for family in inet inet6; do
ipset -exist create ssh-allow-$family hash:net family $family
done

iptables -A INPUT -p tcp -m set --match-set ssh-allow-inet src -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j DROP
ip6tables -A INPUT -p tcp -m set --match-set ssh-allow-inet6 src -m tcp --dport 22 -j ACCEPT
ip6tables -A INPUT -p tcp -m tcp --dport 22 -j DROP


The contents of /etc/ipset/ssh_allow_inet look like this:

<sten@host:~> cat /etc/ipset/ssh_allow_inet
# me
127.0.0.1
# Work network
192.0.2.0/24
# home
198.51.100.0/24
# friend
203.0.113.1


And the created set looks like this:

<sten@host:~> sudo ipset -l ssh-allow-inet
Name: ssh-allow-inet
Type: hash:net
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 16944
References: 1
Members:
127.0.0.1
192.0.2.0/24
198.51.100.0/24
203.0.113.1


• 500 gram Biogarde Stand (other plain and wet yoghurts should work as well)
• 250 gram Mascarpone
• 250 gram Strawberries
• 250 gram Redcurrants
• 250 gram Raspberries
• 15 Ladyfinger biscuits

Whisk the yoghurt and the mascarpone together in a large bowl, the combination should be both fresh and creamy. The wetness of the biogarde also helps quite a bit. It is possible to add some sugar when the strawberries are not that sweet. Grab 3 or 4 desert bowls, first layer in the biscuits, then cover them with the strawberries and the redcurrants. Add the yoghurt/mascarpone mixture to the bowls and lastly cover it with the raspberries. Wait for a few minutes to give the ladyfingers some time to soften and dig in.

• Vlan Name TLV support
• LLDP mau support for Linux
• LLDP autoneg_pmd support for Linux and BSD
• use the NIC hardware name when no ifdescr is configured (Linux sysfs, FreeBSD sysctl)
• use lsb-release to report Linux distro information
• improved locally-generated packet filtering
• Improved detection of Tun/Tap interfaces, including a switch to use them
• Skip FreeBSD’s ipfw interfaces
• FreeBSD dmi/smbios support via kenv()
• added HACKING documentation
• fixes for small packets
• various other small fixes

* use wireless interfaces when the -w option is set
* disable auto-enabled protocols when peers expire
* add port-name to -z ifdescr support
* improved ifdescr supprt (only if needed, multiple peers, etc)
* used strnvis to sanitize strings for ifdescr
* fixed FreeBSD lagg ioctl
* RHEL4 compatibility fixes
* chroot the child, not the master
* use setresuid/setresgid for dropping privileges
* move the child code to child.c an refactor the eventloop
* refactored socket handling in master.c
* sockets are now fully dynamic and always have filters
* bsd vlan detection
* remove multicast registrations on shutdown
* even better unit-tests

This release has been (unit-)tested on Linux (amd64, arm), FreeBSD (i386, amd64) and OpenBSD (sparc64). I’d like to thank Paul de Weerd, Jacek Masiulaniec, Stephan A. Rickauer, David Gwynne and Mattieu Baptiste who have helped to uncover bugs and even submitted patches.

Tarballs and Debian sources are available.

• privilege separation
• SIOCSIFDESCR support (the -z option)
• Automatic protocol enablling based on received packets (-a)
• syslog notifications for new/removed peers (-r)
• EDP support
• FDP support
• NDP / SoNMP support
• abstracted protocol support
• rewritten netif and message lists
• some strict alignment fixes
• unit-tests including extensive protol tests

This release has been (unit-)tested on Linux (amd64, arm), FreeBSD (i386, amd64) and OpenBSD (amd64, sparc64, vax).
Tarballs and Debian sources are available.

• GND – Black
• RX – Yellow
• VCC – Red
• TX – Green

And lo and behold it worked first time round:


Port /dev/ttyS1
__ __ _ _
| \/ | __ _ _ ____ _____| | |
| |\/| |/ _` | '__\ \ / / _ \ | |
| | | | (_| | | \ V / __/ | |
|_| |_|\__,_|_| \_/ \___|_|_|
_ _ ____ _
| | | | | __ ) ___ ___ | |_
| | | |___| _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
\___/ |____/ \___/ \___/ \__| ** LOADER **
** MARVELL BOARD: DB-88F6281A-BP LE

Streaming disabled


As a first step a public notice was posted. Naturally nobody notices public notices, that would be like reading manpages. So I added http-redirects pointing to the new domain, which worked but nobody really noticed the change. Then it became time to post a similar notice via the fifo.sh rss-feeds, which some people noticed. A few days after that I added redirects to funny places which alerted people that something had changed:

<Wiebel> waarom krijg ik shit op de fifo.nl feed?
<Habbie> omdat je de fifo.sh rss feed hebt
<Wiebel> failblog krap


And:

<rqsall> en www.fifo.sh bood ook al geen uitkomst
<rqsall> kittyhell.com wtf


Finally I needed to find a way communicate the same message for irc.fifo.sh, after some experimenting it turned out that sending ascii-art movies works quite well for most irc-clients. So I took the starwars asciimation, added some custom frames, and presto:

<Fluor> snore, wtf man, met je fifo.sh
<Martin> die irc.fifo.sh is grappig


BDFL – Snore

• Fix for interfaces without link-layer addresses (ppp0/pptp0)
• Reset (router/wlan/bridge) capabilities after each run
• Improved the linux virtual interface detection
  (the previous method only worked on 2.6.23+ kernels)
• Add support for OpenBSD’s interface descriptions
• Add support for TIA inventory management TLV set
  using dmi information available on OpenBSD and Linux
• Use an ISC-licensed strlcpy for certain string operations
• Add -m/-M switches to specify management addresses
  via the commandline
• Add ioctl code to linux bonding/bridge detection which
  works on hosts without sysfs
• Add minimal LLDP civic location support using the LOC type
  and the -C (country) switch
• Add pcap headers to debug output to make it suitable for
  piping to tcpdump.

This release owes a lot to Paul de Weerd and Alexander Ottl, their tests and patches have helped to make this release as stable as possible.

Tarballs and Debian sources are available.