peremolto.blogspot.com

Contrició

noreply@blogger.com (Unknown) — Sat, 07 Jan 2017 12:18:00 +0000

Des de fa ja temps, quan llegeixo alguna de les entrades que en el seu moment vaig escriure aquí, tinc una sensació molt semblant a la que sovint un té quan es veu en fotografia i simplement no es troba com s'esperava.

Aquest antic blog meu que en el seu moment em vaig prendre de forma més o menys seriosa, ara haig de dir que no m'estava agradant. El veig com un aparador en el qual intento passar pel que mai he estat: Una excel·lència de tècnic amb un relat literari atractiu. Vist amb la perspectiva del temps, crec que ben poques vegades arribo al primer, i mai o quasi mai al segon. Trobo que quan algú fa una cosa carregat de pretensions, queda més exposat al ridícul. I en poques paraules, és una mica el que sento que vaig fer.

Vaig voler ser didàctic, precís, original, alegre... Però ara només veig xerrameca, poc rigor, una mica d'esnobisme... En línies generals, poca gràcia i un regust de falsa modèstia que en aquell moment no veia, i que ara em fa bastant angúnia. Per moments sembla que vulgui fer una barreja de comèdia i novel·la detectivesca, fent servir les tecnologies com a pretext. Tot plegat molt ranci; o almenys això em sembla, salvant potser algun dels darrers escrits.

Així doncs, he decidit fer un favor al domini públic i eliminar gran part de tota aquesta morralla. Faig una còpia privada, que guardaré com a record de part de la meva activitat en aquell moment, i retallo continguts.

Deixo la part de la que no renego del tot. Mentre vaig estar-hi posat, vaig aprendre molt. I de tant en tant encara consulto el que vaig escriure quan haig de fer alguna cosa que sé que hi surt però que no recordo amb detall. És per això que mantindré allò que em sembli una mica més útil o destacable, i amb una mica de temps potser reescric alguns fragments dels posts que he decidit salvar.

En aquell moment segurament m'hauria dolgut; però sincerament, algú m'hagués hagut d'advertir que el meu estil blogaire era ben justet. Tant se val, ja m'ho dic ara jo mateix.

VMware Server 2.0 + Virtual Infrastructure Client

noreply@blogger.com (Unknown) — Mon, 17 May 2010 11:37:00 +0000

Tras instalar VMware Server en alguna de sus versiones 2.0, observamos que ya no existe la posibilidad de acceder a las VM a través de la típica aplicación cliente de la versión 1.0.

La vía de acceso propuesta por VMware para esta nueva versión es el interface web. Este interface, además de lento no es muy fiable y no parece funcionar demasiado bien con Firefox (por ejemplo en mi caso, la pestaña Console no permite ver nada).

Afortunadamente un tal Andrea Benini nos explica aquí cómo acceder a las VM con el cliente vSphere. El artículo es realmente útil. Y el método de acceso, aunque no-oficial y no-soportado, funciona perfectamente y además está basado en herramientas de la propia vmware. Sin embargo el artículo tiene un punto gris (según mi criterio, claro está):

But what kind of support files do you need, where are there? Here's a link with some useful and legal files in it

Sin poner en duda que el contenido de la descarga de ese link sean "legal files", está claro que no es un link de vmware. De hecho un tal Gaetano en los comentarios del mismo artículo pregunta por un enlace desde donde poder bajar de forma "oficial" el cliente vSphere (o el Virtual Infrastructure Client al que sustituye).

Si a día de hoy uno se pone a mirar en el site de vmware, en unos pocos clicks se puede llegar a la descarga del ESXi (p. ej. 4) que tras ser instalado nos permite descargar el cliente vSphere desde la misma máquina en la que acabamos de instalar el ESXi (mediante acceso https).

Pero por desgracia la versión del cliente de esta versión actualizada no sirve para el método propuesto en el artículo anterior.

Por suerte, vmware guarda un historial de parches históricos descargables.

http://www.vmware.com/patch/portlets/patchupdate/allpatches.html

En concreto éste ESX350-200911201-UG update del ESX 3.5 contiene lo que necesitamos.

Tras descargar el fichero, manejando un CLI de Linux (o bien Cygwin) hacemos lo siguiente:

nohost:/home/nouser# md5sum ESX350-200911201-UG.zip
1ca07f9947ba57e7d9a37610094f0bbc ESX350-200911201-UG.zip
nohost:/home/nouser# unzip ESX350-200911201-UG.zip

Archive: ESX350-200911201-UG.zip
creating: ESX350-200911201-UG/
inflating: ESX350-200911201-UG/VMware-esx-apps-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-esx-backuptools-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-esx-drivers-scsi-vmkiscsi-350.3.6.3.1-1vmw.207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-esx-ima-qla4xxx-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-esx-iscsi-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-esx-lnxcfg-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-esx-perftools-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-esx-srvrmgmt-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-esx-tools-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-esx-vmkctl-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-esx-vmkernel-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-esx-vmx-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/VMware-hostd-esx-3.5.0-207095.i386.rpm
inflating: ESX350-200911201-UG/kernel-source-350.2.4.21-58.EL.207095.i386.rpm
inflating: ESX350-200911201-UG/kernel-vmnix-350.2.4.21-58.EL.207095.i686.rpm
inflating: ESX350-200911201-UG/descriptor.xml
creating: ESX350-200911201-UG/headers/
extracting: ESX350-200911201-UG/headers/VMware-esx-apps-0-3.5.0-207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-esx-backuptools-0-3.5.0-207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-esx-drivers-scsi-vmkiscsi-0-350.3.6.3.1-1vmw.207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-esx-ima-qla4xxx-0-3.5.0-207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-esx-iscsi-0-3.5.0-207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-esx-lnxcfg-0-3.5.0-207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-esx-perftools-0-3.5.0-207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-esx-srvrmgmt-0-3.5.0-207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-esx-tools-0-3.5.0-207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-esx-vmkctl-0-3.5.0-207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-esx-vmkernel-0-3.5.0-207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-esx-vmx-0-3.5.0-207095.i386.hdr
extracting: ESX350-200911201-UG/headers/VMware-hostd-esx-0-3.5.0-207095.i386.hdr
inflating: ESX350-200911201-UG/headers/kernel-source-0-350.2.4.21-58.EL.207095.i386.hdr
inflating: ESX350-200911201-UG/headers/kernel-vmnix-0-350.2.4.21-58.EL.207095.i686.hdr
inflating: ESX350-200911201-UG/headers/header.info
inflating: ESX350-200911201-UG/headers/contents.xml
inflating: ESX350-200911201-UG/headers/contents.xml.sig
inflating: ESX350-200911201-UG/contents.xml
inflating: ESX350-200911201-UG/contents.xml.sig

nohost:/home/nouser#

El fichero VMware-hostd-esx-3.5.0-207095.i386.rpm es el que contiene la versión del cliente vSphere (parece equivaler a la versión 2.5 del Virtual Infrastructure Client) que permite seguir las indicaciones de Andrea. Para obtener el ejecutable .exe con el cliente hacemos esto:

nohost:/home/nouser# cd ESX350-200911201-UG
nohost:/home/nouser/ESX350-200911201-UG# rpm -qpl VMware-hostd-esx-3.5.0-207095.i386.rpm | grep "\.exe"
/usr/lib/vmware/hostd/docroot/client/VMware-viclient.exe
nohost:/home/nouser/ESX350-200911201-UG#
nohost:/home/nouser/ESX350-200911201-UG# rpm2cpio VMware-hostd-esx-3.5.0-207095.i386.rpm | cpio -ivd ./usr/lib/vmware/hostd/docroot/client/VMware-viclient.exe
369160 blocks
nohost:/home/nouser/ESX350-200911201-UG# md5sum ./usr/lib/vmware/hostd/docroot/client/VMware-viclient.exe
b5bb5b2aa1e4d34623392539a57bc352 ./usr/lib/vmware/hostd/docroot/client/VMware-viclient.exe
nohost:/home/nouser/ESX350-200911201-UG#

Ahora, si queremos, podemos actualizar el cliente vSphere a la última versión (por si se quiere acceder a otras flotas). No hay problema por ello porque lo correspondiente a la versión recién instalada permanece en la carpeta

%ProgramFiles%\VMware\Infrastructure\Virtual Infrastructure Client\2.5

que menciona el artículo de Andrea.

El icono de acceso directo del cliente VI cambia su nombre por VMware vSphere Client, pero el acceso a las VM 2.0 sigue siendo posible. En realidad, el orden de la instalación no importa porque si lo hacemos al revés todo queda igual.

Acabo con la colección de links consultados:

http://www.linux.com/community/blogs/accessing-vmware-server-2-with-vsphere-client-the-unsupported-way.html
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1008180
http://sites.google.com/site/andreabenini/support/2.5.rar?attredirects=0&d=1
http://www.vmware.com/patch/portlets/patchupdate/allpatches.html
http://download3.vmware.com/software/vi/ESX350-200911201-UG.zip
http://www.vmware.com/support/vi3/doc/vi3_esx35u2_vc25u2_rel_notes.html
http://www.dennisvanleur.nl/kb/index.php?option=com_content&view=article&catid=70%3Avirtualcenter&id=157%3Avmware-update-manager-10-update-2-release-notes&Itemid=15
http://www.vmware.com/support/vi3/doc/vi3_esx35u1_vc25u1_rel_notes.html
http://www.virtualinsanity.com/index.php/tag/vmware-infrastructure-client/
http://www.dabcc.com/article.aspx?id=6826
http://www.linux.com/community/blogs/vmware-server-2x-thoughts.html
http://downloads.vmware.com/d/details/vc250u6/dGViZGpwQGJkZXBo
http://downloads.vmware.com/d/details/esx_3i_installableu5/dGViZGp3dGJkZXBo
http://downloads.vmware.com/d/details/esx350u5/dGViZGp0cGJkZXBo
http://downloads.vmware.com/d/info/datacenter_downloads/vmware_infrastructure_3/3_0#drivers_tools
http://downloads.vmware.com/d/details/esx350u5/dGViZGp0cGJkZXBo
http://www.desktop-virtualization.com/2008/02/07/convert-vmware-server-20-vms-into-server-104/
http://daviddelprado.blogspot.com/2008/01/vmware-convertir-maquinas-virtuales-de.html
http://communities.vmware.com/message/1324081;jsessionid=A501F5AF0242F8D742838DD504C1B38D
http://downloads.vmware.com/d/details/wkst_701_win/ZGolYmRq QHdiZGR0Kg==
http://www.vmware.com/appliances/getting-started/learn/ovf.html

Cisco DFM stands for...

noreply@blogger.com (Unknown) — Mon, 21 Dec 2009 11:30:00 +0000

Device Fault Manager

Oracle WMS stands for...

noreply@blogger.com (Unknown) — Thu, 17 Dec 2009 10:46:00 +0000

Warehouse Management Datasheet

Cisco DCR stands for...

noreply@blogger.com (Unknown) — Tue, 27 Oct 2009 16:17:00 +0000

Device Credentials Repository

Oracle, SAME, stands for...

noreply@blogger.com (Unknown) — Tue, 13 Oct 2009 18:54:00 +0000

SAME = Strip And Mirror Everything.

Cómo repetir una cadena en bash

noreply@blogger.com (Unknown) — Sun, 01 Feb 2009 22:47:00 +0000

Dos maneras de repetir una cadena en bash, un número determinado de veces. En este caso desde 1 hasta 3:

nouser@nohost:~$ CADENA="loquesea_"

nouser@nohost:~$ for i in {1..3};do printf "%s" $CADENA;done;echo
loquesea_loquesea_loquesea_
nouser@nohost:~$ printf "$CADENA%.0s" {1..3};echo
loquesea_loquesea_loquesea_

sed, borrando bloques de texto delimitado por cadenas

noreply@blogger.com (Unknown) — Tue, 27 Jan 2009 20:36:00 +0000

Tenía unos cuantos ficheros htm dentro de un directorio (pongamos como ruta /ruta/del/directorio), y quería borrar de ellos -si lo contenían- las siguientes líneas:

<div class="links">
<a href="http://peremolto.net">peremolto.net</a>
</div>

En la página de sed, el ejemplo 4.21 se ajusta casi en su totalidad a esto. Tras adaptarlo a lo mío quedó así:

nouser@nohost:~$ cat borra_delimitado.sed
# sed script to delete a block if /regex/ matches inside it
:t
/<div class="links">/,/div>/ { # For each line inside these block markers
/div>/!{ # If we are not at the /end/ marker
$!{ # nor the last line of the file,
N; # add the Next line to the pattern space
bt
} # and branch (loop back) to the :t label.
} # This line matches the /end/ marker.
/>peremolto.net</d; # If /regex/ matches, delete the block.
} # Otherwise, the block will be printed.
#---end of script---

Tal como se presenta este script sed, lo incluimos en un "for i in" que recorre los ficheros devueltos por un find

nouser@nohost:~$ for i in `find /ruta/del/directorio -name "*.htm"`; do sed -f borra_delimitado.sed -i $i; done

Knoppix, problema de visionado de imagen en algunos monitores

noreply@blogger.com (Unknown) — Wed, 21 Jan 2009 19:16:00 +0000

En alguna ocasión que he necesitado arrancar un equipo con una live distro, teniendo sólo a mano un Knoppix, me he encontrado que el monitor que estaba utilizando en aquel momento no era capaz de renderizar la imagen que enviaba el ordenador tras el botado inicial.

Los modificadores de arranque de Knoppix son muchos, pero el que en concreto permite corregir esta situación es 'vga=normal'. Si no recuerdo mal, las ayudas que presenta el menú de inicio de Knoppix no traen documentada esta opción.

En mi caso necesité arrancar con un teclado en castellano, así que el comando de arranque completo fue:

knoppix lang=es vga=normal

Versió alternativa, veure el primer comentari.

PHP desde la línea de comandos, por ejemplo

noreply@blogger.com (Unknown) — Fri, 02 Jan 2009 13:37:00 +0000

nouser@nohost:~$ php -r "phpinfo();"
phpinfo()
PHP Version => 5.2.4-2ubuntu5.4

System => Linux nohost-ubuntu 2.6.24-22-generic #1 SMP Mon Nov 24 18:32:42 UTC 2008 i686

...

Integración Unix AIX, Samba, Winbind, SSH y dominio Windows

noreply@blogger.com (Unknown) — Mon, 24 Dec 2007 10:32:00 +0000

Recientemente he completado una serie de ejercicios de integración entre Samba, Winbind, SSH y Active Directory.

Mientras que con Linux han salido casi todo a la primera, la implantación en un AIX ha sido más traumática de lo que me esperaba.

La parte buena es la de siempre: De ésta también he aprendido. Y aunque la documentación oficial de Samba me parece bastante buena, la parte que se refiere a AIX creo que no cubre el caso de una forma demasiado exhaustiva. Así que he decidido torturar a la "audiencia" con mis vivencias en este sentido.

El ejercicio está dividido en ocho partes (además de la introducción que constituye esta entrada):

Antes de empezar, diré que mi experiencia con AIX es moderada a día de hoy, así que de entrada pido disculpas si el contenido de los artículos se puede desarrollar mejor (seguro que sí). Como en el resto de entradas, es bienvenido cualquier comentario que contribuya a mejorar lo que se explica.

HTML y símbolos matemáticos (entre otros)

noreply@blogger.com (Unknown) — Thu, 20 Dec 2007 20:23:00 +0000

Hace unos días publiqué un artículo en el que tuve la necesidad de mostrar el símbolo matemático "infinito" (∞).

En la primera versión, me limité a especificar el literal "infinito", tal cual. Vi que en Wikipedia lo mostraban mediante una imagen y no le dí más vueltas.

Pero esta semana he visto que en Microsiervos hablaban del símbolo "al cuadrado" (²) y me ha picado la curiosidad. Después de buscar en w3c.org he comprobado que hay una buena colección de caracteres que se pueden mostrar mediante HTML (si el navegador sabe obtener la fuente apropiada). El link concreto con la información en cuestión (Character entity references for symbols, mathematical symbols, and Greek letters) es éste pero lo que me ha decepcionado un poco es que en w3c.org no acompañan la información de cada símbolo con el símbolo en sí (?!). Estaremos de acuerdo en que cuesta menos entender a qué nos referimos si vemos el carácter en lugar de su descripción. Es aquello de que vale más una imagen...

En la tabla de abajo he incorporado la misma información del link de antes, añadiendo los correspondiente símbolos. Sobre Mozilla y Firefox los muestra todos correctamente en todas las pruebas que hago. Según leo aquí, de Opera y Safari también nos podemos fiar. En cambio en determinadas versiones de otros navegadores de peor reputación, puede que sea necesario instalar la fuente Unicode Symbols para poder ver correctamente algunos caracteres. Esta fuente se puede descargar, por ejemplo, aquí.

Y ésta es la tabla:

