While doing some testing for work on my personal laptop, I noticed that the network which docker uses for it’s bridge, aptly named docker0, was in the same network as one of our VPNs.

# ip a s docker0
7: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 ...
 link/ether fe:54:00:18:1a:fd brd ff:ff:ff:ff:ff:ff
 inet 172.17.41.1/16 brd 10.100.72.255 scope global docker0
 ..snip..

# ip a s tun0
139: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1412 ...
    link/none 
    inet 172.17.123.32/24 brd 172.17.224.255 scope global tun0
       valid_lft forever preferred_lft forever

As you can tell, the docker0 network bridge covers all of the tun0 network. Any time I would attempt to ssh into one of the systems inside the VPN, it would time out. I was left wondering why for a few moments.

Luckily, it’s very easy to fix this problem. All that is needed is a defined bridge for docker0 and to restart the docker service. Here’s what to do:

First, stop docker:

# service docker stop
Redirecting to /bin/systemctl stop  docker.service

Next, create the network bridge file. You can choose any IP range you like. On Fedora 19, it looks like this:

# cat /etc/sysconfig/network-scripts/ifcfg-docker0 
DEVICE="docker0"
TYPE="Bridge"
ONBOOT="yes"
NM_CONTROLLED="no"
BOOTPROTO="static"
IPADDR=10.100.72.254
NETMASK=255.255.255.0

Restart your network services.  NOTE: service network restart may be needed.

# service NetworkManager restart
Redirecting to /bin/systemctl restart  NetworkManager.service

The docker0 bridge should now be in a range outside the VPN.

# ip a s docker0
7: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 ...
    link/ether fe:54:00:18:1a:fd brd ff:ff:ff:ff:ff:ff
    inet 10.100.72.254/24 brd 10.100.72.255 scope global docker0

Starting new containers with docker should get IP addesses in the above range:

# service docker start
Redirecting to /bin/systemctl start  docker.service

# docker run -i -t herlo/fedora:20 /bin/bash
bash-4.2# ip a s eth0
141: eth0: <BROADCAST,UP,LOWER_UP> mtu 1412 ...
    link/ether fa:5f:e3:8d:61:f2 brd ff:ff:ff:ff:ff:ff
    inet 10.100.72.2/24 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::f85f:e3ff:fe8d:61f2/64 scope link 
       valid_lft forever preferred_lft forever

SUCCESS!

Cheers,

herlo

We are happy to welcome our new sponsored Fedora Ambassador in February:

• http://fedoraproject.org/wiki/User:Jcarlosgarcia mentored by lbazan
• http://fedoraproject.org/wiki/User:Galoget mentored by dbruno
• http://fedoraproject.org/wiki/User:Lautb1ru  mentored by kaio
• http://fedoraproject.org/wiki/User:Anishjp mentored by cmpahar
• http://fedoraproject.org/wiki/User:Hagr182 mentored by lbazan

Mon Mar 11 02:53:08 2013 | Accounts: 624 | Inactive: 81 (12.98%)

Cheers,

herlo

We are happy to welcome our new sponsored Fedora Ambassador in January:

• http://fedoraproject.org/wiki/User:Psylocke mentored by azneita
• http://fedoraproject.org/wiki/User:Kaptk2 mentored by herlo
• http://fedoraproject.org/wiki/User:Danniel mentored by dbruno
• http://fedoraproject.org/wiki/User:Surfistawagner mentored by dbruno
• http://fedoraproject.org/wiki/User:Jamielinux mentored by eischmann

Fedora Ambassador Statistics

Cheers,

herlo

Yes, the announcement is behind this month. Moving into a new home will do that to you!

Here’s a list with links to the videos (all of them are on youtube):

• FUDCon Session Pitches
• Robyn’s ‘World Famous State of Fedora’ Talk
• ARM to primary
• ARM Building Exercises
• Overhauling the Fedora release model
• State of Fedora security
• An intro to the new Fedora 18 installer
• Ansible (config command control and rpc)
• The Blocker and NTH Process
• Secure Linux Containers
• Fedora Spins and Formulas
• Pulp (Repository management, yum, puppet, others) – Part 1
• Pulp (Repository management, yum, puppet, others) – Part 2
• FedMsg
• Micro-web framework, unit tests, web-app maintainability
• FEL, a little intro to the electronic world with Fedora

Enjoy,

herlo

We are happy to welcome our new sponsored Fedora Ambassador in December:

• https://fedoraproject.org/wiki/User:Jltodea mentored by lbazan

Fedora Ambassador Statistics

Cheers,

herlo

While I was there, I had another agenda item, creating a HOWTO for enabling a GPG SmartCard for use with SSH. Of course, the SmartCard can be used for both encryption and signing as well.

