- WLUG - wlug.mailman3.com

Fedora 34 is officially out today

by joshua.gage.stone＠gmail.com

Hey everyone! Fedora 34 is officially out today, and it has a number of new features! Features include: - Updating to Gnome 40 (https://help.gnome.org/misc/release-notes/40.0/) - Switching from Pulseaudio to Pipewire (https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/FAQ#how-is-pipewir…) - Switching from earlyoomd to systemd-oomd for handling out-of-memory situations - Enabled transparent zstd compression in btrfs (https://fedoramagazine.org/fedora-workstation-34-feature-focus-btrfs-transp…) - Enabling Harfbuzz in FreeType for improved font rendering - KDE using Wayland by default instead of X11 https://fedoramagazine.org/whats-new-in-fedora-workstation-34/ You can try it out today here: https://getfedora.org/en/workstation/download/ Or try the various different spins here: https://dl.fedoraproject.org/pub/fedora/linux/releases/34/ - Josh

April 27, 2021

Re: Zeek - from yesterday's meeting

by Eric Martin

> On Apr 13, 2021, at 4:26 PM, Chuck Anderson via WLUG <wlug(a)lists.wlug.org> wrote: > > On Tue, Apr 13, 2021 at 09:16:10AM -0400, John Stoffel via WLUG wrote: >> Now that I have zeek up and running... what's the best tool/process >> for viewing the data? Looking at the hourly emailed logs is sorta >> interesting, but honestly not a great way to see trends over time. > > I know people use $$$$$plunk (Splunk) for that sort of thing. Perhaps > ELK (Elasticsearch, Logstash, and Kibana) would work. Oh look, > someone has a recipe for how to do that: > > https://logz.io/blog/bro-elk-part-1/ I am one of the $plunk users. Their free tier is fine, though it has less features (authentication being one of them) so I’d put something in front of it. The Splunk Zeek app is really good; if you go the Splunk route let me know. > _______________________________________________ > WLUG mailing list -- wlug(a)lists.wlug.org > To unsubscribe send an email to wlug-leave(a)lists.wlug.org > Create Account: https://wlug.mailman3.com/accounts/signup/ > Change Settings: https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ > Web Forum/Archive: https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/SXYJZ…

April 13, 2021

Re: Zeek - from yesterday's meeting

by Chuck Anderson

On Tue, Apr 13, 2021 at 09:16:10AM -0400, John Stoffel via WLUG wrote: > Now that I have zeek up and running... what's the best tool/process > for viewing the data? Looking at the hourly emailed logs is sorta > interesting, but honestly not a great way to see trends over time. I know people use $$$$$plunk (Splunk) for that sort of thing. Perhaps ELK (Elasticsearch, Logstash, and Kibana) would work. Oh look, someone has a recipe for how to do that: https://logz.io/blog/bro-elk-part-1/

April 13, 2021

Re: Zeek - from yesterday's meeting

by John Stoffel

Guys, Now that I have zeek up and running... what's the best tool/process for viewing the data? Looking at the hourly emailed logs is sorta interesting, but honestly not a great way to see trends over time. I've looked over the zeek.org website, and there's no real discussion there on how to summarize and get a good high level view of what's going on. Even just a daily report would be better, I think. So what I'm doing is setting up my core switch to mirror all the traffic between the switch and the router, while I also have the zeek box on another port on the switch for management. This seems to be working well so far, it's seeing all my traffic to/from the internet and the various devices connected. Cheers, John

April 13, 2021

Re: Zeek - from yesterday's meeting

by John Stoffel

>>>>> "Jon" == Jon \"maddog\" Hall <jon.maddog.hall(a)gmail.com> writes: >> You missed a fun meeting last night. Jon> I am sure I did. Unfortunately I am in Rio de Janeiro and was Jon> tied up with another meeting. Have a great time down there. Brazil is definitely on my list of places to visit some day. Along with Argentina, Chile, Peru.... lots of places in the world to see still.

