- WLUG - wlug.mailman3.com

Hosting in-person meetings at library

by joshua.gage.stone＠gmail.com

Hey all, I've learned that the library in my town is open to the public for hosting club meetings! More info: https://hudsonpubliclibrary.com/ Some of the benefits I can think of for having meetings at the library include: - Free hosting - Free public wifi - Free on-site parking - Low noise levels - Projector and whiteboard are available - Books, music, movies, etc, are available for checking out (https://bark.cwmars.org/eg/opac/home) - Adjacent to many restaurants, most having outdoor seating - Has EV charging stations nearby - Access to well-maintained walking trails and public parks Cons: - Conference room capacity is capped at 10 occupants - Meetings must end 15 minutes before library's closing time, so would have to end at 8:15PM - Many restaurants might be closed by 9PM I could imagine going back to our usual monthly meetings, from 7:00PM to 8:15PM on Thursdays, then walking over to one of the restaurants next door for food and drinks. I can personally vouch for these local establishments, all reachable within a 5 minute walk: https://railtrailflatbread.com/ https://www.wellysrestaurant.com/ https://newcitymicrocreamery.com/ https://www.lessthangreaterthan.com/ https://www.kithandkinhudson.com/ https://www.horseshoepub.com/ https://freshwingma.com/ https://www.medusabrewing.com/beer-garden What do you think? - Josh

July 14, 2021

Re: VPN Question

by Chuck Anderson

"VPN" is an overloaded term. Here are several different usages: - Remote Access Creates a secure tunnel from a VPN client machine to a remote/corporate network. Depending on the VPN client/server configuration, it may route only traffic destined to the remote network through the VPN while all other traffic goes directly to the Internet. That is called "split-tunnel". The other way routes all traffic through the VPN such that you end up using the remote network's ISP for all of your Internet traffic too. That is called "full-tunnel". This the most common traditional usage of the term "VPN". Standard VPN protocols: IPsec, SSL/TLS, L2TP, etc. Proprietary clients (may use standard protocols, but with proprietary extensions): Cisco Anyconnect Pulse Secure Palo Alto GlobalProtect etc. Standard clients (may interoperate with servers from the above companies, but with reduced functionality) Built-in Microsoft Windows L2TP client Built-in Android VPN client Built-in MacOS VPN client etc. Open Source clients (may interoperate with above companies, but with reduced functionality) openconnect / NetworkManager-openconnect - IPsec, SSL/TLS, etc. openswan/freeswan - IPsec openvpn - this one stands on its own as a non-standard but open protocol/software There are also other VPN plugins for NetworkManager - Site-to-Site Creates a secure site-to-site connection between networks. Often uses the same technologies as the remote access use case above, but instead of running a VPN client on an end-user machine and connecting to a VPN server, it is often configured to run directly on routers and/or firewalls so that an entire site's traffic is securely tunneled to one or more remote sites. - "Anonymizer" Create a secure tunnel to a VPN provider for the purposes of "hiding" your traffic from your own ISP (but not the VPN provider or its ISPs) or appearing to Internet services as if you are located in a different geographical region (e.g. to bypass content restrictions) There are various for-pay and possibly free-of-cost services. As far as I know, they are all proprietary and use their own clients, but I could be wrong. - Routed Provider-Provisioned VPN Creates a private "overlay" network using esoteric protocols such as MPLS and VXLAN, etc. They may be encrypted (using IPsec or some other technology), but are often NOT encrypted because their purpose is different. These are used internally by ISPs, medium/large enterprises, etc. to private a virtual private overlay for segmentation reasons, optionally allowing for overlapping IP address spaces (e.g. mulitple customers of an ISP can be using 192.168.1.0/24 and 10.0.0.0/8 at the same time in separate private network overlays that share the same equipment in the ISPs internal backbone.) Examples: VRF-Lite MPLS-based L3VPN MPLS-based L2VPN/L2 Circuits MPLS-based VPLS EVPN-MPLS EVPN-VXLAN other VXLAN-based overlays etc. On Tue, Jul 13, 2021 at 09:55:27AM -0400, Tim Keller via WLUG wrote: > Ron, > > There are a zillion VPN products on the market.. though generally a > specific VPN client is somewhat wed to the server side. Personally I have a > dim view of all things McAffee, but who knows maybe they bought a good VPN > from someone and rebranded it. > Personally I've used Shrewsoft on windows and frankly the built in windows > 10 VPN isn't *horrible*. > > Tim. > > On Sun, Jul 11, 2021 at 11:25 AM hammerron via WLUG <wlug(a)lists.wlug.org> > wrote: > > > Hey everybody: > > > > A friend asked me about VPNs and I don't know a whole lot lot on the > > topic. They have a Windows computer and are using a McAfee VPN. The > > question is, is this a decent product, should they use it or not or > > consider something else?

