x-yuri's questions

What I'm trying to do is launch a bridged OpenVPN server on GCP (in a GCE VM). What looks like a crucial part to me is in the title. If I succeed, the rest is supposedly easy. I tried two approaches:

• The Arch Linux way... the iproute2 way actually. I asked about it on the Arch Linux forum. The details are in a gist.
• The OpenVPN way... the bridge-utils way actually. Based on the script from the official howto. The details are in a gist.

It looks like it's not possible to do it on GCP, or am I missing something? Which is it? Or what can I do to further investigate the issue?

I'm trying to make haproxy proxy requests to a number of replicas:

docker-compose.yml:

services:
  haproxy:
    image: haproxy:2.3-alpine
    volumes:
      - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg
    ports:
      - 8888:80
  app:
    build: .
    command: perl app.pl
    init: true
    deploy:
      replicas: 10

haproxy.cfg:

global
    maxconn  1024
listen in
    bind :80
    server-template srv 10 app:8080 check
    timeout connect 5000ms
    timeout client 50000ms
    timeout server 50000ms

But it seems to see only some of the replicas:

$ docker compose up
...
app-3      | MyWebServer: You can connect to your server at http://localhost:8080/
haproxy-1  | [NOTICE] 094/155107 (1) : New worker #1 (8) forked
app-4      | MyWebServer: You can connect to your server at http://localhost:8080/
app-2      | MyWebServer: You can connect to your server at http://localhost:8080/
app-5      | MyWebServer: You can connect to your server at http://localhost:8080/
app-9      | MyWebServer: You can connect to your server at http://localhost:8080/
app-7      | MyWebServer: You can connect to your server at http://localhost:8080/
app-6      | MyWebServer: You can connect to your server at http://localhost:8080/
app-1      | MyWebServer: You can connect to your server at http://localhost:8080/
app-10     | MyWebServer: You can connect to your server at http://localhost:8080/
app-8      | MyWebServer: You can connect to your server at http://localhost:8080/
app-3      | d3757cd065b4
app-3      | d3757cd065b4
app-3      | d3757cd065b4
app-4      | 226419df4354
app-4      | 226419df4354
app-4      | 226419df4354
...

More details here.

What am I missing?

I have a domain (example.com) configured for sending and receiving mail using Google Workspace. I need to launch additionally a separate (own) mail server. Switching completely to the new server is undesirable. The idea is to have some mail accounts in Google Workspace, and some on the new server.

The natural solution is probably to use subdomains (1). Nothing changes about example.com. I simply launch a mail server and link it to, say, email.example.com.

But there's another idea that struck me (2). Leave MX records pointing to Google Workspace, but change SPF to let the new server send mail using the same domain (example.com). Well, then it occurred to me that there's no way to share the DKIM's private key, is there?

If I can't configure DKIM... I don't like where it takes me. What do you think? Is it a solution worth trying, or a dead end?

What are the cons? The first one is DKIM. Also I'm not sure what happens if I send an email via the new server (using the new server's account) and the user replies. Does it go back to the new server or Google Workspace (considering that I don't want to use a subdomain)? I guess the latter. These are 2 disadvantages I can think of.

As for pros... No need to introduce a subdomain :) Okay, doesn't sound too appealing, I know. But that's all I've got.

Also I wonder if anybody tried it? I don't think I'm the first one to come up with the idea. And I'd expect people to do it in the days where spam was not widespread. (I assume there was such a time.) But these days... probably not. If they were 2 own servers (no Google Workspace), then I guess it's possible to share the DKIM's private key and then it looks like an option. Otherwise... it's probably not.

What do you think?

I configured a mail server a couple of times before and I believe back then I thought that the answer is "yes."

But I'm about to configure another one, and it seems that I was wrong. Let's say the apex domain (example.com) and the (only) MX record point to the same server (mail.example.com). Then I can make:

• example.com point to the server IP (aa.aaa.aa.aaa) and point it back (PTR) to example.com
• a mail server (postfix, exim, ...) respond with example.com (HELO, MAILFROM)

Then the SPF, DKIM and DMARC record names are: @, mail._domainkey (if selector is mail) and _dmarc. Or to put it briefly:

@  A  aa.aaa.aa.aaa
@  MX  10  mail
mail  A  aa.aaa.aa.aaa
aa.aaa.aa.aaa  PTR  @

@  TXT  (SPF)
mail._domainkey  TXT  (DKIM)
_dmarc  TXT  (DMARC)