<!-- Mathematical, Greek and Symbolic characters for HTML -->
<!-- Character entity set. Typical invocation: <!ENTITY % HTMLsymbol PUBLIC "-//W3C//ENTITIES Symbols//EN//HTML"> %HTMLsymbol; -->
<!-- Portions © International Organization for Standardization 1986: Permission to copy in any form is granted for use with conforming SGML systems and applications as defined in ISO 8879, provided this notice is included in all copies. -->
<!-- Relevant ISO entity set is given unless names are newly introduced. New names (i.e., not in ISO 8879 list) do not clash with any existing ISO 8879 entity names. ISO 10646 character numbers are given for each character, in hex. CDATA values are decimal conversions of the ISO 10646 values and refer to the document character set. Names are ISO 10646 names. -->
<!-- Latin Extended-B -->
<!ENTITY fnof CDATA "ƒ" -- latin small f with hook = function = florin, U+0192 ISOtech -->	ƒ
<!-- Greek -->
<!ENTITY Alpha CDATA "Α" -- greek capital letter alpha, U+0391 -->	Α
<!ENTITY Beta CDATA "Β" -- greek capital letter beta, U+0392 -->	Β
<!ENTITY Gamma CDATA "Γ" -- greek capital letter gamma, U+0393 ISOgrk3 -->	Γ
<!ENTITY Delta CDATA "Δ" -- greek capital letter delta, U+0394 ISOgrk3 -->	Δ
<!ENTITY Epsilon CDATA "Ε" -- greek capital letter epsilon, U+0395 -->	Ε
<!ENTITY Zeta CDATA "Ζ" -- greek capital letter zeta, U+0396 -->	Ζ
<!ENTITY Eta CDATA "Η" -- greek capital letter eta, U+0397 -->	Η
<!ENTITY Theta CDATA "Θ" -- greek capital letter theta, U+0398 ISOgrk3 -->	Θ
<!ENTITY Iota CDATA "Ι" -- greek capital letter iota, U+0399 -->	Ι
<!ENTITY Kappa CDATA "Κ" -- greek capital letter kappa, U+039A -->	Κ
<!ENTITY Lambda CDATA "Λ" -- greek capital letter lambda, U+039B ISOgrk3 -->	Λ
<!ENTITY Mu CDATA "Μ" -- greek capital letter mu, U+039C -->	Μ
<!ENTITY Nu CDATA "Ν" -- greek capital letter nu, U+039D -->	Ν
<!ENTITY Xi CDATA "Ξ" -- greek capital letter xi, U+039E ISOgrk3 -->	Ξ
<!ENTITY Omicron CDATA "Ο" -- greek capital letter omicron, U+039F -->	Ο
<!ENTITY Pi CDATA "Π" -- greek capital letter pi, U+03A0 ISOgrk3 -->	Π
<!ENTITY Rho CDATA "Ρ" -- greek capital letter rho, U+03A1 -->	Ρ
<!-- there is no Sigmaf, and no U+03A2 character either -->
<!ENTITY Sigma CDATA "Σ" -- greek capital letter sigma, U+03A3 ISOgrk3 -->	Σ
<!ENTITY Tau CDATA "Τ" -- greek capital letter tau, U+03A4 -->	Τ
<!ENTITY Upsilon CDATA "Υ" -- greek capital letter upsilon, U+03A5 ISOgrk3 -->	Υ
<!ENTITY Phi CDATA "Φ" -- greek capital letter phi, U+03A6 ISOgrk3 -->	Φ
<!ENTITY Chi CDATA "Χ" -- greek capital letter chi, U+03A7 -->	Χ
<!ENTITY Psi CDATA "Ψ" -- greek capital letter psi, U+03A8 ISOgrk3 -->	Ψ
<!ENTITY Omega CDATA "Ω" -- greek capital letter omega, U+03A9 ISOgrk3 -->	Ω
<!ENTITY alpha CDATA "α" -- greek small letter alpha, U+03B1 ISOgrk3 -->	α
<!ENTITY beta CDATA "β" -- greek small letter beta, U+03B2 ISOgrk3 -->	β
<!ENTITY gamma CDATA "γ" -- greek small letter gamma, U+03B3 ISOgrk3 -->	γ
<!ENTITY delta CDATA "δ" -- greek small letter delta, U+03B4 ISOgrk3 -->	δ
<!ENTITY epsilon CDATA "ε" -- greek small letter epsilon, U+03B5 ISOgrk3 -->	ε
<!ENTITY zeta CDATA "ζ" -- greek small letter zeta, U+03B6 ISOgrk3 -->	ζ
<!ENTITY eta CDATA "η" -- greek small letter eta, U+03B7 ISOgrk3 -->	η
<!ENTITY theta CDATA "θ" -- greek small letter theta, U+03B8 ISOgrk3 -->	θ
<!ENTITY iota CDATA "ι" -- greek small letter iota, U+03B9 ISOgrk3 -->	ι
<!ENTITY kappa CDATA "κ" -- greek small letter kappa, U+03BA ISOgrk3 -->	κ
<!ENTITY lambda CDATA "λ" -- greek small letter lambda, U+03BB ISOgrk3 -->	λ
<!ENTITY mu CDATA "μ" -- greek small letter mu, U+03BC ISOgrk3 -->	μ
<!ENTITY nu CDATA "ν" -- greek small letter nu, U+03BD ISOgrk3 -->	ν
<!ENTITY xi CDATA "ξ" -- greek small letter xi, U+03BE ISOgrk3 -->	ξ
<!ENTITY omicron CDATA "ο" -- greek small letter omicron, U+03BF NEW -->	ο
<!ENTITY pi CDATA "π" -- greek small letter pi, U+03C0 ISOgrk3 -->	π
<!ENTITY rho CDATA "ρ" -- greek small letter rho, U+03C1 ISOgrk3 -->	ρ
<!ENTITY sigmaf CDATA "ς" -- greek small letter final sigma, U+03C2 ISOgrk3 -->	ς
<!ENTITY sigma CDATA "σ" -- greek small letter sigma, U+03C3 ISOgrk3 -->	σ
<!ENTITY tau CDATA "τ" -- greek small letter tau, U+03C4 ISOgrk3 -->	τ
<!ENTITY upsilon CDATA "υ" -- greek small letter upsilon, U+03C5 ISOgrk3 -->	υ
<!ENTITY phi CDATA "φ" -- greek small letter phi, U+03C6 ISOgrk3 -->	φ
<!ENTITY chi CDATA "χ" -- greek small letter chi, U+03C7 ISOgrk3 -->	χ
<!ENTITY psi CDATA "ψ" -- greek small letter psi, U+03C8 ISOgrk3 -->	ψ
<!ENTITY omega CDATA "ω" -- greek small letter omega, U+03C9 ISOgrk3 -->	ω
<!ENTITY thetasym CDATA "ϑ" -- greek small letter theta symbol, U+03D1 NEW -->	ϑ
<!ENTITY upsih CDATA "ϒ" -- greek upsilon with hook symbol, U+03D2 NEW -->	ϒ
<!ENTITY piv CDATA "ϖ" -- greek pi symbol, U+03D6 ISOgrk3 -->	ϖ
<!-- General Punctuation -->
<!ENTITY bull CDATA "•" -- bullet = black small circle, U+2022 ISOpub -->	•
<!-- bullet is NOT the same as bullet operator, U+2219 -->
<!ENTITY hellip CDATA "…" -- horizontal ellipsis = three dot leader, U+2026 ISOpub -->	…
<!ENTITY prime CDATA "′" -- prime = minutes = feet, U+2032 ISOtech -->	′
<!ENTITY Prime CDATA "″" -- double prime = seconds = inches, U+2033 ISOtech -->	″
<!ENTITY oline CDATA "‾" -- overline = spacing overscore, U+203E NEW -->	‾
<!ENTITY frasl CDATA "⁄" -- fraction slash, U+2044 NEW -->	⁄
<!-- Letterlike Symbols -->
<!ENTITY weierp CDATA "℘" -- script capital P = power set = Weierstrass p, U+2118 ISOamso -->	℘
<!ENTITY image CDATA "ℑ" -- blackletter capital I = imaginary part, U+2111 ISOamso -->	ℑ
<!ENTITY real CDATA "ℜ" -- blackletter capital R = real part symbol, U+211C ISOamso -->	ℜ
<!ENTITY trade CDATA "™" -- trade mark sign, U+2122 ISOnum -->	™
<!ENTITY alefsym CDATA "ℵ" -- alef symbol = first transfinite cardinal, U+2135 NEW -->	ℵ
<!-- alef symbol is NOT the same as hebrew letter alef, U+05D0 although the same glyph could be used to depict both characters -->
<!-- Arrows -->
<!ENTITY larr CDATA "←" -- leftwards arrow, U+2190 ISOnum -->	←
<!ENTITY uarr CDATA "↑" -- upwards arrow, U+2191 ISOnum-->	↑
<!ENTITY rarr CDATA "→" -- rightwards arrow, U+2192 ISOnum -->	→
<!ENTITY darr CDATA "↓" -- downwards arrow, U+2193 ISOnum -->	↓
<!ENTITY harr CDATA "↔" -- left right arrow, U+2194 ISOamsa -->	↔
<!ENTITY crarr CDATA "↵" -- downwards arrow with corner leftwards = carriage return, U+21B5 NEW -->	↵
<!ENTITY lArr CDATA "⇐" -- leftwards double arrow, U+21D0 ISOtech -->	⇐
<!-- ISO 10646 does not say that lArr is the same as the 'is implied by' arrow but also does not have any other character for that function. So ? lArr can be used for 'is implied by' as ISOtech suggests -->
<!ENTITY uArr CDATA "⇑" -- upwards double arrow, U+21D1 ISOamsa -->	⇑
<!ENTITY rArr CDATA "⇒" -- rightwards double arrow, U+21D2 ISOtech -->	⇒
<!-- ISO 10646 does not say this is the 'implies' character but does not have another character with this function so ? rArr can be used for 'implies' as ISOtech suggests -->
<!ENTITY dArr CDATA "⇓" -- downwards double arrow, U+21D3 ISOamsa -->	⇓
<!ENTITY hArr CDATA "⇔" -- left right double arrow, U+21D4 ISOamsa -->	⇔
<!-- Mathematical Operators -->
<!ENTITY forall CDATA "∀" -- for all, U+2200 ISOtech -->	∀
<!ENTITY part CDATA "∂" -- partial differential, U+2202 ISOtech -->	∂
<!ENTITY exist CDATA "∃" -- there exists, U+2203 ISOtech -->	∃
<!ENTITY empty CDATA "∅" -- empty set = null set = diameter, U+2205 ISOamso -->	∅
<!ENTITY nabla CDATA "∇" -- nabla = backward difference, U+2207 ISOtech -->	∇
<!ENTITY isin CDATA "∈" -- element of, U+2208 ISOtech -->	∈
<!ENTITY notin CDATA "∉" -- not an element of, U+2209 ISOtech -->	∉
<!ENTITY ni CDATA "∋" -- contains as member, U+220B ISOtech -->	∋
<!-- should there be a more memorable name than 'ni'? -->
<!ENTITY prod CDATA "∏" -- n-ary product = product sign, U+220F ISOamsb -->	∏
<!-- prod is NOT the same character as U+03A0 'greek capital letter pi' though the same glyph might be used for both -->
<!ENTITY sum CDATA "∑" -- n-ary sumation, U+2211 ISOamsb -->	∑
<!-- sum is NOT the same character as U+03A3 'greek capital letter sigma' though the same glyph might be used for both -->
<!ENTITY minus CDATA "−" -- minus sign, U+2212 ISOtech -->	−
<!ENTITY lowast CDATA "∗" -- asterisk operator, U+2217 ISOtech -->	∗
<!ENTITY radic CDATA "√" -- square root = radical sign, U+221A ISOtech -->	√
<!ENTITY prop CDATA "∝" -- proportional to, U+221D ISOtech -->	∝
<!ENTITY infin CDATA "∞" -- infinity, U+221E ISOtech -->	∞
<!ENTITY ang CDATA "∠" -- angle, U+2220 ISOamso -->	∠
<!ENTITY and CDATA "∧" -- logical and = wedge, U+2227 ISOtech -->	∧
<!ENTITY or CDATA "∨" -- logical or = vee, U+2228 ISOtech -->	∨
<!ENTITY cap CDATA "∩" -- intersection = cap, U+2229 ISOtech -->	∩
<!ENTITY cup CDATA "∪" -- union = cup, U+222A ISOtech -->	∪
<!ENTITY int CDATA "∫" -- integral, U+222B ISOtech -->	∫
<!ENTITY there4 CDATA "∴" -- therefore, U+2234 ISOtech -->	∴
<!ENTITY sim CDATA "∼" -- tilde operator = varies with = similar to, U+223C ISOtech -->	∼
<!-- tilde operator is NOT the same character as the tilde, U+007E, although the same glyph might be used to represent both -->
<!ENTITY cong CDATA "≅" -- approximately equal to, U+2245 ISOtech -->	≅
<!ENTITY asymp CDATA "≈" -- almost equal to = asymptotic to, U+2248 ISOamsr -->	≈
<!ENTITY ne CDATA "≠" -- not equal to, U+2260 ISOtech -->	≠
<!ENTITY equiv CDATA "≡" -- identical to, U+2261 ISOtech -->	≡
<!ENTITY le CDATA "≤" -- less-than or equal to, U+2264 ISOtech -->	≤
<!ENTITY ge CDATA "≥" -- greater-than or equal to, U+2265 ISOtech -->	≥
<!ENTITY sub CDATA "⊂" -- subset of, U+2282 ISOtech -->	⊂
<!ENTITY sup CDATA "⊃" -- superset of, U+2283 ISOtech -->	⊃
<!-- note that nsup, 'not a superset of, U+2283' is not covered by the Symbol font encoding and is not included. Should it be, for symmetry? It is in ISOamsn -->
<!ENTITY nsub CDATA "⊄" -- not a subset of, U+2284 ISOamsn -->	⊄
<!ENTITY sube CDATA "⊆" -- subset of or equal to, U+2286 ISOtech -->	⊆
<!ENTITY supe CDATA "⊇" -- superset of or equal to, U+2287 ISOtech -->	⊇
<!ENTITY oplus CDATA "⊕" -- circled plus = direct sum, U+2295 ISOamsb -->	⊕
<!ENTITY otimes CDATA "⊗" -- circled times = vector product, U+2297 ISOamsb -->	⊗
<!ENTITY perp CDATA "⊥" -- up tack = orthogonal to = perpendicular, U+22A5 ISOtech -->	⊥
<!ENTITY sdot CDATA "⋅" -- dot operator, U+22C5 ISOamsb -->	⋅
<!-- dot operator is NOT the same character as U+00B7 middle dot -->
<!-- Miscellaneous Technical -->
<!ENTITY lceil CDATA "⌈" -- left ceiling = apl upstile, U+2308 ISOamsc -->	⌈
<!ENTITY rceil CDATA "⌉" -- right ceiling, U+2309 ISOamsc -->	⌉
<!ENTITY lfloor CDATA "⌊" -- left floor = apl downstile, U+230A ISOamsc -->	⌊
<!ENTITY rfloor CDATA "⌋" -- right floor, U+230B ISOamsc -->	⌋
<!ENTITY lang CDATA "〈" -- left-pointing angle bracket = bra, U+2329 ISOtech -->	〈
<!-- lang is NOT the same character as U+003C 'less than' or U+2039 'single left-pointing angle quotation mark' -->
<!ENTITY rang CDATA "〉" -- right-pointing angle bracket = ket, U+232A ISOtech -->	〉
<!-- rang is NOT the same character as U+003E 'greater than' or U+203A 'single right-pointing angle quotation mark' -->
<!-- Geometric Shapes -->
<!ENTITY loz CDATA "◊" -- lozenge, U+25CA ISOpub -->	◊
<!-- Miscellaneous Symbols -->
<!ENTITY spades CDATA "♠" -- black spade suit, U+2660 ISOpub -->	♠
<!-- black here seems to mean filled as opposed to hollow -->
<!ENTITY clubs CDATA "♣" -- black club suit = shamrock, U+2663 ISOpub -->	♣
<!ENTITY hearts CDATA "♥" -- black heart suit = valentine, U+2665 ISOpub -->	♥
<!ENTITY diams CDATA "♦" -- black diamond suit, U+2666 ISOpub -->	♦

División entre cero ¿igual a infinito? No.

noreply@blogger.com (Unknown) — Sun, 02 Dec 2007 21:12:00 +0000

El viernes nos dió por discutir cuál era el resultado de dividir un número entre cero.

Yo siempre había considerado inaceptable la utilización de esta operación en cualquier ámbito matemático. Pero es cierto que el debate me ha servido para revisar algunos conceptos que tenía medio olvidados, y poder darme cuenta que no estaba siendo del todo estricto.

En concreto, en la mayoría de contextos matemáticos (habitualmente números reales a los que se añade +∞ y -∞ (+infinito y -infinito) [1]) la operación de dividir un número entre 0 se define como:

- Indefinida, si el dividendo es distinto de 0 (p. ej. 1/0): Significa que NINGUN valor devuelto sería válido (desarrollado más abajo).

- Indeterminada, si el dividendo es 0 (0/0): Significa que CUALQUIER valor devuelto sería válido [2].

Debido a estas caraterísticas (indefinición e indeterminación) la operación división entre cero no se admite para llevar a cabo otras demostraciones (que en estos contextos resultarían incorrectas o absurdas, como la descrita en este link o en [3])

Tras esta (auto)aclaración, me ha sorprendido lo extendida que está la corriente que asegura que cualquier número dividido entre cero es... ¡INFINITO! ¡¿COMO?! No es así.

Tras empaparme con contenidos de algunas webs, libros y antiguos apuntes, he comprendido de dónde surge esta creencia, que intentaré explicar por qué es errónea:

Tomando un numerador distinto de 0 (debido a lo explicado en [2]), por ejemplo numerador 1, trataremos la función siguiente

f(x) = 1/x

Por definición: Una función es continua en un punto si existe límite en él y coincide con el valor que toma la función en ese punto.Entonces si quisieramos intentar demostrar que 1/x puede tomar algún valor para x = 0, sería necesario demostrar que la función es continua en ese punto. Para ello deberíamos demostrar que existe el siguiente límite:

lim 1/x
x→0

El límite de 1/x cuando x tiende a cero por la derecha es +∞, mientras que cuando tiende a cero por la izquierda es -∞. Mediante notación:

lim 1/x = +∞
x→0+

lim 1/x = -∞
x→0-

En análisis matemático cuando un límite es +∞ o -∞ se considera que ese límite no existe.

Pero además, según uno de los múltiples teoremas de tratamiento de límites utilizados en análisis: Existe el límite si y solo si existen los límites laterales (por la derecha y por la izquierda) y ambos coinciden.

Por cualquiera de las dos razones anteriores

lim 1/x
x→0

no existe.

La consecuencia de esto es por un lado la discontinuidad de la función 1/x en el punto x = 0, y por otro que no exista ningún valor posible para la función en ese punto (valor que coincidiría con el del resultado de la operación 1/0).

Este tipo de discontinuidad en el que uno de los límites (o ambos) son no-finitos se conoce como discontinuidad asintótica.

La misma explicación anterior de una forma algo más práctica:

El límite de 1/x cuando x tiende a 0 con valores positivos (por la derecha) nos lleva, más o menos, a algo así:

1 / 1 = 1
1 / 0.1 = 10
1 / 0.01 = 100
...
1 / 0.00000000000001 = 100000000000000

Podemos hacer que el divisor se acerce a 0 tanto como queramos. Y cuanto más cercano a 0, mayor es el número que resulta. Entonces decimos que el límite que tratamos tiende a ∞.

Esto se puede representar gráficamente de la siguiente manera:

A medida que aproximamos valores de x a cero, el valor de y (o si se prefiere f(x) ) crece cada vez más.

De manera similar, aplicamos lo visto con divisores negativos (x tendiendo a cero por la izquierda):

1 / -1 = -1
1 / -0.1 = -10
1 / -0.01 = -100
...
1 / -0.00000000000001 = -100000000000000

Incorporando los nuevos valores al gráfico anterior resulta lo siguiente:

Ahora a medida que aproximamos valores negativos de x a 0, el valor de y se hace cada vez menor ( f(x) tiende a -∞).

Como se ha dicho antes, el hecho de que al acercarnos a 0 desde números positivos tienda a un resultado (+∞) distinto del resultado al que tiende cuando nos acercamos a 0 desde números negativos (-∞) es suficiente para afirmar que la función no puede tomar ningún valor en el punto x=0.

La conclusión 1/0 = ∞ podría tener algo más de sentido si tomaramos sólo el contexto de los reales positivos. Entonces f(x) = 1/x sólo podría tomar divisores positivos, y en consecuencia diríamos que el resultado tiende a un único valor, que es +∞. Pero si desde ahí deducimos que 1/0 = +∞ caemos de nuevo en un error porque la propia definición del límite nos dice que el denominador "tiende a cero", mientras que en la deducción se está considerando que el valor del denominador es exactamente "igual a cero" (pero la definición excluye ese valor).

Todavía "más" práctico: Es como si me acerco a un precipicio. Puedo estar muy cerca del borde y aun así recorrer la mitad de lo que queda hasta llegar a él. Seguiré pudiendo hacer esto las veces que quiera, mientras me lo permita mi precisión en recorrer distancias cada vez menores. Y mediante leyes físicas podré demostrar que seguiré sin caerme porque el punto que sustenta mi centro de gravedad sigue en el lado desde donde empecé a acercarme, aunque me encuentre rematadamente cerca del borde del precipicio. Pero no puedo asegurar qué pasará si en lugar de recorrer la mitad, recorro justo la distancia de lo que queda. Puede que caiga, puede que no... Puedo hacer mil conjeturas, pero en ese punto ya no puedo demostrar nada de lo que demostré antes.

En conclusión, tampoco podemos basarnos en la expresión que describe que

lim 1/x = +∞
x→0+

para argumentar que 1/0 = +∞, porque en la propia definición del límite, el 0 como divisor queda excluido (aunque incluya números tan cercanos a él como se quiera).

Pese a lo que pueda parecer nunca me gustaron mucho las matemáticas. Reconozco que en este post me he movido en un terreno en el que no soy ningún experto, por lo que he intentado documentarme todo lo que he podido. Cualquiera que entienda del tema y piense que debería rectificar algo, queda invitado a dejar su comentario indicándo lo que considere oportuno.

En recuerdo de Ramón Parés, mi profesor de matemáticas de BUP y COU, del que por desgracia perdí la pista hace muchos años.

Anotaciones:

[1] +∞ y -∞ se consideran números no incluidos en el conjunto de los números reales

[2] 0/0 es una operación indeterminada. Esto es así porque cualquier resultado que se quiera asignar a la operación es válido. Se puede ver convirtiendo 0/0 = 0 en 0 = 0*0, pero también llegamos a 0/0 = 1 ya que 0 = 0*1, y también a 0/0 = 3.1415927 ya que 0 = 0*3.1415927. Y así sucesivamente con cualquier otro número del contexto de los números reales. En este link se presenta una representación gráfica de lo explicado aquí.

0*∞ se considera a su vez una indeterminación, aunque como se ha dicho en [1] ∞ no se considera un número incluido en el conjunto de los números reales. Otras indeterminaciones en este link

[3] Si utilizamos la indeterminación 0/0 en alguna demostración llegamos a conclusiones erróneas. P. ej.: Sabiendo que 0/0 = 1 es correcto y que 0/0 = 2 también lo es, podríamos concluir

0/0 = 1
0/0 = 2

y por tanto 1 = 2, lo cual es absurdo.

Fuentes:

- ANALISI MATEMATICA D'UNA VARIABLE - Edició setembre de 1999 - Eusebi Jarauta Bragulat - Edicions UPC - ISBN 84-89636-37-0
- CURSO PRACTICO DE MATEMATICAS DE COU - 2ª edición - F.Gonzalez-J.Villanova - EDUNSA Ediciones y Distribuciones universitarias S.A. - ISBN 85-85257-50-2
- MATEMATICA 3º Bachillerato - 4ª edición - J. Boadas-R. Romero-R.Villalbí - Editorial Teide - ISBN 84-307-3185-7
- MATEMATICAS 2º BUP - 4ª edición - Pedro Solà Montserrat - Editorial Casals S.A. - ISBN 84-218-0015-9
http://en.wikipedia.org/wiki/Division_by_zero
http://es.wikipedia.org/wiki/L%C3%ADmite_matem%C3%A1tico
http://es.wikipedia.org/wiki/Divisi%C3%B3n_por_cero#Paradoja_cl.C3.A1sica_usando_Divisi.C3.B3n_por_Cero
http://www.friesian.com/zero.htm
http://thales.cica.es/rd/Recursos/rd97/UnidadesDidacticas/39-1-u-continuidad.html
http://thales.cica.es/rd/Recursos/rd97/UnidadesDidacticas/58-Capitulo2.htm
http://www.monografias.com/trabajos13/nocla/nocla.shtml

ACTUALIZACION (modificación) (2007-12-16): He cambiado las cadenas "infinito" y "->" (tiende a) por sus correspondientes símbolos HTML.

Era manso pero topaba.

noreply@blogger.com (Unknown) — Sun, 30 Sep 2007 19:07:00 +0000

Juanito cumplió 78 años la semana pasada.

El día de su cumpleaños sacrificó su partida diaria de cartas para entretenernos tras la comida con algunas de sus batallitas entrañables.

En una de ellas, mientras nos hablaba de un conocido, adornó la historia con la frase del título y lo cierto es que nos hizo mucha gracia a todos los que le acompañábamos.

Felicidades Juan.

Indentado y tabulación en HTML

noreply@blogger.com (Unknown) — Sun, 09 Sep 2007 17:11:00 +0000

Mostrar indentados y tabulaciones en una página html es algo más complicado que en un fichero de texto.

En el anterior post me encontré con esta necesidad. Por si le sirve a alguien, explico cómo puede hacerse mediante style tags:

El siguiente código ...

<style>

</style>
<p class=Normal style='text-indent:30pt'>line 1 - tab level 1 - 30pt</p>
<p class=Normal style='text-indent:60pt'>line 2 - tab level 2 - 60pt</p>
<p class=Normal style='text-indent:90pt'>line 3 - tab level 3 - 90pt</p>
<p class=Normal style='text-indent:60pt'>line 4 - tab level 2 - 60pt</p>
<p class=Normal style='text-indent:30pt'>line 5 - tab level 1 - 30pt</p>

... muestra en el navegador lo siguiente:

line 1 - tab level 1 - 30pt

line 2 - tab level 2 - 60pt

line 3 - tab level 3 - 90pt

line 4 - tab level 2 - 60pt

line 5 - tab level 1 - 30pt

Feliz indentado.

Getting Oracle 10 datapump full path

noreply@blogger.com (Unknown) — Thu, 06 Sep 2007 17:16:00 +0000

This week I have been working on a bash script and I had the need to know the full path of my Oracle 10 datapump directory (directories).

I have found some useful links with general info about datapumps, how to create them, etc, but none of them told me how to find out their defined paths...

Navigating the dictionary information through the PL/SQL Developer trees I have found the view SYS.ALL_DIRECTORIES which contains what I wanted. I have just take a look to this view definition and... this is how I finally get my datapump dirs:

...

export IFS="

export DATAPUMP_DIRS=`

echo "

set heading off;

set feedback off;

select d.os_path

from sys.obj$ o, sys.dir$ d

where o.obj# = d.obj#

and o.type# = 23;

" | sqlplus -S $USER/$PASSWORD

...

Integración Unix AIX, Samba, Winbind, SSH y dominio Windows (1/8) - Instalación

noreply@blogger.com (Unknown) — Sat, 07 Jan 2006 23:00:00 +0000

Home del documento

En esta entrada se cubre la intalación de Samba sobre un sistema operativo AIX 5.3, mediante paquete binario precompilado descargado desde

http://us1.samba.org/samba/ftp/Binary_Packages/AIX/

La explicación se basa en la instalación de la versión 3.0.26a

En este caso, la instalación del paquete precompilado no incluye algunas opciones importantes, como por ejemplo la posibilidad de trabajar con PAM. Estas opciones se tratan más adelante en la instalación mediante compilación de código fuente:

- Gunzipeo y destareo:

# pwd
/usr/src/samba
# ls
README.htm
opt-samba-3.0.26a-AIX5.tar.gz
opt-samba-3.0.26a-AIX5.tar.asc
opt-samba-base.tar.asc
opt-samba-base.tar.gz
# ls *.gz
opt-samba-3.0.26a-AIX5.tar.gz opt-samba-base.tar.gz
# gunzip opt-samba-base.tar.gz
# gunzip opt-samba-3.0.26a-AIX5.tar.gz
# mkdir /tmp/samba
# cp -p opt-samba-base.tar opt-samba-base-AIX5.tar /tmp/samba
# cp -p opt-samba-3.0.26a-AIX5.tar /tmp/samba
# cd /tmp/samba
# ls
opt-samba-3.0.26a-AIX5.tar
opt-samba-base.tar
# tar -xf opt-samba-3.0.26a-AIX5.tar
# tar -xf opt-samba-base.tar

- Simulacro de instalación mediante installp -l:

# installp -lE -d.
*******************************************************************************
installp PREVIEW: installation will not actually occur.
*******************************************************************************

+-----------------------------------------------------------------------------+
Pre-installation Verification...
+-----------------------------------------------------------------------------+
Verifying selections...done
Verifying requisites...done
Results...