July 13, 2021

Re: VPN Question

by Tim Keller

Ron, There are a zillion VPN products on the market.. though generally a specific VPN client is somewhat wed to the server side. Personally I have a dim view of all things McAffee, but who knows maybe they bought a good VPN from someone and rebranded it. Personally I've used Shrewsoft on windows and frankly the built in windows 10 VPN isn't *horrible*. Tim. On Sun, Jul 11, 2021 at 11:25 AM hammerron via WLUG <wlug(a)lists.wlug.org> wrote: > Hey everybody: > > A friend asked me about VPNs and I don't know a whole lot lot on the > topic. They have a Windows computer and are using a McAfee VPN. The > question is, is this a decent product, should they use it or not or > consider something else? > > regards, > > > Ron > > _______________________________________________ > WLUG mailing list -- wlug(a)lists.wlug.org > To unsubscribe send an email to wlug-leave(a)lists.wlug.org > Create Account: https://wlug.mailman3.com/accounts/signup/ > Change Settings: > https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ > Web Forum/Archive: > https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/Q4CVQ… > -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

July 13, 2021

VPN Question

by hammerron

Hey everybody: A friend asked me about VPNs and I don't know a whole lot lot on the topic. They have a Windows computer and are using a McAfee VPN. The question is, is this a decent product, should they use it or not or consider something else? regards, Ron

July 11, 2021

No meeting tonight.. sorry for any confusion. Next Meeting 7/15/2021

by Tim Keller

Hey Gang, I just got back from vacation. We're going to have our meeting next week instead. Later, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

July 8, 2021

Re: I'm thinking Technocopia is a no go.

by Robert N. Evans

June 22, 2021

Re: I'm thinking Technocopia is a no go.

by Kevin Harrington

Hey there! I have been away on vacation for the past few weeks, and in the process of changing jobs. Sorry for the lag! We would love you have the WLUG hosted at technocopia! We are working with the building right now to ramp down some of the building-wide COVID restrictions so that we can have public events at Technocopia again soon. Can you give us an estimate on numbers of folks coming to the meetings? On Tue, Jun 22, 2021 at 1:33 PM Tim Keller via WLUG <wlug(a)lists.wlug.org> wrote: > I've reached out twice and my emails have gone unanswered, I think we > should start planning to have WLUG somewhere else. > > I don't know if WPI is an option or not. I think the last of the people > are gone from WPI so we don't have anybody to reserve a room.. If anybody > knows someone, etc.. awesome. > > If people have other options, I'd love to hear them. > > Thanks, > Tim. > > > > -- > I am leery of the allegiances of any politician who refers to their > constituents as "consumers". > _______________________________________________ > WLUG mailing list -- wlug(a)lists.wlug.org > To unsubscribe send an email to wlug-leave(a)lists.wlug.org > Create Account: https://wlug.mailman3.com/accounts/signup/ > Change Settings: > https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ > Web Forum/Archive: > https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/ACW5C… >

June 22, 2021

I'm thinking Technocopia is a no go.

by Tim Keller

I've reached out twice and my emails have gone unanswered, I think we should start planning to have WLUG somewhere else. I don't know if WPI is an option or not. I think the last of the people are gone from WPI so we don't have anybody to reserve a room.. If anybody knows someone, etc.. awesome. If people have other options, I'd love to hear them. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