But what if I have 2 MX records (mail1 and mail2)? Then I can't make example.com point to 2 different IPs and point them back to example.com, can I? But even if I can, I can see that Gmail doesn't use gmail.com for HELO, MAILFROM. And it seems more sensible for each server to respond with its own name, doesn't it? But then what, I should have 2 SPF records? After all:

the current version of SPF — called SPFv1 or SPF Classic — protects the envelope sender address

http://www.open-spf.org/Introduction/

@  A  (whatever)

@  MX  10  mail1
mail1  A  aa.aaa.aa.aaa
aa.aaa.aa.aaa  PTR  mail1

@  MX  20  mail2
mail2  A  bb.bbb.bb.bbb
bb.bbb.bb.bbb  PTR  mail2

mail1  TXT  (SPF)
mail2  TXT  (SPF)
mail._domainkey  TXT  (DKIM)
_dmarc  TXT  (DMARC)

To be frank I'm confused after reading different articles and answers on configuring a mail server. What is the correct or a better setup?

As far as I can see connection over SSL/TLS is always available with Cloud SQL. If I enforce it, it becomes required. But the maximum level of protection I was able reach is verify-ca from the perspective of both the client and the server. That is:

• the server won't make sure (auth-options) the common name in the client certificate matches the user I'm trying to connect as (any common name can be used)
• the client won't make sure the common name in the server certificate matches the hostname I'm connecting to (any hostname can be used)

According to the docs I can connect with sslmode=verify-full but either I don't know what instance name they mean, or the information in the docs is out of date. (1) How do I connect with verify-full?

The docs also says:

An SSL mode of verify-full is not required; verify-ca is enough because the CA is instance-specific.

In the pg docs I can see:

The difference between verify-ca and verify-full depends on the policy of the root CA. If a public CA is used, verify-ca allows connections to a server that somebody else may have registered with the CA. In this case, verify-full should always be used. If a local CA is used, or even a self-signed certificate, using verify-ca often provides enough protection.

(2) What does this mean? If the CA is local, only authorized people can create a certificate and a private key, and sign the certificate with the CA's root certificate? And although one can probably get the server's certificate (if the server is public), but one can't get the private key? As such, no unauthorized person can have a valid certificate? As such, if a certificate is valid, it was created by an authorized person, and it doesn't matter what the CN is? Why? It seems like I'm close, but there's still something I'm missing.

(3) If the CA is local, verify-ca == verify-full (no eavesdropping, no MITM)?

More details on what exactly I did can be found here.

It seems like it's needed, because it asks me for the password. But if so, then what's the point in having 2 credentials (a credentials file + password)?

If not, then what am I missing?

The docs is not too revealing about this:

If prompted, enter the password.

To test it from the local machine I did:

docker-compose.yml:

services:
  app:
    build: .
    command: sleep infinity
    init: true
    volumes:
      - .:/app
    depends_on:
      - proxy

  proxy:
    image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.6.0
    command:
      --address 0.0.0.0
      --credentials-file /credentials.json
      --debug
      myprj:europe-central2:db
    volumes:
      - ./credentials.json:/credentials.json

Dockerfile:

FROM google/cloud-sdk:435.0.1-alpine
RUN apk add terraform postgresql15-client
WORKDIR /app

main.tf:

provider "google" {
  project = "myprj"
}

resource "google_sql_database_instance" "test-auth" {
  deletion_protection = false
  name = "db"
  region = "europe-central2"
  database_version = "POSTGRES_11"
  settings {
    tier = "db-f1-micro"
  }
}

resource "google_sql_user" "test-auth" {
  name = "postgres"
  instance = google_sql_database_instance.test-auth.name
  password = 123456
}

resource "google_service_account" "test-auth" {
  account_id = "dbaccount"
}

resource "google_project_iam_member" "test-auth" {
  project = "myprj"
  role    = "roles/cloudsql.client"
  member  = "serviceAccount:${google_service_account.test-auth.email}"
}

$ gcloud auth application-default login
$ terraform init
$ terraform apply
// create the service account key, copy to ./credentials.json, restart the container
$ psql -h proxy -U postgres

I've got a server running Debian 8. Yes, a pretty old one. But there's something really strange about it. I can't connect to it over HTTPS:

