More thoughts on Minecraft, compression and encryption

So earlier, I had touched on Minecraft, and lamented on how it doesn’t compress its network data very well.  Well, it turns out that yes, in the server.properties file, there is an option network-compression-threshold, which by default is set to 256, meaning packets larger than 256bytes are compressed

network-compression-threshold=256

Using this quick stunnel guide, I thought I’d try a quick experiment.  So, I loaded up Titan City, and ran some connection experiments:

First, the Minecraft server with a setting of 256000000 which I would imagine effectively turns off compression.  I’m capturing one minutes worth of game play as it tries to render the spawn point.  Then again with the threshold set to 256:

12M 28 Apr 13:44 minecraft-nocompression.cap
1.6M 28 Apr 13:46 minecraft-256compression.cap

So, uncompressed it’s 12MB worth of data!  While with the Minecraft compression on, it’s 1.6 MB worth of data.

And now with stunnel using zlib compression, we get the following results:

2.1M 28 Apr 13:42 stunnel-nocompressioninserver.cap
1.5M 28 Apr 13:48 stunnel-256compression.cap

2.1MB worth of traffic relying on zlib in this case to do all the compression, and 1.5MB with zlib compressing the Minecraft compression.  And for the heck of it, why not compress the data again?
964K 28 Apr 13:46 minecraft-256compression.cap.gz
993K 28 Apr 13:44 minecraft-nocompression.cap.gz
938K 28 Apr 13:48 stunnel-256compression.cap.gz
1.5M 28 Apr 13:42 stunnel-nocompressioninserver.cap.gz

Well, now that is strange, why is the stunnel traffic even compressible, after it’s been encrypted?  Kind of weird to me. At any rate, here is some more data thanks to the capinfos program:
# capinfos *cap
File name: minecraft-nocompression.cap
File type: Wireshark/tcpdump/… – pcap
File encapsulation: Ethernet
Packet size limit: file hdr: 1520 bytes
Number of packets: 14 k
File size: 12 MB
Data size: 12 MB
Capture duration: 59 seconds
Start time: Tue Apr 28 13:43:30 2015
End time: Tue Apr 28 13:44:29 2015
Data byte rate: 211 kBps
Data bit rate: 1,689 kbps
Average packet size: 844.05 bytes
Average packet rate: 250 packets/sec
SHA1: ffb5542c47da69ddc93da902136e1173d76b56e0
RIPEMD160: bc2102185a924096a8cf145c54375a05ab90e3c6
MD5: ba0e1addfcb36e7db6314764941fa6af
Strict time order: True

File name: minecraft-256compression.cap
File type: Wireshark/tcpdump/… – pcap
File encapsulation: Ethernet
Packet size limit: file hdr: 1520 bytes
Number of packets: 10 k
File size: 1,686 kB
Data size: 1,524 kB
Capture duration: 54 seconds
Start time: Tue Apr 28 13:45:28 2015
End time: Tue Apr 28 13:46:22 2015
Data byte rate: 28 kBps
Data bit rate: 226 kbps
Average packet size: 150.91 bytes
Average packet rate: 187 packets/sec
SHA1: 5b5e51f53f0716fd84a39120afd68eadbfaf9816
RIPEMD160: f2bf3839c084b1d7b31fce0a8a8ce959316643a7
MD5: dc6f56a5a1c10e642548e0eeb979629b
Strict time order: True

And now let’s look at the stunnel captures:

File name: stunnel-nocompressioninserver.cap
File type: Wireshark/tcpdump/… – pcap
File encapsulation: Ethernet
Packet size limit: file hdr: 1520 bytes
Number of packets: 9,949
File size: 2,159 kB
Data size: 1,999 kB
Capture duration: 59 seconds
Start time: Tue Apr 28 13:41:13 2015
End time: Tue Apr 28 13:42:12 2015
Data byte rate: 33 kBps
Data bit rate: 270 kbps
Average packet size: 201.02 bytes
Average packet rate: 168 packets/sec
SHA1: 418cc249c3393d85e6e59a6e02c02060b7b7ce4f
RIPEMD160: bf7f56af412734260e0e96d1a0c7d2f28be3ba95
MD5: 1b96fce1db9d38d8dbbecf9bb2278079
Strict time order: True