SUCCESSES
---------
Filesets listed in this section passed pre-installation verification
and will be installed.

Selected Filesets
-----------------
pware.BerkeleyDB.4.4-NC.rte 4.4.20.4 # Patched Berkeley DB 4.4.20-NC
pware.MIT-krb5.rte 1.4.4.1 # MIT Kerberos 1.4.4
pware.base.rte 5.2.0.0 # pware base for AIX 5.2
pware.cyrus-sasl.rte 2.1.22.0 # Cyrus SASL 2.1.22
pware.gcc-shared-libs.rte 4.1.1.0 # gcc shared libs 4.1.1
pware.libiconv.rte 1.9.2.0 # libiconv 1.9.2
pware.openldap.rte 2.3.27.0 # OpenLDAP 2.3.27
pware.openssl.rte 0.9.8.3 # OpenSSL 0.9.8c
pware.popt.rte 1.7.0.0 # popt 1.7
pware.samba-3.0.26a.rte 3.0.26.1 # Samba 3.0.26a

<< End of Success Section >>

FILESET STATISTICS
------------------
10 Selected to be installed, of which:
10 Passed pre-installation verification
----
10 Total to be installed

RESOURCES
---------
Estimated system resource requirements for filesets being installed:
(All sizes are in 512-byte blocks)
Filesystem Needed Space Free Space
/usr 7837 28591976
/opt 557944 9631888
----- -------- ------
TOTAL: 565781 38223864

NOTE: "Needed Space" values are calculated from data available prior
to installation. These are the estimated resources required for the
entire operation. Further resource checks will be made during
installation to verify that these initial estimates are sufficient.
Use the option to extend filesystems (-X flag) to ensure that any
additional resources which may be needed are automatically allocated.

LICENSE AGREEMENTS
------------------
License agreement for:
pware.base.rte
pware.samba-3.0.26a.rte
pware.openldap.rte
pware.cyrus-sasl.rte
pware.gcc-shared-libs.rte
pware.libiconv.rte
pware.openssl.rte
pware.popt.rte
pware.samba-3.0.26a.rte
pware.BerkeleyDB.4.4-NC.rte
pware.MIT-krb5.rte

THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
...
are THE SOLE RESPONSIBILITY OF THE INSTALLER.

******************************************************************************
End of installp PREVIEW. No apply operation has actually occurred.
******************************************************************************

- Viendo que parece que no va a haber problemas, procedemos a instalar de verdad:

# installp -agYX -d. all
+-----------------------------------------------------------------------------+
Pre-installation Verification...
+-----------------------------------------------------------------------------+
Verifying selections...done
Verifying requisites...done
Results...

SUCCESSES
---------
Filesets listed in this section passed pre-installation verification
and will be installed.

Selected Filesets
-----------------
pware.BerkeleyDB.4.4-NC.rte 4.4.20.4 # Patched Berkeley DB 4.4.20-NC
pware.MIT-krb5.rte 1.4.4.1 # MIT Kerberos 1.4.4
pware.base.rte 5.2.0.0 # pware base for AIX 5.2
pware.cyrus-sasl.rte 2.1.22.0 # Cyrus SASL 2.1.22
pware.gcc-shared-libs.rte 4.1.1.0 # gcc shared libs 4.1.1
pware.libiconv.rte 1.9.2.0 # libiconv 1.9.2
pware.openldap.rte 2.3.27.0 # OpenLDAP 2.3.27
pware.openssl.rte 0.9.8.3 # OpenSSL 0.9.8c
pware.popt.rte 1.7.0.0 # popt 1.7
pware.samba-3.0.26a.rte 3.0.26.1 # Samba 3.0.26a

<< End of Success Section >>

FILESET STATISTICS
------------------
10 Selected to be installed, of which:
10 Passed pre-installation verification
----
10 Total to be installed

+-----------------------------------------------------------------------------+
Installing Software...
+-----------------------------------------------------------------------------+

installp: APPLYING software for:
pware.base.rte 5.2.0.0

Filesets processed: 1 of 10 (Total time: 2 secs).

installp: APPLYING software for:
pware.MIT-krb5.rte 1.4.4.1

Filesets processed: 2 of 10 (Total time: 6 secs).

installp: APPLYING software for:
pware.BerkeleyDB.4.4-NC.rte 4.4.20.4

Filesets processed: 3 of 10 (Total time: 33 secs).

installp: APPLYING software for:
pware.popt.rte 1.7.0.0

Filesets processed: 4 of 10 (Total time: 35 secs).

installp: APPLYING software for:
pware.openssl.rte 0.9.8.3

Filesets processed: 5 of 10 (Total time: 55 secs).

installp: APPLYING software for:
pware.libiconv.rte 1.9.2.0

Filesets processed: 6 of 10 (Total time: 58 secs).

installp: APPLYING software for:
pware.gcc-shared-libs.rte 4.1.1.0

Filesets processed: 7 of 10 (Total time: 1 mins 1 secs).

installp: APPLYING software for:
pware.cyrus-sasl.rte 2.1.22.0

Filesets processed: 8 of 10 (Total time: 1 mins 3 secs).

installp: APPLYING software for:
pware.openldap.rte 2.3.27.0

Filesets processed: 9 of 10 (Total time: 1 mins 9 secs).

installp: APPLYING software for:
pware.samba-3.0.26a.rte 3.0.26.1

Restoring files, please wait.
Finished processing all filesets. (Total time: 2 mins 3 secs).

+-----------------------------------------------------------------------------+
Summaries:
+-----------------------------------------------------------------------------+

Installation Summary
--------------------
Name Level Part Event Result
-------------------------------------------------------------------------------
pware.base.rte 5.2.0.0 USR APPLY SUCCESS
pware.MIT-krb5.rte 1.4.4.1 USR APPLY SUCCESS
pware.BerkeleyDB.4.4-NC.rte 4.4.20.4 USR APPLY SUCCESS
pware.popt.rte 1.7.0.0 USR APPLY SUCCESS
pware.openssl.rte 0.9.8.3 USR APPLY SUCCESS
pware.libiconv.rte 1.9.2.0 USR APPLY SUCCESS
pware.gcc-shared-libs.rte 4.1.1.0 USR APPLY SUCCESS
pware.cyrus-sasl.rte 2.1.22.0 USR APPLY SUCCESS
pware.openldap.rte 2.3.27.0 USR APPLY SUCCESS
pware.samba-3.0.26a.rte 3.0.26.1 USR APPLY SUCCESS
#

- Hacemos limpieza:

# installp -u pware.*
+-----------------------------------------------------------------------------+
Pre-deinstall Verification...
+-----------------------------------------------------------------------------+
Verifying selections...done
Verifying requisites...done
Results...

WARNINGS
--------
Problems described in this section are not likely to be the source of any
immediate or serious failures, but further actions may be necessary or
desired.

Not Installed
-------------
No software could be found on the system that could be deinstalled for the
following requests:

pware.BerkeleyDB.4.4-NC.4.4.20.4.bff
pware.MIT-krb5.1.4.4.1.bff
pware.base.5.2.0.0.bff
pware.cyrus-sasl.2.1.22.0.bff
pware.gcc-shared-libs.4.1.1.0.bff
pware.libiconv.1.9.2.0.bff
pware.openldap.2.3.27.0.bff
pware.openssl.0.9.8.3.bff
pware.popt.1.7.0.0.bff
pware.samba-3.0.26a.3.0.26.1.bff

(The fileset may not be currently installed, or you may have made a
typographical error.)

<< End of Warning Section >>

FILESET STATISTICS
------------------
10 Selected to be deinstalled, of which:
10 FAILED pre-deinstall verification
----
0 Total to be deinstalled

Pre-installation Failure/Warning Summary
----------------------------------------
Name Level Pre-installation Failure/Warning
-------------------------------------------------------------------------------
pware.BerkeleyDB.4.4-NC.4 Nothing by this name to deinstall
pware.MIT-krb5.1.4.4.1.bf Nothing by this name to deinstall
pware.base.5.2.0.0.bff Nothing by this name to deinstall
pware.cyrus-sasl.2.1.22.0 Nothing by this name to deinstall
pware.gcc-shared-libs.4.1 Nothing by this name to deinstall
pware.libiconv.1.9.2.0.bf Nothing by this name to deinstall
pware.openldap.2.3.27.0.b Nothing by this name to deinstall
pware.openssl.0.9.8.3.bff Nothing by this name to deinstall
pware.popt.1.7.0.0.bff Nothing by this name to deinstall
pware.samba-3.0.26a.3.0.2 Nothing by this name to deinstall

- Comprobamos mediante comando que se ha instalado Samba:

# lslpp -L all|grep samba
pware.samba-3.0.26a.rte 3.0.26.1 C F Samba 3.0.26a

- Como prueba, intento arrancar smbd y ver que pasa...

# /opt/pware/samba/3.0.26a/sbin/smbd -D
# echo $?
255

- Da error porque no sabe donde encontrar el fichero smb.conf, así que lo busco entre los filesystems:

# find / -name smb.conf -ls
33462 4 -rw-r--r-- 1 root system 3904 Jan 3 2006 /opt/pware/samba/3.0.26a/examples/LDAP/smbldap-tools-0.9.2/smb.conf
33570 4 -rw-r--r-- 1 root system 793 Feb 25 2005 /opt/pware/samba/3.0.26a/examples/dce-dfs/smb.conf
33763 4 -rw-r--r-- 1 root system 1924 Feb 25 2005 /opt/pware/samba/3.0.26a/examples/tridge/smb.conf

- Copio uno de ellos en /etc que sería su ubicación habitual en AIX. Otra posibilidad sería arrancar el smbd con el parámetro -s e indicarle a continuación un fichero de configuración (con su ruta completa si fuera necesario)

# cp -p /opt/pware/samba/3.0.26a/examples/dce-dfs/smb.conf /etc

... y tuneo el fichero de acuerdo a mis necesidades. Debería quedar más o menos así:

# cat /etc/smb.conf
[global]
workgroup = DOMINIO
netbios name = modsed
encrypt passwords = yes
security = domain
log file = /var/log/samba/samba.log

# separate domain and username with '\', like DOMAIN\username
winbind separator = \\

# use uids from 10000 to 20000 for domain users
idmap uid = 10000-20000

# use gids from 10000 to 20000 for domain groups
idmap gid = 10000-20000

# allow enumeration of winbind users and groups
winbind enum users = yes
winbind enum groups = yes

[dosys]
comment = Testing Samba and Active Directory integration
path = /home/dosys
read only = no
public = no
writable = yes
printable = no

- Creo un directorio de log en la ruta que he definido en el fichero de antes...

# mkdir /var/log/samba

- Pero lo que hemos instalado espera el fichero smb.conf en la ruta /opt/pware/samba/3.0.26a/lib. Pues nada, linkamos en esa ruta el fichero que he copiado en el paso anterior...

# ln -s /etc/smb.conf /opt/pware/samba/3.0.26a/lib/smb.conf

... y tuneo el PATH en el /etc/profile:

# cat /etc/profile
...
export SAMBA_HOME=/opt/pware/samba/3.0.26a
export PATH=$PATH:$SAMBA_HOME/bin:$SAMBA_HOME/sbin

#

- Preparo, si no existe ya, la ruta del recurso compartido que he definido ([dosys])

# mkdir -p /home/dosys
# chown -R dosys:teson /home/dosys

- Vuelvo a arrancar, a ver que pasa ahora:

# smbd -D
# echo $?
0

# nmbd -D
# echo $?
0

Parece que ahora tira.

Home del documento

Integración Unix AIX, Samba, Winbind, SSH y dominio Windows (2/8) - Agregar host al dominio de Windows

noreply@blogger.com (Unknown) — Fri, 06 Jan 2006 23:00:00 +0000

Home del documento

Vamos bien, pero si no nos fiamos de que haya arrancado alguno de los daemons anteriores, podemos lanzar un ps -ef | grep mbd

Ahora según el howto oficial de Samba tocaría trabajar el NSS a través del fichero /etc/nsswitch.conf. En el sistema en el que me he basado la expliación no existe este fichero, pero sí que hay un /etc/netsvc.conf (la sintaxis es algo distinta) que se ha dejado así:

# cat /etc/netsvc.conf
# @(#)43 1.1 src/tcpip/etc/netsvc.conf, tcpip, tcpip530 4/3/02 22:12:29
...
#
hosts = local4 , bind4

- En este punto también nos proponen el uso de ldconfig para empezar hacer uso de las librerias necesarias. En mi caso ni existe el comando en el SO ni ha hecho falta reiniciar máquina tal como se indica.

- También hay que tunear el fichero /usr/lib/security/methods.cfg. En mi caso he tenido que añadir la sección WINBIND que detallo a continuación en color negro:

# cat /usr/lib/security/methods.cfg
* @(#)78 1.5 src/bos/usr/lib/security/methods.cfg.S, cmdsadm, bos530 6/11/03 17:06:16
...
NIS:
program = /usr/lib/security/NIS
program_64 = /usr/lib/security/NIS_64
DCE:
program = /usr/lib/security/DCE
WINBIND:
program = /usr/lib/security/WINBIND

- El fichero /usr/lib/security/WINBIND hay que tenerlo en la ruta indicada en el fichero anterior. Con un link funciona, pero también se puede copiar:

# ln -s /opt/pware/samba/3.0.26a/lib/security/WINBIND /usr/lib/security/WINBIND

En algún documento he encontrado referencias que comentan el hecho de que /usr/lib/security/WINBIND debe tener permisos 444 y propietario/grupo root:security. En este caso no ha hecho falta determinar nada de esto.

- Ahora viene la parte en la que hay que añadir la máquina al dominio (WORKGROUP indicado en el smb.conf):

# net rpc join -S delta.dominio.com -U administrador
Password:
Joined domain DOMINIO.
#

- En teoría ya hemos acabado. Arrancamos winbind (con -B para agilizar consultas mediante caché)...

# winbindd -B
# echo $?
0

... y comprobamos que la máquina se ha unido al dominio.

# wbinfo -t
checking the trust secret via RPC calls succeeded

- Si matamos el winbindd (o si éste hubiera arrancado de forma incorrecta) y preguntamos de nuevo lo mismo obtenemos algo así:

# wbinfo -t
checking the trust secret via RPC calls failed
error code was NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND (0xc0000233)
Could not check secret
#

- Entonces, con el winbindd arrancado, preguntamos al dominio por sus cuentas de usuario:

# wbinfo -u
Error looking up domain users

WTF!? Pues no, aun no hemos acabado (Este problema no tuve que sufrirlo en un Linux). En el próximo capítulo explico cómo llevar a cabo el debugado.

Home del documento

Integración Unix AIX, Samba, Winbind, SSH y dominio Windows (3/8) - Debugado de problemas

noreply@blogger.com (Unknown) — Thu, 05 Jan 2006 23:00:00 +0000

Home del documento

En el caso presentado, si en lugar de preguntar por los usuarios del dominio, pregunto por los grupos...

# wbinfo -g
BUILTIN\administrators
BUILTIN\users

... o sea, no da error, pero tampoco responde correctamente.

Para localizar el error, como de costumbre, se debe consultar el log correspondiente. Si este nos trae información suficiente, perfecto. Si no es así, tenemos la posibilidad de subir el nivel de log que nos trae winbindd. Este nivel de log puede subir hasta un nivel 20, pero para la mayoría de propositos un nivel 3 es suficiente para propósitos de traza de problemas.

En este caso se pudo localizar el error arrancando winbindd en modo interactivo con los siguientes parámetros:

# winbindd -S -n -i --debuglevel=3

-S para mostrar salida en pantalla
-n para deshabilitar posibles problemas de credenciales cacheadas
-i para no lanzar como daemon
--debuglevel=3 para mostrar log con un nivel 3 de detalle

- Ahora toca arremangarse y empezar a digerir la salida del comando (o al menos intentarlo). El problema queda patente entre las siguientes líneas:

ads_dns_lookup_srv: 17 records returned in the answer section.
ads_dns_parse_rr_srv: Failed to parse RR record
ads_dns_lookup_srv: Failed to parse answer record!
get_dc_list: no servers found
get_dc_list: preferred server list: ", *"
resolve_lmhosts: Attempting lmhosts lookup for name dominio.com<0x1c>
startlmhosts: Can't open lmhosts file /opt/pware/samba/3.0.26a/lib/lmhosts. Error was No such file or directory
resolve_wins: Attempting wins lookup for name dominio.com<0x1c>
resolve_wins: WINS server resolution selected and no WINS servers listed.
name_resolve_bcast: Attempting broadcast lookup for name dominio.com<0x1c>
get_dc_list: no servers found
get_dc_list: preferred server list: "DELTA, *"
get_dc_list: returning 1 ip addresses in an ordered list
get_dc_list: 192.168.92.56:0
nmb packet from 192.168.92.56(137) header: id=14682 opcode=Query(0) response=Yes
header: flags: bcast=No rec_avail=No rec_des=No trunc=No auth=Yes
header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0
answers: nmb_name=DOMINIO<1c> rr_type=33 rr_class=1 ttl=0
answers 0 char .DELTA hex --------------------------------
answers 10 char .D.DELTA hex --------------------------------
answers 20 char D.DOMINIO hex --------------------------------
answers 30 char ...DOMINIO hex --------------------------------
answers 40 char ...DOMINIO hex --------------------------------
answers 50 char .D.DOMIN hex --------------------------------
answers 60 char IO ...DEL hex --------------------------------
answers 70 char TA .D.D hex --------------------------------
answers 80 char OMINIO .D hex --------------------------------
answers 90 char ...__MSBROWSE__. hex --------------------------------
answers a0 char ...ADMINISTRADOR hex --------------------------------
answers b0 char .D...kXV3..... hex --------------------------------
answers c0 char ................ hex --------------------------------
answers d0 char ................ hex --------------------------------
answers e0 char ... hex 000000
rpc_dc_name: Returning DC DELTA (192.168.92.56) for domain DOMINIO
get_dc_list: preferred server list: ", *"
ads_dns_lookup_srv: 17 records returned in the answer section.
ads_dns_parse_rr_srv: Failed to parse RR record
ads_dns_lookup_srv: Failed to parse answer record!
get_dc_list: no servers found
get_dc_list: preferred server list: ", *"
resolve_lmhosts: Attempting lmhosts lookup for name dominio.com<0x1c>
startlmhosts: Can't open lmhosts file /opt/pware/samba/3.0.26a/lib/lmhosts. Error was No such file or directory
resolve_wins: Attempting wins lookup for name dominio.com<0x1c>
resolve_wins: WINS server resolution selected and no WINS servers listed.
name_resolve_bcast: Attempting broadcast lookup for name dominio.com<0x1c>
get_dc_list: no servers found
ads_connect for domain DOMINIO failed: No logon servers

- Se trata de la no-existencia del fichero /opt/pware/samba/3.0.26a/lib/lmhosts. Lo creamos, (fijarse en la formato utilizado)...

# cat /opt/pware/samba/3.0.26a/lib/lmhosts
192.168.92.56 delta delta.dominio.com
#

... e intentamos de nuevo. Se queja de la sintaxis utilizada:

resolve_lmhosts: Attempting lmhosts lookup for name dominio.com<0x1c>
getlmhostsent: too many columns in lmhosts file (obsolete syntax)

- Pues nada, dejamos el fichero a su gusto:

# cat /opt/pware/samba/3.0.26a/lib/lmhosts
192.168.92.56 delta
192.168.92.56 delta.dominio.com
#

- Ahora tras reinicir winbind obtuve en el log algo así...

get_dc_list: 192.168.92.104:389 192.168.92.56:389 192.168.92.102:389
Connected to LDAP server 192.168.92.104
time offset is 0 seconds
Found SASL mechanism GSS-SPNEGO
ads_sasl_spnego_bind: got OID=1 2 840 48018 1 2 2
ads_sasl_spnego_bind: got OID=1 2 840 113554 1 2 2
ads_sasl_spnego_bind: got OID=1 2 840 113554 1 2 2 3
ads_sasl_spnego_bind: got OID=1 3 6 1 4 1 311 2 2 10
ads_sasl_spnego_bind: got server principal name = lambda$@DOMINIO.COM
ads_krb5_mk_req: krb5_cc_get_principal failed (No credentials cache found)
ads_cleanup_expired_creds: Ticket in ccache[MEMORY:winbind_ccache] expiration Tue, 20 Nov 2007 20:32:27 NFT

... y lo que antes fallaba empezó a funcionar:

# wbinfo -g
DOMINIO\Grupo 1
...
DOMINIO\Grupo N menos 3
DOMINIO\Grupo N menos 2
DOMINIO\Grupo N menos 1
DOMINIO\Grupo N

# wbinfo -u
DOMINIO\Usuario 1
...
DOMINIO\Usuario N menos 3
DOMINIO\Usuario N menos 2
DOMINIO\Usuario N menos 1

- Vamos lanzados, a ver que obtengo con getent...

# getent passwd
ksh: getent: not found.
#

WTF!?

Home del documento

Integracion Unix AIX, Samba, Winbind, SSH y dominio Windows (4/8) - Otros problemas encontrados en AIX en este punto

noreply@blogger.com (Unknown) — Wed, 04 Jan 2006 23:00:00 +0000

Home del documento

Pues parece que ni en IBM ni en mi AIX 5.3 saben nada del comando getent (que sirve para obtener listas unificadas de usuarios locales y usuarios de Active Directory)... A ver como podemos obtener alguna funcionalidad parecida.

En el momento de escibir este documento veo que el comando net (propio de la suite de Samba) ofrece multiples posibilidades. Sin haber leido de forma exhaustiva toda su documentación no me atrevo a decir que lo que voy a explicar ahora se pueda hacer de otra forma más sencilla... De momento explico mi trabajo: Me voy a /home ...

# ls -l
total 0
drwxr-x--x 2 dosys teson 256 Nov 06 13:17 dosys
drwxr-xr-x 2 user1 usr 256 Nov 13 17:37 user1
drwxr-xr-x 2 usertwo usr 256 Nov 12 11:40 usertwo
drwxr-xr-x 2 guest usr 256 Jul 06 2006 guest
drwxr-xr-x 2 usuario3 usr 256 Nov 12 10:04 usuario3
drwx------ 2 root system 256 Apr 12 2007 lost+found
drwxr-xr-x 2 userzet usr 256 Nov 05 16:31 userzet
drwxr-xr-x 2 teson teson 256 May 14 2007 teson

... y cambio el propietario y el grupo del directorio dosys

# chown "DOMINIO\smolarek" dosys
# ls -l
total 0
drwxr-x--x 2 DOMINIO\ teson 256 Nov 06 13:17 dosys
drwxr-xr-x 2 user1 usr 256 Nov 13 17:37 user1
drwxr-xr-x 2 usertwo usr 256 Nov 12 11:40 usertwo
drwxr-xr-x 2 guest usr 256 Jul 06 2006 guest
drwxr-xr-x 2 usuario3 usr 256 Nov 12 10:04 usuario3
drwx------ 2 root system 256 Apr 12 2007 lost+found
drwxr-xr-x 2 userzet usr 256 Nov 05 16:31 userzet
drwxr-xr-x 2 teson teson 256 May 14 2007 teson
# chgrp "DOMINIO\Domain master-users" dosys
# ls -l
total 0
drwxr-x--x 2 DOMINIO\ DOMINIO\ 256 Nov 06 13:17 dosys
drwxr-xr-x 2 user1 usr 256 Nov 13 17:37 user1
drwxr-xr-x 2 usertwo usr 256 Nov 12 11:40 usertwo
drwxr-xr-x 2 guest usr 256 Jul 06 2006 guest
drwxr-xr-x 2 usuario3 usr 256 Nov 12 10:04 usuario3
drwx------ 2 root system 256 Apr 12 2007 lost+found
drwxr-xr-x 2 userzet usr 256 Nov 05 16:31 userzet
drwxr-xr-x 2 teson teson 256 May 14 2007 teson

- Desde este momento se puede acceder al recurso compartido \\modsed\dosys (que nos mostrará el contenido de la ruta /home/dosys) con los permisos que indica el ls anterior (?!)