$ curl -sSLv https://example.com
*   Trying xx.yyy.xx.yyy:443...
* Connected to example.com (xx.yyy.xx.yyy) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: none
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to example.com:443 
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to example.com:443 

$ sslscan example.com
Version: 2.0.11
OpenSSL 1.1.1m  14 Dec 2021

Connected to xx.yyy.xx.yyy

Testing SSL server example.com on port 443 using SNI name example.com

  SSL/TLS Protocols:
SSLv2     disabled
SSLv3     disabled
TLSv1.0   disabled
TLSv1.1   disabled
TLSv1.2   disabled
TLSv1.3   disabled

  TLS Fallback SCSV:
Connection failed - unable to determine TLS Fallback SCSV support

  TLS renegotiation:
Session renegotiation not supported

  TLS Compression:
OpenSSL version does not support compression
Rebuild with zlib1g-dev package for zlib support

  Heartbleed:

  Supported Server Cipher(s):
Certificate information cannot be retrieved.

$ dpkg -l | grep openssl
ii  openssl                             1.0.1t-1+deb8u12             amd64        Secure Sockets Layer toolkit - cryptographic utility

$ cat /etc/nginx/nginx.conf | grep ssl
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

$ dpkg -l | grep nginx
ii  nginx                               1.6.2-5                      all          small, powerful, scalable web/proxy server
ii  nginx-common                        1.6.2-5                      all          small, powerful, scalable web/proxy server - common files
ii  nginx-full                          1.6.2-5                      amd64        nginx web/proxy server (standard version)

To compare it to another Debian 8 server:

$ sslscan example2.com
Version: 2.0.11
OpenSSL 1.1.1m  14 Dec 2021

Connected to xx.xxx.xx.xxx

Testing SSL server example2.com on port 443 using SNI name example2.com

  SSL/TLS Protocols:
SSLv2     disabled
SSLv3     disabled
TLSv1.0   enabled
TLSv1.1   enabled
TLSv1.2   enabled
TLSv1.3   disabled

  TLS Fallback SCSV:
Server supports TLS Fallback SCSV

  TLS renegotiation:
Secure session renegotiation supported

  TLS Compression:
OpenSSL version does not support compression
Rebuild with zlib1g-dev package for zlib support

  Heartbleed:
TLSv1.2 not vulnerable to heartbleed
TLSv1.1 not vulnerable to heartbleed
TLSv1.0 not vulnerable to heartbleed