File name: stunnel-256compression.cap
File type: Wireshark/tcpdump/… – pcap
File encapsulation: Ethernet
Packet size limit: file hdr: 1520 bytes
Number of packets: 9,585
File size: 1,554 kB
Data size: 1,401 kB
Capture duration: 59 seconds
Start time: Tue Apr 28 13:47:35 2015
End time: Tue Apr 28 13:48:34 2015
Data byte rate: 23 kBps
Data bit rate: 189 kbps
Average packet size: 146.21 bytes
Average packet rate: 162 packets/sec
SHA1: 19b2bbfff8cd9c5c0e460d64ad0f4b966cf3a141
RIPEMD160: e31c226101daea9327a8b13a4a1012a24bea11c1
MD5: a7b4b0d5ecf3e6a472255cff13466b51
Strict time order: True

Well for me this is still interesting.  The stunnel connection sent less packets, and smaller.  I know that this is horrible to ‘measure’ like this, and yes none of the datasets are the same, making this kind of bogus. However, honestly compressing with stunnel does feel faster.

So, want to try?  I guess I can let people try if they want, but you’ll need stunnel.  I’ve read horror stories on griefers and I figure if i raise the bar to connect it’ll be somewhat distractionless.

So here is my stunnel.conf I’m using on the client side.

client = yes
compression = zlib
foreground = yes
debug = 6

[minecraft]
accept = 127.0.0.1:25565
connect = virtuallyfun.com:25566
cert = minecraft.pem

And of course, you need my certificate pair, so here is minecraft.pem:

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEArvdyw5UGic3wCDowzGM/ZVdaCrnDFeo8SmkP1jJGIhsAzzMV
+56Ctd98raKPnw5nnEtrmV7yImBiF/A32SPbYF6nqBhNKPbrUg4u4dsr9uyo7/F4
00VMcXbcgwc+pDOU5uUCg7hZcmCGolVs+7GxC3R1m8SbPZYvlgcHHJXdnEKL8RG8
z54B2L1Ai76CYlD6Q94QnQxiJricy8DJJP6/ZuqkGg01AcoaCaTOa8mvZMLkBFkj
Ase0aX0nSDRxNkBBe/hgwkRuFWaMI1iGgTCX9J1rogLg2WfZoGIFtuYp8jnwiNQQ
dEM6TTGURm9iqb78pBd6PwWsFBqOa0GLOEzLzwIDAQABAoIBAAz8/373VBnsuLHT
qAW0JGOgfWWobov07G7Vp8BN0Rj9Ci1XbH1WQfvAUGAPXjv/dL+MdbtX6f+VShLe
2TZ8S++2dxmqXCf7VHKt7NsFSxk0bkIJmd+NGGSf3zS21/aWgao2O96NU86CzdvF
Hab9hNgF2CktCh0jRfsMIIIFugK8amQGxpKrseSXuuyWGHNW2a6TIHBJRD1L2DQA
GMVgmpb43aYQHYqeQLmgP40PkJgByazQRV40zqsap1DBxNi2TnDjLUWufKACDM64
RPltM8lZm3H2yqVQEQ2yGbzoEuwVysG5+AlDOCVcbDtQqcj5sV/gzL8X+e6DgV+0
o46pZgkCgYEA5QGN+73cApm1OkjsV1OW7RR22EmGWT9HeFFGReWSBsVoDh/dFjIJ
/KtE7PbafvMcV8JMTzbSxBElc+nPFsRk8J4W+JD3Bluw0MfU1K+AUEmPsj5bX6O6
9Mv8/n8HVhpUusIFvO7K7HutdxxNOis510AtRL8oA6NFkiUBot5KGUMCgYEAw5c1
UVT+N9nciFKopgJlzfcb60SKy60vtWd3eQOuLuRd+1QhF3VpUzTAvwbLARuYdlYM
gIaKcOb7A2+ZNKNCccwP6lTIDEwQuQ3lDyG3KXzHfHocZV4n5uT2SpKLv5NzZlF5
4ealpD5pPwN2c4zpvRDeweWznNahUVngYxma5IUCgYEAvac68eg7g3/OYZWw/WVB
kdgn0FmbxN+uDcupWguUkrz7vu7OhyorsTAZ5fFN5GLr7xX/Yn7xr+TPUp6onZ9K
RSd3uKU9nutilJVaAkXSCyvQsHoJ7DvJgiBJxm5nIfyufPhgDibosU5/yywKHQld
XpFMrClvNwwJes3g/AQB88cCgYEAvOfQ7jG5qrW3Ys765gOQ0gHlrDAyIY+ucXVy
FaYxWEbmYnSZ1W9n/54GvzlPXk2JzllDj+rh0TO1olbp0MYRyZj+kiO6Zu4chK7f
2eKFZgOHJDlILbtnrIDdQ58QbEJ8hYkRv9Yli2FgAyVUBTxHEH03uGwjMsq1Wb4F
k5FKYYUCgYBSe0wqziRUNjxhig/3g5qG6iGt0jnbHN5eTsNiEqe3QxDLKNERGTS4
pjpS0LV52bEdpX7imsIskmt81ed/cPUEKd6nbYyrLT67fUCeLuQ07Zlebc/PI8AD
ZoRiyx8x8k55z143XCIdzIyZTriQ5SkUV33wbzPRF8upD0xaygf2Tw==
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIEOTCCAyGgAwIBAgIJAIOpvPCh+v5fMA0GCSqGSIb3DQEBBQUAMIGyMQswCQYD
VQQGEwJVUzERMA8GA1UECAwISWxsaW5vaXMxEDAOBgNVBAcMB0NoaWNhZ28xHDAa
BgNVBAoME1N1cGVyZ2xvYmFsbWVnYWNvcnAxFjAUBgNVBAsMDVZpcnR1YWxseSBG
dW4xGTAXBgNVBAMMEHZpcnR1YWxseWZ1bi5jb20xLTArBgkqhkiG9w0BCQEWHmpz
dGV2ZUBzdXBlcmdsb2JhbG1lZ2Fjb3JwLmNvbTAeFw0xNTA0MjgwMjU1MzJaFw0y
MDEyMDUwMjU1MzJaMIGyMQswCQYDVQQGEwJVUzERMA8GA1UECAwISWxsaW5vaXMx
EDAOBgNVBAcMB0NoaWNhZ28xHDAaBgNVBAoME1N1cGVyZ2xvYmFsbWVnYWNvcnAx
FjAUBgNVBAsMDVZpcnR1YWxseSBGdW4xGTAXBgNVBAMMEHZpcnR1YWxseWZ1bi5j
b20xLTArBgkqhkiG9w0BCQEWHmpzdGV2ZUBzdXBlcmdsb2JhbG1lZ2Fjb3JwLmNv
bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK73csOVBonN8Ag6MMxj
P2VXWgq5wxXqPEppD9YyRiIbAM8zFfuegrXffK2ij58OZ5xLa5le8iJgYhfwN9kj
22Bep6gYTSj261IOLuHbK/bsqO/xeNNFTHF23IMHPqQzlOblAoO4WXJghqJVbPux
sQt0dZvEmz2WL5YHBxyV3ZxCi/ERvM+eAdi9QIu+gmJQ+kPeEJ0MYia4nMvAyST+
v2bqpBoNNQHKGgmkzmvJr2TC5ARZIwLHtGl9J0g0cTZAQXv4YMJEbhVmjCNYhoEw
l/Sda6IC4Nln2aBiBbbmKfI58IjUEHRDOk0xlEZvYqm+/KQXej8FrBQajmtBizhM
y88CAwEAAaNQME4wHQYDVR0OBBYEFJcb/w/SowAjTa/hvtim9oWYSarZMB8GA1Ud
IwQYMBaAFJcb/w/SowAjTa/hvtim9oWYSarZMAwGA1UdEwQFMAMBAf8wDQYJKoZI
hvcNAQEFBQADggEBAIISqlsBZKh67of21sJhsavDB4T7xrd/qC5zTUeUioScXr+j
n2aziysr+HazliIpVNa5QjicYTniG7urAZdL/zhegSyxEq6r1/BVAks0ooYxJT/f
G5EIhQurv3wQcGKSEXx6IA7+kheqYX++XcM6lAz5jPPIXsRV4NDsE7T68vVuQrr/
RYMHkbCXMqCbUq8x8k65KNN3EPJ66lH83kXuQJRazeurJmcquhmWqApjkORS17kq
+g2xRlnEolvS7umkGz9cbGP7SAWY+ySVIulKSKUKzji8qK8T/hW0dYWUPTZ6+LZx
hHnFJXiaGbnd1sEEB6uVV17XipnE15TGJ8NPT2s=
-----END CERTIFICATE-----

