Today is my Hong Kong boss last day in company, and also the Beijing boss came to Hong Kong for handover and some meetings.
So we have activities to farewell HK boss and welcome BJ boss.
For farewell we went to Karaoke in CEO, and for welcome we went to happy valley to have seafood dinner, both nice!
2007/08/31
2007/08/30
Distrubia
今晚和Gi & FK 去了睇剛上映的 "窺兇殺人", 改編自希治閣的"後窗", 由變型金剛的傻仔男主角主演, 故事好簡單, 講一個犯了事被軟禁家中不能外出的少年, 因為太悶, 偷窺附近的鄰居, 最後竟發現了連環殺手, 差點被殺, 幸好大命(一定啦, 男主角) 結果殺死了該罪犯, 還得到鄰居少女的歡心! 正所謂又食又拎!
推廣 Linux 時的言行守則
[From CLDP]
請記得你代表了 Linux 網路社會的一份子, 因此在 mailing list 或 newsgroup 中發言時, 請保持專業風度。避免使用粗鄙的言語及不雅的稱謂 (譯註: 例如用鄙夷的字眼稱呼意見不同的人或自己不滿意的公司產品等等) 想像你自己是 Linux 虛擬企業公司的一員, 而 Linux 核心作者 Torvalds 先生是你的總裁。你說的話會左右 Linux 網路社會在一般讀者心目中的形象。
* 不要過分吹噓 Linux 的好處, 下誇張不實的結論。這麼做不但有失專業風度, 而且會招惹來無謂的爭辯。
* 在網路上看到文章時, 請深思熟慮之後才做回應。有深度, 條理清晰的文章不僅可以讓你的讀者獲益良多, 也會令他們更敬重你的學識能力。
* 千萬不要去咬 ``筆戰誘餌'' (flame-bait)。有太多的討論到最後都落入 ``我用的作業系統比你的好'' 這樣的俗套。我們只要不卑不亢地把 Linux 能做的事描述清楚就好了, 不必再多說些甚麼。
* 切記如果你說了些傷人或羞辱人的話, 他們這些不愉快的經驗可能會一傳十, 十傳百。 因此萬一要是你的話真的惹惱了誰, 請一定要想辦法補救。
* 強調 Linux 的功能與優點就好, 不需要去詆毀其他的系統。我們這份產品的品質就是它自己最佳的廣告材料。
* 請尊重其他作業系統。 雖然 Linux 功能強大, 並不見得適合每一個人使用。
* 請以正式的名稱來稱呼其他產品。 用一些所謂 ``有創意的拼法'' 來消遣某些公司或他們的產品對於推廣 Linux 並無助益。如果我們希望別人尊重 Linux, 我們也應該尊重其他產品。
* 銘謝或推崇軟體與文件的作者時, 應盡力避免張冠李戴。 Linux 只是核心部份而已。 如果沒有 GNU 計劃, 麻省理工學院, 柏克萊以及其他許多人的貢獻, 一般使用者並不能真的直接使用 Linux 核心。
* 不要一口咬定 Linux 是解決某一個問題的唯一答案。正因為 Linux 網路社會珍惜 Linux 帶給我們的自由, 我們也更應該尊重其他人選擇的自由。
* 總會有 Linux 無法解決問題的情況, 這個時候應該要主動認清事實, 而且提出替代方案。
請記得你代表了 Linux 網路社會的一份子, 因此在 mailing list 或 newsgroup 中發言時, 請保持專業風度。避免使用粗鄙的言語及不雅的稱謂 (譯註: 例如用鄙夷的字眼稱呼意見不同的人或自己不滿意的公司產品等等) 想像你自己是 Linux 虛擬企業公司的一員, 而 Linux 核心作者 Torvalds 先生是你的總裁。你說的話會左右 Linux 網路社會在一般讀者心目中的形象。
* 不要過分吹噓 Linux 的好處, 下誇張不實的結論。這麼做不但有失專業風度, 而且會招惹來無謂的爭辯。
* 在網路上看到文章時, 請深思熟慮之後才做回應。有深度, 條理清晰的文章不僅可以讓你的讀者獲益良多, 也會令他們更敬重你的學識能力。
* 千萬不要去咬 ``筆戰誘餌'' (flame-bait)。有太多的討論到最後都落入 ``我用的作業系統比你的好'' 這樣的俗套。我們只要不卑不亢地把 Linux 能做的事描述清楚就好了, 不必再多說些甚麼。
* 切記如果你說了些傷人或羞辱人的話, 他們這些不愉快的經驗可能會一傳十, 十傳百。 因此萬一要是你的話真的惹惱了誰, 請一定要想辦法補救。
* 強調 Linux 的功能與優點就好, 不需要去詆毀其他的系統。我們這份產品的品質就是它自己最佳的廣告材料。
* 請尊重其他作業系統。 雖然 Linux 功能強大, 並不見得適合每一個人使用。
* 請以正式的名稱來稱呼其他產品。 用一些所謂 ``有創意的拼法'' 來消遣某些公司或他們的產品對於推廣 Linux 並無助益。如果我們希望別人尊重 Linux, 我們也應該尊重其他產品。
* 銘謝或推崇軟體與文件的作者時, 應盡力避免張冠李戴。 Linux 只是核心部份而已。 如果沒有 GNU 計劃, 麻省理工學院, 柏克萊以及其他許多人的貢獻, 一般使用者並不能真的直接使用 Linux 核心。
* 不要一口咬定 Linux 是解決某一個問題的唯一答案。正因為 Linux 網路社會珍惜 Linux 帶給我們的自由, 我們也更應該尊重其他人選擇的自由。