  Supported Server Cipher(s):
Preferred TLSv1.2  256 bits  ECDHE-RSA-AES256-GCM-SHA384   Curve P-256 DHE 256
Accepted  TLSv1.2  256 bits  ECDHE-RSA-AES256-SHA384       Curve P-256 DHE 256
Accepted  TLSv1.2  256 bits  ECDHE-RSA-AES256-SHA          Curve P-256 DHE 256
Accepted  TLSv1.2  256 bits  DHE-RSA-AES256-GCM-SHA384     DHE 1024 bits
Accepted  TLSv1.2  256 bits  DHE-RSA-AES256-SHA256         DHE 1024 bits
Accepted  TLSv1.2  256 bits  DHE-RSA-AES256-SHA            DHE 1024 bits
Accepted  TLSv1.2  256 bits  DHE-RSA-CAMELLIA256-SHA       DHE 1024 bits
Accepted  TLSv1.2  256 bits  AES256-GCM-SHA384            
Accepted  TLSv1.2  256 bits  AES256-SHA256                
Accepted  TLSv1.2  256 bits  AES256-SHA                   
Accepted  TLSv1.2  256 bits  CAMELLIA256-SHA              
Accepted  TLSv1.2  128 bits  ECDHE-RSA-AES128-GCM-SHA256   Curve P-256 DHE 256
Accepted  TLSv1.2  128 bits  ECDHE-RSA-AES128-SHA256       Curve P-256 DHE 256
Accepted  TLSv1.2  128 bits  ECDHE-RSA-AES128-SHA          Curve P-256 DHE 256
Accepted  TLSv1.2  128 bits  DHE-RSA-AES128-GCM-SHA256     DHE 1024 bits
Accepted  TLSv1.2  128 bits  DHE-RSA-AES128-SHA256         DHE 1024 bits
Accepted  TLSv1.2  128 bits  DHE-RSA-AES128-SHA            DHE 1024 bits
Accepted  TLSv1.2  128 bits  DHE-RSA-CAMELLIA128-SHA       DHE 1024 bits
Accepted  TLSv1.2  128 bits  AES128-GCM-SHA256            
Accepted  TLSv1.2  128 bits  AES128-SHA256                
Accepted  TLSv1.2  128 bits  AES128-SHA                   
Accepted  TLSv1.2  128 bits  CAMELLIA128-SHA              
Preferred TLSv1.1  256 bits  ECDHE-RSA-AES256-SHA          Curve P-256 DHE 256
Accepted  TLSv1.1  256 bits  DHE-RSA-AES256-SHA            DHE 1024 bits
Accepted  TLSv1.1  256 bits  DHE-RSA-CAMELLIA256-SHA       DHE 1024 bits
Accepted  TLSv1.1  256 bits  AES256-SHA                   
Accepted  TLSv1.1  256 bits  CAMELLIA256-SHA              
Accepted  TLSv1.1  128 bits  ECDHE-RSA-AES128-SHA          Curve P-256 DHE 256
Accepted  TLSv1.1  128 bits  DHE-RSA-AES128-SHA            DHE 1024 bits
Accepted  TLSv1.1  128 bits  DHE-RSA-CAMELLIA128-SHA       DHE 1024 bits
Accepted  TLSv1.1  128 bits  AES128-SHA                   
Accepted  TLSv1.1  128 bits  CAMELLIA128-SHA              
Preferred TLSv1.0  256 bits  ECDHE-RSA-AES256-SHA          Curve P-256 DHE 256
Accepted  TLSv1.0  256 bits  DHE-RSA-AES256-SHA            DHE 1024 bits
Accepted  TLSv1.0  256 bits  DHE-RSA-CAMELLIA256-SHA       DHE 1024 bits
Accepted  TLSv1.0  256 bits  AES256-SHA                   
Accepted  TLSv1.0  256 bits  CAMELLIA256-SHA              
Accepted  TLSv1.0  128 bits  ECDHE-RSA-AES128-SHA          Curve P-256 DHE 256
Accepted  TLSv1.0  128 bits  DHE-RSA-AES128-SHA            DHE 1024 bits
Accepted  TLSv1.0  128 bits  DHE-RSA-CAMELLIA128-SHA       DHE 1024 bits
Accepted  TLSv1.0  128 bits  AES128-SHA                   
Accepted  TLSv1.0  128 bits  CAMELLIA128-SHA              

  Server Key Exchange Group(s):
TLSv1.2  128 bits  secp256r1 (NIST P-256)

  SSL Certificate:
Signature Algorithm: sha256WithRSAEncryption
RSA Key Strength:    4096

Subject:  example2.com
Altnames: DNS:example2.com
Issuer:   R3

Not valid before: Dec 17 21:00:13 2021 GMT
Not valid after:  Mar 17 21:00:12 2022 GMT

$ dpkg -l | grep openssl
ii  openssl                          1.0.1k-3+deb8u2                                amd64        Secure Sockets Layer toolkit - cryptographic utility

$ cat /etc/nginx/nginx.conf | grep ssl
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

$ dpkg -l | grep nginx
ii  nginx                            1.6.2-5                                        all          small, powerful, scalable web/proxy server
ii  nginx-common                     1.6.2-5                                        all          small, powerful, scalable web/proxy server - common files
ii  nginx-full                       1.6.2-5                                        amd64        nginx web/proxy server (standard version)

What's wrong with the first server? How do I make https work?

If you try to bind mount a directory into a container under Red Hat you might have problems with selinux. The directory will be unreadable from inside the container. Unless you add a z/Z volume option.

But what I don't understand is why I can't see corresponding errors in /var/log/audit/audit.log. Indeed after:

sudo semodule --disable_dontaudit --build

they start getting logged:

type=AVC msg=audit(1624806449.148:2225): avc:  denied  { read } for  pid=34576
comm="ls" name="a" dev="xvda2" ino=8546053
scontext=system_u:system_r:container_t:s0:c48,c319
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir permissive=0

But which rule disables logging? I can see:

$ sesearch --dontaudit | grep container_t
dontaudit container_t container_t:capability audit_write; [ virt_sandbox_use_netlink ]:False
dontaudit container_t container_t:capability { fsetid net_admin sys_module };
dontaudit container_t container_t:capability2 block_suspend;
dontaudit container_t container_t:dir { add_name write };
dontaudit container_t container_t:file create;
dontaudit container_t container_t:netlink_audit_socket { append bind connect create getattr getopt ioctl lock nlmsg_read nlmsg_relay read setattr setopt shutdown write }; [ virt_sandbox_use_netlink ]:False
dontaudit container_t container_t:udp_socket listen;

Is it one of those? Or some other one?

