Speeding up SSH logon

A firewall blocks port 53 for my servers so ssh is trying to resolve my address every time I attempt log in.

The timeout is frustrating, so I read the man page [1] and found this configuration directive

  UseDNS  Specifies whether sshd(8) should look up the remote host name and check that the resolved host name for the remote IP address maps back to the very same IP address. The default is ''yes''.

I set it to 'no' and restarted the service and it worked like a charm :D

Note:
  When working on OpenBSD, be sure to be logged in on the console by other method (like physical console access or serial) because restarting the ssh service on OpenBSD causes all remote sessions to be closed.

[1] http://linux.die.net/man/5/sshd_config

--
  = ^ . ^ =

Kill annoying processes that match a pattern

So, there was a bunch of annoying processes named wit a pattern and I wanted to kill all of them

Here is the script (I know this can be done in a much cleaner way in awk, but I like this way)


#!/bin/sh

P="master(-worker)?"

PS=/bin/ps

SED=/bin/sed

KILL=/bin/kill

GREP=/bin/grep

CUT=/usr/bin/cut

$KILL `$PS ax | $GREP -E $P | $GREP -v grep | $SED -e 's/^\ \+//g' | $CUT -d ' ' -f 1 | $GREP -E '^[[:digit:]]+'`

--

  = ^ . ^ =

OpenBSD - Check hosts alive

#!/bin/sh


# Check all hosts within the network
# BSD license


PING=/sbin/ping
SEQ=gseq


NET=192.168.2
ME=192.168.0.2


i=1;
while [ $i -le 254 ] ;
do
  $PING -v -D -s 8 -t 1 -w 1 -c 1 -I $ME $NET.$i 1>/dev/null
  printf "$?"
  i=`expr $i + 1` ;
done


printf "\n"

Thanks to this site [1] for the while loop

[1] http://www.linuxmisc.com/27-linux-on-alpha/9fdb61f03bee119e.htm

--

  = ^ . ^ =

Round Robin DNS redirect in OpenBSD

Redirect all dns requests to a pool of trusted DNS servers (in this case OpenDNS)

Configuration in /etc/pf.conf

dns_servers = "{ 208.67.222.222 208.67.220.220 }"

pass in quick on $inside_if proto udp from <allowed> to any port 53 rdr-to $dns_servers round-robin 

You might also want to add sticky-address to keep asking to one dns server [1] (not my case)

The result when analyzing on the internal interface

# tcpdump -ni rtw0 'port 53 and host ( 8.8.8.8 )'

17:44:46.295443 192.168.127.36.37796 > 8.8.8.8.53: 22244+ A? toneji.to. (31)

17:44:46.384365 8.8.8.8.53 > 192.168.127.36.37796: 22244 1/0/0 A 67.215.65.132 (47)

The result when analyzing on the external interface

# tcpdump -ni xl0 'port 53 and host ( 208.67.220.220 or 208.67.222.222 )'

17:44:46.295561 10.0.2.2.59847 > 208.67.220.220.53: 22244+ A? toneji.to. (31)

17:44:46.384302 208.67.220.220.53 > 10.0.2.2.59847: 22244 1/0/0 A 67.215.65.132 (47) (DF)

This means that *any* DNS request will be forwarded to our trusted DNS servers (Thanks OpenDNS)

References:

[1]  http://www.openbsd.org/faq/pf/pools.html

--

  = ^ . ^ =