* 總會有 Linux 無法解決問題的情況, 這個時候應該要主動認清事實, 而且提出替代方案。
2007/08/28
CF to IDE adapter
Today I bought a CF to IDE adapter, in order to boot my computer from a CF card, why do so? The reason is complicated:
1. My computer only got IDE on board controller, I inserted a PCI SATA adapter
2. The BIOS cannot boot the computer from the SATA adapter
3. I was using IDE hard disk before, and now I got a SATA hard disk
4. I can move all data from the IDE hard disk to the SATA hard disk, but according to (2), it cannot boot
5. According to (1), I cannot use 2 hard disks on my computer
6. In conclusion, I need to find something to boot and then mount the SATA hard disk
7. CF to IDE adapter only costs $35 and it is bootable, so I decided to install a boot loader on a CF card and boot from it
Now I am still doing the data migration, afterward I can try boot it up.
1. My computer only got IDE on board controller, I inserted a PCI SATA adapter
2. The BIOS cannot boot the computer from the SATA adapter
3. I was using IDE hard disk before, and now I got a SATA hard disk
4. I can move all data from the IDE hard disk to the SATA hard disk, but according to (2), it cannot boot
5. According to (1), I cannot use 2 hard disks on my computer
6. In conclusion, I need to find something to boot and then mount the SATA hard disk
7. CF to IDE adapter only costs $35 and it is bootable, so I decided to install a boot loader on a CF card and boot from it
Now I am still doing the data migration, afterward I can try boot it up.
2007/08/26
New LCD TV
As the old Toshiba TV at home got some problems, we decided to change
the TV, today I went to buy a new TV.
We saw many models, and came up to 3 models - JNC, Mag and LG, after
some discussion, mum decided to go for Mag, the reason is ... it is easier to
clean...
the TV, today I went to buy a new TV.
We saw many models, and came up to 3 models - JNC, Mag and LG, after
some discussion, mum decided to go for Mag, the reason is ... it is easier to
clean...
2007/08/25
Private
開始轉回正版懷抱的感慨.
記得10幾年前上網還未流行, 歌曲CD $100 隻 都好多人買, 正版 game 都要成200蚊隻,
都幾多人肯買.
之後出左d 翻版game帶, 磁碟, 30蚊隻翻版 CD, 搞到正版games/CD少好多人買,
到上網流行, 什至連翻版CD/翻版games都冇得撈了...
翻版越來越易得到, 人就越來越唔珍惜歌/games了, 正版? 明明是正確的行為, 現在
被視為"有錢人"的行為, "傻仔" 的行為...
記得10幾年前上網還未流行, 歌曲CD $100 隻 都好多人買, 正版 game 都要成200蚊隻,
都幾多人肯買.
之後出左d 翻版game帶, 磁碟, 30蚊隻翻版 CD, 搞到正版games/CD少好多人買,
到上網流行, 什至連翻版CD/翻版games都冇得撈了...
