Network | FyhTech

cryptorecord 0.9.2 released

I proudly pronounce the first (pre-)release of cryptorecord. Cryptorecords is a ruby gem that provides an API and scripts for creating crypto-related dns-records(e.g. DANE). Currently it supports TLSA, OPENPGPKEYS and SSHFP but I plan to support other records in future. The API doesn't create any keys or certificates. It just takes existing keyfiles to create the DNS-records.

Thoughts about DNSsec

DNS is one of the oldest but also one of the most important network protocols we have and actively use. Dan Kaminsky discovered 2008 some serious flaws in DNS which is very well explained on this site. DNSsec is supposed to solve those problems.

What if dnsmasq and ubound marry?

Dnsmasq is a great piece of software. Described in few words I would say that it is a dns-forwarder, dhcp-server and tftp-server. I like the way dnsmasq can be configured. A-Records can be created by simply adding entries in /etc/hosts and I define dhcp-hosts by adding lines in /etc/ethers. But we live in very strange times. Google-DNS, Cloudflare-DNS and QUAD9 are open dns servers, but might spy on us(if a service is free to use in the internet, then we might not be the customer but the product). All the DNS-resolvers of our ISP aren't trustworthy either since the EU already decided to force ISP's to block sites. But blocking sites might not be the only problem. The one who controlls your dns-requests, is also able to route your traffic which could be used for Man-in-the-middle-attacks to gain control. So I decided to install a dns-recursor in my network. Dnsmasq does its jobs satisfyingly but it needs another dns-recursor. That's why I want to add a recursor and use it together with dnsmasq. A very handy dns-recursor is unbound. It's easy to configure and does DNSsec.

Fairphone2 has a problem with 2 sim cards

Today I inserted another sim card in my fairphone 2. I want to use LTE with this card, but I wasn't able to configure 4G/3G/2G. 2G was selected and the button was disabled. So I just had 2G. The other card worked as expected and I was able to choose 4G/3G/2G. This bothered me the whole day.

In the evening I figured out how to fix the problem:

Simple WebApp-Stress-Tool

Simulty is a very simple webapp-stress-tool. It reads random urls from a file and executes multiple get-requests simultaneously to them.

Setup LXC-Container in Debian Jessie

LXC-Containers are very useful. They are more leightweight than virtual machines and not as static as docker-containers. That's why I like them especially for my server environments. In this article I will show a very basic setup of LXC-Containers on Debian Jessie.

Shorewall: setup Geo-IP filtering

shorewall - iptables made easy

Sometimes it is neccessary to filter packets based on their geo-ip location. Shorewall can make use of the xt_geoip-module for iptables. In this article I will explain how to setup this module on Debian.

Tcpdump: capturing ipv6-packets only


tcpdump -i eth0  ip6

Filetransfer using netcat

It's quite easy to share files using netcat.

Serve a file on a listening port:


cat myfile.txt | nc -l -p 1337

Connect to this port and download file:


netcat SERVERIP 1337 > myfile.txt

Tcpdump: capturing packets with specific tcpflags

Let's catpure for example only tcp-packets with syn or ack-flag set:

tcpdump "tcp[tcpflags] & (tcp-syn|tcp-ack) != 0"