Nuevo problema: Hemos determinado un propietario y un grupo del dominio para la carpeta dosys, pero el sistema presenta la salida de un ls en un formato que nos impide ver a qué corresponden esos nombres. (Este problema no se da, p. ej., con Linux que adapta la salida de manera que nos permita ver el propietario/grupo). En nuestro caso he utilizado un método alternativo que paso a explicar:

# ls -n
total 0
drwxr-x--x 2 10000 10009 256 Nov 06 13:17 dosys
drwxr-xr-x 2 204 100 256 Nov 13 17:37 user1
drwxr-xr-x 2 208 100 256 Nov 12 11:40 usertwo
drwxr-xr-x 2 100 100 256 Jul 06 2006 guest
drwxr-xr-x 2 206 100 256 Nov 12 10:04 usuario3
drwx------ 2 0 0 256 Apr 12 2007 lost+found
drwxr-xr-x 2 205 100 256 Nov 05 16:31 userzet
drwxr-xr-x 2 300 300 256 May 14 2007 teson

... que muestra los UID y GID que maneja winbindd (y que tienen que ver con las variables globales idmap uid e idmap gid determinadas en smb.conf)

- Tomamos el UID 10000 que nos muestra el ls y preguntamos el SID asociado:

# wbinfo -U 10000
S-1-5-21-2079082624-1001472106-643713613-4753

- Con ese SID preguntamos el nombre de usuario asociado:

# wbinfo -s S-1-5-21-2079082624-1001472106-643713613-4753
DOMINIO\SMOLAREK 1

- Podemos hacer lo mismo pero con el GID en lugar del UID:

# wbinfo -G 10009
S-1-5-21-2079082624-1001472106-643713613-512
# wbinfo -s S-1-5-21-2079082624-1001472106-643713613-512
DOMINIO\Domain master-users 2

- Y hasta aquí el primer workaround. Hay que reconocer que obtener el nombre de usuario de esta forma es muy incomodo, así que he preparado cuatro pequeños scripts (uid2name, gid2name, name2uid, name2gid) que facilitan el trabajo. Para que funcionen primero debemos asegurar que el wbinfo se encuentra en el PATH

# echo $PATH
/usr/bin:/etc:/usr/sbin:/usr/ucb:/usr/bin/X11:/sbin:/usr/java14/jre/bin:/usr/java14/bin:
/opt/pware/samba/3.0.26a/bin:/opt/pware/samba/3.0.26a/sbin

- Estos son los cuatro scripts:

# cat /usr/bin/uid2name
UID=$1
SID=`wbinfo -U $UID`
wbinfo -s $SID

# cat /usr/bin/gid2name
GID=$1
SID=`wbinfo -G $GID`
wbinfo -s $SID

# cat /usr/bin/name2uid
NAME=$1
SID=`wbinfo -n "$NAME"`
wbinfo -S $SID

# cat /usr/bin/name2gid
NAME=$1
SID=`wbinfo -n "$NAME"`
wbinfo -Y $SID

- Doy permisos de ejecución a todo el mundo...

# chmod +x /usr/bin/uid2name /usr/bin/gid2name /usr/bin/name2uid /usr/bin/name2gid

... y dado que los cuatro están en el PATH...

# name2uid "DOMINIO\smolarek"
10000
# name2gid "DOMINIO\Domain master-users"
10009
# uid2name 10000
DOMINIO\SMOLAREK 1
# gid2name 10009
DOMINIO\Domain master-users 2

- Para establecer permisos en recursos compartidos mediante Samba debemos recurrir a los comandos chown y chmod. No es viable la utilización de las herramientas propias de Windows para gestionar estos permisos.

Otras posibilidades en el entorno que hemos preparado: Conocer los dominios "trusted" en los que nos movemos...

# wbinfo -m
DOMINIO

... conocer los GID de una cuenta...

# wbinfo -r "DOMINIO\smolarek"
10005
10006
10007
...
10025
10000
10001

... mediante uno de los scripts propuestos (gid2name) conocer los nombres de los grupos que nos ha mostrado el comando anterior...

# for i in `wbinfo -r "DOMINIO\smolarek"`
> do
> gid2name $i
> done
DOMINIO\Grupo 10 2
DOMINIO\Grupo 20 2
DOMINIO\Grupo 30 2
...
DOMINIO\Grupo 60 4
BUILTIN\Administrators 4
BUILTIN\Users 4

... e información completa de una cuenta de usuario.

# lsuser "DOMINIO\smolarek"
DOMINIO\smolarek id=10000 pgrp=DOMINIO\usuarios del dominio home=/home shell=/bin/ksh gecos=P Smolarek login=true su=true rlogin=true daemon=true admin=false sugroups=ALL admgroups= tpath=nosak ttys=ALL expires=0 auth1=SYSTEM auth2=NONE umask=22 registry=WINBIND SYSTEM=compat logintimes= loginretries=0 pwdwarntime=0 account_locked=false minage=0 maxage=0 maxexpired=-1 minalpha=0 minother=0 mindiff=0 maxrepeats=8 minlen=0 histexpire=0 histsize=0 pwdchecks= dictionlist= fsize=-1 cpu=-1 data=786432 stack=196608 core=2097151 rss=196608 nofiles=6000 roles= id=10000 pgrp=DOMINIO\usuarios del dominio home=/home shell=/bin/ksh gecos=P Smolarek shell=/bin/ksh pgrp=DOMINIO\usuarios del dominio SID=S-1-5-21-2079082624-1001472106-643713613-4753

Home del documento

Integración Unix AIX, Samba, Winbind, SSH y dominio Windows (5/8) - Winbind y SSH, compilación código fuente de Samba

noreply@blogger.com (Unknown) — Tue, 03 Jan 2006 23:00:00 +0000

Home del documento

En este apartado tratamos la integración de winbind con SSH, lo que nos va a permitir acceder a la linea de comandos del sistema con nuestra cuenta del dominio.

- Lo primero que hay que hacer es añadir a nuestro smb.conf las siguientes líneas en la sección global

template homedir = /home
template shell = /bin/ksh

- Tal como deja entrever la doc oficial de Samba aquí (en la sección "NSS Winbind on AIX") esta integración que pretendemos hacer este SO no es trivial. Es debido a que /usr/lib/security/WINBIND es un módulo que sólo provee servicios de identificación, mientras que para logar a un sistema con SSH necesitamos identificación y autenticación.

Esto nos lleva a la utilización de PAM (Pluggable Authentication Modules) que en el caso de AIX presenta de nuevo ciertas particularidades que complican el tema.

- El primer obstáculo en este punto se presenta debido a que el paquete binario que hemos utilizado no viene precompilado para uttlizar PAM:

# type smbd
smbd is /opt/pware/samba/3.0.26a/sbin/smbd
# smbd -b | grep -i PAM
#

Así que, si no disponemos de otro binario para AIX que incluya las opciones que necesitamos, no queda otro remedio que compilar el paquete a nuestro gusto (Toca descargar código fuente desde alguno de los mirrors de Samba, seguimos con la versión samba-3.0.26a)

- Segundo obstáculo (al menos en mi caso): El SO no trae compilador de C.

# type cc
cc not found.
# type gcc
gcc not found.

- A través de

http://gcc.gnu.org/install/binaries.html

llegamos a

http://www.bullfreeware.com/download/wpar_tt/

donde disponemos de un binario precompilado (gcc-3.3.2-5.aix5.3.ppc.rpm en el momento de redactar) de la versión GNU del compilador de C para AIX (Me bajé también por si acaso la libgcc-3..., pero parece que no la necesita). Instalamos mediante rpm:

# pwd
/usr/src/rpms
# ls
gcc-3.3.2-5.aix5.3.ppc.rpm libgcc-3.3.2-5.aix5.3.ppc.rpm
# rpm -ivh gcc-3.3.2-5.aix5.3.ppc.rpm
gcc ##################################################
# type cc
cc not found.
# type gcc
gcc is /usr/bin/gcc
# ln -s /usr/bin/gcc /usr/bin/cc
#

- Desgunzipado y desempaquetado:

# pwd
/usr/src
# ls samba*.gz
samba-3.0.26a.tar.gz
# gunzip samba*.gz
# ls samba*.tar
samba-3.0.26a.tar
# tar -xf samba*.tar
#

- configure ...:

# cd samba-3.0.26a
# cd source
# ./configure
...
config.status: creating include/config.h
config.status: executing rm-stdint.h commands
config.status: executing rm-stdbool.h commands
#

... pero sólo con esto no llegará a construir el módulo pam_winbind.so (necesario). Entonces lo que he hecho es:

# ./configure --with-pam --with-pam_smbpass
...
config.status: creating script/installbin.sh
config.status: creating script/uninstallbin.sh
config.status: creating include/config.h
config.status: executing rm-stdint.h commands
config.status: executing rm-stdbool.h commands

- Ahora toca make...

# make
...
nsswitch/pam_winbind.c: In function `pam_sm_chauthtok':
nsswitch/pam_winbind.c:1976: warning: passing arg 2 of `pam_get_user' from incompatible pointer type
Linking shared library bin/pam_winbind.so
Target "all" is up to date.

... y me aseguro que el módulo se ha construido:

# find . -name pam_winbind.so
./bin/pam_winbind.so
#

- Lo siguiente sería hacer make install. Atención! Esto sobreescribe la versión de Samba que pudiera haber en /usr/local/samba pero puede que esto no interese por algún motivo. Por ejemplo tras esto habría que volver a añadir la máquina al dominio.

# make install
...
#

- Hemos acabado con la compilación de Samba. Ahora probamos con la nueva versión que hemos construido. Primero linkamos /etc/smb.conf y despues arrancamos cada uno de los daemons...

# ln -s /etc/smb.conf /usr/local/samba/lib/smb.conf
# /usr/local/samba/sbin/smbd -D
# /usr/local/samba/sbin/nmbd -D
# /usr/local/samba/sbin/winbindd -B

... y tras esto volvemos a añadir la máquina al dominio:

# net rpc join -S delta.dominio.com -U administrador
Password:
Joined domain DOMINIO.
#

Home del documento

Integracion Unix AIX, Samba, Winbind, SSH y dominio Windows (6/8) - Winbind y SSH, puesta en marcha y debugado

noreply@blogger.com (Unknown) — Mon, 02 Jan 2006 23:00:00 +0000

Home del documento

Tras construir Samba en el paso anterior, hay que asegurar que /usr/lib/security/WINBIND apunta a lo nuevo y no a la que nos traía el paquete precompilado (que no es la que nos interesa). Por lo tanto hay que cambiar ese soft link (o eliminar ese fichero si lo fuera) y hacer que apunte a la nueva versión, que queda construida en /usr/src/samba-3.0.26a/source/nsswitch/WINBIND:

# ln -s /usr/src/samba-3.0.26a/source/nsswitch/WINBIND /usr/lib/security/WINBIND
# ls -l /usr/lib/security/WINBIND
lrwxrwxrwx 1 root system 46 Dec 10 19:17 /usr/lib/security/WINBIND -> /usr/src/samba-3.0.26a/source/nsswitch/WINBIND
#

- Otro link necesario es el siguiente:

# ln -s /usr/src/samba-3.0.26a/source/bin/pam_winbind.so /usr/lib/security/pam_winbind.so

- También se requiere retocar algunos ficheros del sistema operativo. En concreto /etc/security/login.cfg ...

# tail /etc/security/login.cfg
* Valid values: STD_AUTH, PAM_AUTH
*
*******************************************************************************

usw:
shells = /bin/sh,/bin/bsh,/bin/csh,/bin/ksh,/bin/tsh,/bin/ksh93,/usr/bin/sh,/usr/bin/bsh,/usr/bin/csh,/usr/bin/ksh,/usr/bin/tsh,/usr/bin/ksh93,/usr/bin/rksh,/usr/bin/rksh93,/usr/sbin/uucp/uucico,/usr/sbin/sliplogin,/usr/sbin/snappd
maxlogins = 32767
logintimeout = 60
auth_type = PAM_AUTH

... en el que cambiamos

auth_type = STD_AUTH

por

auth_type = PAM_AUTH ...

... /usr/lib/security/methods.cfg que lo dejamos así ...

# cat /usr/lib/security/methods.cfg
* @(#)78 1.5 src/bos/usr/lib/security/methods.cfg.S, cmdsadm, bos530 6/11/03 17:06:16
.
NIS:
program = /usr/lib/security/NIS
program_64 = /usr/lib/security/NIS_64
DCE:
program = /usr/lib/security/DCE
PAM:
program = /usr/lib/security/PAM
WINBIND:
program = /usr/lib/security/WINBIND

*diferentes options que he probado aqui
*y que no parecen hacer falta
*
* options = db=BUILTIN
* options = auth=PAM
* options = auth=PAM , db=BUILTIN
* options = authonly
#

... y /etc/pam.conf...

# cat /etc/pam.conf
# IBM_PROLOG_BEGIN_TAG
...
#
# Authentication
#
ftp auth required /usr/lib/security/pam_aix
imap auth required /usr/lib/security/pam_aix
login auth required /usr/lib/security/pam_aix
rexec auth required /usr/lib/security/pam_aix
rlogin auth sufficient /usr/lib/security/pam_rhosts_auth
rlogin auth required /usr/lib/security/pam_aix
rsh auth required /usr/lib/security/pam_rhosts_auth
snapp auth required /usr/lib/security/pam_aix
~~sshd auth sufficient /usr/lib/security/pam_winbind.so try_first_pass~~
~~sshd auth sufficient /usr/lib/security/pam_aix try_first_pass~~
sshd auth sufficient /usr/lib/security/pam_aix
sshd auth sufficient /usr/lib/security/pam_winbind.so try_first_pass
su auth sufficient /usr/lib/security/pam_allowroot
su auth required /usr/lib/security/pam_aix
telnet auth required /usr/lib/security/pam_aix
OTHER auth required /usr/lib/security/pam_prohibit

#
# Account Management
#
ftp account required /usr/lib/security/pam_aix
login account required /usr/lib/security/pam_aix
rexec account required /usr/lib/security/pam_aix
rlogin account required /usr/lib/security/pam_aix
rsh account required /usr/lib/security/pam_aix
~~sshd account sufficient /usr/lib/security/pam_winbind.so~~
~~sshd account sufficient /usr/lib/security/pam_aix~~
sshd account sufficient /usr/lib/security/pam_aix
sshd account sufficient /usr/lib/security/pam_winbind.so try_first_pass
su account sufficient /usr/lib/security/pam_allowroot
su account required /usr/lib/security/pam_aix
telnet account required /usr/lib/security/pam_aix
OTHER account required /usr/lib/security/pam_prohibit

#
# Password Management
#
login password required /usr/lib/security/pam_aix
passwd password required /usr/lib/security/pam_aix
rlogin password required /usr/lib/security/pam_aix
sshd password sufficient /usr/lib/security/pam_aix
su password required /usr/lib/security/pam_aix
telnet password required /usr/lib/security/pam_aix
OTHER password required /usr/lib/security/pam_prohibit

#
# Session Management
#
ftp session required /usr/lib/security/pam_aix
imap session required /usr/lib/security/pam_aix
login session required /usr/lib/security/pam_aix
rexec session required /usr/lib/security/pam_aix
rlogin session required /usr/lib/security/pam_aix
rsh session required /usr/lib/security/pam_aix
~~sshd session sufficient /usr/lib/security/pam_aix~~
sshd session required /usr/lib/security/pam_aix
snapp session required /usr/lib/security/pam_aix
su session required /usr/lib/security/pam_aix
telnet session required /usr/lib/security/pam_aix
OTHER session required /usr/lib/security/pam_prohibit
...

#

... en el que hemos añadido ...

~~sshd auth sufficient /usr/lib/security/pam_winbind.so try_first_pass~~
sshd auth sufficient /usr/lib/security/pam_aix try_first_pass

sshd account sufficient /usr/lib/security/pam_winbind.so
sshd account sufficient /usr/lib/security/pam_aix

sshd session sufficient /usr/lib/security/pam_aix

sshd auth sufficient /usr/lib/security/pam_aix
sshd auth sufficient /usr/lib/security/pam_winbind.so try_first_pass

sshd account sufficient /usr/lib/security/pam_aix
sshd account sufficient /usr/lib/security/pam_winbind.so try_first_pass

sshd password sufficient /usr/lib/security/pam_aix

sshd session required /usr/lib/security/pam_aix

Con try_first_pass evitamos la doble solicitud de password.

Estas modificaciones no requieren reiniciar ningun servicio.

- En las diferentes pruebas que estuve realizando también estuve toqueteando el fichero /etc/security/user. En realidad este fichero no hace falta modificarlo.

- Finalmente en el fichero sshd_config (en nuestro caso en la ruta /etc/ssh/sshd_config) se debe indicar

UsePAM yes

- Si queremos impedir el acceso directo como root desde SSH debemos indicar

PermitRootLogin no

en el fichero anterior.

- Hemos acabado con el ssh. Como parece que ya lo tenemos, probamos de acceder con el cliente SSH (En este caso Cygwin)...

smolarek@host1 ~
$ ssh "DOMINIO\smolarek@modsed"
Password:

... pero falló. Probé con -vvv ...

smolarek@host1 ~
$ ssh -vvv "DOMINIO\smolarek@modsed"
Password:
...

pero no me aclaró nada. En este punto, al igual que antes con winbind, toca revisar el log. Dado que el debug del lado cliente no nos ofrece información util al caso, intento debugar en el servidor. Para ello arranco el sshd con -ddd

# /usr/sbin/sshd -ddd
debug2: load_server_config: filename /etc/ssh/sshd_config
debug2: load_server_config: done config len = 174
debug2: parse_server_config: config /etc/ssh/sshd_config len 174
debug1: sshd version OpenSSH_4.3p2
debug1: private host key: #0 type 0 RSA1
debug3: Not a RSA1 key file /etc/ssh/ssh_host_rsa_key.
debug1: read PEM private key done: type RSA
debug1: private host key: #1 type 1 RSA
debug3: Not a RSA1 key file /etc/ssh/ssh_host_dsa_key.
debug1: read PEM private key done: type DSA
debug1: private host key: #2 type 2 DSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-ddd'
debug2: fd 3 setting O_NONBLOCK
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
Generating 768 bit RSA key.
RSA key generation complete.
...

- En diferentes ejecucuiones pude obtener errores que decían más o menos lo siguiente:

Failed to set process credentials
...
setgid: Operation not permitted

- Tras consultar algunos links (
http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.basetechref/doc/basetrf2/setpcred.htm
http://marc.info/?l=openssh-unix-dev&m=107481704511303&w=2
http://fixunix.com/openssh/179321-64bit-compiled-sshd-fails-ibm-aix.html
http://groups.google.com/group/mailing.unix.openssh-dev/browse_thread/thread/6762b3aca31a6c14/69313ba97dd810a2?lnk=st&q=sshd+setpcred+%22Failed+to+set+process+credentials%22#69313ba97dd810a2
) y examinar el código fuente, he deducido que el sshd de mi SO no se manejaba bien con PAM o bien con la funcion setpcred(). No he podido llegar más allá, por lo que ha habido que compilar de nuevo código fuente (en este caso del sshd). En caso de no llegar a ninguna conclusión, tocaría aplicar el parche para debug propuesto en el último de los links descritos. :-(((

Así pues, en uno de los corespondientes mirrors, descargo el openssh con su código fuente. En mi caso es la openssh-4.7p1, descargada desde

ftp://ftp.stacken.kth.se/pub/OpenBSD/OpenSSH/portable

Home del documento

ACTUALIZACION (Añadido) (2008-01-20): Se ha modificado el orden y la forma del fichero pam.conf. Al hacerlo como al principio, cuando caducaba el password del usuario el SO no era capaz de permitir indicar una nueva contraseña ya que faltaba la orden correspoendiente en la sección passwords.

Por otro lado, el orden es más correcto como se indica ahora, es decir, primero pam_aix y después pam_winbind.

Integración Unix AIX, Samba, Winbind, SSH y dominio Windows (7/8) - Winbind y SSH, PAM y compilación del openssh

noreply@blogger.com (Unknown) — Sun, 01 Jan 2006 23:00:00 +0000

Home del documento

- Desgunzipo, destareo (no se muestra, ejemplos mostrados anteriormente) y lanzo el ./configure indicándole los modificadores --prefix y --with-pam. Redirecciono log por si he de consultar algo:

# pwd
/usr/src/openssh-4.7p1
# ./configure --prefix=/opt/openssh-4.7p1 --with-pam 2>&1 | tee /tmp/configure.log
...
checking for getspnam in -lgen... no
checking for library containing basename... none required
checking for deflate in -lz... yes
checking zlib.h usability... no
checking zlib.h presence... no
checking for zlib.h... no
configure: error: *** zlib.h missing - please install first or check config.log ***

- Se queja de que no encuentra zlib. Se puede descargar en http://www.zlib.net (http://www.zlib.net/zlib-1.2.3.tar.gz en el momento de redactar). Pues nada, descargo, desgunzipo, destareo y continuamos (ahora es ./configure , make test y make install)...