And I run it something like this from the client side…

# stunnel mine.conf
2015.04.28 14:25:23 LOG5[ui]: stunnel 5.16 on x86_64-apple-darwin14.3.0 platform
2015.04.28 14:25:23 LOG5[ui]: Compiled/running with OpenSSL 0.9.8zd 8 Jan 2015
2015.04.28 14:25:23 LOG5[ui]: Threading:PTHREAD Sockets:SELECT,IPv6 TLS:ENGINE,OCSP
2015.04.28 14:25:23 LOG5[ui]: Reading configuration from file mine.conf
2015.04.28 14:25:23 LOG5[ui]: UTF-8 byte order mark not detected
2015.04.28 14:25:23 LOG6[ui]: Compression enabled: 1 method(s)
2015.04.28 14:25:23 LOG6[ui]: Initializing service [minecraft]
2015.04.28 14:25:23 LOG6[ui]: Loading certificate from file: mine.pem
2015.04.28 14:25:23 LOG6[ui]: Loading key from file: mine.pem
2015.04.28 14:25:23 LOG4[ui]: Insecure file permissions on mine.pem
2015.04.28 14:25:23 LOG5[ui]: Configuration successful

Now with stunnel connected, you just have to add a server, but you connect to ‘localhost’. This will have you talking to the stunnel program which then talks to my server, which then redirects to the VM running Minecraft.

aa

Setup a server to ‘localhost’ to access stunnel

bb

Now you can connect to the stunnel server

No promises on how long it’ll be up though.

Titan City!

Titan City!

For normal clients... (shhhh!)

For normal clients… (shhhh!)

AltaVista Personal Indexer

caption

Probably not a good idea..

I never got into the whole ‘desktop search’ thing as I used to know where my stuff was.  But now we live in the future where not only can you just go out and buy terabytes worth of storage but downloading 10 years’ worth of usenet is something you can accomplish in a few minutes (on a good connection) but storing it as flat files only takes 20 minutes to decompress some 2,070,332 worth of files is a trivial manner.  It’s really cool to live in the future.

Total Files Listed: 2070332 File(s) 5,429,376,673 bytes 
                    168164 Dir(s) 1,119,884,468,224 bytes free

Now what about finding something in those files?

I should be embarrassed as I was using grep.

Yes, in my hunt for obscure information grep was my tool of choice.

So, after Frank had mentioned it in passing, if I’d ever used AltaVista Personal Search 97 before I thought I’d give it a bit of a test.  First, I unpacked some BSD source code, and had it index that.  The results were incredibly FAST.  So the next thing to do was to try the UTZOO archives.  I should have expanded my NT 4.0 VM’s disk first, but I got this far until I was down to 200MB of free disk space

Screen Shot 2014-10-29 at 9.04.27 PM

I should add that I’m sharing the UTZOO archvie over the network.  Not the fastest way at all.  And I only made it about 40% the way through the archive.  Even at this point the search database is only 1.2GB

So how does it run?  Well, it’s a localized web service that resides on your desktop.  Of course, it only works when you request from 127.0.0.1 as they sold a network searchable version of AltaVista, the Workgroup Edition. Even this was a retail product at one point retailing for $29 to $35

Screen Shot 2014-10-29 at 9.46.46 PM

Show me the Xenix!

So, you hit the web page, type in your search, and you get an answer like immediately.  It really is scary how fast this thing is.  Although the results can need a lot of tweaking, but we are talking 800,000 files.

But needless to say, there was the disastrous Compaq buyout of DEC, and the entrance of Google, and it was over.  From what I understand people are still selling the workgroup/enterprise search.  I can see why even though the 97 is rough it still has promise.

What a bargain!

What a bargain!

For anyone who cares, it’s geared to Windows 95, or Windows NT 4.0.. 2000 and beyond is at your own risk.  It uses a Win16 setup program, so Windows 7 x64 was out of the question, but you can download it here.

Exchange 5.5 OWA vs Outlook 2003

ASP 0115

ASP 0115

error ‘ASP 0115’

Unexpected error

/exchange/USA/root.asp

A trappable error occurred in an external object. The script cannot continue running.

So, call me crazy, but I’ve been running an Exchange 5.5 server a home for a while without issues.  It’s perfect for a single user, I can keep up to 16GB worth of email on there, and best of all I can use real email clients like Outlook (or is it LookOut!?).  Anyways I noticed something weird which is that Outlook 2003 always is unsure if the server is there, and I have to tell it that it’s OK to connect.  Also once the Outlook 2003 client connects, it kills OWA, giving me these weird ASP 0115 Unexpected errors.

googling around for a fix was a bit futile, and I’d largely written off OWA, as in this day & age, who really wants some ASP 3.0 app?  But for some reason, today was going to be the day to fix it, as I don’t have Outlook on my macbook air.

So with the Outlook 2003 clue in mind I finally found KB-818709, aka “Outlook Web Access stops responding when you try to access a mailbox on an Exchange 5.5 computer”.