翻版越來越易得到, 人就越來越唔珍惜歌/games了, 正版? 明明是正確的行為, 現在
被視為"有錢人"的行為, "傻仔" 的行為...
2007/08/24
OpenSuSE 10.2 on iBook
As Debian looks quite boring and ... outdated in package list, I would like to reinstall the Linux on my iBook.
I've tried Ubuntu, Fedora, Gentoo on it, originally I want to try YellowDog, but cannot download for a whole night, so I switched to download OpenSuSE, see if it is good.
After downloading the 3.7 GB DVD image, burnt and tested, oops, the DVD cannot boot on my iBook, strange, after several trials, I decided to download the network install CD (88MB in size) and use network to install from the DVD.
But the network installation is very slow, and I found that I can choose media instead of network in installation source, so I use network install CD to boot and change to the burnt DVD, and it worked!
Now updating the whole system, should be finished in half hour.
I've tried Ubuntu, Fedora, Gentoo on it, originally I want to try YellowDog, but cannot download for a whole night, so I switched to download OpenSuSE, see if it is good.
After downloading the 3.7 GB DVD image, burnt and tested, oops, the DVD cannot boot on my iBook, strange, after several trials, I decided to download the network install CD (88MB in size) and use network to install from the DVD.
But the network installation is very slow, and I found that I can choose media instead of network in installation source, so I use network install CD to boot and change to the burnt DVD, and it worked!
Now updating the whole system, should be finished in half hour.
2007/08/21
New game - Slide Adventure: Mag Kid
今晚買咗新 game, 叫Slide Adventure: Mag Kid, 滑動小子,
是一隻好特別的 game, 要加件 hardware 落部機度, 好似 mouse 咁控制, 幾得意!
官網: http://www.nintendo.co.jp/ds/aguj/
是一隻好特別的 game, 要加件 hardware 落部機度, 好似 mouse 咁控制, 幾得意!
官網: http://www.nintendo.co.jp/ds/aguj/
Chemotherapy
After 2 rounds of chemotherapy, father's lung cancer treatment has some progress.
1. The main cancer tissue collapsed from 3.x cm in diameter to 1.x cm in diameter, ie. 3/4 of the cell killed in 2 rounds.
2. There are some small spots of cancer tissue on the opposite side of lung, now there is none.
3. The white blood cell in his blood is still OK for next round of chemotherapy, which according to the doctor, is due to healthy body.
Of course, still need to keep the therapy until the tissue is small enough in order to do radioactive-therapy, which will kill most of the cancer cell at one time.
Anyway, it is still a good news.
1. The main cancer tissue collapsed from 3.x cm in diameter to 1.x cm in diameter, ie. 3/4 of the cell killed in 2 rounds.
2. There are some small spots of cancer tissue on the opposite side of lung, now there is none.
3. The white blood cell in his blood is still OK for next round of chemotherapy, which according to the doctor, is due to healthy body.
Of course, still need to keep the therapy until the tissue is small enough in order to do radioactive-therapy, which will kill most of the cancer cell at one time.
Anyway, it is still a good news.
2007/08/20
Horrible China Airline...