# pwd
/usr/src/zlib-1.2.3
# ./configure
Checking for gcc...
Building static library libz.a version 1.2.3 with gcc.
Checking for unistd.h... Yes.
Checking whether to use vs[n]printf() or s[n]printf()... using vs[n]printf()
Checking for vsnprintf() in stdio.h... Yes.
Checking for return value of vsnprintf()... Yes.
Checking for errno.h... Yes.
Checking for mmap support... Yes.
# make test
gcc -O3 -DUSE_MMAP -c example.c
gcc -O3 -DUSE_MMAP -c adler32.c
gcc -O3 -DUSE_MMAP -c compress.c
gcc -O3 -DUSE_MMAP -c crc32.c
gcc -O3 -DUSE_MMAP -c gzio.c
gcc -O3 -DUSE_MMAP -c uncompr.c
gcc -O3 -DUSE_MMAP -c deflate.c
gcc -O3 -DUSE_MMAP -c trees.c
gcc -O3 -DUSE_MMAP -c zutil.c
gcc -O3 -DUSE_MMAP -c inflate.c
gcc -O3 -DUSE_MMAP -c infback.c
gcc -O3 -DUSE_MMAP -c inftrees.c
gcc -O3 -DUSE_MMAP -c inffast.c
ar rc libz.a adler32.o compress.o crc32.o gzio.o uncompr.o deflate.o trees.o zutil.o inflate.o infback.o inftrees.o inffast.o
gcc -O3 -DUSE_MMAP -o example example.o -L. libz.a
gcc -O3 -DUSE_MMAP -c minigzip.c
gcc -O3 -DUSE_MMAP -o minigzip minigzip.o -L. libz.a
hello world
zlib version 1.2.3 = 0x1230, compile flags = 0x55
uncompress(): hello, hello!
gzread(): hello, hello!
gzgets() after gzseek: hello!
inflate(): hello, hello!
large_inflate(): OK
after inflateSync(): hello, hello!
inflate with dictionary: hello, hello!
*** zlib test OK ***
# make install
cp zlib.h zconf.h /usr/local/include
chmod 644 /usr/local/include/zlib.h /usr/local/include/zconf.h
cp libz.a /usr/local/lib
cd /usr/local/lib; chmod 755 libz.a
cd /usr/local/lib; if test -f libz.so.1.2.3; then rm -f libz.so libz.so.1; ln -s libz.so.1.2.3 libz.so; ln -s libz.so.1.2.3 libz.so.1; (ldconfig || true) >/dev/null 2>&1; fi
cp zlib.3 /usr/local/share/man/man3
chmod 644 /usr/local/share/man/man3/zlib.3

- Volvemos a /usr/src/openssh-4.7p1 y lanzamos de nuevo el ./configure del openssh:

# cd /usr/src/openssh-4.7p1
#./configure --prefix=/opt/openssh-4.7p1 --with-pam 2>&1 | tee /tmp/configure.log
IP address in $DISPLAY hack: no
Translate v4 in v6 hack: no
BSD Auth support: no
Random number source: OpenSSL internal ONLY

Host: powerpc-ibm-aix5.3.0.0
Compiler: gcc
Compiler flags: -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare
Preprocessor flags:
Linker flags: -Wl,-blibpath:/usr/lib:/lib
Libraries: -lcrypto -lz
+for sshd: -lpam -ldl

PAM is enabled. You may need to install a PAM control file
for sshd, otherwise password authentication may fail.
Example PAM control files can be found in the contrib/
subdirectory

- Ahora está OK, lanzamos make y make install. Como al lanzar el ./configure indiqué --prefix, la cuestión de que me sobreescriba algo no me preocupa tanto como en el caso del make install de Samba. Aunque hay que tenerlo en cuenta.

# make 2>&1 | tee /tmp/make.log
...
# make install 2>&1 | tee /tmp/make_install.log
...
if [ ! -z "" ]; then ./install-sh -c -m 644 ssh-rand-helper.8.out /opt/openssh-4.7p1/share/man/man8/ssh-rand-helper.8 ; fi
./install-sh -c -m 644 sftp.1.out /opt/openssh-4.7p1/share/man/man1/sftp.1
./install-sh -c -m 644 sftp-server.8.out /opt/openssh-4.7p1/share/man/man8/sftp-server.8
./install-sh -c -m 644 ssh-keysign.8.out /opt/openssh-4.7p1/share/man/man8/ssh-keysign.8
rm -f /opt/openssh-4.7p1/bin/slogin
ln -s ./ssh /opt/openssh-4.7p1/bin/slogin
rm -f /opt/openssh-4.7p1/share/man/man1/slogin.1
ln -s ./ssh.1 /opt/openssh-4.7p1/share/man/man1/slogin.1
if [ ! -d /opt/openssh-4.7p1/etc ]; then ./mkinstalldirs /opt/openssh-4.7p1/etc; fi
mkdir /opt/openssh-4.7p1/etc
exec(): 0509-036 Cannot load program ./ssh-keygen because of the following errors:
0509-150 Dependent module libcrypto.a(libcrypto.so.0.9.7) could not be loaded.
0509-022 Cannot load module libcrypto.a(libcrypto.so.0.9.7).
0509-026 System error: A file or directory in the path name does not exist.
make: 1254-004 The error code from the last command is 255.

Stop.

- De nuevo un error debido a que no encuentra algo, que ahora tiene que ver con ssh-keygen. Me voy al directorio y pregunto con el comando dump (En este link proponen también el uso de los comandos truss y/o strace, y/o comentar las líneas de código que sigue el flujo del programa al pasar por ahí.).

# cd /opt/openssh-4.7p1/bin
# dump -H ssh-keygen

ssh-keygen:

***Loader Section***
Loader Header Information
VERSION# #SYMtableENT #RELOCent LENidSTR
0x00000001 0x000000d8 0x00000465 0x0000003e

#IMPfilID OFFidSTR LENstrTBL OFFstrTBL
0x00000003 0x0000491c 0x0000067a 0x0000495a

***Import File Strings***
INDEX PATH BASE MEMBER
0 /usr/lib:/lib
1 libc.a shr.o
2 libcrypto.a libcrypto.so.0.9.7

- El problema lo tengo en libcrypto.a que aunque lo tengo en el sistema, no lo tengo en la ruta que el espera. En mi SO la librería estaba (desde antes de mi intervención) en /opt/freeware/lib/libcrypto.a. Así pues linko la ruta que él espera de acuerdo con la salida que me ha proporcionado el dump:

# ln -s /opt/freeware/lib/libcrypto.a /usr/lib/libcrypto.a
#

- Vuelvo a lanzar el make install que esta vez funciona.

Al haber construido el sshd indicando un --prefix=/opt/openssh-4.7p1 debo tunear el fichero /opt/openssh-4.7p1/etc/sshd_config indicando la misma opcion (UsePAM yes) que indiqué anteriormente.

- Ahora hay que parar el sshd antiguo y arrancar el nuevo. Por lo que pudiera ser, en este punto es aconsejable activar la entrada por telnet.

# startsrc -t'telnet'
0513-124 The telnet subserver has been started.

- Nos aseguramos...

# lssrc -t'telnet'
Service Command Description Status
telnet /usr/sbin/telnetd telnetd -a active

... aunque mejor probar de acceder directamente con un telnet.

- El sshd antiguo está arriba...

# ps -ef|grep "/sshd"|grep -v grep
root 26364 8068 0 11:02:31 - 0:00 /usr/sbin/sshd

- Lo paramos...

# stopsrc -s sshd
0513-044 The sshd Subsystem was requested to stop.

... y aseguramos que ya no corre.

# ps -ef|grep "/sshd"|grep -v grep

- Arrancamos el sshd nuevo con...

# /opt/openssh-4.7p1/sbin/sshd -d
debug1: sshd version OpenSSH_4.7p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: rexec_argv[0]='/opt/openssh-4.7p1/sbin/sshd'
debug1: rexec_argv[1]='-d'
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
...

... vuelvo a probar con el cliente ssh...

smolarek@host1 ~
$ ssh "DOMINIO\smolarek@modsed"
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
6c:0b:ea:c3:2a:87:b3:28:0e:cd:0d:06:7b:fd:e8:5a.
Please contact your system administrator.
Add correct host key in /cygdrive/c/Documents and Settings/smolarek/.ssh/known_hosts to get rid of this message.
Offending key in /cygdrive/c/Documents and Settings/smolarek/.ssh/known_hosts:21
RSA host key for modsed has changed and you have requested strict checking.
Host key verification failed.

- Al haber cambiar el sshd, cambio la identificación de host remoto. En determinados casos esto hará que el cliente ssh aborte la conexión sin ni tan siquiera llege a solicitar password.

Una posible solución es utilizar la configuración ssh anterior en lugar de la creada en /opt/openssh-4.7p1 al compilar el ssh. La otra es borrar la entrada que identifica el host del servidor en mi directorio (cliente) de ssh. Aquí he utilizado la segunda:

smolarek@host1 ~
$ tail -3 .ssh/known_hosts
192.168.84.124 ssh-rsa AAAAB3N...
192.168.21.1 ssh-dss AAAAB3Nz...
modsed,192.168.92.13 ssh-rsa ...

smolarek@host1 ~
$

- En el caso de mi equipo (cliente) habría que borrar la última linea de $HOME/.ssh/known_hosts cuya entrada corresponde a servidor al que quiero conectarme. Tras esto intento conectar de nuevo

$ ssh "DOMINIO\smolarek@modsed"
The authenticity of host 'modsed (192.168.92.13)' can't be established.
RSA key fingerprint is 6c:0b:ea:c3:2a:87:b3:28:0e:cd:0d:06:7b:fd:e8:5a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'modsed,192.168.92.13' (RSA) to the list of known hosts.
Password:
*******************************************************************************
* *
* *
* Welcome to AIX Version 5.3! *
* *
* *
* Please see the README file in /usr/lpp/bos for information pertinent to *
* this release of the AIX Operating System. *
* *
* *
*******************************************************************************
DOMINIO\smolarek@modsed:/home]

FUNCIONA !!!

Home del documento

Integracion Unix AIX, Samba, Winbind, SSH y dominio Windows (8/8) - Winbind y SSH, ultimos detalles

noreply@blogger.com (Unknown) — Sat, 31 Dec 2005 23:00:00 +0000

Home del documento

- Como ya tenemos el sshd en el estado que queríamos, desactivamos telnet

# stopsrc -t'telnet'

- Y nos aseguramos

# lssrc -t'telnet'
Service Command Description Status
#

- En las pruebas, en alguna ocasión me he encontrado que el host remoto cierra la conexión en el inicio:

smolarek@host1 ~
$ ssh "DOMINIO\smolarek@modsed"
Password:
Connection to modsed closed by remote host.
Connection to modsed closed.

No he sido capaz de determinar la causa. Las veces que ha pasado tenía el log desactivado y en el siguiente intento, tras activarlo, siempre me ha funcionado... (?!). (TODO) Esto me queda pendiente.

- Para incorporar todo lo que hemos creado en el arranque de máquina habría que incorporar nuevos subsistemas (o subservidores) y quitar los antiguos que no procedan. En nuestro caso, en lo que se refiere a ssh y Samba, sólo teníamos un ssh:

# lssrc -a
Subsystem Group PID Status
syslogd ras 9330 active
...
sshd ssh inoperative

- En la operación de añadir un nuevo subsistema sshd-4.7 (previa parada del daemon corriendo)...:

# mkssys -p /opt/openssh-4.7p1/sbin/sshd -s sshd-4.7 -u 0 -G ssh
0513-071 The sshd-4.7 Subsystem has been added.
#

# startsrc -s sshd-4.7
0513-059 The sshd-4.7 Subsystem has been started. Subsystem PID is 29068.
#

... no ha habido suerte. Parece que arranca bién pero luego hago un ps -ef y no hay nada del pid que me ha devuelto el startsrc. (TODO) Como ya no quedan muchas energias me olvido de este tema y lo haré de la manera que mejor conozco, así que me cargo el subsistema que he creado antes...

# rmssys -s sshd-4.7
0513-083 Subsystem has been Deleted.
#

... y hago un script de arranque/parada. Primero creo una carpeta old en /etc/rc.d/rc2.d que es donde está el script Sshd que voy a reutilizar. Antes de nada lo copio en esa carpeta. Tras modificar el fichero Ssshd queda así:

# cat Ssshd
#!/bin/ksh
PROGRAM="/opt/openssh-4.7p1/sbin/sshd"
case "$1" in
start )
echo Starting $PROGRAM...
$PROGRAM
$0 status
;;
stop )
echo Stopping $PROGRAM...
ps -ef | grep "$PROGRAM" | grep -v grep | awk '{print $2}' | xargs kill
$0 status
;;
status )
echo Requesting status...
ps -ef | grep "$PROGRAM" | grep -v grep || echo No $PROGRAM running.
;;
restart )
$0 stop
$0 start
;;
* )
echo "Usage: $0 ( start | stop | restart | status )"
exit 1
esac

- Lo linko con el fichero K de parada...

# ln -s /etc/rc.d/rc2.d/Ssshd /etc/rc.d/rc2.d/Ksshd

- Parecido para Samba:

# cat Ssamba
#!/bin/ksh

SMBD="/usr/local/samba/sbin/smbd"
NMBD="/usr/local/samba/sbin/nmbd"
WINBINDD="/usr/local/samba/sbin/winbindd"
SMBD_OPTIONS="-D"
NMBD_OPTIONS="-D"
WINBIND_OPTIONS="-B"
case "$1" in
start )
for i in "$SMBD $SMBD_OPTIONS" "$NMBD $NMBD_OPTIONS" "$WINBINDD $WINBIND_OPTIONS"
do
echo Starting $i...
$i
done
$0 status
;;
stop )
for i in $SMBD $NMBD $WINBINDD
do
echo Stopping $i...
ps -ef | grep $i | grep -v grep | awk '{print $2}' | xargs kill
done
$0 status
;;
status )
for i in $SMBD $NMBD $WINBINDD
do
echo Requesting $i status...
ps -ef | grep $i | grep -v grep || echo No $i running.
done
;;
restart )
$0 stop
$0 start
;;
* )
echo "Usage: $0 ( start | stop | restart | status )"
exit 1
esac

# ln -s /etc/rc.d/rc2.d/Ssamba /etc/rc.d/rc2.d/Ksamba
#

... para dejarlo todo así:

# ls -l
total 16
lrwxrwxrwx 1 root system 22 Dec 13 11:59 Ksamba -> /etc/rc.d/rc2.d/Ssamba
lrwxrwxrwx 1 root system 5 Dec 05 18:14 Ksshd -> Ssshd
-rwxr-xr-x 1 root system 846 Dec 13 11:57 Ssamba
-rwxr-xr-x 1 root system 579 Dec 11 13:35 Ssshd
drwxr-xr-x 2 root system 256 Dec 05 16:28 old

- El fichero de configuración de Samba smb.conf que hemos preparado determina que el HOME del usuario (template home) sea/home lo cual no es muy ortodoxo. Lo normal es determinar un template home como el siguiente

template home = /home/%D/%U

con %D haciendo referencia al dominio y %U al usuario. Pero esto provoca que si no existe esa ruta recibamos un error tras el login. Para evitarlo, la manera más correcta sería utilzar el módulo PAM pam_mkhomedir, pero este módulo no se incluye en los PAM de AIX. Como workaround se puede dejar el template home como lo habíamos puesto al principo

template home = /home

y gestionar el resto desde el fichero /etc/profile, que se ejecuta tras el login

# cat /etc/profile
# @(#)27 1.20 src/bos/etc/profile/profile, cmdsh, bos530 8/9/94 12:01:38
...
# System wide profile. All variables set here may be overridden by
# a user's personal .profile file in their $HOME directory. However,
# all commands here will be executed at login regardless.

trap "" 1 2 3
readonly LOGNAME
...
# unset LC_MESSAGES.
if [ "$LC_MESSAGES" = "C@lft" -a "$TERM" != "lft" ]
then
unset LC_MESSAGES
fi
...
#control de entrada de usuaris con user/password de windows
SAMBA_CONF=/etc/smb.conf
SAMBA_FIRST_UID=`grep "idmap uid" $SAMBA_CONF|cut -f2 -d"="|cut -f1 -d"-"|grep [0-9]`
SAMBA_VALID_SSH_DOMAIN="DOMINIO"
SAMBA_VALID_SSH_USER="Domain master-users"
UID=`id -u`
if [ $UID -ge $SAMBA_FIRST_UID ] ; then
SAMBA_VALID_SSH_LOGON=$SAMBA_VALID_SSH_DOMAIN\\\\$SAMBA_VALID_SSH_USER
MATCH=`id | grep -i "$SAMBA_VALID_SSH_LOGON"`
#comprova que tingui permis per logar amb ssh amb usuari/pw de AD
if [ "$MATCH" = "" ] ; then
echo "ERROR: Domain account not allowed to SSH login."
exit
fi
#prepara el $HOME
ACCOUNT=$(echo $LOGNAME | sed '1,$s/'$SAMBA_VALID_SSH_DOMAIN'\\//g')
export HOME=/home/$SAMBA_VALID_SSH_DOMAIN/$ACCOUNT
mkdir -p $HOME
cd $HOME
umask 022
#prepara el PATH, para que funcione ui2name gid2name name2uid y name2gid
export PATH=$PATH:/usr/local/samba/bin/
fi
...
trap 1 2 3

- Con lo anterior:

Forzamos que el usuario no pueda hacer un Control-C durante el proceso de validación (código entre los las dos instrucciones trap).
Forzamos que sólo pueden logar con SSH y usuario de Windows aquellos users de AD que pertenezcan al grupo indicado en SAMBA_VALID_SSH_USER (en este caso "admins. del dominio")
Creamos un HOME por usuario
Preparamos el PATH, para que funcionen los patches ui2name, gid2name, name2uid y name2gid que preparamos anteriormente.

- Fuentes oficiales:

http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp
http://samba.org
http://gnu.org
http://openssh.org
http://www.zlib.net

Home del documento

Contenido fichero /data/config/analyzer/policy/0/log_names.txt en Stonegate IPS

noreply@blogger.com (Unknown) — Sat, 31 Dec 2005 23:00:00 +0000

Esta entrada enlaza con esta otra.

IPS Versión 2.0:

LN_AGENT_ID
1290 int32 Inspection agent identifier 1.x\Diagnostics

LN_AVG_AVG
1470 double TBD 1.x\Common

LN_AVG_CNT
1471 int64 TBD 1.x\Common

LN_AVG_MAX
1469 double TBD 1.x\Common

LN_AVG_MIN
1468 double TBD 1.x\Common

LN_AVG_STRUCT
1061 void (Marker showing that this struct contains minimum, maximum, average, and number of samples) 1.x\System

LN_BLACKLIST_DURATION
1052 int32 Duration of blacklisting in seconds. Blacklist response

LN_BYTES
1018 int64 Number of bytes 1.x\Structure fields

LN_BYTES_CHECKED
1019 int64 Number of inspected bytes 1.x\Structure fields

LN_BYTES_MISSED
1020 int64 Number of missed bytes 1.x\Structure fields

LN_CLIENT_PORT
1050 int32 Blacklisted Endpoint1 port (empty = all ports). Blacklist response

LN_CLIENT_PORT_RANGE
1051 int32 Blacklisted Endpoint1 port range. Blacklist response

LN_COMP_ID
3 int32 The identifier of the creator of the log entry. Sender

LN_CONN_DIRECTION
310 int32 Connection direction

LN_CONN_STATUS
309 int32 Connection status

LN_CONN_TYPE
308 int32 Connection type

LN_COUNT
1021 int32 Count 1.x\Structure fields

LN_DHCP_LEASE_EXPIRES
528 ntpstamp DHCP_LEASE_EXPIRES

LN_DHCP_LEASE_GW
529 ipv4 DHCP_LEASE_GW

LN_DHCP_LEASE_IP
530 ipv4 DHCP_LEASE_IP

LN_DHCP_LEASE_NETMASK
531 int32 DHCP_LEASE_NETMASK

LN_DHCP_LEASE_RECEIVED
532 ntpstamp DHCP_LEASE_RECEIVED

LN_END_POINT
504 int32 END_POINT

LN_ETH_LENGTH_AVG
1462 double TBD 1.x\Ethernet\Protocol analysis

LN_ETH_LENGTH_CNT
1463 int64 TBD 1.x\Ethernet\Protocol analysis

LN_ETH_LENGTH_MAX
1461 double TBD 1.x\Ethernet\Protocol analysis

LN_ETH_LENGTH_MIN
1460 double TBD 1.x\Ethernet\Protocol analysis

LN_ETH_TYPE
1082 int32 Type field in Ethernet frame Ethernet\Frame

LN_EVENT_REF_CNT
1293 int32 Number of references to shared objects 1.x\Diagnostics

LN_FIELD_ID
1402 int32 Log field identifier Diagnostics

LN_FIELD_UPDATABLE
1403 bool Log field is content is updateable Diagnostics

LN_FIREWALL_ID
1042 int32 The ID number of firewall node for which the blacklist request is assigned (this must match to the firewall id given blacklist analyzer module). Blacklist response

LN_FPS_MATCHED
1206 int64 Number of fingerprints matched 1.x\Statistics\TCP fingerprinting

LN_FRAMES
1017 int32 Number of frames 1.x\Structure fields

LN_FW_ACCEPTED_BYTES
326 int64 FW_ACCEPTED_BYTES

LN_FW_ACCEPTED_PACKETS
327 int64 FW_ACCEPTED_PACKETS

LN_FW_ACCOUNTED_BYTES
336 int64 FW_ACCOUNTED_BYTES

LN_FW_ACCOUNTED_PACKETS
337 int64 FW_ACCOUNTED_PACKETS

LN_FW_DECRYPTED_BYTES
332 int64 FW_DECRYPTED_BYTES

LN_FW_DECRYPTED_PACKETS
333 int64 FW_DECRYPTED_PACKETS

LN_FW_DROPPED_BYTES
328 int64 FW_DROPPED_BYTES

LN_FW_DROPPED_PACKETS
329 int64 FW_DROPPED_PACKETS

LN_FW_ENCRYPTED_BYTES
330 int64 FW_ENCRYPTED_BYTES

LN_FW_ENCRYPTED_PACKETS
331 int64 FW_ENCRYPTED_PACKETS

LN_FW_NATTED_BYTES
334 int64 FW_NATTED_BYTES

LN_FW_NATTED_PACKETS
335 int64 FW_NATTED_PACKETS

LN_FW_RECEIVED_BYTES
322 int64 FW_RECEIVED_BYTES

LN_FW_RECEIVED_PACKETS
323 int64 FW_RECEIVED_PACKETS

LN_FW_SENT_BYTES
324 int64 FW_SENT_BYTES

LN_FW_SENT_PACKETS
325 int64 FW_SENT_PACKETS

LN_ICMP_FIELD_CODE
1371 int32 ICMP code field value 1.x\ICMP\Protocol analysis

LN_ICMP_FIELD_TYPE
1370 int32 ICMP type field value 1.x\ICMP\Protocol analysis

LN_INFO_MSG
19 string Information Message Situation

LN_INTERFACE
35 int32 Interface

LN_IP_CLIENT_ADDR
1045 ipv4 Blacklisted IP addresses for Endpoint1. Blacklist response

LN_IP_CLIENT_MASK
1046 int32 Netmask for blacklisted Endpoint1 IP address (32 = host address). Blacklist response

LN_IP_DATAGRAM_BYTES
1115 int64 Number of bytes in IPv4 datagrams 1.x\IP\Protocol analysis

LN_IP_DATAGRAM_COUNT
1114 int32 Number of IPv4 datagrams 1.x\IP\Protocol analysis

LN_IP_DATAGRAM_LENGTH
1137 int32 IPv4 datagram length IP\Protocol analysis

LN_IP_DATA_LENGTH
1113 int32 Length of IP data payload (not header) 1.x\IP\Protocol analysis

LN_IP_DEST
1352 ipv4 Destination IPv4 field in packet header IP\Packet

LN_IP_FRAGMENT_SIZE_AVG
1122 double The average fragment size of received ip datagramsx 1.x\IP\Protocol analysis

LN_IP_FRAGMENT_SIZE_CNT
1123 int32 The number of received fragmented ip datagrams 1.x\IP\Protocol analysis

LN_IP_FRAGMENT_SIZE_MAX
1121 int32 The maximum fragment size of received ip datagrams 1.x\IP\Protocol analysis

LN_IP_FRAGMENT_SIZE_MIN
1120 int32 The minimum fragment size of received ip datagrams 1.x\IP\Protocol analysis

