08:25 -0700

Code:

Current configuration : 10490 bytes

!

! Last configuration change at 16:50:29 MST Sun Nov 15 2009 by rootme

!

version 15.0

service nagle

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

service password-encryption

service sequence-numbers

!

hostname gw

!

boot-start-marker

boot-end-marker

!

logging buffered 4096

enable secret 5 #############################

!

aaa new-model

!

!

aaa group server radius rad_eap

!

aaa group server radius rad_mac

!

aaa group server radius rad_acct

!

aaa group server radius rad_admin

!

aaa group server tacacs+ tac_admin

!

aaa group server radius rad_pmip

!

aaa group server radius dummy

!

aaa authentication login local_authen local

aaa authentication login eap_methods group rad_eap

aaa authentication login mac_methods local

aaa authorization exec local_author local

aaa authorization ipmobile default group rad_pmip

!

!

!

!

!

aaa session-id common

!

!

!

clock timezone MST -7

!

crypto pki trustpoint TP-self-signed-2547479397

**removed*!

!

crypto pki certificate chain TP-self-signed-2547479397

**removed*

        quit

dot11 syslog

!

dot11 ssid baxterit

 max-associations 7

 authentication open

 guest-mode

 wpa-psk ascii 7 101951495247425954537C

!

no ip source-route

!

!

no ip dhcp use vrf connected

ip dhcp excluded-address 10.10.10.1 10.10.10.12

!

ip dhcp pool home-pool

   import all

   network 10.10.10.0 255.255.255.0

   default-router 10.10.10.1

   dns-server 64.59.184.13 64.59.184.15 64.59.135.133 64.59.135.135

   domain-name baxterit.net

   netbios-name-server 10.10.10.4

   lease 7

!

!

ip cef

no ip bootp server

ip domain name baxterit.net

no ipv6 cef

!

multilink bundle-name authenticated

!

!

!

license udi pid CISCO1811W-AG-A/K9 sn FHK111011P7

archive

 log config

  hidekeys

!

spanning-tree portfast bpduguard

username rootme **removed*

!

!

!

class-map match-any HOME-Transactional-1

 match  dscp af21

 match  dscp af22

 match  dscp af23

class-map match-any HOME-Signaling-1

 match  dscp cs3

 match  dscp af31

class-map match-any HOME-Routing-1

 match  dscp cs6

class-map match-any HOME-Management-1

 match  dscp cs2

!

!

policy-map HOME-QoS-Policy-2

policy-map HOME-QoS-Policy-1

 class HOME-Signaling-1

    bandwidth percent 5

 class HOME-Routing-1

    bandwidth percent 5

 class HOME-Management-1

    bandwidth percent 5

 class HOME-Transactional-1

    bandwidth percent 5

 class class-default

    fair-queue

     random-detect

!

!

!

!

bridge irb

!

!

!

!

interface Tunnel0

 description Hurricane Electric IPv6 Tunnel Broker

 no ip address

 ipv6 address 2001:470:A:116::2/64

 ipv6 enable

 tunnel source MY_IP

 tunnel mode ipv6ip

 tunnel destination 216.218.226.238

 !

!

interface Dot11Radio0

 description Wireless

 no ip address

 ip flow ingress

 ip flow egress

 no ip route-cache cef

 no ip route-cache

 beacon period 20

 beacon dtim-period 1

 !

 encryption key 1 size 40bit 7 511A13062545 transmit-key

 encryption mode wep mandatory

 !

 ssid baxterit

 !

 speed basic-36.0 basic-48.0 basic-54.0

 station-role root

 world-mode dot11d country CA both

 no cdp enable

 bridge-group 1

 bridge-group 1 subscriber-loop-control

 bridge-group 1 spanning-disabled

 bridge-group 1 block-unknown-source

 no bridge-group 1 source-learning

 no bridge-group 1 unicast-flooding

 !

!

interface Dot11Radio1

 no ip address

 beacon period 30

 !

 encryption key 1 size 40bit 7 0F7F5D623C70 transmit-key

 encryption mode wep mandatory

 !

 ssid baxterit

 !

 speed basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0

 station-role root

 world-mode dot11d country CA both

 bridge-group 1

 bridge-group 1 subscriber-loop-control

 bridge-group 1 spanning-disabled

 bridge-group 1 port-protected

 bridge-group 1 block-unknown-source

 no bridge-group 1 source-learning

 no bridge-group 1 unicast-flooding

 !

!

interface FastEthernet0

 description Shaw

 mac-address 001b.dead.beef

 ip dhcp client update dns

 ip address dhcp hostname gw.baxterit.net

 ip nat outside

 ip virtual-reassembly

 duplex auto

 speed auto

 !

 service-policy output HOME-QoS-Policy-2

!

interface FastEthernet1

 no ip address

 shutdown

 duplex auto

 speed auto

 !

!

interface FastEthernet2

 description Downstairs

 !

!

interface FastEthernet3

 description Parents comp (jessica)

 !

!

interface FastEthernet4

 !

!

interface FastEthernet5

 !

!

interface FastEthernet6

 !

