Cisco IOU with web interface

What is IOU? IOU stands for IOS on Unix, special versions of IOS, which can be run as x86 services. These IOS versions are very light weight, they need less memory and CPU than GNS3 (or dynamips).

I had some problems during the installation of Cisco IOU, so I will show you how to do that easily. We will use IOU with a web interface (iou-web).

1. First of all, you will need a 32bit version of debian (or ubuntu, gentoo, whatever linux). If they are 32bit systems, your life will be better, trust me.

2. Then download the iou-web interface files from here. Download the latest .deb file and install it:

sudo dpkg -i <iou-web_version>

If it needs some dependencies, type:

sudo apt-get install -f
sudo dpkg -i <iou-web_version>

If everything is OK, the iou-web files are installed in /opt/iou.

So now you have the web interface working. Lets install the IOU! (For the IOU files, please use google!)

3. Install 'libcrypto' library:

sudo apt-get install libssl1.0.0
sudo apt-get install libssl0.9.8

4. You will need libcrypto.so.4, but it is not installable, so you will hack it a little: create a symlink:

sudo ln -s /lib/libcrypto.so.1.0.1e /usr/lib/libcrypto.so.4

5. You will need to install the license, you will find some information in the downloads.

6. Navigate to the web interface in your browser and choose 'Manage' menu, then 'manage IOSes'. Here you van upload the .bin files. After uploading them, you can create your own lab in the 'Laboratories' menu with the 'Add new lab' button.

References:

http://www.routereflector.com/cisco/cisco-iou-web-interface/
http://ciscoiseasy.blogspot.hu/2014/07/iou-forbidden-fruit.html

Postfix behind Iptables masquerade (NAT)

I've been working on a mail server behind iptables masquerade for some days, and it just didn't work, but I found the solution, it may help you.

If you use SMTP server behind NAT, and you get the following errors:

• mail postfix/smtp[7854]: warning: host gmail-smtp-in.l.google.com[173.194.70.26]:25 greeted me with my own hostname mail.example.com
• mail for gmail.com loops back to myself

you should check your iptables configuration. A proper port-forward config:

iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d PUBLICIP --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -t nat -A PREROUTING -p tcp --dport 25 -i eth0 -j DNAT --to MAILSERVERPRIVATEIP:25

(Only forward packets from port 25 to your mail server's private IP port 25, if it comes from the outside.)

You can test it on your mail server by telnetting to a foreign smtp server for example:

telnet smtp.gmail.com 25

It should show:

Trying 173.194.70.108...
Connected to gmail-smtp-msa.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP r54sm45040303eev.8 - gsmtp

If you see


220- mail.yourdomain.com gsmtp

you config is not good yet.

STEAMCMD Segmentation fault

If you use SteamCMD on Hardened Gentoo, you need some additional security configuration otherwise it will throw:

./steam.sh: line 67: 22525 Segmentation fault ${DEBUGGER}

"${STEAMROOT}"/${PLATFORM}/${STEAMEXE} "$@"

It throws because of PaX. PaX is a security layer of hardened gentoo, which helps to prevent some attacks. We will user paxctl, For more informations:

man paxctl

So first, go to steamcmd (usually it's in /ga/me/folder/steam/linux32)

cd /ga/me/folder/steam/linux32

You can check pax flags:

paxctl -v steamcmd

PaX control v0.7

Copyright 2004,2005,2006,2007,2009,2010,2011,2012 PaX Team <pageexec@freemail.hu>

Then you need to set up some flags:

-x: disable RANDEXEC
-e: disable EMUTRMA

paxctl -ex steamcmd

Then check flags:

paxctl -v steamcmd

PaX control v0.7

Copyright 2004,2005,2006,2007,2009,2010,2011,2012 PaX Team <pageexec@freemail.hu> 

- PaX flags: -------x-e-- [steamcmd]

RANDEXEC is disabled EMUTRAMP is disabled

Update:
Keep in mind: If you update steam, you have to do this again! (The updater will download a new steamcmd, so there will be no PaX headers!)

Gentoo: Apache does not interpreting PHP

If you use Gentoo/CentOS with Apache2 and PHP, and PHP is not interpreted, you should do the followings:

Open Apache2's configurations:
nano /etc/conf.d/apache2

Change the line:
APACHE2_OPTS="-D DEFAULT_VHOST -D INFO -D SSL -D SSL_DEFAULT_VHOST -D LANGUAGE -D PHP5 -D USERDIR"

After changing the line, don't forget to restart Apache:
/etc/init.d/apache2 restart

Now it should work!