LN_IP_FRAG_DIFFERENT_BYTES
1438 int32 Total number of differing bytes IP\Protocol analysis

LN_IP_FRAG_DIFFERENT_BYTES_FIRST
1439 int32 Index of the first differing byte IP\Protocol analysis

LN_IP_FRAG_DIFFERENT_BYTES_LAST
1440 int32 Index of the last differing byte IP\Protocol analysis

LN_IP_FRAG_DIFFERENT_NEW_FIRST
1442 int32 New value for the first differing byte IP\Protocol analysis

LN_IP_FRAG_DIFFERENT_NEW_LAST
1444 int32 New value for the last differing byte IP\Protocol analysis

LN_IP_FRAG_DIFFERENT_OLD_FIRST
1441 int32 Original value for the first differing byte IP\Protocol analysis

LN_IP_FRAG_DIFFERENT_OLD_LAST
1443 int32 Original value for last differing byte IP\Protocol analysis

LN_IP_PROTO
1047 int32 IP protocol number in packet header 1.x\IP\Packet

LN_IP_SERVER_ADDR
1043 ipv4 Blacklisted IP addresses for Endpoint2. Blacklist response

LN_IP_SERVER_MASK
1044 int32 Netmask for blacklisted Endpoint2 IP address (32 = host address). Blacklist response

LN_IP_SOURCE
1351 ipv4 Source IPv4 field in packet header IP\Packet

LN_IP_TTL_AVG
1118 double The average time to live of received ip datagrams 1.x\IP\Protocol analysis

LN_IP_TTL_CNT
1119 int32 The number of received ip datagrams 1.x\IP\Protocol analysis

LN_IP_TTL_MAX
1117 int32 The maximum time to live value of received ip datagrams 1.x\IP\Protocol analysis

LN_IP_TTL_MIN
1116 int32 The minimum time to live value of received ip datagrams 1.x\IP\Protocol analysis

LN_LENGTH
1467 int32 TDB 1.x\Common

LN_MEMORY_USAGE
1292 int32 Used amount of memory 1.x\Diagnostics

LN_MODPAR_BOOL
1320 bool Boolean value agent parameter. 1.x\Configuration

LN_MODPAR_DFA_ID
1323 int32 Fingerprint identifier agent parameter. 1.x\Configuration

LN_MODPAR_DOUBLE
1322 double Floating point value agent parameter. 1.x\Configuration

LN_MODPAR_FIELD_ID
1546 int32 Correlation log field identifier agent parameter. 1.x\Configuration

LN_MODPAR_ID
1318 int32 Identifier of agent parameter. 1.x\Configuration

LN_MODPAR_INT
1319 int32 Integer value agent parameter. 1.x\Configuration

LN_MODPAR_IPV4
1324 ipv4 IP address agent parameter. 1.x\Configuration

LN_MODPAR_SITUATION
1325 int32 Situation identifier agent parameter. 1.x\Configuration

LN_MODPAR_STRING
1321 string String value agent parameter. 1.x\Configuration

LN_MODULE_ID
1291 int32 Module identifier 1.x\Diagnostics

LN_NAT_BALANCE_ID
393 int32 NAT_BALANCE_ID

LN_NAT_MAP_ID
394 int32 NAT_MAP_ID

LN_NUM_LOG_EVENTS
363 int64 Number of log events

LN_PASSED_BYTES
388 int64 PASSED_BYTES

LN_PEER_COMPONENT_ID
307 int32 Peer component id

LN_PEER_END_POINT
506 int32 PEER_END_POINT

LN_PEER_SECURITY_GATEWAY
505 int32 PEER_SECURITY_GATEWAY

LN_PHASE1_FAIL
511 int64 IKE_PHASE1_FAIL

LN_PHASE1_SUCC
510 int64 IKE_PHASE1_SUCC

LN_PHASE2_FAIL
513 int64 IKE_PHASE2_FAIL

LN_PHASE2_SUCC
512 int64 IKE_PHASE2_SUCC

LN_PORT_DEST
1354 int32 TCP or UDP destination port in packet header IP\Packet

LN_PORT_SOURCE
1353 int32 TCP or UDP source port in packet header IP\Packet

LN_PORT_TCP_CLIENT
1357 int32 Port number of the client in a TCP connection 1.x\TCP\Connection

LN_PORT_TCP_SERVER
1358 int32 Port number of the server in a TCP connection 1.x\TCP\Connection

LN_PROBE_FAIL
500 int32 PROBE_FAIL

LN_PROBE_OK
399 int32 PROBE_OK

LN_PROTOCOL
11 int32 IP protocol Packet\Filtering

LN_REF_COMP_ID
1026 int32 The sender id of the referred event Structure fields

LN_REF_CREATION_TIME
1563 ntpstamp The event timestamp of the referred event Structure fields

LN_REF_EVENT_ID
1027 int64 The event id of the referred event Structure fields

LN_SCRIPT_PARAMS
1039 string The parameters for the script in script response. 1.x\Script response

LN_SCRIPT_PATH
1038 string The path of the script to be executed in script response. 1.x\Script response

LN_SELECTED_CACHE
396 int32 SELECTED_CACHE

LN_SELECTED_RTT
395 int32 SELECTED_RTT

LN_SENDER_BUILD
1448 int32 Build number Configuration

LN_SENDER_MODULE_MAJOR
1314 int32 Module major version Configuration

LN_SENDER_MODULE_MINOR
1315 int32 Module minor version Configuration

LN_SENDER_MODULE_PL
1316 int32 Module patchlevel Configuration

LN_SENSOR_INSPECTED_BYTES
357 int64 Bytes inspected by sensor

LN_SENSOR_INSPECTED_PACKETS
358 int64 Packets inspected by sensor

LN_SENSOR_LOST_BYTES
359 int64 Bytes lost in sensor

LN_SENSOR_LOST_PACKETS
360 int64 Packets lost in sensor

LN_SENSOR_PROCESSED_BYTES
355 int64 Bytes processed by sensor

LN_SENSOR_PROCESSED_PACKETS
356 int64 Packets processed by sensor

LN_SENSOR_RECEIVED_BYTES
338 int64 Bytes received by sensor

LN_SENSOR_RECEIVED_PACKETS
339 int64 Packets received by sensor

LN_SERVER_PORT
1048 int32 Blacklisted Endpoint2 port (empty = all ports). Blacklist response

LN_SERVER_PORT_RANGE
1049 int32 Blacklisted Endpoint2 port range. Blacklist response

LN_SHAPING_CLASS
386 int32 SHAPING_CLASS

LN_SHAPING_GUARANTEE
389 int64 SHAPING_GUARANTEE

LN_SHAPING_LIMIT
390 int64 SHAPING_LIMIT

LN_SHAPING_PRIORITY
391 int32 SHAPING_PRIORITY

LN_SMTP_MAIL_AVG_SIZE
1221 double The average e-mail message size seen 1.x\SMTP\Protocol analysis

LN_SMTP_MAIL_CNT
1222 int64 The number of e-mail messages seen 1.x\SMTP\Protocol analysis

LN_SMTP_MAIL_MAX_SIZE
1220 double The largest e-mail message size seen 1.x\SMTP\Protocol analysis

LN_SMTP_MAIL_MIN_SIZE
1219 double The smallest e-mail message size seen 1.x\SMTP\Protocol analysis

LN_SRC_ADDRESS
398 ipv4 SRC_ADDRESS

LN_TCP_BYTE_CNT
1153 int64 Number of payload bytes 1.x\TCP\Protocol analysis

LN_TCP_BYTE_CNT_FRAGMENTED
1154 int64 Number of payload bytes in fragmented segments 1.x\TCP\Protocol analysis

LN_TCP_FLAG_VALUE
1187 int32 Value of the flag field in TCP header 1.x\TCP\Protocol analysis

LN_TCP_MISSING_SEG_CNT
1157 int32 Number of delivered missing segment marks 1.x\TCP\Protocol analysis

LN_TCP_OPTION_KIND
1191 int32 Option kind TCP\Protocol analysis

LN_TCP_SEG_CNT
1149 int32 Number of segments 1.x\TCP\Protocol analysis

LN_TCP_SEG_CNT_FRAGMENTED
1152 int32 Number of fragmented segments 1.x\TCP\Protocol analysis

LN_TEST_INT32
1237 int32 32-bit test integer. Testing

LN_TOTAL_BYTES
387 int64 TOTAL_BYTES

LN_UNRESOLVED_FIELD
1547 int32 Blacklist Response field for which value resolving failed. Blacklist response

LN_VPN_BYTES_RECEIVED
509 int64 VPN_BYTES_RECEIVED

LN_VPN_BYTES_SENT
508 int64 VPN_BYTES_SENT

LN_ACTION
14 int32 Connection action

LN_AGENT_MEMUSAGE
1296 map( LN_AGENT_ID; LN_MEMORY_USAGE, LN_EVENT_REF_CNT) Memory usage of each agent 1.x\Diagnostics

LN_ALERT
25 int32 Type of alert Alert

LN_ALERT_SEVERITY
602 int32 Severity of an alert Situation

LN_ANALYZER_CONFIG_UPDATE
1583 opaque This is an internal log field. The value contains an update to analyzer configuration.

LN_BALANCING_PROBING
397 map( LN_SRC_ADDRESS; LN_PROBE_OK, LN_PROBE_FAIL ) BALANCING_PROBING

LN_BALANCING_SELECTION
392 map( LN_NAT_BALANCE_ID, LN_NAT_MAP_ID; LN_SELECTED_RTT, LN_SELECTED_CACHE ) BALANCING_SELECTION

LN_BLACKLIST_RESPONSE
1053 struct(LN_FIREWALL_ID,LN_IP_SERVER_ADDR,LN_IP_SERVER_MASK,LN_IP_CLIENT_ADDR,LN_IP_CLIENT_MASK,LN_PROTOCOL,LN_SERVER_PORT,LN_SERVER_PORT_RANGE,LN_CLIENT_PORT,LN_CLIENT_PORT_RANGE,LN_BLACKLIST_DURATION,LN_UNRESOLVED_FIELD) Firewall blacklist response Blacklist response

LN_BLOCKED_RECEIVE
1299 bool Receive was blocked temporarily due to low free memory 1.x\Diagnostics

LN_CLUSTER_ID
1554 int32 The identifier of the cluster of the creator of the log entry. Sender

LN_CONFIG_ID
1447 int32 Configuration identifier related to this situation. 1.x\Situation

LN_CONNECTION_ANALYSIS_END
1450 void Application module could not continue analysing traffic stream after this event. Situation

LN_CONNECTIVITY
306 struct(LN_PEER_COMPONENT_ID,LN_CONN_TYPE,LN_CONN_STATUS,LN_CONN_DIRECTION,LN_INFO_MSG) Connectivity

LN_CONN_STAT
1059 void Marker showing that the event record contains the statistics of a connection. 1.x\Situation

LN_CORE_EVENT_REF_CNT
1295 int32 Number of references to shared objects in analyzer core 1.x\Diagnostics

LN_CORE_MEMORY_USAGE
1294 int32 Used amount of memory in analyzer core 1.x\Diagnostics

LN_CORRELATE_EVENT_FIELDS_FOR_MATCHING
1481 int32 Event fields for matching similar events

LN_CORRELATE_EVENT_LIMIT_IN_TIME_WINDOW
1482 int32 Event limit in time window

LN_CORRELATE_EVENT_MATCHING_CRITERIA
1483 int32 Criteria for matching the event fields for counting similar events

LN_CORRELATE_ONLY
1568 bool This is an internal log field. The value is TRUE if the event should not be forwarded to log server, but instead only be used for correlation purposes.

LN_CORRELATE_SID
1567 int32 This is an internal log field. The field contains the identifier of a correlation situation that has ordered this event.

LN_CORRELATE_TIME_SLOTS_IN_TIME_WINDOW
1484 int32 Events are counted for each slot and then summed for the sliding time window

LN_CORRELATE_TIME_WINDOW
1485 int32 A time window in seconds for counting the matched events

LN_CORRELATION_COMP_ID
1584 int32 This log field is used to indicate the policy which is used to decide a response after successful correlation. Usually the value of this field is the same as "Component ID", and the field is omitted. Sender

LN_CORR_EXTRA_PAYLOAD
1587 int32 This is an internal log field. The value contains a log field id that is present in the log record only for correlation purposes and should be stripped before storing the event in the log server database.

LN_DATA_CALL_STATS
1475 struct(LN_AVG_STRUCT,LN_AVG_MIN,LN_AVG_MAX,LN_AVG_AVG,LN_AVG_CNT) TBD 1.x\Statistics\TCP fingerprinting

LN_DETECT_TIME
1280 ntpstamp Time of detecting the situation. 1.x\Time

LN_DHCP_LEASES
527 struct( LN_INTERFACE, LN_DHCP_LEASE_IP, LN_DHCP_LEASE_NETMASK, LN_DHCP_LEASE_GW, LN_DHCP_LEASE_RECEIVED, LN_DHCP_LEASE_EXPIRES ) DHCP_LEASES

LN_DIX_FRAMESBYTES
1454 struct(LN_FRAMES,LN_BYTES) TBD (DIX_FRAMESBYTES) 1.x\Statistics\Ethernet

LN_DIX_TYPES
1457 map( LN_ETH_TYPE; LN_FRAMES, LN_BYTES ) Map describing how many frames and bytes of each Ethernet type in Ethernet (DIX or IEEE) frames 1.x\Statistics\Ethernet

LN_DNS_CLASS
1428 string DNS RR class DNS\Protocol analysis

LN_DNS_HDR_ANCOUNT
1420 int32 DNS answers count DNS\Protocol analysis

LN_DNS_HDR_ARCOUNT
1422 int32 DNS additional section count DNS\Protocol analysis

LN_DNS_HDR_FLAG_TC
1415 bool DNS header flag TC DNS\Protocol analysis

LN_DNS_HDR_ID
1411 int32 DNS message ID DNS\Protocol analysis

LN_DNS_HDR_IS_REQUEST
1412 bool DNS message is request DNS\Protocol analysis

LN_DNS_HDR_NSCOUNT
1421 int32 DNS authority section count DNS\Protocol analysis

LN_DNS_HDR_OPCODE
1413 string DNS operation DNS\Protocol analysis

LN_DNS_HDR_QDCOUNT
1419 int32 DNS questions count DNS\Protocol analysis

LN_DNS_HDR_RCODE
1418 string DNS return code DNS\Protocol analysis

LN_DNS_NAME_LENGTH
1435 int32 DNS name length DNS\Protocol analysis

LN_DNS_OFFSET
1432 int32 DNS message offset where the situation occurs DNS\Protocol analysis

LN_DNS_POINTER
1431 int32 DNS name pointer DNS\Protocol analysis

LN_DNS_QCLASS
1425 string DNS query class DNS\Protocol analysis

LN_DNS_QNAME
1423 string DNS query name (first) DNS\Protocol analysis

LN_DNS_QTYPE
1424 string DNS query type DNS\Protocol analysis

LN_DNS_SECTION
1426 string DNS section DNS\Protocol analysis

LN_DNS_TYPE
1427 string DNS RR type DNS\Protocol analysis

LN_DNS_UDP_PAYLOAD
1433 int32 UDP payload size DNS\Protocol analysis

LN_DNS_UDP_PAYLOAD_BY_OPT
1434 int32 UDP payload advertized by DNS OPT record DNS\Protocol analysis

LN_DPORT
10 int32 Packet destination protocol port Packet\Filtering

LN_DROP
1557 void Drop response was applied.

LN_DROPPED_DGRAM_CNT
1302 int32 Number of dropped datagrams

LN_DROP_CONNECTION
1561 void Drop Response dropped a connection.

LN_DROP_DATAGRAM
1560 void Drop Response dropped a datagram.

LN_DROP_FAILED
1558 void Drop Response could not be applied.

LN_DROP_FRAME
1559 void Drop Response dropped a frame.

LN_DROP_SESSION
1562 void Drop Response dropped a session.

LN_DST
8 ipv4 Packet destination IP address Packet\Filtering

LN_DST_IP_RANGE
526 ipv4 DST_IP_RANGE

LN_ERROR_CNT
1007 int32 Number of errors 1.x\Diagnostics

LN_ERROR_ID
1480 int32 Error identifier Diagnostics

LN_ERROR_MSG
1002 string Error message for debugging and testing 1.x\Diagnostics

LN_ETH_FRAMESBYTES
1456 struct(LN_FRAMES,LN_BYTES) TBD (DIX_FRAMESBYTES) 1.x\Ethernet\Protocol analysis

LN_ETH_FRAME_LENGTH
1089 int32 Ethernet frame length Ethernet\Protocol analysis

LN_ETH_LENGTH_DIST
1464 map(LN_LENGTH;LN_COUNT) TBD 1.x\Ethernet\Protocol analysis

LN_ETH_LENGTH_STATS
1459 struct(LN_AVG_STRUCT,LN_ETH_LENGTH_MIN,LN_ETH_LENGTH_MAX,LN_ETH_LENGTH_AVG,LN_ETH_LENGTH_CNT) TBD (ETH_LENGTH_STATS) 1.x\Ethernet\Protocol analysis

LN_ETH_MIN_FRAME_LENGTH
1090 int32 Minimum ethernet frame length Ethernet\Protocol analysis

LN_ETH_TYPES
1091 map( LN_ETH_TYPE; LN_FRAMES, LN_BYTES ) Map describing how many frames and bytes of each Ethernet type in Ethernet (DIX or IEEE) frames 1.x\Ethernet\Protocol analysis

LN_EVENT_COUNT
1077 int32 Number of events in time frame Situation

LN_EVENT_ID
1030 int64 Event id, unique within one sender Situation

LN_EVENT_UPDATE
1401 int64 Event id for which this event is update Diagnostics

LN_EXCERPT
1016 opaque Recording of application level data stream of the attack. Traffic record\Excerpt

LN_EXCERPT_POS
1348 int32 Position within the attached short recording Traffic record\Excerpt

LN_FACILITY
22 int32 Engine subsystem

LN_FAILED_ALLOC_CNT
1300 int32 Number of failed memory allocation attempts 1.x\Diagnostics

LN_FAILED_RESP_CNT
1301 int32 Number of failed response attempts 1.x\Diagnostics

LN_FBACTION
10015 int32 Identifies an action to be performed to a running command Common

LN_FBCHANNEL
10003 int64 Command channel of Field buffer coded command Common

LN_FBCOMMAND
10002 int32 Field buffer coded command Common

LN_FBDATA
10008 string Block of sginfo data Common

LN_FBDESCRIPTIVENAME
10004 string Description of FBCOMMAND Common

LN_FBENABLED
10011 bool Enable/disable sshd Common

LN_FBENCRYPTED
10006 void Allow policy to be encrypted in sginfo Common

LN_FBERRNO
10013 int32 Error number of failed command Common

LN_FBMESSAGE
10014 string Error message of failed command Common

LN_FBNEWPASSWORD
10012 string New password Common

LN_FBOTP
10016 string Fb new management contact Common

LN_FBPROGRESS_CURRENT
10009 int64 Current progress Common

LN_FBPROGRESS_MAX
10010 int64 Total progress Common

LN_FBREPLY
10007 int32 Field buffer coded reply Common

LN_FBTRANSFER_INCLUDE_CORE_FILES
10005 void Include core files with sginfo Common

LN_FIELDS_UPDATABLE
1404 map( LN_FIELD_ID; LN_FIELD_UPDATABLE) Map of updateable logfields Diagnostics

LN_FORWARD_RULE_TAG
1365 int32 The tag of the last matching rule when forwarding the traffic to the agent that made this log record 1.x\Situation

LN_FP_SITUATION
1004 int32 The situation identifier of a matching fingerprint. 1.x\Situation

LN_FTP_ACCOUNT_LEN
1329 int32 FTP account length FTP\Protocol analysis

LN_FTP_ADAT_ARG_LEN
1336 int32 FTP ADAT argument length FTP\Protocol analysis

LN_FTP_ALLOCATE_SIZE
1330 int32 FTP allocate size FTP\Protocol analysis

LN_FTP_ARG_LEN
1345 int32 FTP argument length FTP\Protocol analysis

LN_FTP_AUTH_ARG_LEN
1335 int32 FTP AUTH argument length FTP\Protocol analysis

LN_FTP_CLIENT_STATE_NAME
1282 string FTP module client state FTP\Protocol analysis

LN_FTP_CLNT_ARG_LEN
1346 int32 FTP CLNT argument length FTP\Protocol analysis

LN_FTP_CMD_BOUND_TYPE
1275 int32 Command bound violation type (0=none, 1=too long pathname, 2=too long username, 3=too long ACCT information, 4=too large ALLO size, 5=too long SITE parameter, 6=too long HELP parameter, 7=too long marker (REST), 8=too large protection buffer size (PBSZ), 9=too long AUTH parameter, 10=too long ADAT parameter, 11=too long MIC parameter, 12=too long CONF parameter, 13=too long ENC parameter, 14=too long LANG parameter, 15=too long EPRT parameter, 16=too long OPTS parameter, 17=too long LPRT parameter, 18=too long password, 19=too long fixed-length command, 20=too long CLNT parameter, 21=too long ESTP parameter) 1.x\FTP\Protocol analysis

LN_FTP_CMD_LEN
1273 int32 The length of the too long FTP command 1.x\FTP\Protocol analysis

LN_FTP_CMD_NAME
1274 string The name of the FTP command (no arguments) FTP\Protocol analysis

LN_FTP_COMMAND
1271 string FTP client command FTP\Protocol analysis

LN_FTP_CONF_ARG_LEN
1338 int32 FTP CONF argument length FTP\Protocol analysis

LN_FTP_ENC_ARG_LEN
1339 int32 FTP ENC argument length FTP\Protocol analysis

LN_FTP_EPRT_ARG_LEN
1341 int32 FTP EPRT argument length FTP\Protocol analysis

LN_FTP_ESTP_ARG_LEN
1347 int32 FTP ESTP argument length FTP\Protocol analysis

LN_FTP_HELP_ARG_LEN
1332 int32 FTP HELP argument length FTP\Protocol analysis

LN_FTP_LANG_ARG_LEN
1340 int32 FTP LANG argument length FTP\Protocol analysis

LN_FTP_LPRT_ARG_LEN
1343 int32 FTP LPRT argument length FTP\Protocol analysis

LN_FTP_MARKER_LEN
1333 int32 FTP REST argument length FTP\Protocol analysis

LN_FTP_MIC_ARG_LEN
1337 int32 FTP MIC argument length FTP\Protocol analysis

LN_FTP_OPTS_ARG_LEN
1342 int32 FTP OPTS argument length FTP\Protocol analysis

LN_FTP_PASSWORD_LEN
1344 int32 FTP password length FTP\Protocol analysis

LN_FTP_PATHNAME_LEN
1327 int32 FTP pathname length FTP\Protocol analysis

LN_FTP_PROTECTION_BUFFER_SIZE
1334 int32 FTP protection buffer size (PBSZ argument) FTP\Protocol analysis

LN_FTP_REPLY
1276 string FTP server reply FTP\Protocol analysis

LN_FTP_REPLY_CODE
1277 int32 FTP server reply code FTP\Protocol analysis

LN_FTP_REPLY_LEN
1278 int32 The length of the too long FTP server reply FTP\Protocol analysis

