Author Archives: Matt

Cisco WS-C2948G-GE-TX Review

Posted on by
1

I picked up a Cisco WS-C2948G-GE-TX switch on eBay a while back. I’m about a decade late to the party in reviewing one (mine’s dated November 3, 2003!), but they’re showing up in quantity on eBay for short money, so I thought a modern look at the thing might be helpful.

WS-C2948G-GE-TX (on top of a Dell C6100)

So, the executive summary is this:

Pros:

  • 48-port Gigabit switch
  • Managed
  • 4x SFP ports
  • Runs about $100 on eBay

Of course, a 48-port Gigabit managed Cisco for $100 seems must have some catch. Read on!

Cons:

  • Past End of Life
  • CatOS support only (no upgrade to IOS)
  • Oversubscribed switching fabric (12 Gbps)
  • SFPs have no 10Gb support
  • Appears to support SSH v1.0 only?

If you’re looking for a switch for a serious production environment, this isn’t for you. (But why are you even looking at sub-$100 switches on eBay if that’s the case?!) But for certain cases, this is seemingly the perfect switch. I’m building out a small home lab. I want Gigabit ports (and more than a few of them) but I’m not actually moving a ton of traffic through the switch, so the fact that the switch couldn’t support all 48 ports actually pushing 1Gbps simultaneously is of no concern to me. The CatOS bit isn’t great, but I’m not trying to go for my CCIE where I need all the latest features IOS brings, or running this in a production environment where having the latest security patches is critical. (Not that security is ever unimportant, but it’s on a private LAN in my basement so I’m not going to lose sleep if it’s got known vulnerabilities.) Realistically the only “managed” feature I have used is setting up a second VLAN for a few ports.

For the curious, here’s what mine came running:

sw01> (enable) sho ver

WARNING: This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and use.
Delivery of Cisco cryptographic products does not imply third-party authority
to import, export, distribute or use encryption. Importers, exporters,
distributors and users are responsible for compliance with U.S. and local
country laws. By using this product you agree to comply with applicable
laws and regulations. If you are unable to comply with U.S. and local laws,
return this product immediately.

WS-C2948G-GE-TX Software, Version NmpSW: 8.4(11)GLX
Copyright (c) 1995-2006 by Cisco Systems, Inc.
NMP S/W compiled on Apr 27 2006, 12:46:44
GSP S/W compiled on Apr 27 2006, 11:47:52

System Bootstrap Version: 6.1(6)

Hardware Version: 1.1  Model: WS-C2948G-GE-TX  Serial #: [redacted]

Mod Port Model              Serial #              Versions
--- ---- ------------------ -------------------- -------------------------------
1   0    WS-X2948G-GE-TX    [redacted]           Hw : 1.1
                                                 Gsp: 8.4(11.0)
                                                 Nmp: 8.4(11)GLX
2   52   WS-C2948G-GE-TX    [redacted]           Hw : 1.1

       DRAM                    FLASH                   NVRAM
Module Total   Used    Free    Total   Used    Free    Total Used  Free
------ ------- ------- ------- ------- ------- ------- ----- ----- -----
1       65536K  36933K  28603K  16384K  10779K   5605K  480K  320K  160K

Uptime is 94 days, 1 hour, 25 minutes

And then, the modules:

Mod Slot Ports Module-Type               Model               Sub Status
--- ---- ----- ------------------------- ------------------- --- --------
1   1    0     Switching Supervisor      WS-X2948G-GE-TX     no  ok
2   1    52    10/100/1000 Ethernet      WS-C2948G-GE-TX     no  ok

Mod Module-Name          Serial-Num
--- -------------------- --------------------
1                        [redacted]
2                        [redacted]

Mod MAC-Address(es)                        Hw     Fw         Sw
--- -------------------------------------- ------ ---------- -----------------
1   00-0d-bd-b1-XX-00 to 00-0d-bd-b1-XX-3f 1.1    6.1(6)     8.4(11)GLX
2   00-0e-bd-b1-XX-de to 00-0e-bd-b1-XX-3d 1.1

Note that I haven’t tried anything fancy. In theory it supports stuff like CDP, tagged VLANs, 802.1x, LACP, RADIUS, port mirroring, SNMP monitoring, STP, and so on, but I haven’t set any of that up, and frankly wouldn’t know how.