April 10, 2021

Re: Zeek - from yesterday's meeting

by Jon "maddog" Hall

>You missed a fun meeting last night. I am sure I did. Unfortunately I am in Rio de Janeiro and was tied up with another meeting. Warmest regards, maddog On Fri, Apr 9, 2021 at 7:21 PM John Stoffel <john(a)stoffel.org> wrote: > >>>>> "Jon" == Jon \"maddog\" Hall <jon.maddog.hall(a)gmail.com> writes: > > Jon> From time to time I used a USB Ethernet port: > Jon> https://www.bestbuy.com/site/shop/usb-to-ethernet-adapter > > I used to have one of those kicking around, but for now I'm going to > go with the APU2 dedicated hardware box, it should have enough oomph > once I get Debian Buster (10.10) installed on it. > > Jon> Generally they are about 25 USD. You might be able to find them > Jon> on Ebay or other places for less than that. You might as well > Jon> get a USB 3.0, since it will work with USB 2.0 ports, but USB 2.0 > Jon> will not support 1 Gbit/second, whereas USB 3.0 will. On the > Jon> other hand if the networking flow is not 1 Gbit/second then USB > Jon> 2.0 might work fine. > > Jon> I have found the Linux support for these generic USB Ethernet > Jon> devices to be generally good. > > Thanks for the feedback! You missed a fun meeting last night. > > Jon> md > > Jon> On Fri, Apr 9, 2021 at 5:09 PM John Stoffel via WLUG < > wlug(a)lists.wlug.org> wrote: > > Jon> Guys, > Jon> I'm looking into Zeek and unfortunately I don't have a second > ethernet > Jon> port on my main system, so it's not clear how I'd run a span port > off > Jon> my main switch to grab traffic. > > Jon> What hardware do people recommend for a zeek data collection > node? I > Jon> guess I could spin up my old WRAP board (http://www.pcengines.ch) > Jon> which I used as my main router for years before I replaced it > Jon> recently. But it's not super fast. It's got three 1gb ports, and > 4gb > Jon> of RAM with a 1Ghz single core AMD CPU. So it might do the job, > esp > Jon> since I can install Debian Buster on there without too much > trouble. > Jon> Sweet! > > Jon> John > Jon> _______________________________________________ > Jon> WLUG mailing list -- wlug(a)lists.wlug.org > Jon> To unsubscribe send an email to wlug-leave(a)lists.wlug.org > Jon> Create Account: https://wlug.mailman3.com/accounts/signup/ > Jon> Change Settings: > https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ > Jon> Web Forum/Archive: > Jon> > https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/HCS2L… > >

April 9, 2021

Re: Zeek - from yesterday's meeting

by John Stoffel

>>>>> "Jon" == Jon \"maddog\" Hall <jon.maddog.hall(a)gmail.com> writes: Jon> From time to time I used a USB Ethernet port: Jon> https://www.bestbuy.com/site/shop/usb-to-ethernet-adapter I used to have one of those kicking around, but for now I'm going to go with the APU2 dedicated hardware box, it should have enough oomph once I get Debian Buster (10.10) installed on it. Jon> Generally they are about 25 USD. You might be able to find them Jon> on Ebay or other places for less than that. You might as well Jon> get a USB 3.0, since it will work with USB 2.0 ports, but USB 2.0 Jon> will not support 1 Gbit/second, whereas USB 3.0 will. On the Jon> other hand if the networking flow is not 1 Gbit/second then USB Jon> 2.0 might work fine. Jon> I have found the Linux support for these generic USB Ethernet Jon> devices to be generally good. Thanks for the feedback! You missed a fun meeting last night. Jon> md Jon> On Fri, Apr 9, 2021 at 5:09 PM John Stoffel via WLUG <wlug(a)lists.wlug.org> wrote: Jon> Guys, Jon> I'm looking into Zeek and unfortunately I don't have a second ethernet Jon> port on my main system, so it's not clear how I'd run a span port off Jon> my main switch to grab traffic. Jon> What hardware do people recommend for a zeek data collection node? I Jon> guess I could spin up my old WRAP board (http://www.pcengines.ch) Jon> which I used as my main router for years before I replaced it Jon> recently. But it's not super fast. It's got three 1gb ports, and 4gb Jon> of RAM with a 1Ghz single core AMD CPU. So it might do the job, esp Jon> since I can install Debian Buster on there without too much trouble. Jon> Sweet! Jon> John Jon> _______________________________________________ Jon> WLUG mailing list -- wlug(a)lists.wlug.org Jon> To unsubscribe send an email to wlug-leave(a)lists.wlug.org Jon> Create Account: https://wlug.mailman3.com/accounts/signup/ Jon> Change Settings: https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ Jon> Web Forum/Archive: Jon> https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/HCS2L…