After finishing that HOWTO, I was talking about it with a few people within Fedora, and there seemed to be quite a bit of interest. It turns out there was quite a bit of interest, so I’ve decided to do a hackfest on Saturday at FUDCon to help move people over to GPG SmartCards. This is also going to be quite nice in that there will be a GPG key signing event after this hackfest.

Come Prepared – Equipment Required

It’s important you come prepared! If you have ever had interest in this sort of thing, there’s time to get equipment for the hackfest. Here’s what you need:

• SmartCard Reader, any will do. I recommend the Gemalto USB Shell Token V2 from kernelconcepts.de.
• An OpenPGP SmartCard. Several vendors have them. I recommend the OpenPGP SmartCard V2 from kernelconcepts.de.

Both pieces are required. Order ASAP, it takes about 10 days to ship. Consider even shipping to the FUDCon hotel if you are concerned or late. I know Petra will work hard to deliver them as fast as possible.

Doing a Little Prep Work

If you get your Token and SmartCard before FUDCon Lawrence and have a few spare minutes, feel free to read through my HOWTO. If you get through it, come to the hackfest and help others who might not have had time.

Cheers,

herlo

We are happy to welcome our new sponsored Fedora Ambassadors in November:

• http://fedoraproject.org/wiki/User:Mhayden mentored by herlo
• https://fedoraproject.org/wiki/User:Nsglynn mentored by fab
• https://fedoraproject.org/wiki/User:Juranir mentored by dbruno
• https://fedoraproject.org/wiki/User:Edtomasa mentored by azneita
• https://fedoraproject.org/wiki/User:Cardero mentored by lbazan
• https://fedoraproject.org/wiki/User:Mayorgalinux mentored by lbazan

Fedora Ambassador Statistics

Sun Dec 2 10:19:18 2012 | Approved: 616 | Inactive: 82 | % inactive: 13.31

Cheers,

Herlo

• Installed and configured totpcgi authentication on the staging environment. This performs the verification from the clients. There will be several servers doing authentication to prevent a single point of failure.
• Installed and configured pam_url on each staging client with the intent of connecting to the authentication servers.
• Enabled yubikey as an alternate second factor.
• Reviewed RPMs for pam_url and totpcgi (and a few others to help along the way)
• Setup the totpcgi provisioning web page for google authenticator
• Fixed fun bugs in pam_url
• Wrote documentation on how to setup authentication.

A few things were accomplished that were not part of the goals, but good stuff nonetheless:

• Enjoyed some awesome tapas at Buku (a restaurant is at the base of the Red Hat Tower)
• Found the open source cow
• Documented the setup of the OpenPGP SmartCard with gpg-agent and GNOME 3
• Watched Seth Vidal do some Beastie Boys!
• Enjoyed some yummy dinner at Gravy (thanks to Ruth Suehle and Red Hat)
• Discussed some ideas for FUDCon Lawrence and the future of FUDCons

While I didn’t participate in all of the above activities, I was definitely involved in many of them. It turns out, everyone there was fairly involved at the FAD. It was fun to watch everyone come together to solve this issue. Everyone seemed to have a good sense of satisfaction accomplishing the goals.

Cheers,

herlo

One of the perks I’ve been able to work out will be to attend the Fedora Activity Day this week in Raleigh, where we’ll be working on two-factor authentication among other things. This has been something I’ve recently set up at LF and am hopefully going to be involved in getting this working for Fedora as well.

Additionally, I have been working on getting a GPG SmartCard token working to accommodate ssh authentication. I think Fedora is going to be using Yubikeys, but I thought it might be cool to show this off as an alternative.

Anyway, it should be a fun week and very busy as well. Watch for more reports here about our progress.

Cheers,

Herlo

We are happy to welcome our new sponsored Fedora Ambassadors in October:

• https://fedoraproject.org/wiki/User:Dona from the Philippines mentored by azneita
• https://fedoraproject.org/wiki/User:Cewillia from the USA mentored by jbwillia
• http://fedoraproject.org/wiki/User:Asoliard from Argentina mentored by lbazan
• https://fedoraproject.org/wiki/User:Williamjmorenor from Nicargua mentored by lbazan
• https://fedoraproject.org/wiki/User:Sergiodj from Brasil mentored by dbruno

Fedora Ambassador Statistics

Sun Nov 4 08:57:45 2012 | Approved: 611 | Inactive: 81 | % inactive:13.26

Cheers,

Herlo