Back of switch

All in all, if you’re looking for a cheap Gigabit switch with some basic management features and don’t mind it running old software and having a heavily-oversubscribed backplane, I’ve found this switch to be a steal.

SSH Tip: Hash known_hosts names

Posted on by
Reply

I picked up a little book called SSH Mastery the other day. It’s a fairly short read, but quite interesting.

It mentioned one tip that happened to solve something that always bothered me—ssh keeps a ~/.ssh/known_hosts file with the host keys of all the machines you’ve connected to previously. It’s good for SSH, since it can verify that the host keys haven’t changed since you last connected, but it’s also a privacy and security risk, to have a file listing all the servers you have access to. Not exactly something that keeps me up at night, but a sub-optimal situation.

The book mentions that ssh can easily be changed to record a hash of the hostnames instead, with the directive HashKnownHosts yes. (But note that it’s not retroactive, though ssh-keygen has an option to encode the existing ones.)

The only downside is that this makes it impossible to periodically prune the contents of known_hosts of systems you no longer care about — though that probably won’t save you more than a few kB of disk space.

Purging Old Mail in Thunderbird

Posted on by
Reply

I’ve always wished for a feature in a mail client that would let me say, “Only keep mail in this folder for ___ days,” after which point it would just be automatically deleted. I filter mail from mailing lists into individual folders, and mail can get out of control quickly if I don’t watch it. I’ve searched a few times for Thunderbird extensions to do this, and was always surprised that none existed. In the back of my mind, I figured I’d have to write my own.

Today, I realized why this plugin doesn’t exist. It’s because it’s a native feature in Thunderbird.

Right-click on a folder, click “Properties,” and then there’s the “Retention Policy” tab:

Oh happy day.

Fixing “Invalid key 0 given to dptr_close”

Posted on by
7

Last night, I threw together a quick Samba server on a RHEL 6.4 machine at home. (I’m running RHEL, but you’d almost certainly have an identical experience on CentOS.) I set up user homedirs accessed over Samba, and was able to authenticate properly from my Mac laptop.

However, I ran into an issue where I could connect okay, but the mounted share showed as empty. I couldn’t copy files in, and any files already there didn’t show up. A bit of Googling suggests this isn’t an uncommon problem. The share looked blank/empty.

Checking /var/log/messages, I saw a bunch of these entries:

May  9 22:04:02 c6100-n4 smbd[8537]: [2013/05/09 22:04:02.949679,  0] smbd/dir.c:315(dptr_close)
May  9 22:04:02 c6100-n4 smbd[8537]:   Invalid key 0 given to dptr_close

Googling this, I found an article suggesting that it’s caused by SELinux, and another from a SuSE user having the same issue with AppArmor. I really didn’t like the suggestions to disable these services, though; it feels akin to disabling a firewall because it’s too complicated to configure.

And, if you know where to look (man samba_selinux), it’s actually easier to fix this the right way than to persistently disable SELinux:

If you want to allow samba to share users home directories, you must turn on the
samba_enable_home_dirs boolean.

setsebool -P samba_enable_home_dirs 1

It’s annoying that the error in /var/log/messages doesn’t convey anything useful, but I can understand why this behavior would be prohibited by default. Why should a daemon be allowed to read users’ home directories out of the box?

Running the setsebool -P samba_enable_home_dirs 1 command (note that -P makes it persist, and that doing so updates on-disk policies, which takes a moment), everything works great. My clients can see the shares just fine, the cryptic errors aren’t being logged, and SELinux remains in enforcing mode.