Michael H.'s questions

My coworkers have been complaining about receiving email from a certain company without formatting. I see the formatting just fine. Digging in, the differences appear to be that I receive email that contains both plain text and HTML formatting, and the X-MS-TNEF-CORRELATOR header exists but is blank, whereas my coworkers have a value for X-MS-TNEF-CORRELATOR, and a blob of binary stuff at the end which I assume is a winmail.dat or equivalent.

The sender's IT department says they are not responsible for the lack of formatting, but to my knowledge there is no way for these emails to be changed in this way after they've left the sender's mail servers -- in other words, that there's no way for this to be due to my company's mail server (which happens to be Google). Is this correct?

If so, then what can I ask the sender's IT department to look for on what I assume is their Exchange server, which would send email to me in HTML and email to coworkers in MS-TNEF/etc.?

My coworker was doing what should've been a straight-forward install of memcached this weekend on our Ubuntu 10.04.04 LTS server, but something went awry. I'm still trying to figure out the details, but I can tell you:

$ /lib/libc.so.6
GNU C Library (Ubuntu EGLIBC 2.11.1-0ubuntu7.12) stable release version 2.11.1, by Roland McGrath et al.
Copyright (C) 2009 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 4.4.3.
Compiled on a Linux >>3.2.0-23-generic<< system on 2012-11-15.
Available extensions:
       crypt add-on version 2.1 by Michael Glad and others
       GNU Libidn by Simon Josefsson
       Native POSIX Threads Library by Ulrich Drepper et al
       BIND-8.2.3-T5B

However, I also see this:

$ ldd --version
ldd (Ubuntu EGLIBC 2.15-0ubuntu10.5) 2.15
Copyright (C) 2012 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

With comparison to another Ubuntu 10.04.04 LTS machine, I know that 2.11.1 is where it ought to be, unless we try to use the upgrade tools to go to Ubuntu 12.04 LTS. But what is the best path to get there? Do I copy over libraries from the working machine until it all works, or is there a better way?

We have a hosted dedicated server, and we're looking at adding another one. We think our current provider is a touch expensive, so I'm also gathering quotes from other providers. I was asked if we should leave our original machine with the original provider and get a new machine with a new provider -- the idea being a kind of risk management.

My impulse is to say no, because then you've got two bills to pay and two admin consoles to use. Plus, there are services on the first machine (database, webservices) that we'll want to call out to from the second, not to mention copying large files back and forth occasionally.

Is there any argument for splitting machines across providers, apart from the convenience factor of not having to reconstruct the original machine at the new site?

I'm using a combination of /etc/hosts.deny and ufw on my ubuntu 10.04.04 server. Most days, I see failed ssh attempts from machines in the .com.cn domain, reported like so:

Failed logins from:
112.114.63.139 (139.63.114.112.broad.km.yn.dynamic.163data.com.cn): 1 time

However, in /etc/hosts.deny, I have this rule:

ALL: .com.cn

Shouldn't this be blocking the connection before it even hits ssh? I've tested it via blocking my home machine, and it certainly denies me a connection right away before I get a login prompt (and yes, I've moved my ssh keys away so those aren't involved).

Is this working as intended?

Edit: James Sneeringer prompted me to look more closely at the logs, and perhaps I see why this is happening. From auth.log:

Nov  5 09:38:40 mymachine sshd[22864]: warning: /etc/hosts.deny, line 21: can't verify hostname: getaddrinfo(139.63.114.112.broad.km.yn.dynamic.163data.com.cn, AF_INET) failed
Nov  5 09:38:44 mymachine sshd[22864]: reverse mapping checking getaddrinfo for 139.63.114.112.broad.km.yn.dynamic.163data.com.cn [112.114.63.139] failed - POSSIBLE BREAK-IN ATTEMPT!
Nov  5 09:38:45 mymachine sshd[22864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.114.63.139  user=root
Nov  5 09:38:47 mymachine sshd[22864]: Failed password for root from 112.114.63.139 port 37245 ssh2
Nov  5 09:38:47 mymachine sshd[22866]: Connection closed by 112.114.63.139

This implies to me that if sshd isn't sure about the IP->name lookup, then it errs on the side of caution and does not block that host. Is that right?