As the cause states:

This problem occurs when you try to access a user account that was previously accessed by a client computer that is running Microsoft Office Outlook 2003.

Outlook 2003 adds a fourth entry to the PR_FREEBUSY_ENTRYIDS property. PR_FREEBUSY_ENTRYIDS is a multi-valued MAPI property that is stored on the Inbox folder. CDO expects three entries. The unexpected fourth entry causes heap corruption that causes OWA or the third-party program to stop responding.

Well how about that?

So with the hotfix in hand, and a reboot, it now works perfectly, like it did back in 1997.  And the best part is that it works great in Chrome.

And for anyone crazy like me with Exchange 5.5, remember to install SP4, and of course the KB829436 hotfix!

Playing around with Gopher

virtuallyfun gopher

My Gopher Site, via proxy

Back in the day, if you were ‘hip’ and ‘cool’ and had a UNIX shell account back in 1993 there was this cool way of getting around various computer systems around the world called gopher.  What was really cool, is that it offered search services, indexing and even gateways into various libraries (where they kept physical books) where you could search their card catalogs for various tomes you were looking for.

Some colleges even had various services that you could connect to, offering things like news, weather and whatnot.  It was pretty neat, however there was one stumbling block, which is gopher was a VERY controlled environment, where most universities locked their client to only starting at one particular gopher server, and to get anywhere else you had to memorize an insane number of keystrokes that would make 1800 operators go crazy.  Also there was nothing like virtual hosting, so the idea of having your own gophersite was most likely out of the question.  The other issue is that the University of Minnesota, where boombox resided (the master gopherserver) saw they had something good going, and unlike UCB’s CSRG which gave BSD away for free, they were going to license the server for $100 for a educational institution, and $500 for a commercial institution.

Needless to say, this CERN thing called HTTP which they were trying to distance themselves from, which wanted no money for became the next big thing, and with the freedom and ease of setting up website, gopher became a ghost of the past.

But as the world was starting to build web clients, many understood gopher, including Microsoft’s Internet Explorer.  Although starting with version 7 (gopher was also disabled with some updates in IE6), gopher has since been removed.  But thanks to the Utilu IE Collection, and this quick registry setting you too can surf gopher space with IE 4.0 (or 5,5.5..) like it’s the mid 1990s.

My gopher site via IE 4.0

My gopher site via IE 4.0

So needless to say with a client in hand, I wanted to setup my own server.  And keeping with it being old, I decided to use the old 2.3.1 gopher server.  I also compiled it with freeWAIS support, although I haven’t quite worked out how to get that fully working right now.  Compiling this stuff on 32bit i386 Linux was trivial to say the least, but if you need binaries or anything they are here.

the next thing was to get both wais, and gopherd running from xinetd, which was easy once I knew how.  These are the service files I created:

service gopher
{
socket_type = stream
protocol = tcp
wait = no
user = gopher
server = /usr/local/etc/gopherd
server_args = -I -l /var/log/gopherd.log -u gopher /gopher-data 70
instances = 20
}

And for wais:

service wais
{
socket_type = stream
protocol = tcp
wait = no
user = root
server = /usr/local/bin/waisserver
server_args = -d /gopher-data/wais /gopher-data/wais.log -l 10 -p 210
instances = 20
}

Easy, right?

Gopher likes to be a named service, so I went with my virtuallyfun.com domain, as it is easier to type.  I guess I could have gone with gopher.superglobalmegacorp.com but that is… LONG. Another cool thing is that there are several gopher proxies out there for HTTP only people, so you can also get to my gopher page here (via gopher.floodgap.com).

The harder part was figuring out how the directory mapping works, but luckily there was enough in the test directory to get something working, changing this

ls

About decode-n-scripts install mspl tmp
bin ftp-horrors lib pids

Into this:

The old UNIX gopher client

The old UNIX gopher client

The secret is all in the .names and .Links files.  The .names file will map a directory name to something more pleasing, such as changing mspl to the “Microsoft Programmer’s Libary”.

Path=./mspl
Name=Microsoft Programmer’s Library

Easy, right?

And the .Links file creates links to various content, from a telnet example (to my bbs….)

Type=8
Name=QemuOS/2 BBS (My BBS!)
Host=bbs.superglobalmegacorp.com
Port=23
Numb=100
Abstract=My Synchronet BBS running on OS/2 inside of Qemu! #100
Path=

To another gopher system

Name=My lame SDF.org site
Type=1
Host=sdf.org
Port=70
Path=/users/jsteve
Abstract=My personal SDF gopherspace (itsucks) #-11
Numb=-11

To even doing some crude ascii art!