[轉自 ETtoday]
華航在20日一架波音737-800型編號CI-120客機，由桃園國際機場飛往琉球那霸機場，在飛機降落後在滑行時，由於地勤人員發現飛機上出現著火情 形，華航依照作業程序，立即疏散乘客及機組人員，包括157名旅客與8名機組員都平安逃離飛機，華航已在下午由總經理趙國帥前往琉球做相關事件的後續處 理。
華航公關處長孫鴻文表示，今（20）日上午8:15起飛，由桃園飛往琉球那霸機場的飛機，所使用的機型為2002年7月採購的波音737-800機型，機 齡為5年，目前華航共有相同機型12架，一架飛機約為7~8千萬美金。搭載乘客包括8位商務艙、147位經濟艙乘客、2位小孩，總共有157名乘客，而機 組人員為2位機長、6位空服員，全部共165名。
根據外電新聞以及搭乘這架飛機的旅客陳述表示，這架飛機在降落時機長已經透過廣播表示，飛機出現狀況，在停好飛機時需要做緊急的疏散下飛機，而多 位旅客也都表示，降落時曾看到飛機在冒煙。不過華航表示，飛機是在降落於滑行期間，由地勤人員看到飛機正在起火，因而通知機長，機長立刻做緊急的疏散處 理，並以滑梯下滑的方式到停機坪來做疏散。
華航在20日一架波音737-800型編號CI-120客機，由桃園國際機場飛往琉球那霸機場，在飛機降落後在滑行時，由於地勤人員發現飛機上出現著火情 形，華航依照作業程序，立即疏散乘客及機組人員，包括157名旅客與8名機組員都平安逃離飛機，華航已在下午由總經理趙國帥前往琉球做相關事件的後續處 理。
華航公關處長孫鴻文表示，今（20）日上午8:15起飛，由桃園飛往琉球那霸機場的飛機，所使用的機型為2002年7月採購的波音737-800機型，機 齡為5年，目前華航共有相同機型12架，一架飛機約為7~8千萬美金。搭載乘客包括8位商務艙、147位經濟艙乘客、2位小孩，總共有157名乘客，而機 組人員為2位機長、6位空服員，全部共165名。
根據外電新聞以及搭乘這架飛機的旅客陳述表示，這架飛機在降落時機長已經透過廣播表示，飛機出現狀況，在停好飛機時需要做緊急的疏散下飛機，而多 位旅客也都表示，降落時曾看到飛機在冒煙。不過華航表示，飛機是在降落於滑行期間，由地勤人員看到飛機正在起火，因而通知機長，機長立刻做緊急的疏散處 理，並以滑梯下滑的方式到停機坪來做疏散。
2007/08/18
Thinkpad T60 CPU changed
Change Thinkpad CPU DIY:
1. Remove screws on the back for keyboard, wrist rest and touch pad.
2. Remove wrist rest and touch pad, remember to detach the cable under the touch pad.
3. Move away the keyboard, no need to detach if you are brave enough, just move it a bit, so that you can touch the thing under keyboard.
4. Remove the cover of wireless antenna.
5. Remove screws for CPU fan and move it a bit to see the CPU.
6. Turn the screws for CPU lock 180" to release the CPU.
7. Change it and undo the above steps.
I changed the CPU on T60 myself, now it changed from T2400 to T7600, speed boost and got 64bit mode enabled.
Forgotten to take pictures!
1. Remove screws on the back for keyboard, wrist rest and touch pad.
2. Remove wrist rest and touch pad, remember to detach the cable under the touch pad.
3. Move away the keyboard, no need to detach if you are brave enough, just move it a bit, so that you can touch the thing under keyboard.
4. Remove the cover of wireless antenna.
5. Remove screws for CPU fan and move it a bit to see the CPU.
6. Turn the screws for CPU lock 180" to release the CPU.
7. Change it and undo the above steps.
I changed the CPU on T60 myself, now it changed from T2400 to T7600, speed boost and got 64bit mode enabled.
Forgotten to take pictures!
2007/08/17
2007/08/16
Last day in Taiwan
今朝晏左少少起身, 9點鐘就 check out 了, 總共$11,xxx 台幣, 都算幾貴~
返到公司休息一陣, 就去 Bestcom 做少少 presentation, 因為好近, 所以 11點幾就返公司了.
在公司附近食個 quick lunch 就要跟台灣的同事們分別了.
個幾鐘頭的飛機, 就返到香港了, 香港天氣不好, 落大雨...
不過台灣明天都應該會打風呢.
總括而言, 台北是好地方, 比北京好好多!
返到公司休息一陣, 就去 Bestcom 做少少 presentation, 因為好近, 所以 11點幾就返公司了.
在公司附近食個 quick lunch 就要跟台灣的同事們分別了.
個幾鐘頭的飛機, 就返到香港了, 香港天氣不好, 落大雨...
不過台灣明天都應該會打風呢.
總括而言, 台北是好地方, 比北京好好多!