LN_FTP_REPLY_LINE_LEN
1279 int32 The length of the too long FTP server reply line FTP\Protocol analysis

LN_FTP_SERVER_ACTION
1284 int32 Suspicious server action after a suspicious client command 1) connection terminated (server possibly crashed), 2) server violated the protocol in reply (probably a successful attack), 3) server replied "OK" FTP\Protocol analysis

LN_FTP_SERVER_BANNER
1272 string FTP server banner FTP\Protocol analysis

LN_FTP_SERVER_STATE_NAME
1283 string FTP module server state FTP\Protocol analysis

LN_FTP_SITE_ARG_LEN
1331 int32 FTP SITE argument length FTP\Protocol analysis

LN_FTP_STATE_NAME
1285 string State of FTP session FTP\Protocol analysis

LN_FTP_USERNAME_LEN
1328 int32 FTP username length FTP\Protocol analysis

LN_GROUPING_REASON
1029 string Reason for grouping these event records together. 1.x\Situation

LN_GROUP_ID
1551 int32 The identifier of the situation group that matched in a situation response 1.x\Diagnostics

LN_HANDLER_CALLS
1453 int64 Number of validation handler calls during validation of a TCP connection. 1.x\Statistics\TCP fingerprinting

LN_HTTP_CONTENT_LENGTH
1308 int64 HTTP content length 1.x\HTTP\Protocol analysis

LN_HTTP_CONTENT_TYPE
1307 string HTTP content type 1.x\HTTP\Protocol analysis

LN_HTTP_HEADER
1313 string HTTP header field contents HTTP\Protocol analysis

LN_HTTP_HEADER_NAME
1312 string HTTP header field name HTTP\Protocol analysis

LN_HTTP_NO_REQUEST
1366 void Response could not be associated to any request. HTTP\Protocol analysis

LN_HTTP_REQUESTS_NOT_STORED
1449 int64 Number of requests that could not be stored in this pipelined HTTP connection due to pipeline overflow. HTTP\Protocol analysis

LN_HTTP_REQUEST_HOST
1586 string HTTP request host 1.x\HTTP\Protocol analysis

LN_HTTP_REQUEST_LINE
1566 string HTTP request line HTTP\Protocol analysis

LN_HTTP_REQUEST_MESSAGE_FIELD_NAME_LENGTH
1406 int64 HTTP request header field name length HTTP\Protocol analysis

LN_HTTP_REQUEST_MESSAGE_FIELD_VALUE_LENGTH
1407 int64 HTTP request header field value length HTTP\Protocol analysis

LN_HTTP_REQUEST_METHOD
1303 string HTTP request method HTTP\Protocol analysis

LN_HTTP_REQUEST_URI
1305 string HTTP request uri HTTP\Protocol analysis

LN_HTTP_REQUEST_VERSION
1304 string HTTP request version HTTP\Protocol analysis

LN_HTTP_RESPONSE_CODE
1306 int32 HTTP response code HTTP\Protocol analysis

LN_HTTP_RESPONSE_MESSAGE_FIELD_NAME_LENGTH
1408 int64 HTTP response header field name length HTTP\Protocol analysis

LN_HTTP_RESPONSE_MESSAGE_FIELD_VALUE_LENGTH
1409 int64 HTTP response header field value length HTTP\Protocol analysis

LN_HTTP_URI_LENGTH
1405 int64 HTTP request URI length HTTP\Protocol analysis

LN_ICMP_CODE
101 int32 ICMP code attribute ICMP

LN_ICMP_EXPECTED_MESSAGE_LENGTH
1398 int32 Expected ICMP message length ICMP\Protocol analysis

LN_ICMP_FIELD_ADDRESS_MASK
1385 int32 ICMP address mask field value ICMP\Protocol analysis

LN_ICMP_FIELD_ADDR_ENTRY_SIZE
1378 int32 ICMP address entry size field value ICMP\Protocol analysis

LN_ICMP_FIELD_DATAGRAM_REFERENCE
1372 opaque Header of datagram associated with the ICMP message 1.x\ICMP\Protocol analysis

LN_ICMP_FIELD_DOMAIN_NAME
1391 string ICMP domain name field value ICMP\Protocol analysis

LN_ICMP_FIELD_GATEWAY_IP_ADDR
1374 ipv4 ICMP gateway address field value ICMP\Protocol analysis

LN_ICMP_FIELD_IDENTIFIER
1375 int32 ICMP identifier field value 1.x\ICMP\Protocol analysis

LN_ICMP_FIELD_LIFETIME
1379 int32 ICMP lifetime field value ICMP\Protocol analysis

LN_ICMP_FIELD_NUM_ADDRS
1377 int32 ICMP number of addresses field value ICMP\Protocol analysis

LN_ICMP_FIELD_ORIGINATE_TIMESTAMP
1382 int32 ICMP originate timestamp field value ICMP\Protocol analysis

LN_ICMP_FIELD_OUTBOUND_HOP_COUNT
1387 int32 ICMP outbound hop count field value ICMP\Protocol analysis

LN_ICMP_FIELD_OUTPUT_LINK_MTU
1390 int32 ICMP output link MTU field value ICMP\Protocol analysis

LN_ICMP_FIELD_OUTPUT_LINK_SPEED
1389 int32 ICMP output link speed field value ICMP\Protocol analysis

LN_ICMP_FIELD_POINTER
1373 int32 Byte offset to problem value in datagram associated with the ICMP message ICMP\Protocol analysis

LN_ICMP_FIELD_PREFERENCE_LEVEL
1381 int32 ICMP preference level field value ICMP\Protocol analysis

LN_ICMP_FIELD_RECEIVE_TIMESTAMP
1383 int32 ICMP receive timestamp field value ICMP\Protocol analysis

LN_ICMP_FIELD_RETURN_HOP_COUNT
1388 int32 ICMP return hop count field value ICMP\Protocol analysis

LN_ICMP_FIELD_ROUTER_ADDRESS
1380 ipv4 ICMP router address field value ICMP\Protocol analysis

LN_ICMP_FIELD_SEQUENCE_NUMBER
1376 int32 ICMP sequence number field value ICMP\Protocol analysis

LN_ICMP_FIELD_TRACEROUTE_ID
1386 int32 ICMP traceroute ID field value ICMP\Protocol analysis

LN_ICMP_FIELD_TRANSMIT_TIMESTAMP
1384 int32 ICMP transmit timestamp field value ICMP\Protocol analysis

LN_ICMP_ID
102 int32 ICMP identifier ICMP

LN_ICMP_MESSAGE_LENGTH
1397 int32 ICMP message length ICMP\Protocol analysis

LN_ICMP_REFERENCED_DESTINATION_IP_ADDR
1393 ipv4 Destination IP address of datagram associated with the ICMP message ICMP\Protocol analysis

LN_ICMP_REFERENCED_DESTINATION_PORT
1396 int32 Destination port of IP datagram associated with the ICMP message ICMP\Protocol analysis

LN_ICMP_REFERENCED_IP_PROTO
1394 int32 Protocol field of IP datagram associated with the ICMP message ICMP\Protocol analysis

LN_ICMP_REFERENCED_SOURCE_IP_ADDR
1392 ipv4 Source IP address of datagram associated with the ICMP message ICMP\Protocol analysis

LN_ICMP_REFERENCED_SOURCE_PORT
1395 int32 Source port of IP datagram associated with the ICMP message ICMP\Protocol analysis

LN_ICMP_TYPE
100 int32 ICMP type attribute ICMP

LN_IEEE_FRAMESBYTES
1455 struct(LN_FRAMES,LN_BYTES) TBD (DIX_FRAMESBYTES) 1.x\Statistics\Ethernet

LN_IEEE_TYPES
1458 map( LN_ETH_TYPE; LN_FRAMES, LN_BYTES ) Map describing how many frames and bytes of each Ethernet type in Ethernet (DIX or IEEE) frames 1.x\Statistics\Ethernet

LN_IF_LOGICAL
1477 int32 Logical interface for packet Sender\Capture

LN_IF_PHYSICAL
1478 int32 Physical interface for packet Sender\Capture

LN_IMF_ENCODED_WORD
1228 string The encoded word token related to this event. SMTP\Protocol analysis

LN_IMF_HEADER_FIELD
1225 string The contents (possibly partial) of the mail header field related to this event. SMTP\Protocol analysis

LN_IMF_HEADER_FIELD_NAME
1224 string The name of the mail header field related to this event. SMTP\Protocol analysis

LN_IMF_HEADER_FIELD_POSITION
1229 int32 The number of characters processed in this header field when this event was generated. SMTP\Protocol analysis

LN_IMF_TOKEN
1226 string The syntactical token in mail body related to this event. SMTP\Protocol analysis

LN_IMF_TOKEN_LENGTH
1227 int32 The length of the syntactical token in mail body related to this event. SMTP\Protocol analysis

LN_IPS_SERVICE
1479 struct(LN_IP_PROTO,LN_PORT_TCP_CLIENT,LN_PORT_TCP_SERVER,LN_PORT_SOURCE,LN_PORT_DEST,LN_ICMP_FIELD_TYPE,LN_ICMP_FIELD_CODE) Special field for filtering IPS logs using the defined services. Not present in the log entries as such. 1.x\Protocol header fields

LN_IP_ATTACKER
1359 ipv4 IPv4 address of the attacking host Attacker analysis

LN_IP_CHECKSUM
1110 int32 Checksum number in IPv4 header IP\Protocol analysis

LN_IP_DATAGRAM_NEW_LENGTH
1446 int32 IPv4 datagram suggested new length IP\Protocol analysis

LN_IP_FRAGMENT_OFFSET
1107 int32 Fragment offset in IPv4 IP\Protocol analysis

LN_IP_FRAG_CONFLICT_RANGE
1445 struct(LN_IP_FRAG_DIFFERENT_BYTES,LN_IP_FRAG_DIFFERENT_BYTES_FIRST,LN_IP_FRAG_DIFFERENT_BYTES_LAST,LN_IP_FRAG_DIFFERENT_OLD_FIRST,LN_IP_FRAG_DIFFERENT_NEW_FIRST,LN_IP_FRAG_DIFFERENT_OLD_LAST,LN_IP_FRAG_DIFFERENT_NEW_LAST) Byte range that had content conflict between fragments IP\Protocol analysis

LN_IP_HEADER_FLAGS
1106 int32 Header flags of IPv4 1.x\IP\Protocol analysis

LN_IP_HEADER_LENGTH
1102 int32 Length of IP (version 4) header IP\Protocol analysis

LN_IP_IDENTIFICATION
1105 int32 Identification in IPv4 header IP\Protocol analysis

LN_IP_MINIMUM_FRAGMENT_SIZE_LIMIT
1111 int32 Minimum fragment size limit of IPv4 1.x\IP\Protocol analysis

LN_IP_OFFSET
1112 int32 Start offset of IP from the begining of ethernet frame IP\Protocol analysis

LN_IP_OPTION_LENGTH
1437 int32 Length of IP option that caused the response IP\Protocol analysis

LN_IP_OPTION_NUMBER
1436 int32 IP option number that caused the response IP\Protocol analysis

LN_IP_TARGET
1360 ipv4 IPv4 address of the target host Attacker analysis

LN_IP_TCP_CLIENT
1355 ipv4 IPv4 address of the client in a TCP connection 1.x\TCP\Connection

LN_IP_TCP_SERVER
1356 ipv4 IPv4 address of the server in a TCP connection 1.x\TCP\Connection

LN_IP_TIME_TO_LIVE
1108 int32 Time to live field in IPv4 header 1.x\IP\Protocol analysis

LN_IP_TOTAL_LENGTH
1104 int32 IPv4 total length IP\Protocol analysis

LN_IP_TS_CHECKSUM_ERROR_CNT
1141 int32 Number of datagrams with checksum error 1.x\IP\Protocol analysis

LN_IP_TS_CHECKSUM_ERROR_DATAGRAM_SOURCES
1130 map(LN_IP_SOURCE;LN_IP_DATAGRAM_COUNT,LN_IP_DATAGRAM_BYTES) How many bytes and datagrams with invalid ip checksum we have seen from each source ip 1.x\IP\Protocol analysis

LN_IP_TS_DATAGRAMS_WITH_OPTIONS
1133 int32 How many datagrams we have seen with ip options 1.x\IP\Protocol analysis

LN_IP_TS_DATAGRAM_BYTE_CNT
1138 map( LN_IP_DATAGRAM_LENGTH; LN_IP_DATAGRAM_COUNT ) For each datagram length, the number of datagrams 1.x\IP\Protocol analysis

LN_IP_TS_DESTINATIONS_DATAGRAMSBYTES
1135 map(LN_IP_DEST;LN_IP_DATAGRAM_COUNT,LN_IP_DATAGRAM_BYTES) How many bytes and datagrams we have seen from each target ip 1.x\IP\Protocol analysis

LN_IP_TS_DF_SET_CNT
1131 int32 Number of datagrams seen with dont fragment bit set in ip header 1.x\IP\Protocol analysis

LN_IP_TS_DF_SET_SOURCES
1132 map(LN_IP_SOURCE;LN_IP_DATAGRAM_COUNT,LN_IP_DATAGRAM_BYTES) How many bytes and datagrams we have seen from each source ip with dont fragment bit set in ip header 1.x\IP\Protocol analysis

LN_IP_TS_FIRST_FRAGMENT_SIZE
1127 struct(LN_AVG_STRUCT,LN_IP_FRAGMENT_SIZE_MIN,LN_IP_FRAGMENT_SIZE_MAX,LN_IP_FRAGMENT_SIZE_AVG,LN_IP_FRAGMENT_SIZE_CNT) Statistics on ip fragment size only for first seen fragments for each datagram 1.x\IP\Protocol analysis

LN_IP_TS_FRAGMENTED_DATAGRAMS_SOURCES
1129 map(LN_IP_SOURCE;LN_IP_DATAGRAM_COUNT,LN_IP_DATAGRAM_BYTES) How many bytes and datagrams we have seen from each source ip 1.x\IP\Protocol analysis

LN_IP_TS_FRAGMENT_CNT
1140 int32 Number of datagram fragments 1.x\IP\Protocol analysis

LN_IP_TS_FRAGMENT_SIZE
1126 struct(LN_AVG_STRUCT,LN_IP_FRAGMENT_SIZE_MIN,LN_IP_FRAGMENT_SIZE_MAX,LN_IP_FRAGMENT_SIZE_AVG,LN_IP_FRAGMENT_SIZE_CNT) Statistics on ip fragment size 1.x\IP\Protocol analysis

LN_IP_TS_FRAGMENT_SIZE_DISTRIBUTION
1128 map(LN_IP_DATA_LENGTH; LN_IP_DATAGRAM_COUNT) How many times each fragment size is seen 1.x\IP\Protocol analysis

LN_IP_TS_LENGTH_DISTRIBUTION
1124 map( LN_IP_DATA_LENGTH; LN_IP_DATAGRAM_COUNT) IP datagram length distribution (fragments are counted also, so varies from 0 to ~1480) 1.x\IP\Protocol analysis

LN_IP_TS_OPTIONS_SOURCES_DATAGRAMBYTES
1134 map(LN_IP_SOURCE;LN_IP_DATAGRAM_COUNT,LN_IP_DATAGRAM_BYTES) How many bytes and datagrams from each source ip with ip header options 1.x\IP\Protocol analysis

LN_IP_TS_PROTOCOLS
1139 map( LN_PROTOCOL; LN_IP_DATAGRAM_COUNT, LN_IP_DATAGRAM_BYTES ) For each protocol on IP, the number of datagrams and total number of bytes in them 1.x\IP\Protocol analysis

LN_IP_TS_SOURCES_DATAGRAMSBYTES
1136 map(LN_IP_SOURCE;LN_IP_DATAGRAM_COUNT,LN_IP_DATAGRAM_BYTES) How many bytes and datagrams we have seen from each source ip 1.x\IP\Protocol analysis

LN_IP_TS_TTL
1125 struct(LN_AVG_STRUCT,LN_IP_TTL_MIN,LN_IP_TTL_MAX,LN_IP_TTL_AVG,LN_IP_TTL_CNT) Statistics on ip ttl values 1.x\IP\Protocol analysis

LN_IP_TYPE_OF_SERVICE
1103 int32 Type of service of IP (version 4) header 1.x\IP\Protocol analysis

LN_IP_VERSION
1101 int32 Version of IP header IP\Protocol analysis

LN_LOG_ID
2 int64 Data Identifier System

LN_LONG_MSG
601 string Long description of alert 1.x\Alert

LN_MAC_DEST
1349 mac Destination MAC field in packet header Ethernet\Frame

LN_MAC_DEST_OTHER
1025 mac The former MAC address corresponding to the seen target IPv4 address 1.x\Ethernet\Frame

LN_MAC_SOURCE
1361 mac Source MAC field in packet header Ethernet\Frame

LN_MAC_SOURCE_OTHER
1023 mac The former MAC address corresponding to the seen source IPv4 address 1.x\Ethernet\Frame

LN_MEM_AVAIL
1298 int32 Total amount of free memory 1.x\Diagnostics

LN_MISSED_CALL_STATS
1476 struct(LN_AVG_STRUCT,LN_AVG_MIN,LN_AVG_MAX,LN_AVG_AVG,LN_AVG_CNT) TBD 1.x\Statistics\TCP fingerprinting

LN_MODPAR_VAL
1326 struct(LN_MODPAR_ID,LN_MODPAR_INT,LN_MODPAR_BOOL,LN_MODPAR_STRING,LN_MODPAR_DOUBLE,LN_MODPAR_DFA_ID,LN_MODPAR_IPV4,LN_MODPAR_SITUATION,LN_MODPAR_FIELD_ID) List of agent parameters and the defined values. 1.x\Configuration\Inspection

LN_MODULE_MEMUSAGE
1297 map( LN_MODULE_ID; LN_MEMORY_USAGE, LN_EVENT_REF_CNT) Memory usage of each module 1.x\Diagnostics

LN_NODE_CONFIGURATION
304 string Current configuration Configuration

LN_NODE_CONFIGURATION_TIMESTAMP
305 ntpstamp Configuration upload time

LN_NODE_DYNUP
303 string Update package level Configuration

LN_NODE_ID
4 ipv4 The IPv4 address of the originator Sender

LN_NODE_LOAD
320 int32 Node load

LN_NODE_STATUS
300 int32 Node status

LN_NODE_VERSION
301 string Node version Sender

LN_NOT_FINAL_VALUE
1410 void Entry is not final Diagnostics

LN_NUM_ALERTS
1037 int32 [OUT OF USE] The number of configured alert responses in this event record. 1.x\Alert

LN_NUM_ALERT_RESPONSES
365 int64 Number of alert responses performed by this engine

LN_NUM_BLACKLIST_RESPONSES
369 int64 Number of blacklist responses performed by this engine

LN_NUM_DISCARD_RESPONSES
368 int64 Number of discard responses performed by this engine

LN_NUM_LOG_RESPONSES
364 int64 Number of log responses performed by this engine

LN_NUM_RECORD_RESPONSES
366 int64 Number of record responses performed by this engine

LN_NUM_RESET_RESPONSES
367 int64 Number of reset responses performed by this engine

LN_ONE_LAN
1549 void The "View interface as one LAN" option was enabled on the logical interface through which the packet was received. Sender\Capture

LN_ORIG_ALERT
1486 int32 Type of alert in the referred event Alert

LN_ORIG_ALERT_SEVERITY
1487 int32 Severity of an alert in the referred event Situation

LN_ORIG_COMP_ID
1488 int32 The identifier of the log entry's creator in the referred event Sender

LN_ORIG_CONFIG_ID
1489 int32 Configuration identifier related to the situation in the referred event

LN_ORIG_EVENT_COUNT
1490 int32 Count of events in the time frame of the referred event Situation

LN_ORIG_EVENT_ID
1491 int64 Event id of the referred event, unique within one sender Situation

LN_ORIG_GROUP_ID
1556 int32 Identifier of the situation group that matched in a situation response 1.x\Diagnostics

LN_ORIG_NODE_ID
1493 ipv4 The IPv4 address of the originator of the referred event Sender

LN_ORIG_NUM_ALERTS
1494 int32 [OUT OF USE] The number of configured alert responses in the referred event record. 1.x\Alert

LN_ORIG_RESPONSE_ID
1555 int32 Identifier of the response that was generated, when the response was a situation response 1.x\Diagnostics

LN_ORIG_SENDER_AGENT_ID
1495 int32 Sender agent identification in the referred event 1.x\Configuration

LN_ORIG_SENDER_CONFIG_ID
1545 int32 Configuration identifier of the sender of the referred event 1.x\Configuration

LN_ORIG_SENDER_MODULE_ID
1492 int32 Sender module identification in the referred event Configuration

LN_ORIG_SENDER_MODULE_VERSION
1496 struct(LN_SENDER_MODULE_MAJOR,LN_SENDER_MODULE_MINOR,LN_SENDER_MODULE_PL,LN_SENDER_BUILD) Module version in the referred event

LN_ORIG_SENDER_OS_VER
1497 string The operating system version of the sender of the referred event

LN_ORIG_SITUATION
1498 int32 The identifier of the situation that caused sending the referred event Situation

LN_ORIG_TIMESTAMP
1499 ntpstamp Time of creating the referred event record Time

LN_ORIG_TIME_FRAME_BEGIN
1500 ntpstamp Ntp stamp of begin of time frame in the referred event Configuration

LN_ORIG_TIME_FRAME_END
1501 ntpstamp Ntp stamp of end of time frame in the referred event Configuration

LN_PACKET_ANALYSIS_END
1369 void Module could not continue analysing network packet or datagram after this event. Situation

LN_PACKET_DATA
1367 opaque Recorded packet data Traffic record\Full capture

LN_PACKET_NOT_SEEN
1350 void Flag indicating that the related packet was not seen IP\Protocol analysis

LN_PASSIVE_DISCARD
1565 void Discard response was made with passive option. Drop response

LN_RECEIVED_LOG_EVENTS
361 map( LN_COMP_ID; LN_NUM_LOG_EVENTS ) RECEIVED_LOG_EVENTS

LN_RECEPTION_TIME
24 ntpstamp Reception Time Time

LN_RECORD_FRAME_CACHED
1368 void Marker showing that this frame was received before the recording was started. The frame was taken from a memory cache to this recording. Traffic record\Full capture

LN_RECORD_ID
1041 int64 Identification of the connection recording Traffic record\Full capture

LN_REF_EVENT
1028 struct(LN_REF_COMP_ID,LN_REF_EVENT_ID,LN_REF_CREATION_TIME) Reference to another event Reference

LN_RESPONSE_ID
1550 int32 The identifier of the matched situation response 1.x\Diagnostics