I'm running a Red Hat instance on AWS:

Red Hat Enterprise Linux 8 with High Availability - ami-06ec8443c2a35b0ba

I've recently run into Debian wiki not recommending to set exim's primary_hostname explicitly. From what I can gather, here's the code that chooses primary_hostname.

Basically, either I have FQDN in /etc/hostname (myhostname.example.com), or just myhostname and a line in /etc/hosts:

ip.add.re.ss  myhostname.example.com  myhostname

Now, which IP address? 127.0.0.1 or an external one?

I guess having FQDN point to localhost is okay. So, myhostname in /etc/hostname, and the following in /etc/hosts?

127.0.0.1  myhostname.example.com  myhostname  localhost

Looks pretty promising to me:

$ hostname
myhostname
$ hostname -d
example.com
$ hostname --fqdn
myhostname.example.com

Other than that exim would probably use myhostname.example.com for the greeting (EHLO). And that might affect whether emails would be considered spam or not. That, or I must send mail from myhostname.example.com, not from example.com?

Can anyone possibly break the cycle for me? And well, that's not only about exim. Are there optimal settings that would make everyone happy? Or most of them?

Do I need both to install packages? What is the purpose of each of those?

I'm thinking of adding an SPF to a domain. So I'm concerned if there are circumstances under which my MTA would use some relay when sending mail. Like, when the destination servers are too busy or something? I'm mainly interested in postfix's or exim's default settings.

One of my servers ran out of space recently. So I started looking into it. The nginx logs took half of the partition. Also, I noticed a strange thing. For a lot of sites (60%) extra rotations where present (example.com-access.log.53.gz when rotate 52). And most of the biggest ones—but not all—had only two rotations:

example.com-access.log
example.com-access.log.53.gz

50% of the logs had only those two rotations. Sometimes there were just holes in the rotations (30%): one file or more. *.log.1 was often missing (25%). Sometimes there were both *.log.1 and *.log.1.gz (2 out of 172).

Can you explain this missing/duplicate rotations? *.log + *.log.53.gz case makes me think that at some point it was unable to rotate *.log.1 to *.log.2.gz. But wouldn't it stop after unsuccessful gzip? Then there must be no holes. Or at least there must be *.log.1 present if it wouldn't, mustn't there?

I'm running Debian server if anything.

/etc/logrotate.conf:

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

# system-specific logs may be configured here

/etc/logrotate.d/nginx:

/var/log/nginx/*.log {
    weekly
    missingok
    rotate 52
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    size 50M
    sharedscripts
    prerotate
        if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
            run-parts /etc/logrotate.d/httpd-prerotate; \
        fi \
    endscript
    postrotate
        [ -s /run/nginx.pid ] && kill -USR1 `cat /run/nginx.pid`
    endscript
}

/etc/logrotate.d/httpd-prerotate doesn't exist.

I'm running Debian Stretch and PostgreSQL 10 from apt.postgresql.org. When I do:

postgresql disable --now postgresql

the database server doesn't stop. It says:

Synchronizing state of postgresql.service with SysV service script with /lib/systemd/systemd-sysv-install.                                                                                                
Executing: /lib/systemd/systemd-sysv-install disable postgresql                                      
insserv: warning: current start runlevel(s) (empty) of script `postgresql' overrides LSB defaults (2 3 4 5).
insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `postgresql' overrides LSB defaults (0 1 6).

But that probably of not much importance.

systemctl disable --now postgresql@10-main does the job, but I'm curious about postgresql unit. Its start, stop, restart, reload tasks work fine.

Am I missing something? Is this a bug or limitation of systemd? Or of PostgreSQL package?