June 22, 2021

Re: opinions on home email services

by Keith Wright

Mike Peckar via WLUG <wlug(a)lists.wlug.org> writes: > I've noted that many of you host your own email and file servers, I run a mail server (Postfix) as well as web and name servers on a Pentium ATX bought used 2012-09-27 for $225. It has a Tandy monitor that I have had since forever, and connects to the internet via DSL. > I've wanted to do this for several years, Why? What to do depends on what you want to get done. > but I've been avoiding taking this on myself. This is due to the time > investment (to learn tech I don't necessarily want to learn) I run Linux because I _do_ want to know how it all works and be able to control it myself, ... at least sometimes. Sometimes I wish it would just work. > Quite frankly, I'm getting lazy in my old age and I'm > considering a packaged solution/service like The Helm. Why not gmail? > If a lazy guy like me sets up an email server, but then doesn't > get around to applying security updates for half a year, is he > just asking to be hacked? You don't want to run an open relay, but a packaged server from a Linux distribution will not do that. Don't do something really stupid to change it. I don't think the chance of the server getting hacked is great. The server doesn't do much but copy Ascii characters from an internet port to your mail file. No harm in that. The crackers will be trying to trick you, some other user on your machine, or some stupid software, to treat that text as an executable program and run it. Don't do that! One example of a potentially stupid program is a web browser that treats the email as HTML and obeys javescript, downloads URL-s, and does a lot of automagic to give you a "user experience". In short---worry about the user interface and the user more than the mail server. > I am a local Charter customer with a standard internet-only subscription. What does that mean? Not bundled with cable TV and telephone? The old question: Are they stupid or lying? It's not an XOR question. Sometimes it's both, and sometimes the meaning of words has changed. At one time internret service meant you got an internet address and packets sent to that address came to you. Now, it's not so clear, but internet-only might mean you get what you need to run a web browser and not one bit more. They may actively try to prevent other internet traffic. > I guess my question is, are the tech barriers to setting up a home > email server really as formidable as claimed in the below > justification from The Helm's web site? > From: https://blog.thehelm.com/post/how-helm-works-part-1-networking I looked at that. They are trying to sell a stange shaped box. There is almost no information about what's in the box, at least on that page. Helm web page> Since announcing Helm three weeks ago That's a bit scary, but the web page is 18 months old. Maybe by now you can find some product reviews from one who bought it a few months ago. Helm web page> When you buy a Helm, a gateway (AWS EC2 instance) is spun up with an Elastic IP. I didn't know what is an "Elastic IP", so I Googled that. It looks like a Rube Goldberg plan to get Amazon Web Service to give you a temporary IP address without conforming to the DHCP RFC. I saw ominous references to an _hourly_ charge if your IP address is not used in the way AWS expects. Does Helm help get AWS to work, or just provide another level of indirection and recusive finger pointing? Helm> ISPs in the U.S. block port 25 by default, Helm> ISPs also typically assign dynamic IPs Helm> To summarize, port blocking, dynamic IPs and challenges in Helm> establishing a PTR record all interfere with easily running an email I don't know your ISP. I got my setup almost two decades ago from Speakeasy. Speakeasy was great. I could email a question Sunday night and have a reply from someone who understood the question and knew the answer by the time I woke up Monday. They set up reverse DNS, and ran a secondary name server for a one-time set up fee and negligble monthly charge. Speakeasy was sold to Best Buy, who sold to...Megapath... ...I forget...who sold it to GTT. With each sale the service got worse, until now it's a hassle to just pay the bill and get it credited to the right acount. They provide no service. They ignore email, but insist that communication comes via "tickets" on their web interface. These are handled by some bot-man who is paid to push a button that generates an auto-reply that says: "That is not a problem. The ticket is closed." I can't imagine getting this set up with my current Idiot Service Provider. Fortunately, they have (so far) not screwed up _all_ of the setup they bought. In particular I still have the same IP address and reverse DNS. I live in fear that some Idiot will "upgrade" my service by breaking something zey does not understand, and I will never get it back. Ask your ISP how to get an IP address with reverse DNS. If they do not understand the question, ignore it, of say $10,000/month, think of a new plan. -- Keith

June 17, 2021

Re: opinions on home email services

by John Stoffel

>>>>> "Michael" == Michael Voorhis via WLUG <wlug(a)lists.wlug.org> writes: Michael> On 6/15/21 12:13 PM, Mike Peckar via WLUG wrote: >> [quoted text] For an email server to send and receive email with >> other servers on the internet, they need port 25 to be open. >> Unfortunately, ISPs in the U.S. block port 25 by default [...] ISPs >> also typically assign dynamic IPs to residential internet >> connections. Large email service providers block residential dynamic >> IPs en masse also due to the issue raised above. [...] Michael> Port 25 access is not blocked by Charter in central MA, anyway. Perhaps Michael> it is blocked elsewhere. Michael> My IP address has changed about 4 times in the past 7 years Michael> or so. When it changes a script of mine warns me, and I go Michael> edit my DNS to change the MX and SPF information there. This Michael> all takes perhaps 5 minutes. If you don't want to watc hyour Michael> home IP as carefully, you could run a backup MX server in Michael> some more IP-stable location, i.e., a VM off in Amazon EC2. Michael> Certain domains will flat-out refuse to accept email which Michael> originates from a RESIDENTIAL network block. The only one Michael> I've encountered though is Comcast. Email sent to addresses Michael> @comcast.net are refused, even when the email passes all the Michael> tests (SPF, DKIM, DMARC etc). Mail sent to GMAIL, YAHOO, Michael> various microsoft/azure addresses etc, all work. I presume Michael> that if you want your mail to be accepted from everywhere, Michael> you should get a business plan from your ISP. I run my own domain on a Linode Droplet and it works well, except for when I get on a spam list for some reason. I used to run on a Digital Ocean Droplet, but charter.net would just refuse to accept my email, so I had to move. I've not got a company blocking my emails, which is frustrating since I'm such a small outgoing email system. Michael> Depending on what you'd like to add on top of your mail Michael> service things can get more complicated, but email itself Michael> isn't too bad. Test out your setup before exposing it to the Michael> internet, and make sure it doesn't accept email for domains Michael> other than your own. If you run an open relay email server Michael> that's a very good way to get shut off. In my experience, setting up postfix/dovecot on a system in the cloud isn't too hard, but both Mike and I are IT people at the $WORK job, so it's something we do anyway. I haven't made the jump to doing DKIM yet, if only because it's painful to do so, and I'd probably have to spring for a larger node with more memory at Linode to handle that overhead. In general, it's not too bad, and could be made even simpler if there was an Ansible playbook to do all the setup for you. So I pay $7/mo for my Linode host, plus te $60/year for my DNS hosting elsewhere. So if Helm is $10/month for 10 addresses/mailboxes, then maybe it's not worth doing it yourself. But I also like the control and I like to learn new things. John

June 17, 2021