April 9, 2021

Re: Zeek - from yesterday's meeting

by Jon "maddog" Hall

From time to time I used a USB Ethernet port: https://www.bestbuy.com/site/shop/usb-to-ethernet-adapter Generally they are about 25 USD. You might be able to find them on Ebay or other places for less than that. You might as well get a USB 3.0, since it will work with USB 2.0 ports, but USB 2.0 will not support 1 Gbit/second, whereas USB 3.0 will. On the other hand if the networking flow is not 1 Gbit/second then USB 2.0 might work fine. I have found the Linux support for these generic USB Ethernet devices to be generally good. md On Fri, Apr 9, 2021 at 5:09 PM John Stoffel via WLUG <wlug(a)lists.wlug.org> wrote: > > Guys, > I'm looking into Zeek and unfortunately I don't have a second ethernet > port on my main system, so it's not clear how I'd run a span port off > my main switch to grab traffic. > > What hardware do people recommend for a zeek data collection node? I > guess I could spin up my old WRAP board (http://www.pcengines.ch) > which I used as my main router for years before I replaced it > recently. But it's not super fast. It's got three 1gb ports, and 4gb > of RAM with a 1Ghz single core AMD CPU. So it might do the job, esp > since I can install Debian Buster on there without too much trouble. > Sweet! > > John > _______________________________________________ > WLUG mailing list -- wlug(a)lists.wlug.org > To unsubscribe send an email to wlug-leave(a)lists.wlug.org > Create Account: https://wlug.mailman3.com/accounts/signup/ > Change Settings: > https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ > Web Forum/Archive: > https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/HCS2L… >

April 9, 2021

Zeek - from yesterday's meeting

by John Stoffel

Guys, I'm looking into Zeek and unfortunately I don't have a second ethernet port on my main system, so it's not clear how I'd run a span port off my main switch to grab traffic. What hardware do people recommend for a zeek data collection node? I guess I could spin up my old WRAP board (http://www.pcengines.ch) which I used as my main router for years before I replaced it recently. But it's not super fast. It's got three 1gb ports, and 4gb of RAM with a 1Ghz single core AMD CPU. So it might do the job, esp since I can install Debian Buster on there without too much trouble. Sweet! John

April 9, 2021

Reminder! We've got a meeting this Thursday (April 8th, 2021!)

by Tim Keller

Hey Everybody, This is a reminder that we have a meeting on April 8th, 2021. Same bat time, same bat channel Date: April 8th, 2021 7pm: Jitsi @ https://meet.jit.si/WlugMA Topic: As of yet, there's no topic for the meeting, however, there's a ton to talk about none the less! The PHP git server hack, the OpenSSL vulnerabilities, turns out the spectre mitigations can be mitigated? I'm sure more stuff will come up as well.. As usual drinks and refreshments aren't being provided as this is a virtual meeting.. But soon.. so soon I hope we'll all be able to get together safely. Thanks for being patient and coming to the meetings, I appreciate it. Tim.

April 5, 2021