And now that I look into it, systemctl disable postgresql doesn't prevent PostgreSQL from starting on boot. I'd like not to be tied to a particular version. I thought stopping and disabling PostgreSQL would be simply a matter of doing systemctl disable --now postgresql. But it turns out I've got to:

systemctl list-units 'postgresql*' \
    | grep ^postgresql \
    | awk '{print $1}' \
    | xargs -r -I{} -d\\n systemctl disable --now {}

And even that doesn't always work for some mysterious reasons. I have a copy of data dir for testing purposes. Then in a script I restore database to initial state (stop, rm, cp, start). After which I'm trying to stop and disable pg as above. It gets disabled, but doesn't stop. I can see all it's processes running before the command, I can see:

database system is ready to accept connections

in the log (supposedly fully started). But it just wouldn't. So right now I do:

systemctl stop postgresql
systemctl list-units ... | xargs ... systemctl disable {}

From the man page:

--now When used with enable, the units will also be started. When used with disable or mask, the units will also be stopped. The start or stop operation is only carried out when the respective enable or disable operation has been successful.

On Debian Jessie servers I see systemd-timesyncd listening on random UDP ports. Which is not the case on Debian Stretch hosts. By random I mean the port it listens to varies from server to server. Does it need to listen to a UDP port to work properly? I want to block ports that are not needed. Does this mean I've got to leave all UDP ports open?

I have PostgreSQL 9.4 running on CentOS 7. I installed it from PostgreSQL's repository. And now I want to install ruby gem pg. But it fails, since it can't find pg_config.

Now then, psql works, and in the rpm file I can see:

$ rpm -q --scripts -p postgresql94-9.4.12-1PGDG.rhel7.x86_64.rpm | egrep 'psql|pg_config'
/usr/sbin/update-alternatives --install /usr/bin/psql pgsql-psql /usr/pgsql-9.4/bin/psql 940
...

So, it makes psql automatically available, but not pg_config. Is it by design or by accident? Should I install posgresql as well and use pg_config from PosgreSQL 9.2?

I'm trying to make LXC containers use static IP addresses. For that I specify

lxc.network.ipv4 = 10.0.3.3
lxc.network.ipv4.gateway = 10.0.3.1

in lxc config file. I have only loopback interface in /etc/network/interfaces in containers. And it mostly works. Except for domain name resolution. Is there a way to do something similar to what dns-nameservers stanza in /etc/network/interfaces does in lxc config file?

For now I'm considering to move network settings inside container.

On my server I redirect mail, arriving to [email protected], to [email protected] and [email protected] with /etc/aliases file.

Recently I got the following email in my [email protected] mailbox (where [email protected] mail is redirected to):

Received: by 10.52.34.73 with SMTP id ...;
        Sun, 27 Apr 2014 03:37:39 -0700 (PDT)
...
Received: from myhost (... [16.19.64.110])
        by mx.google.com with ESMTPS id ...
        for <[email protected]>
        (version=TLSv1 cipher=RC4-SHA bits=128/128);
        Sun, 27 Apr 2014 03:37:39 -0700 (PDT)
...
Received: from Debian-exim by myhost with local (Exim 4.72)
    id ...
    for [email protected]; Fri, 25 Apr 2014 13:17:05 +0300
...
Date: Fri, 25 Apr 2014 13:17:05 +0300
...
To: [email protected]

Message frozen

Message 1WddBb-0007hU-1l has been frozen (delivery error message).
The sender is <>.

The following address(es) have yet to be delivered:
  [email protected] <[email protected]>: SMTP error from remote mail server after MAIL FROM:<> SIZE=1558: host gmail-smtp-in.l.google.com [74.125.201.108]: 530-5.5.1 Authentication Required. Learn more at\n530 5.5.1 http://support.google.com/mail/bin/answer.py?answer=14257 h7sm7285577igy.2 - gsmtp
  [email protected] <[email protected]>: SMTP error from remote mail server after MAIL FROM:<> SIZE=1558: host gmail-smtp-in.l.google.com [74.125.201.108]: 530-5.5.1 Authentication Required. Learn more at\n530 5.5.1 http://support.google.com/mail/bin/answer.py?answer=14257 h7sm7285577igy.2 - gsmtp

Then I run:

# exigrep -l 1WddBb-0007hU-1l $(find /var/log/exim4 -name 'mainlog*' | sort -rn -t . -k2,2)
2014-04-25 13:17:02 1WddBb-0007hU-1l <= <> H=(115.78.92.64) [118.69.183.136] P=smtp S=522
2014-04-25 13:17:02 1WddBb-0007hU-1l gmail-smtp-in.l.google.com [2a00:1450:4013:c01::1a] Network is unreachable
2014-04-25 13:17:03 1WddBb-0007hU-1l SMTP error from remote mail server after end of data: host gmail-smtp-in.l.google.com [74.125.136.26]: 421-4.7.0 [16.19.64.110      15] Our system has detected an unusual rate of\n421-4.7.0 unsolicited mail originating from your IP address. To protect our\n421-4.7.0 users from spam, mail sent from your IP address has been temporarily\n421-4.7.0 rate limited. Please visit http://www.google.com/mail/help/bulk_mail.\n421 4.7.0 html to review our Bulk Email Senders Guidelines. t3si12446024eeg.301 - gsmtp
2014-04-25 13:17:03 1WddBb-0007hU-1l SMTP error from remote mail server after end of data: host gmail-smtp-in.l.google.com [74.125.136.27]: 421-4.7.0 [16.19.64.110      15] Our system has detected an unusual rate of\n421-4.7.0 unsolicited mail originating from your IP address. To protect our\n421-4.7.0 users from spam, mail sent from your IP address has been temporarily\n421-4.7.0 rate limited. Please visit http://www.google.com/mail/help/bulk_mail.\n421 4.7.0 html to review our Bulk Email Senders Guidelines. x46si12473877eea.209 - gsmtp
2014-04-25 13:17:05 1WddBb-0007hU-1l ** [email protected] <[email protected]> R=dnslookup T=remote_smtp: SMTP error from remote mail server after MAIL FROM:<> SIZE=1558: host gmail-smtp-in.l.google.com [74.125.201.108]: 530-5.5.1 Authentication Required. Learn more at\n530 5.5.1 http://support.google.com/mail/bin/answer.py?answer=14257 h7sm7285577igy.2 - gsmtp
2014-04-25 13:17:05 1WddBb-0007hU-1l ** [email protected] <[email protected]> R=dnslookup T=remote_smtp: SMTP error from remote mail server after MAIL FROM:<> SIZE=1558: host gmail-smtp-in.l.google.com [74.125.201.108]: 530-5.5.1 Authentication Required. Learn more at\n530 5.5.1 http://support.google.com/mail/bin/answer.py?answer=14257 h7sm7285577igy.2 - gsmtp
2014-04-25 13:17:05 1WddBb-0007hU-1l Frozen (delivery error message)
2014-04-25 13:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 14:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 14:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 15:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 15:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 16:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 16:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 17:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 17:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 18:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 18:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 19:07:58 1WddBb-0007hU-1l Message is frozen
2014-04-25 19:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 20:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 20:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 21:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 21:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 22:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 22:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 23:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-25 23:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 00:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 00:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 01:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 01:37:58 1WddBb-0007hU-1l Message is frozen
2014-04-26 02:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 02:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 03:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 03:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 04:07:38 1WddBb-0007hU-1l Message is frozen
2014-04-26 04:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 05:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 05:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 06:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 06:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 07:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 07:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 08:07:58 1WddBb-0007hU-1l Message is frozen
2014-04-26 08:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 09:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 09:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 10:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 10:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 11:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 11:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 12:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 12:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 13:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 13:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 14:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 14:37:58 1WddBb-0007hU-1l Message is frozen
2014-04-26 15:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 15:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 16:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 16:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 17:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 17:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 18:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 18:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 19:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 19:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 20:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 20:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 21:07:58 1WddBb-0007hU-1l Message is frozen
2014-04-26 21:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 22:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 22:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 23:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-26 23:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 00:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 00:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 01:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 01:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 02:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 02:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 03:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 03:37:58 1WddBb-0007hU-1l Message is frozen
2014-04-27 04:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 04:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 05:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 05:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 06:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 06:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 07:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 07:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 08:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 08:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 09:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 09:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 10:07:58 1WddBb-0007hU-1l Message is frozen
2014-04-27 10:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 11:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 11:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 12:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 12:37:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 13:07:37 1WddBb-0007hU-1l Message is frozen
2014-04-27 13:37:37 1WddBb-0007hU-1l Unfrozen by errmsg timer
2014-04-27 13:37:38 1WddBb-0007hU-1l => [email protected] <[email protected]> R=dnslookup T=remote_smtp H=gmail-smtp-in.l.google.com [74.125.136.27] X=TLS1.0:RSA_ARCFOUR_SHA1:16 DN="C=US,ST=California,L=Mountain View,O=Google Inc,CN=mx.google.com"
2014-04-27 13:37:38 1WddBb-0007hU-1l -> [email protected] <[email protected]> R=dnslookup T=remote_smtp H=gmail-smtp-in.l.google.com [74.125.136.27] X=TLS1.0:RSA_ARCFOUR_SHA1:16 DN="C=US,ST=California,L=Mountain View,O=Google Inc,CN=mx.google.com"
2014-04-27 13:37:38 1WddBb-0007hU-1l Completed

