StrongSwan: we have no ipsecN interface for either end of this connection

I installed a new NIC card on one of my PCs where IPSec was already set up through StrongSwan and configured NAT-ing through iptables. Afterward, when I tried to do "ipsec up myconnection" I got this error:

we have no ipsecN interface for either end of this connection

The reason, it turns out, is that if the ipsec services were started before all the network interfaces came up, it is confused about which egress route to take. As I found on the Layer9 blog (and translated from German to English via Babelfish), it turns out you need to make sure that ipsec starts after the network has come up. The quick fix was just an IPSec restart:

sudo /etc/init.d/ipsec restart

And the long-term fix was definitely to just delay the ipsec a little. Add this to your /etc/rc.local file:

/etc/init.d/ipsec stopsleep 5/etc/init.d/ipsec start

Strongswan: ike alg: unable to locate my private key

If you are using StrongSwan to establish an IPSec connection and you encounter this error:

root@crackjack:~# ipsec up conn-to-td
002 "conn-to-td" #2: initiating Main Mode
002 "conn-to-td" #2: ike alg: unable to locate my private key
002 "conn-to-td" #2: ike alg: unable to locate my private key
003 "conn-to-td" #2: empty ISAKMP SA proposal to send (no algorithms for ike selection?)

Then I have found the way to solve the first part of your problem - the private key part. Basically, after FreeSwan became OpenSwan and then finally StrongSwan, they created a directory for each individual part under /etc/ipsec.d. So for example the CA certs are stored in the folder /etc/ipsec.d/cacerts, or the certs you got are stored in /etc/ipsec.d/certs. Similarly, you are supposed to store your private key at /etc/ipsec.d/private. What you have probably done is that in /etc/ipsec.conf you wrote down

leftcert=/etc/ipsec.d/private/my_private_key.pem

When in fact you should have your /etc/ipsec.conf as the following:

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
    plutodebug=all
    plutostderrlog=/var/log/pluto.log
    charonstart=yes
    plutostart=yes


conn host-to-host
      left=
      leftcert=my_cert.pem
      leftid=my_private_key.pem
      right=
      rightid=
      auto=start
      pfs=no
      rekey=no
      keyingtries=3

After this, you can do the faithful /etc/init.d/ipsec restart and the private key problem will disappear

Ubuntu/ALSA controlling volume from the command line

If you are using ALSA as your audio framework, if you are using a common distribution like Ubuntu you probably are, there is a command line program called alsamixer which provides an elaborate set of options to control your sound settings.

The sound setting I most often tinker with is, of course, raising and lowering the volume. A simple way to do that on the command line is "amixer -c 0 sset Master,0 %", for e.g. amixer -c 0 sset Master,0 60%.

mediawiki blank page after install

If you have freshly installed MediaWiki and are getting a blank page after installing, here is what you are probably doing wrong: the LocalSettings.php needs to have read permissions by everyone as well.

(I am assuming a standard install here)
So if you go to /var/lib/mediawiki/LocalSettings.php it should actually be a softlink to /etc/mediawiki/LocalSettings.php. Try this command:

sudo chmod 755 /etc/mediawiki/LocalSettings.php

And then restart apache (just to make sure):

sudo /etc/init.d/apache restart

That should be it. Now your http://localhost/mediawiki should be visible :)

VMWare tries network boot although you've specified an ISO file in the device settings

It just happened to me, and I found the solution thanks to my teammate. You have to click on the check-box under CDRom that says "Connect at power on". By default, when you add a new CDRom to the machine, this box is not checked. So, there goes...

Cisco IOS router stuck in rommon

Moral of the story - if you are getting checksum errors on the rommon prompt of a Cisco IOS router, and you know that you have downloaded the correct image from the correct website, then either your router's flash memory or the USB drive you are using to transfer it is corrupt. I know the latter seems like a distant possibility, but yes, it has happened to me and I lost a good 3 weeks of productive time trying to troubleshoot this.

Peace!!