2007/08/15
Taipei at night
今晚同啲台灣同事去咗新光三越附近的“筷子”食了晚餐，感覺不錯啊，食嘅都係簡單嘢，但就好啱胃口。
食完飯之後去咗士林夜市行下。我記得四年前左右嚟過台北，跟團嚟，去過士林，今次再去，有少少唔同咗，多咗好多可以玩嘅嘢，幾好呀。我仲認到其中一啲地方添！例如 city jungle,呢度有啲似香港嘅女人街或者廟街一帶咁，都幾熱鬧！
行完就坐捷運返嚟嚕～
食完飯之後去咗士林夜市行下。我記得四年前左右嚟過台北，跟團嚟，去過士林，今次再去，有少少唔同咗，多咗好多可以玩嘅嘢，幾好呀。我仲認到其中一啲地方添！例如 city jungle,呢度有啲似香港嘅女人街或者廟街一帶咁，都幾熱鬧！
行完就坐捷運返嚟嚕～
Taiwan Seminar
今日下晝公司搞 seminar, 其中一部分係我講的，冇錯，係講國語！
一小時的 presentation 同埋 demo, 好緊張刺激，原本諗住講英文的，不過好似好古怪咁，都係用中文好了。
連續講一小時的國語，難度果然高，好在觀眾好以都明明地。
今晚可以輕鬆一下了！不過明天還有一個小小的 presentation, 但只係對 partner, 易好多。
一小時的 presentation 同埋 demo, 好緊張刺激，原本諗住講英文的，不過好似好古怪咁，都係用中文好了。
連續講一小時的國語，難度果然高，好在觀眾好以都明明地。
今晚可以輕鬆一下了！不過明天還有一個小小的 presentation, 但只係對 partner, 易好多。
2007/08/14
Second day in Taiwan
Today after I went to eat the famous 牛肉面，and then went to have meeting with TSMC (台積電) in 新竹。
We took the latest railway, Taiwan High Speed Rail (高鐵) to 新竹, very like Yuen Long, nearly nothing there, just some fields and pools.
On the meeting I need to present in Mandarin, so hard for me, I was not sure that they understand what I say or not, but looks like they are more puzzling than me...
After the meeting it was already 6:30pm and someone drove us to the rail station and we back to Taipei station to had a quick dinner there, and now I am resting in hotel.
Tomorrow there will be a session for me, so excited.
We took the latest railway, Taiwan High Speed Rail (高鐵) to 新竹, very like Yuen Long, nearly nothing there, just some fields and pools.
On the meeting I need to present in Mandarin, so hard for me, I was not sure that they understand what I say or not, but looks like they are more puzzling than me...
After the meeting it was already 6:30pm and someone drove us to the rail station and we back to Taipei station to had a quick dinner there, and now I am resting in hotel.
Tomorrow there will be a session for me, so excited.
Les Suite Taipei
台北商旅不錯，房間整齊，設備完善，密度不高，不會好像香港樓宇一樣擠在一起。
不過可能第一晚，睡得不慣，起了兩次床，今晚應該可以睡得好一點。
今天早上自己從飯店坐捷運回公司，飯店在忠孝復興站，公司在西門站，只有5個車站，不過要轉車，結果... 一上車就上錯方向了，幸好另一方向下一個站便是總站，最後終於一個人走了回公司，很有成功感～
不過可能第一晚，睡得不慣，起了兩次床，今晚應該可以睡得好一點。
今天早上自己從飯店坐捷運回公司，飯店在忠孝復興站，公司在西門站，只有5個車站，不過要轉車，結果... 一上車就上錯方向了，幸好另一方向下一個站便是總站，最後終於一個人走了回公司，很有成功感～
2007/08/13
First day in Taipei
今朝10點就出門口去機場了，要坐12:20的飛機到台北公幹。
今次搭飛機好搞笑，我對正個空姐坐，佢個樣成隻熊貓咁，睇佢應該唔夠訓，坐在空姐坐位等起飛時，我睇住佢釣魚！
釣釣下魚，突然 Toilet 門口個燈罩甩左，跌左落佢側邊，嚇到佢彈起身，佢仲問我有冇嚇親，我估佢嚇親就真，哈哈...
(後來問左佢了，原來今朝再早D佢係由上海黎香港班機度做，休息唔夠幾個鐘又黎過)
2點半就到台北了，有車接送，真好，大約3點半就到公司了。
公司環境不錯，雖然細細間，但因為係 Business Center，配套好好。
住在“台北商旅”，個樣好有氣派～ 希望真係咁啦。
今次搭飛機好搞笑，我對正個空姐坐，佢個樣成隻熊貓咁，睇佢應該唔夠訓，坐在空姐坐位等起飛時，我睇住佢釣魚！
釣釣下魚，突然 Toilet 門口個燈罩甩左，跌左落佢側邊，嚇到佢彈起身，佢仲問我有冇嚇親，我估佢嚇親就真，哈哈...