!

interface FastEthernet7

 switchport mode trunk

 !

!

interface FastEthernet8

 !

!

interface FastEthernet9

 !

!

interface Vlan1

 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$

 no ip address

 ip tcp adjust-mss 1452

 ip policy route-map webtraffic-redirect

 bridge-group 1

 !

!

interface Async1

 no ip address

 encapsulation slip

 !

!

interface BVI1

 description $ES_LAN$

 ip address 10.10.10.1 255.255.255.0

 ip nat inside

 ip virtual-reassembly

 !

!

ip forward-protocol nd

ip http server

ip http access-class 3

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

!

ip flow-top-talkers

 top 50

 sort-by bytes

 cache-timeout 30000

!

ip dns server

ip nat inside source list 1 interface FastEthernet0 overload

ip nat inside source static tcp 10.10.10.5 20 MY_IP 20 extendable

ip nat inside source static tcp 10.10.10.5 21 MY_IP 21 extendable

ip nat inside source static tcp 10.10.10.4 22 MY_IP 22 extendable

ip nat inside source static udp 10.10.10.5 53 MY_IP 53 extendable

ip nat inside source static udp 10.10.10.2 69 MY_IP 69 extendable

ip nat inside source static tcp 10.10.10.4 80 MY_IP 80 extendable

ip nat inside source static tcp 10.10.10.5 2087 MY_IP 2087 extendable

ip nat inside source static tcp 10.10.10.2 3389 MY_IP 3389 extendable

ip nat inside source static udp 10.10.10.2 161 MY_IP 6161 extendable

ip nat inside source static udp 10.10.10.4 8161 MY_IP 8161 extendable

ip nat inside source static udp 10.10.10.1 161 MY_IP 9161 extendable

ip nat inside source static udp 10.10.10.5 161 MY_IP 10161 extendable

ip nat inside source static udp 10.10.10.12 161 MY_IP 12161 extendable

ip route 70.74.189.110 255.255.255.254 Null0

!

ip access-list extended HOME_HTTPS

 remark HOME_ACL Category=1

 permit tcp any any eq 443

 remark HOME_ACL Category=1

ip access-list extended HOME_SHELL

 remark HOME_ACL Category=1

 permit tcp any any eq cmd

 remark HOME_ACL Category=1

ip access-list extended HOME_SSH

 remark HOME_ACL Category=1

 permit tcp any any eq 22

 remark HOME_ACL Category=1

!

access-list 1 remark HOME_ACL Category=3

access-list 1 permit 10.10.10.0 0.0.0.255

access-list 2 remark HTTP Access-class list

access-list 2 remark HOME_ACL Category=1

access-list 2 permit 10.10.10.0 0.0.0.7

access-list 2 deny   any

access-list 3 remark HTTP Access-class list

access-list 3 remark HOME_ACL Category=1

access-list 3 permit 10.10.10.0 0.0.0.7

access-list 3 deny   any

access-list 102 remark VTY Access-class list

access-list 102 remark HOME_ACL Category=1

access-list 102 permit ip 10.10.10.0 0.0.0.7 any

access-list 102 deny   ip any any

access-list 102 remark VTY Access-class list

access-list 102 remark HOME_ACL Category=1

access-list 103 remark HOME_ACL Category=0

access-list 103 permit ip any host 10.10.10.3

access-list 103 remark HOME_ACL Category=0

access-list 106 remark HOME_ACL Category=0

access-list 106 permit ip any host 10.10.10.3

access-list 106 remark HOME_ACL Category=0

access-list 107 remark HOME_ACL Category=0

access-list 107 permit ip any host 10.10.10.3

access-list 107 remark HOME_ACL Category=0

access-list 108 remark HOME_ACL Category=0

access-list 108 permit ip any host 10.10.10.3

access-list 108 remark HOME_ACL Category=0

access-list 111 remark HOME_ACL Category=0

access-list 111 permit ip any host 10.10.10.3

access-list 111 remark HOME_ACL Category=0

access-list 166 deny   ip 207.46.0.0 0.0.255.255 any log

ipv6 route ::/0 Tunnel0

!

!

!

!

snmp-server community COMMUNITY_STRING RO

snmp-server location Sylvan Lake, AB

snmp-server contact burn

!

!

control-plane

 !

!

bridge 1 protocol ieee

bridge 1 route ip

alias exec spc show proc cpu | exclude 0.00

banner motd ^C

Access to this device or the attached

networks is prohibited without express written permission.

Violators will be prosecuted to the fullest extent of both civil

and criminal law.

We don't like you. Go away.

^C

!

line con 0

line 1

 modem InOut

 stopbits 1

 speed 115200

 flowcontrol hardware

line aux 0

line vty 0 2

 access-class 1 in

 privilege level 15

 password 7 #############################

 authorization exec local_author

 login authentication local_authen

 transport input ssh

line vty 3 4

 access-class 102 in

 password 7 ###########################

 authorization exec local_author

 login authentication local_authen

 transport input ssh

!

!

webvpn context Default_context

 ssl authenticate verify all

 !

 no inservice

!

end