When encrypting a file to send to a collaborator, I see this message:

gpg: using subkey XXXX instead of primary key YYYY

Why would that be? I've noticed that when they send me an encrypted file, it also appears to be encrypted towards my subkey instead of my primary key. For me, this doesn't appear to be a problem; gpg (1.4.x, macosx) just handles it & moves on. But for them, with their automated tool setup, this seems to be an issue, and they've requested that I be sure to use their primary key.

I've tried to do some reading, and I have the Michael Lucas's "GPG & PGP" book on order, but I'm not seeing why there's this distinction. I have read that the key used for signing and the key used for encryption would be different, but I assumed that was about public vs private keys at first.

In case it was a trust/validation issue, I went through the process of comparing fingerprints and verifying, yes, I trust this key. While I was doing that, I noticed the primary & subkeys had different "usage" notes:

primary:  usage: SCA
subkey:   usage: E

"E" seems likely to mean "Encryption". But, I haven't been able to find any documentation on this. Moreover, my collaborator has been using these tools & techniques for some years now, so why would this only be a problem for me?

Is there a way to restrict FTPS ports on both the server & client side of the connection?

I've already read this answer and I have vsftpd set to restrict passive port usage to a narrow range on the server side. I've verified that this restriction does work -- for the server. However, if the client is behind a firewall itself and is carefully restricting access on that end, the connections fail. Inspecting with tcpdump, it appears that arbitrary high ports on the client side are being used.

SFTP is not an option. (Believe me, I wish it were.)

I have a pair of heavily-used machines which are running Fedora Core 5 or FC6, i.e.:

$ uname -r -v
2.6.20-1.2320.fc5 #1 SMP Tue Jun 12 18:50:49 EDT 2007

(I think one of them might have started out with RedHat Enterprise Linux 5.)

As you might imagine, software doesn't get updated much on them any more because it's a hassle.

Someday I'd like to move these to an updated version of the kernel (and rest of the OS), in order to get bug fixes and general improvements.

At this point, should I just wait until we can buy a new machine, and then move all the users over and reinstall/configure the software? Or can I do an in-place update? I've read posts like this which strongly recommend against trying to upgrade the system. But, does that mean I have to suck it up and backup/transplant/update all the various programs, databases, and all that by hand? If so, it seems like I could move to Ubuntu or anything else because it will be the same basic work anyhow. Is that correct?

One of my users is having some trouble with forwarding to an internal web app from a public address.

Everything worked fine for him when the situation was like this:

• front page: http://www.myexample.com/
• public ref to internal app: http://www.example.com/app-8903/app.html
• secretly goes to: http://secret.example.com:8903/app-8903/app.html

This is to say, my user is providing the very last URL, with the port information duplicated in the URL base, and they were using that to give a public face that hid both the port and the internal machine name. You could still read the port in the URL base if you looked, but the obvious reference and machine name were hidden.

Doing it this way, he could have several different instances of the application running on secret.example.com with different ports, and on the front end it just looked like it was changing the URL directory/base.

Now the user wants to do the same thing over https:, and the people helping him with apache config say it can't be done.

Is that so? Without being there to tinker with the configuration myself, I'm not sure what his IT people have tried, but reading through the apache2 SSL FAQ and other docs, it seems like it should be possible to rewrite URLs to different ports and still use https:.

I have an interesting situation, where a user's account has been temporarily removed (paperwork not renewed in time). However, thanks to the magic of "screen", his processes are still running.

I would love to be able to reconnect to those old screen sessions and save some data out. Is that possible? I have sudo powers, but am not sure how to apply them in this case.

Normally I would do:

1. chmod 777 `tty`
2. sudo su <user>
3. screen -x

but the user no longer exists in this case. Naively plugging in the old user ID didn't work (not that I really expected it to).

This is RedHat Enteprise Linux 5: (2.6.18-53.1.14.el5)