How to see a Cisco IOS CA's root certificate

If you have created an IOS CA server and want to see its root certificate for distribution to other machines, then you must look at its storage location. Suppose you used the following to create your CA:

# enable

(config)# cry pki server thehacklist

(cs-server)# database url flash:

(cs-server)# issuer-name C=IN, ST=WB, O=thehacklist

(cs-server)# cdp none

(cs-server)# grant auto

(cs-server)# no shut

%Some server settings cannot be changed after CA certificate generation.

% Please enter a passphrase to protect the private key

% or type Return to exit

Password:

Re-enter password:

% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

% Exporting Certificate Server signing certificate and keys...

% Certificate Server enabled.

(cs-server)# end

Now if you look at the storage location (flash in this case, as specified above), you will see a three files named after your CA server (with extensions ending in ser, crl and p12).

# dir flash:

Directory of flash:/

11 -rw- 32 Jul 10 2010 17:54:20 +00:00 thehacklist.ser

1 -rw- 1826 Jan 15 2008 17:52:38 +00:00 sdmconfig-38xx.cfg

2 -rw- 6036480 Jan 15 2008 17:53:10 +00:00 sdm.tar

3 -rw- 861696 Jan 15 2008 17:53:26 +00:00 es.tar

4 -rw- 1164288 Jan 15 2008 17:53:46 +00:00 common.tar

5 -rw- 1038 Jan 15 2008 17:54:02 +00:00 home.shtml

6 -rw- 113152 Jan 15 2008 17:54:16 +00:00 home.tar

7 -rw- 1697952 Jan 15 2008 17:54:42 +00:00 securedesktop-ios-3.1.1.45-k9.pkg

8 -rw- 416354 Jan 15 2008 17:55:06 +00:00 sslclient-win-1.1.3.173.pkg

9 -rw- 59526004 Jun 29 2010 19:23:10 +00:00 c3845-advipservicesk9-mz.124-22.T2

10 -rw- 60288320 Dec 15 2008 23:27:58 +00:00 c3845-adventerprisek9-mz.124-20.T

12 -rw- 247 Jul 10 2010 17:54:20 +00:00 thehacklist.crl

13 -rw- 1627 Jul 10 2010 17:54:22 +00:00 thehacklist_00001.pem

From here, to see the root certificate of the CA, you can use:

# more flash:/thehacklist_00001.pem

-----BEGIN CERTIFICATE-----

MIIB/TCCAWagAwIBAgIBATANBgkqhkiG9w0BAQQFADASMRAwDgYDVQQDEwdjbG91

ZGNhMB4XDTEwMDUwNTIxNDI1MloXDTEzMDUwNDIxNDI1MlowEjEQMA4GA1UEAxMH

Y2xvdWRjYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAlKg0l1DdBpgc/5j3

mA8XodkRq3d5c6K4ZYgUKftEUBAJV3tQz8/ms+CObfmvOn8BdZl0vsLDhJIPRCoq

pypec//gtJpQAAo2I8PCl874yB8k/ebhxBMMhzxQ7y70B0d6gbl8Ub+pmXJnl7Gi

61G41bmNCzXHdfUUiVczpVnaaaaaaaaaaaaaaaaaaaYDVR0TAQH/BAUwAwEB/zAO

BgNVHQ8BAf8EBAMCAYYwHwYDVR0jBBgwFoAUbjpam0qXL8U93MSmngJ1vE1USrMw

HQYDVR0OBBYEFG46WptKly/FPdzEpp4CdbxNVEqzMA0GCSqGSIb3DQEBBAUAA4GB

ACDHm7NNssxSzdD1aQUyUtAni9zo2TCrdcVYtUa5z497JWAPK5YE1tGsMdkYawky

/sUuQMQY4nQFaHtlwKoDHKUSRuygq24GjCUXwoSLLR8jqzfuSgah1ZPohZUPRFEo

EAN2hDdw3Y0o75rsHzie355AH2a22nDnyAm+89EJqEsv

-----END CERTIFICATE-----