(後來問左佢了，原來今朝再早D佢係由上海黎香港班機度做，休息唔夠幾個鐘又黎過)
2點半就到台北了，有車接送，真好，大約3點半就到公司了。
公司環境不錯，雖然細細間，但因為係 Business Center，配套好好。
住在“台北商旅”，個樣好有氣派～ 希望真係咁啦。
2007/08/10
Typhoon in a sudden
昨晚睇完戲返屋企，一路上都好大雨，新聞話風球已經登陸，的士司機話“打風唔成三日雨”，呢幾日都會好大雨。
今天零晨已經除下所有風球，早上不停落雨。
但好景不常，風球突然轉向再襲香港，結果幾小時之內一號、三號、八號風球出齊，下晝兩點半八號風球，由於銅鑼灣好大雨，我唔行去坐巴士，改坐地鐵。
點知地鐵實在太多人，銅鑼灣、中環、香港、南昌站都塞晒，由地鐵到西鐵到輕鐵共用了兩個鐘頭才回到家，天文台實在太過份！
2007/08/09
Simpson movie
其實之前一直都冇睇過 Simpson 的卡通片, 不過老友叫到, 今晚去了睇 Simpson 大電影, 中文版, 由頭笑到尾, 全場d人都好大聲笑!
不過套戲都有少少溫情位, 有少少意義咁啦...
出戲院好好好大雨, 返到屋企竟然乜雨都冇, 激死.
不過套戲都有少少溫情位, 有少少意義咁啦...
出戲院好好好大雨, 返到屋企竟然乜雨都冇, 激死.
2007/08/08
New iMac
New iMac finally came.
Silvery case, very slim, but the color is not very "Mac" now...
I like white case with grey apple logo more.
2007/08/07
偶遇
This morning a lady sitting next to me was having her breakfast on bus, and finished before departure, as the journey is nearly an hour, I don't want her to carry the empty bags all the way, so I offered to help her to throw litter (luckily there is rubbish bin on estate bus).
Nothing happened during the journey, but...
Finally I got off at 鵝頸橋, and she should got off next stop at SOGO, the last stop. On the way to office, I was thinking it is too good if she was the new comer in the company on my floor, as I knew there will be a new one.
When I was still thinking, or dreaming, suddenly I found that the lady was on the opposite side of the traffic light, waiting for green light, unbelievable.
Of course, nothing happened after that too, haha...
Nothing happened during the journey, but...
Finally I got off at 鵝頸橋, and she should got off next stop at SOGO, the last stop. On the way to office, I was thinking it is too good if she was the new comer in the company on my floor, as I knew there will be a new one.
When I was still thinking, or dreaming, suddenly I found that the lady was on the opposite side of the traffic light, waiting for green light, unbelievable.
Of course, nothing happened after that too, haha...