Name= # # # ##### ##### # # ## # # # #
Type=3
Path=
Numb=5
#
Name= # # # # # # # # # # # # # #
Type=3
Path=
Numb=6

.. and so on.

So yes, to be difficult, all the links in this post are gopher:// links. I don’t know if that’ll deter the likes of any self proclaimed virus scanner king, but I’d like to think that his poorly constructed automated tests will be unable to connect to gopher resources.

Now if I can figure out how to setup my own jughead or veronica to search my own wais of information, that’d be excellent.

If I had the virtual space I’d host the whole thing on a virtual VAX…. or something equally insane.  Word is Shoebill just got ethernet support, so running my gopher space on A/UX would be cool.

I guess you’ve all heard by now

that the internet broke pretty good yesterday.  Apparently someone added some new routes, and it broke the 500,000 route limit in most BGP routers.

Oops.

But this has been a long time coming, even back in 2003 when I had a full BGP load I was running on a 7206vxr with 512MB of ram.

So if you had connectivity problems, that is what was going on.

Fun times for sure!

Running Microsoft Exchange from home.

Well thanks to my latest outage, I’ve gone back from having an Exchange server in the “cloud” (well really a server I rented), to a Virtual Server at home.

First my ‘plan’ is to get a VPS that I can run OpenVPN on.  From there I’m going to build a VM at home that will also run OpenVPN, and it will connect to the VPS.  I will then setup routing, so that the Exchange server can then communicate with the VPS’s internal interface, and the VPS can communicate directly with the exchange server.  I’ll then configure postfix to store & forward email to the Exchange server.  This way if the link drops, the VPS will just spool the mail.  Finally I’ll setup SpamAssasin to filter out the SPAM.

First you will need to have a tun0 interface in your VPS.  Almost everyone supports this these days so it shouldn’t be too hard… If you cannot get a tun0 interface, perhaps ppp0 with pptp..?

I followed these instructions on setting up OpenVPN on Debian 6.  Now granted, I’m using Debian 7, but the instructions are pretty much the same.  Basically you have to setup a CA (Certificate Authority), and then you generate a Server certificate, and a client certificate.  For my needs, I’m going to issue single certificates for everything(one) that connects into my VPN.  I also have a network at home that I want routed to the VPS, so this is included (192.168.0.0/24).

A simple server.conf looks like this:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 192.168.0.0 255.255.255.0
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

And a the client configuration I’m using is this:

client
dev tun
proto udp
remote MYHOST MYPORT
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert hong-kong-home.crt
key hong-kong-home.key
ns-cert-type server
comp-lzo
verb 3

In the directory /etc/openvpn/ccd on the server, I have to ensure that I have a file called ‘homefw’ which is the common name of the client certificate.  It has to contain the following line to ensure that my home network is routed to the VPS.

iroute 192.168.0.0 255.255.255.0

Don’t forget to turn on ip forwarding on both the VPS, and the local ‘tunnel router’.  For Linux based stuff you need to make sure that “/proc/sys/net/ipv4/ip_forward ” is a 1.  You can just do a simple “echo 1 > /proc/sys/net/ipv4/ip_forward ” in “/etc/rc.local” or go through your distributions networking documentation to make sure you set it up ‘correctly’.

In OpenBSD I just simply uncomment the following line from /etc/sysctl.conf

net.inet.ip.forwarding=1 # 1=Permit forwarding (routing) of IPv4 packets

If you don’t have routing in place you’ll notice that you can only ping the tunnel interfaces, but not the IP’s on the LAN.  While this may be fine for a p2p or client setup it isn’t good enough if you want to route traffic.

I’m running VMWare ESXi 5 at home, and thankfully it does support Windows NT 4.0 Server out of the box.  I setup a Domain Controller running DNS & WINS.  The VMWare tools won’t work properly with some service pack (4 I think?) but I went all the way to 6, along with the rollup.  Until you load the service pack, the network adapter will *NOT* work.

I’m going with Exchange 5.5, so again I installed another NT 4.0 server, service packed it, and joined it with the domain controller.  Remember to install IIS, and the ASP update, as 5.5 OWA needs asp. Be sure to apply the latest service pack for Exchange, SP4 – in the case of Exchange 5.5 .

Now for routing I could go with dynamic routing, or static routing.  I chose static as I didn’t want to get too involved for this project, as I needed to get email flowing as quickly as possible.

route add 10.8.0.1 mask 255.255.255.255 192.168.0.49 -p

From Windows NT.