LN_RULE_ID
20 int32 Rule tag value of acceptance rule Packet\Filtering

LN_SA_AUTH_ALG
520 int32 SA_AUTH_ALG

LN_SA_BUNDLE
514 int32 SA_BUNDLE

LN_SA_CIPHER_ALG
518 int32 SA_CIPHER_ALG

LN_SA_COMPRESSION_ALG
519 int32 SA_COMPRESSION_ALG

LN_SA_EXPIRE_HARDLIMIT
524 ntpstamp SA_EXPIRE_HARDLIMIT

LN_SA_EXPIRE_SOFTLIMIT
523 ntpstamp SA_EXPIRE_SOFTLIMIT

LN_SA_INCOMING
517 bool SA_INCOMING

LN_SA_KB_HARDLIMIT
522 int32 SA_KB_HARDLIMIT

LN_SA_KB_SOFTLIMIT
521 int32 SA_KB_SOFTLIMIT

LN_SA_RESPONDER
516 bool SA_RESPONDER

LN_SA_TYPE
515 int32 SA_TYPE

LN_SCAN_ICMP_ECHO_NO_RESPONSE_COUNTER
1520 int32 Number of distinct ICMP Echo Request (ping) destinations that did not reply to a request. Scan detection\ICMP\Analysis

LN_SCAN_ICMP_ECHO_NO_RESPONSE_LIMIT
1521 int32 Maximum number of allowed ICMP Echo Request (ping) destinations per originator that do not reply to a request. 1.x\Scan detection\ICMP\Analysis

LN_SCAN_ICMP_ECHO_REQUEST_COUNTER
1518 int32 Number of distinct ICMP Echo Request (ping) destinations detected. Scan detection\ICMP\Analysis

LN_SCAN_ICMP_ECHO_REQUEST_LIMIT
1519 int32 Maximum number of allowed ICMP Echo Request (ping) destinations per originator. 1.x\Scan detection\ICMP\Analysis

LN_SCAN_ICMP_ECHO_TARGETS
1530 string List of the detected ICMP Echo Request (ping) destinations. Scan detection\ICMP\Analysis

LN_SCAN_ICMP_NETMASK_NO_RESPONSE_COUNTER
1528 int32 Number of distinct ICMP Netmask Request destinations that did not reply to a request. Scan detection\ICMP\Analysis

LN_SCAN_ICMP_NETMASK_NO_RESPONSE_LIMIT
1529 int32 Maximum number of allowed ICMP Netmask Request destinations per originator that do not reply to a request. 1.x\Scan detection\ICMP\Analysis

LN_SCAN_ICMP_NETMASK_REQUEST_COUNTER
1526 int32 Number of distinct ICMP Netmask Request destinations detected. Scan detection\ICMP\Analysis

LN_SCAN_ICMP_NETMASK_REQUEST_LIMIT
1527 int32 Maximum number of allowed ICMP Netmask Request destinations per originator. 1.x\Scan detection\ICMP\Analysis

LN_SCAN_ICMP_NETMASK_TARGETS
1532 string List of the detected ICMP Netmask Request destinations. Scan detection\ICMP\Analysis

LN_SCAN_ICMP_NO_RESPONSE_COUNTER
1516 int32 Number of the distinct ICMP request destinations for any of counted ICMP requests (Echo Request, Timestamp Request, Netmask Request) that did not reply to a request. Scan detection\ICMP\Analysis

LN_SCAN_ICMP_NO_RESPONSE_LIMIT
1517 int32 Maximum number of allowed ICMP request destinations per originator for any of the counted ICMP requests (Echo Request, Timestamp Request, Netmask Request) that do not reply to a request. 1.x\Scan detection\ICMP\Analysis

LN_SCAN_ICMP_REQUEST_COUNTER
1514 int32 Number of the distinct ICMP request destinations for the counted ICMP requests (Echo Request, Timestamp Request, Netmask Request). Scan detection\ICMP\Analysis

LN_SCAN_ICMP_REQUEST_LIMIT
1515 int32 Maximum number of allowed ICMP request destinations per originator for any of the counted ICMP requests (Echo Request, Timestamp Request, Netmask Request). 1.x\Scan detection\ICMP\Analysis

LN_SCAN_ICMP_TIMESTAMP_NO_RESPONSE_COUNTER
1524 int32 Number of the distinct ICMP Timestamp Request destinations that did not reply to a request. Scan detection\ICMP\Analysis

LN_SCAN_ICMP_TIMESTAMP_NO_RESPONSE_LIMIT
1525 int32 Maximum number of allowed ICMP Timestamp Request destinations per originator that do not reply to a request. 1.x\Scan detection\ICMP\Analysis

LN_SCAN_ICMP_TIMESTAMP_REQUEST_COUNTER
1522 int32 Number of the distinct ICMP Timestamp Request destinations detected. Scan detection\ICMP\Analysis

LN_SCAN_ICMP_TIMESTAMP_REQUEST_LIMIT
1523 int32 Maximum number of allowed ICMP Timestamp Request destinations per originator. 1.x\Scan detection\ICMP\Analysis

LN_SCAN_ICMP_TIMESTAMP_TARGETS
1531 string List of the detected ICMP Timestamp Request destinations. Scan detection\ICMP

LN_SCAN_RULE_TAG
1513 int32 Rule tag of the rule where the scan domain is defined. 1.x\Scan detection

LN_SCAN_START_TIME
1511 ntpstamp Detected starting time of this port scanning activity. Scan detection

LN_SCAN_TCP_NEGATIVE_COUNTER
1537 int32 Number of distinct TCP destinations that denied attempted connections with TCP RST. Scan detection\TCP\Analysis

LN_SCAN_TCP_NEGATIVE_LIMIT
1538 int32 Maximum number of allowed TCP destinations per originator that deny connection attempts with TCP RST. 1.x\Scan detection\TCP\Analysis

LN_SCAN_TCP_NORMAL_COUNTER
1533 int32 Number of distinct TCP destinations with successful connection establishment and bidirectional data transfer. Scan detection\TCP\Analysis

LN_SCAN_TCP_NORMAL_LIMIT
1534 int32 Maximum number of allowed TCP destinations per originator with whom normal connection establishment is allowed. 1.x\Scan detection\TCP\Analysis

LN_SCAN_TCP_NO_ACK_COUNTER
1541 int32 Number of distinct TCP destinations targeted for illegal TCP segments. Scan detection\TCP\Analysis

LN_SCAN_TCP_NO_ACK_LIMIT
1542 int32 Maximum number of allowed TCP destinations per originator targeted for illegal TCP segments. 1.x\Scan detection\TCP\Analysis

LN_SCAN_TCP_NO_ACK_TARGETS
1544 string List of TCP destinations targeted for illegal TCP segments. Scan detection\TCP\Analysis

LN_SCAN_TCP_NO_RESPONSE_COUNTER
1539 int32 Number of distinct TCP destinations that did not reply to connection attempts. Scan detection\TCP\Analysis

LN_SCAN_TCP_NO_RESPONSE_LIMIT
1540 int32 Maximum number of allowed TCP destinations per originator that do not reply to connection attempts. 1.x\Scan detection\TCP\Analysis

LN_SCAN_TCP_POSITIVE_COUNTER
1535 int32 Number of distinct TCP destinations with successful connection establishment but no data sent by the client within the defined time limit. Scan detection\TCP\Analysis

LN_SCAN_TCP_POSITIVE_LIMIT
1536 int32 Maximum number of distinct TCP destinations per originator with normal connection establishment where the client sends no data (successful scan of open TCP port). 1.x\Scan detection\TCP\Analysis

LN_SCAN_TCP_TARGETS
1543 string List of the detected TCP port scan destinations. Scan detection\TCP

LN_SCAN_UDP_NEGATIVE_COUNTER
1502 int32 Number of distinct destinations detected that replied with ICMP Port Unreachable (successful scan of closed UDP port). Scan detection\UDP\Analysis

LN_SCAN_UDP_NEGATIVE_LIMIT
1503 int32 Maximum number of destinations per originator allowed to reply with ICMP Port Unreachable. 1.x\Scan detection\UDP\Analysis

LN_SCAN_UDP_POSITIVE_COUNTER
1504 int32 Number of bi-directional UDP conversations detected. Scan detection\UDP\Analysis

LN_SCAN_UDP_POSITIVE_LIMIT
1505 int32 Maximum number of allowed destinations per originator that reply with UDP datagram. 1.x\Scan detection\UDP\Analysis

LN_SCAN_UDP_PROBE_COUNTER
1506 int32 Number of destinations that did not reply using UDP. Scan detection\UDP\Analysis

LN_SCAN_UDP_PROBE_LIMIT
1507 int32 Maximum number of allowed destinations per originator that do not reply to UDP datagram with UDP datagram. 1.x\Scan detection\UDP\Analysis

LN_SCAN_UDP_TARGETS
1510 string List of the detected UDP destinations. Scan detection\UDP

LN_SCAN_UDP_TARGET_COUNTER
1508 int32 Total number of UDP destinations detected. Scan detection\UDP\Analysis

LN_SCAN_UDP_TARGET_LIMIT
1509 int32 Maximum number of allowed of UDP destinations per originator. 1.x\Scan detection\UDP\Analysis

LN_SCRIPT_RESPONSE
1040 struct(LN_SCRIPT_PATH,LN_SCRIPT_PARAMS) Script response 1.x\Script response

LN_SECURITY_GATEWAY
502 int32 SECURITY_GATEWAY

LN_SENDER_AGENT_ID
1364 int32 Sender agent identification 1.x\Configuration

LN_SENDER_CONFIG_ID
1281 int32 Configuration identifier of the sender 1.x\Configuration

LN_SENDER_MODULE_ID
1363 int32 Sender module identification Configuration

LN_SENDER_MODULE_VERSION
1317 struct(LN_SENDER_MODULE_MAJOR,LN_SENDER_MODULE_MINOR,LN_SENDER_MODULE_PL,LN_SENDER_BUILD) Module version Configuration

LN_SENDER_OS_VER
1005 string The operating system version of the sender. 1.x\Configuration

LN_SENDER_TYPE
31 int32 Sender type Configuration

LN_SENDER_TYPE_OBSOLETE
1564 int32 Placeholder for removed SENDER_TYPE field (had wrong id).

LN_SENT_LOG_EVENTS
362 map( LN_COMP_ID; LN_NUM_LOG_EVENTS ) SENT_LOG_EVENTS

LN_SERVICE
27 struct(LN_IP_PROTO,LN_PORT_TCP_CLIENT,LN_PORT_TCP_SERVER,LN_PORT_SOURCE,LN_PORT_DEST,LN_ICMP_FIELD_TYPE,LN_ICMP_FIELD_CODE) Special field for filtering logs using the defined services. Not present in the log entries as such. 1.x\Protocol header fields

LN_SESSION_EVENT
302 int32 Session monitoring event code (1 = new, 2 = update, 3 = remove)

LN_SIP_CALL_ID
1579 string SIP call ID SIP\Protocol analysis

LN_SIP_CONTACT
1578 string SIP contact address SIP\Protocol analysis

LN_SIP_CONTENT_LENGTH
1582 string Length of message body SIP\Protocol analysis

LN_SIP_CONTENT_TYPE
1581 string Content type of message body SIP\Protocol analysis

LN_SIP_FROM
1576 string From address SIP\Protocol analysis

LN_SIP_HEADER
1574 string SIP header field contents SIP\Protocol analysis

LN_SIP_HEADER_NAME
1575 string SIP header field name SIP\Protocol analysis

LN_SIP_REQUEST_METHOD
1569 string SIP request method SIP\Protocol analysis

LN_SIP_REQUEST_URI
1570 string SIP request URI SIP\Protocol analysis

LN_SIP_REQUEST_VERSION
1571 string SIP request version SIP\Protocol analysis

LN_SIP_RESPONSE_REASON_PHRASE
1573 string SIP response reason-phrase SIP\Protocol analysis

LN_SIP_RESPONSE_STATUS_CODE
1572 string SIP response status code SIP\Protocol analysis

LN_SIP_TO
1577 string To address SIP\Protocol analysis

LN_SIP_VIA
1580 string SIP VIA address SIP\Protocol analysis

LN_SITUATION
1000 int32 The identifier of the situation that caused sending this event. Situation

LN_SMTP_COMMAND
1213 string Suspicious SMTP command sent by the client. SMTP\Protocol analysis

LN_SMTP_MAIL_STATS
1223 struct(LN_AVG_STRUCT,LN_SMTP_MAIL_MIN_SIZE,LN_SMTP_MAIL_MAX_SIZE,LN_SMTP_MAIL_AVG_SIZE,LN_SMTP_MAIL_CNT) Statistics on e-mail messages 1.x\SMTP\Protocol analysis

LN_SMTP_MISPLACED_COMMAND
1214 string Command that occurred in a wrong place in the command sequence. SMTP\Protocol analysis

LN_SMTP_RECIPIENT
1212 string SMTP recipient (RCPT parameter forward path) of the envelope. SMTP\Protocol analysis

LN_SMTP_REPLY
1217 string Suspicious SMTP reply message sent by the server. SMTP\Protocol analysis

LN_SMTP_REVERSE_PATH
1211 string SMTP reverse path (MAIL FROM parameter) of the envelope. SMTP\Protocol analysis

LN_SMTP_SERVER_ACTION
1218 int32 Suspicious server action after a suspicious client command 1) connection terminated (server possibly crashed), 2) server violated the protocol in reply (probably a successful attack), 3) server replied "OK" SMTP\Protocol analysis

LN_SMTP_SERVER_BANNER
1216 string Banner sent by the SMTP server at the beginning of the connection. SMTP\Protocol analysis

LN_SMTP_TRANSACTION_STATE
1215 string State of SMTP transaction. SMTP\Protocol analysis

LN_SOURCE_FILE
1286 string Source file name Diagnostics

LN_SOURCE_FILE_LINE
1287 int32 Line number in source file Diagnostics

LN_SPORT
9 int32 Packet source protocol port Packet\Filtering

LN_SRC
7 ipv4 Packet source IP address Packet\Filtering

LN_SRC_IP_RANGE
525 ipv4 SRC_IP_RANGE

LN_SRC_VLAN
112 int32 Source VLAN

LN_SRVHELPER_ID
110 int32 Protocol agent identification

LN_SSH1_FORBIDDEN_AUTHENTICATION_METHOD
1289 string Forbidden SSHv1 authentication method. 1.x\SSH\Protocol analysis

LN_SSH1_FORBIDDEN_CIPHER
1288 string Forbidden SSHv1 cipher. 1.x\SSH\Protocol analysis

LN_SSH1_HOST_KEY_BITS
1267 int32 SSHv1 host key bits. SSH\Protocol analysis

LN_SSH1_HOST_KEY_MIN_LEN_VALUE
1268 int32 SSHv1 host key minimum length value. 1.x\SSH\Protocol analysis

LN_SSH1_SERVER_KEY_BITS
1265 int32 SSHv1 server key bits. SSH\Protocol analysis

LN_SSH1_SERVER_KEY_MIN_LEN_VALUE
1266 int32 SSHv1 server key minimum length value. 1.x\SSH\Protocol analysis

LN_SSH_CALC_CLIENT_CRYPTO_BIT_RATIO
1270 float Calculated SSH client crypto bit ratio. SSH\Protocol analysis

LN_SSH_CALC_SERVER_CRYPTO_BIT_RATIO
1269 float Calculated SSH server crypto bit ratio. SSH\Protocol analysis

LN_SSH_CLIENT_CRYPTO_BIT_RATIO
1252 float SSH client crypto bit ratio. 1.x\SSH\Protocol analysis

LN_SSH_CLIENT_CRYPTO_BLOCK_COUNT
1254 int32 SSH client crypto block count. 1.x\SSH\Protocol analysis

LN_SSH_CLIENT_CRYPTO_BLOCK_LEN
1253 int32 SSH client crypto block length. 1.x\SSH\Protocol analysis

LN_SSH_SERVER_CRYPTO_BIT_RATIO
1249 float SSH server crypto bit ratio. 1.x\SSH\Protocol analysis

LN_SSH_SERVER_CRYPTO_BLOCK_COUNT
1251 int32 SSH server crypto block count. 1.x\SSH\Protocol analysis

LN_SSH_SERVER_CRYPTO_BLOCK_LEN
1250 int32 SSH server crypto block length. 1.x\SSH\Protocol analysis

LN_STORAGE_SERVER_ID
30 int32 Internal field for log server.

LN_SYSLOG_FACILITY
1055 int32 Syslog entry facility 1.x\Syslog

LN_SYSLOG_LEVEL
1056 int32 Syslog entry level 1.x\Syslog

LN_SYSLOG_MSG
1054 string Syslog entry message string 1.x\Syslog

LN_SYSLOG_TYPE
111 int32 Syslog message type Syslog

LN_TCP_CONNECTION_START_TIME
1142 ntpstamp The start time of the TCP connection. TCP\Connection

LN_TCP_EXPECTED_LEN
1451 int32 Expected length of an item. 1.x\TCP\Protocol analysis

LN_TCP_FLAG_USAGE_TS_STAT
1199 map( LN_TCP_FLAG_VALUE; LN_COUNT ) FIXME!!! 1.x\TCP\Protocol analysis

LN_TCP_FP_CONN_STATS
1472 struct(LN_BYTES_CHECKED,LN_BYTES_MISSED,LN_FPS_MATCHED) TBD 1.x\TCP\Protocol analysis

LN_TCP_FP_CONN_STATS_C
1473 struct(LN_BYTES_CHECKED,LN_BYTES_MISSED,LN_FPS_MATCHED) TBD 1.x\TCP\Protocol analysis

LN_TCP_FP_CONN_STATS_S
1474 struct(LN_BYTES_CHECKED,LN_BYTES_MISSED,LN_FPS_MATCHED) TBD 1.x\TCP\Protocol analysis

LN_TCP_HANDSHAKE_SEEN
1362 bool Was the TCP connection initial handshake seen? TCP\Connection

LN_TCP_OPTION_LENGTH
1585 int32 Length of TCP option that caused the response TCP\Protocol analysis

LN_TCP_OPTION_USAGE_TS_STAT
1200 map( LN_TCP_OPTION_KIND; LN_COUNT ) FIXME!!! 1.x\TCP\Protocol analysis

LN_TCP_RST
1552 void Reset Response was applied to reset a TCP connection. 1.x\Reset response

LN_TCP_RST_NO_TCP
1553 void Reset Response could not be applied because there was no TCP connection. 1.x\Reset response

LN_TCP_SEEN_LEN
1452 int32 The length of an item seen in network traffic. 1.x\TCP\Protocol analysis

LN_TCP_SEG_TS_STAT
1196 struct(LN_TCP_SEG_CNT,LN_TCP_SEG_CNT_FRAGMENTED,LN_TCP_BYTE_CNT,LN_TCP_BYTE_CNT_FRAGMENTED,LN_TCP_MISSING_SEG_CNT) TCP traffic statistics 1.x\TCP\Protocol analysis

LN_TEST_BOOL
1233 bool Test boolean Testing

LN_TEST_DOUBLE
1235 double Test double Testing

LN_TEST_FLOAT
1234 float Test float Testing

LN_TEST_INT64
1241 int64 64-bit test integer Testing

LN_TEST_IPV4
1240 ipv4 Test IPv4 address Testing

LN_TEST_MAC
1243 mac Test MAC address Testing

LN_TEST_MAP
1239 map(LN_TEST_INT32,LN_TEST_INT32;LN_TEST_INT32,LN_TEST_INT32) Test map Testing

LN_TEST_NTPSTAMP
1242 ntpstamp Test timestamp Testing

LN_TEST_STRING
1236 string Test string Testing

LN_TEST_STRUCT
1238 struct(LN_TEST_INT32,LN_IP_SOURCE) Test struct Testing

LN_TEST_VOID
1244 void Test void data Testing

LN_TIMESTAMP
1 ntpstamp Time of creating the event record. Time

LN_TIME_FRAME_BEGIN
1075 ntpstamp Ntp stamp of begin of time frame Configuration

LN_TIME_FRAME_END
1076 ntpstamp Ntp stamp of end of time frame Configuration

LN_TRAFFIC_COUNTERS
319 map( LN_INTERFACE; LN_FW_RECEIVED_BYTES, LN_FW_RECEIVED_PACKETS, LN_FW_SENT_BYTES, LN_FW_SENT_PACKETS, LN_FW_ACCEPTED_BYTES, LN_FW_ACCEPTED_PACKETS, LN_FW_DROPPED_BYTES, LN_FW_DROPPED_PACKETS, LN_FW_ENCRYPTED_BYTES, LN_FW_ENCRYPTED_PACKETS, LN_FW_DECRYPTED_BYTES, LN_FW_DECRYPTED_PACKETS, LN_FW_NATTED_BYTES, LN_FW_NATTED_PACKETS, LN_FW_ACCOUNTED_BYTES, LN_FW_ACCOUNTED_PACKETS, LN_SENSOR_RECEIVED_BYTES, LN_SENSOR_RECEIVED_PACKETS, LN_SENSOR_PROCESSED_BYTES, LN_SENSOR_PROCESSED_PACKETS, LN_SENSOR_INSPECTED_BYTES, LN_SENSOR_INSPECTED_PACKETS, LN_SENSOR_LOST_BYTES, LN_SENSOR_LOST_PACKETS ) Traffic counters

LN_TRAFFIC_SHAPING
385 map( LN_SHAPING_CLASS, LN_INTERFACE; LN_TOTAL_BYTES, LN_PASSED_BYTES, LN_SHAPING_GUARANTEE, LN_SHAPING_LIMIT, LN_SHAPING_PRIORITY ) TRAFFIC_SHAPING

LN_TS_RULE_TAG
1060 int32 The rule tag of the rule that caused compilation of the time slot statistics in this event record. 1.x\Sender

LN_UDP_DATAGRAM_SIZE
1205 int32 The size of the UDP datagram. UDP\Protocol analysis

LN_UDP_FP_CONN_STATS
1309 struct(LN_BYTES_CHECKED,LN_BYTES_MISSED,LN_FPS_MATCHED) Connection statistics made by udp_fp (both streams) 1.x\UDP\Protocol analysis

LN_UDP_FP_CONN_STATS_C
1310 struct(LN_BYTES_CHECKED,LN_BYTES_MISSED,LN_FPS_MATCHED) Connection statistics made by udp_fp (client stream) 1.x\UDP\Protocol analysis

LN_UDP_FP_CONN_STATS_S
1311 struct(LN_BYTES_CHECKED,LN_BYTES_MISSED,LN_FPS_MATCHED) Connection statistics made by udp_fp (server stream) 1.x\UDP\Protocol analysis

LN_VLAN_ID
1548 int32 Identifier of the VLAN the packet was received from 1.x\Sender\Capture

LN_VPN_ID
501 int32 VPN_ID

LN_VPN_STATISTICS
507 map( LN_END_POINT, LN_PEER_SECURITY_GATEWAY, LN_PEER_END_POINT; LN_VPN_BYTES_SENT, LN_VPN_BYTES_RECEIVED, LN_PHASE1_SUCC, LN_PHASE1_FAIL, LN_PHASE2_SUCC, LN_PHASE2_FAIL ) VPN_STATISTICS

LN_VPN_STATUS
503 map( LN_END_POINT, LN_PEER_SECURITY_GATEWAY, LN_PEER_END_POINT; LN_CONN_STATUS, LN_INFO_MSG ) VPN_STATUS

LN_WHOLE_SESSION_SEEN
1003 bool True, if no data of this session has been missed up to this point. Protocol analysis\General