2007/08/06
Firewall using iptables
節錄自 Jamyy'w Weblog
iptables limit 參數備忘
限制前, 可正常每 0.2 秒 ping 一次
ping your.linux.ip -i 0.2
限制每秒只接受一個 icmp echo-request 封包
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 1 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
--limit 1/s 表示每秒一次; 1/m 則為每分鐘一次
--limit-burst 表示允許觸發 limit 限制的最大次數 (預設 5)
再以每 0.2 秒 ping 一次, 得到的回應是每秒一次
ping your.linux.ip -i 0.2
限制 ssh 連入頻率
建立自訂 Chain, 限制 tcp 連線每分鐘一次, 超過者觸發 Log 記錄 (記錄在 /var/log/messages)
iptables -N ratelimit
iptables -A ratelimit -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A ratelimit -p tcp --syn -m limit --limit 1/m --limit-burst 1 -j ACCEPT
iptables -A ratelimit -p tcp -j LOG --log-level "NOTICE" --log-prefix "[RATELIMIT]"
iptables -A ratelimit -p tcp -j DROP
引用自訂 Chain, 限制 ssh (tcp port 22) 連入頻率
iptables -A INPUT -p tcp --dport 22 -s 192.168.0.0/16 -j ACCEPT (特定 IP 來源不受限制)
iptables -A INPUT -p tcp --dport 22 -j ratelimit
同理可證
iptables -N pinglimit
iptables -A pinglimit -m limit --limit 1/s --limit-burst 1 -j ACCEPT
iptables -A pinglimit -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -j pinglimit
亦可達到每秒只接受一個 echo-request 封包
防治 SYN-Flood 碎片攻擊
iptables -N syn-flood
iptables -A syn-flood -m limit --limit 100/s --limit-burst 150 -j RETURN
iptables -A syn-flood -j DROP
iptables -I INPUT -j syn-flood
模擬攻擊
wget http://www.xfocus.net/tools/200102/naptha-1.1.tgz
wget ftp://rpmfind.net/linux/freshrpms/redhat/7.0/libnet/libnet-1.0.1b-1.src.rpm
tar -zxf naptha-1.1.tgz
rpmbuild --recompile libnet-1.0.1b-1.src.rpm
cp -r /var/tmp/libnet-buildroot/usr/* /usr/local/
cd naptha-1.1
make
./synsend your.linux.host.ip 80 local.host.eth0.ip 0.1
若成功抵擋, 不久後會出現 Can't send packet!: Operation not permitted 的訊息
iptables limit 參數備忘
- 限制特定封包傳入速度
- 限制特定埠口連入頻率
- 防治 SYN-Flood 碎片攻擊
限制前, 可正常每 0.2 秒 ping 一次
ping your.linux.ip -i 0.2
限制每秒只接受一個 icmp echo-request 封包
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 1 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
--limit 1/s 表示每秒一次; 1/m 則為每分鐘一次
--limit-burst 表示允許觸發 limit 限制的最大次數 (預設 5)
再以每 0.2 秒 ping 一次, 得到的回應是每秒一次
ping your.linux.ip -i 0.2
限制 ssh 連入頻率
建立自訂 Chain, 限制 tcp 連線每分鐘一次, 超過者觸發 Log 記錄 (記錄在 /var/log/messages)
iptables -N ratelimit
iptables -A ratelimit -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A ratelimit -p tcp --syn -m limit --limit 1/m --limit-burst 1 -j ACCEPT
iptables -A ratelimit -p tcp -j LOG --log-level "NOTICE" --log-prefix "[RATELIMIT]"
iptables -A ratelimit -p tcp -j DROP
引用自訂 Chain, 限制 ssh (tcp port 22) 連入頻率
iptables -A INPUT -p tcp --dport 22 -s 192.168.0.0/16 -j ACCEPT (特定 IP 來源不受限制)
iptables -A INPUT -p tcp --dport 22 -j ratelimit
同理可證
iptables -N pinglimit
iptables -A pinglimit -m limit --limit 1/s --limit-burst 1 -j ACCEPT
iptables -A pinglimit -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -j pinglimit
亦可達到每秒只接受一個 echo-request 封包
防治 SYN-Flood 碎片攻擊
iptables -N syn-flood
iptables -A syn-flood -m limit --limit 100/s --limit-burst 150 -j RETURN
iptables -A syn-flood -j DROP
iptables -I INPUT -j syn-flood
模擬攻擊
wget http://www.xfocus.net/tools/200102/naptha-1.1.tgz
wget ftp://rpmfind.net/linux/freshrpms/redhat/7.0/libnet/libnet-1.0.1b-1.src.rpm
tar -zxf naptha-1.1.tgz
rpmbuild --recompile libnet-1.0.1b-1.src.rpm
cp -r /var/tmp/libnet-buildroot/usr/* /usr/local/
cd naptha-1.1
make
./synsend your.linux.host.ip 80 local.host.eth0.ip 0.1
若成功抵擋, 不久後會出現 Can't send packet!: Operation not permitted 的訊息
2007/08/05
2007/08/03
Blade server first touch
Today went to IBM to test their virtualization management software.
First time use blade server, taking photos is a must! :-)
2007/08/02
One day in HKPC
Helped HKPC guys to setup RHEL 5 workstations including virtualized guest today, spent nearly whole day for fine tuning and testing, but it worths.
訂閱：
文章 (Atom)