It is imperative no matter what version of Exchange you run, that you turn off the open relay “feature”.  A great step by step guide is available here on msexchange.org .

With the basic routing in place you should be able to talk to the Exchange servers’ SMTP engine.  You may want to setup either a local DNS and populate the VPS’s source address or put in some host entries for it.

# telnet 192.168.0.55 25
Trying 192.168.0.55…
Connected to 192.168.0.55.
Escape character is ‘^]’.
220 exchange.superglobalmegacorp.com ESMTP Server (Microsoft Exchange Internet Mail Service 5.5.2653.13) ready
HELO
250 OK

Now it would be insane to place an Exchange server directly onto the internet.  Plus when the VPN link is down, it’d be nice to have the VPS store email and forward it when it can.  So for this task I installed postfix.

For me the big changes in main.cf were:

mydestination = nodedeploy.superglobalmegacorp.com, localhost.superglobalmegacorp.com, , localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 10.8.0.0/24 192.168.0.0/24
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
relay_domains = superglobalmegacorp.com work.com
transport_maps = hash:/etc/postfix/transport
virtual_alias_domains = virtuallyfun.com
virtual_alias_maps = hash:/etc/postfix/virtual

This will permit my exchange server to relay out my VPS, and tell postfix that it’s OK to accept email for the various domains I have.

My transport database is very simple.  For the email accounts I’m using two domains, so I simply instruct postfix to forward emails destined to these domains to the exchange server

superglobalmegacorp.com smtp:192.168.0.55
work.com smtp:192.168.0.55

And for domains I couldn’t be bothered to create mailboxes for, instead I have their email setup to forward to an existing box using a virtual domain in the ‘virtual’ file.

[email protected] [email protected]
[email protected] [email protected]

Now due to the nature of postfix you need to generate database hashes for it to work, so my script to kick this off is:

postmap hash:/etc/postfix/transport
postmap /etc/postfix/virtual
newaliases
postfix reload

Which isn’t too involved once you get the bits in the right place.

Assuming you’ve got your MX records setup on the outside, with any luck you should start seeing some mail flow through.  If not telnet to port 25 and start talking to your mail server.

One problem I have is that superglobalmegacorp.com is an old domain, and it’s lapsed a few times to different idiots who not only added to the ridiculous spam lists I’m on, but also spammed from it as well.  So to deal with SPAM, I went ahead and installed spamassassin, as described in this page.

As mentioned adding the two lines to master.cf got it going

smtp inet n – – – – smtpd -o content_filter=spamassassin -o syslog_name=postfix/submission
spamassassin unix – n n – – pipe
user=spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

And I did change the spamassasin local.cf

use_razor2 1
use_dcc 1
use_pyzor 1

As I do get a lot of spam.

I don’t think most people will care, but this is more so for me keeping my notes straight.  So yeah I run Exchange 5.5 at home (which I got on ebay for $25!) with Outlook 2003 on Windows XP x64.  It works well enough for me.

Web Rendering Proxy

(note this is a guest post from Tenox)

WRP is a HTTP proxy service that renders web pages in to GIF images associated with a clickable imagemap of the original web links. It basically allows to use historical and obsolete web browsers on the modern web.

See a gallery of today’s news sites. All links are clickable!

CNN via Internet Explorer 1.5

CNN via Internet Explorer 1.5

 

Reuters via IBM Web Explorer

Reuters via IBM Web Explorer

 

BBC News via Mac Mosaic

BBC News via Mac Mosaic

 

Reddit via NextStep OmniWeb

Reddit via NextStep OmniWeb

 

netscape3

Netscape 3.x visiting DNA Lounge

 

For more background information and screenshots you can see my previous post on the matter.

There are two versions. Cocoa-webkit for Mac OS X and QT-Webkit for Linux/BSD/etc. The script can be downloaded here.

Kali

My friend, Mara’akate is working on locating all the versions of Kali, and it’s precursor iDoom/iFrag.  His collection is available here.

Briefly this software let you play Doom (and other Doom variants) with other people over the internet.

I’ll have to write something up about this later on, but before I head out this Friday evening I thought I should at least give him a quick shout out, and hope that anyone out there has anything further to contribute could do so.

I wonder how hard it’d be to organize a Doom match in 2013…. probably just as hard as it was in 1993 if not more difficult.  Although the main issue today would be time, not finding a capable machine like it was back then.

From reading slashdot there was this fine article:

Why Didn’t the Internet Take Off In 1983?

Well I’d say it was a few simple reasons.  First the internet in 1983 was a very limited ARPANET, which was a big deal for an institution to get onto, let along an individual.

In the quick Slashdot post, they go on about the Viewtron service offered by AT&T.  And why did it not become such a major success, where the internet trumped everything?

Its quite simple, nobody likes a walled garden.  You can bet that AT&T wouldn’t allow people to just spout off their opinion wherever on their network.  Even today there is a limit on what you can say on corporate networks, and on corporate systems.  The big thing about the internet is that anyone can not only register a domain, but easily get access to server software and become their own ‘site’ on the internet independent of what large corporations may think, or wish.

The other thing to remember is the state of personal computing in 1983.  While the rise of personal eight bit computing, there was no ‘open’ networking standards on which to build large scale networks.  Because everything had to be licensed, and people were expected to pay big money for those technologies, people (hackers!) ended up writing them on their own.  Even the mighty internet today is more so because of hackers, and not from major corporations.  And fill the gap they did with what limited systems were available with BBSes and FIDONET.

What about UNIX?

While UNIX was a popular OS and the hackers dream, in 1983, getting a PC to run UNIX was a BIG endeavor, as the hardware was super expensive, and licensing was very restrictive.  The big ‘player’ of course was Microsoft via SCO with Xenix. For example in 1983, an Apple Lisa was $9,999. And Xenix could easily set you back some $2000 for the OS alone.

Even by 1987 a decent Xenix machine could still set you back some $15,000! That would be $27,567.45 in 2010 dollars!  And that is just a ‘runtime’ machine, no STREAMS, TCP/IP, and NO COMPILER!

$14,559 for UNIX in 1987!

 

This of course raises me to the next point about the lack of affordable 32bit general computing in 1983, and software.  Even at the university level the kind of machine that was going to be connected to the internet was a massive ‘mid’ range machine like the VAX 11/780 running BSD Unix.  Even back then BBN was trying to get its proprietary TCP/IP stack into a ‘base’ UNIX, which would further encumber the distribution of UNIX, while Bill Joy freed us all by providing BSD 4.2, and licensing it for free with only four clauses to be redistributed, and altered at will.  Which was fantastic, but the hardware requirements vs what anyone could buy off the shelf was.. a massive gulf. While a VAX with 8 MB of ram, a 500MB disk, and an Ethernet adapter (which was again an open standard) would cost several hundred thousand dollars, the 68000 chip from Motorola was changing everything, and was democratizing network stations first with Apollo, then with SUN.

Heck even SUN was founded on trying to bring BSD 4.2 to the masses, and the SUN-1 didn’t even run BSD UNIX but rather a UniSoft port of UNIX v7. Even from the business plan, the expected price at retail was $7000.

Of course as good as the hardware was getting “affordable” where a workstation would cost as much as a mid level car, the software however was *NOT* free.  This is where Richard Stallman stepped in with the FSF, and started to replace piece by piece all the software on SunOS with free & open equivalents.  It wasn’t until 1991 that there was enough GNU/Free software from that end to even start to bootstrap a free system (Linux).  Even the BSD people with their NET/2 release wasn’t ready until 1991 as well.

In addition take a look at this computer from 1991:

It is comparable to the $14,500 IBM PS/2 model 80, but at $2,295 it is something that the average user could afford.  And even in 1991 there was the beginnings of free & Open UNIX via Linux & 386 BSD to run.

So as you can see with the rise of affordable 32bit computing, open software with open networking standards in software and hardware that made an open network prevalent.

As we move into the future the larger question to me is, are people going to accept the big networks trying to turn the clock backwards to these ‘gardens’ where you must obey your corporate owners, never speak ill of them, and live with all the censorship.. I still believe that what made the internet unique is that not only could you participate in a global network, but you could with little investment become part of it.  Just as someone like me who had an issue with blogger being down for a protracted amount of time, was able to take my content and host it myself.  Something you cannot do in the walled garden of networks.

Trumpet Winsock 2.0b

So while browsing around k7tty, I came across this file, internet.zip, that pretty much has everything you need for a windows 3.1 machine to get into the internet using Trumpet Winsock.

I used a packet driver, along with Qemu’s built in ne2000 and it works pretty well!

While I never used Trumpet back in the day, setting it up for LAN access was pretty easy, and while Trumpet 1.0 loads on Windows 3.0 I never could find any applications that actually work with it. Trumpet 2.0 seems more along the line of the finalized Winsock 1.1 stacks, with applications abound to run with it and Windows 3.1