2014-04-25 13:17:05 1WddBd-0007hk-1p <= <> R=1WddBb-0007hU-1l U=Debian-exim P=local S=1111
2014-04-25 13:17:06 1WddBd-0007hk-1p ** [email protected] <[email protected]> R=dnslookup T=remote_smtp: SMTP error from remote mail server after MAIL FROM:<> SIZE=2150: host gmail-smtp-in.l.google.com [74.125.201.109]: 530-5.5.1 Authentication Required. Learn more at\n530 5.5.1 http://support.google.com/mail/bin/answer.py?answer=14257 p7sm7216866igg.15 - gsmtp
2014-04-25 13:17:06 1WddBd-0007hk-1p Frozen (delivery error message)
2014-04-25 13:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 14:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 14:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 15:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 15:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 16:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 16:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 17:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 17:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 18:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 18:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 19:07:58 1WddBd-0007hk-1p Message is frozen
2014-04-25 19:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 20:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 20:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 21:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 21:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 22:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 22:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 23:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-25 23:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 00:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 00:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 01:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 01:37:58 1WddBd-0007hk-1p Message is frozen
2014-04-26 02:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 02:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 03:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 03:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 04:07:38 1WddBd-0007hk-1p Message is frozen
2014-04-26 04:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 05:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 05:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 06:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 06:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 07:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 07:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 08:07:58 1WddBd-0007hk-1p Message is frozen
2014-04-26 08:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 09:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 09:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 10:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 10:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 11:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 11:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 12:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 12:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 13:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 13:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 14:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 14:37:58 1WddBd-0007hk-1p Message is frozen
2014-04-26 15:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 15:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 16:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 16:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 17:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 17:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 18:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 18:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 19:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 19:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 20:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 20:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 21:07:58 1WddBd-0007hk-1p Message is frozen
2014-04-26 21:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 22:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 22:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 23:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-26 23:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 00:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 00:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 01:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 01:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 02:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 02:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 03:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 03:37:58 1WddBd-0007hk-1p Message is frozen
2014-04-27 04:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 04:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 05:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 05:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 06:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 06:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 07:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 07:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 08:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 08:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 09:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 09:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 10:07:58 1WddBd-0007hk-1p Message is frozen
2014-04-27 10:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 11:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 11:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 12:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 12:37:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 13:07:37 1WddBd-0007hk-1p Message is frozen
2014-04-27 13:37:38 1WddBd-0007hk-1p Unfrozen by errmsg timer
2014-04-27 13:37:39 1WddBd-0007hk-1p => [email protected] <[email protected]> R=dnslookup T=remote_smtp H=gmail-smtp-in.l.google.com [74.125.136.27] X=TLS1.0:RSA_ARCFOUR_SHA1:16 DN="C=US,ST=California,L=Mountain View,O=Google Inc,CN=mx.google.com"
2014-04-27 13:37:39 1WddBd-0007hk-1p Completed

First of all, I have problems interpreting it.

We got bounce message from 118.69.183.136. But why does it bounce to both [email protected] and [email protected]? Did they both send an email, which could not be delivered? Unlikely.

Then google replies with "421-4.7.0 [16.19.64.110 15] Our system has detected an unusual rate of unsolicited mail originating from your IP address. To protect our users from spam, mail sent from your IP address has been temporarily rate limited. Please visit http://www.google.com/mail/help/bulk_mail.html to review our Bulk Email Senders Guidelines." What is this supposed to mean? [email protected] is a feedback mailbox, redirected to [email protected] and [email protected]. I doubt they send a lot of emails. Would you suggest a way to count them?

As a result one more bounce message is generated for [email protected]. But now google replies with "530-5.5.1 Authentication Required. Learn more at http://support.google.com/mail/bin/answer.py?answer=14257" That I don't understand either. I now can send messages to [email protected] just fine.

In the end, the bounce messages get delivered. I'm running debian 6. Could you explain me what's going on and what am I to do?

I'm experiencing symptoms similar to those of the other question. That is, peoples are complaining about a domain name being inaccessible. And then, it suddenly starts working after a while. But I doubt it's because of unreliable DNS servers. They are of my domain name registrar, which is pretty popular in my country.

Could there be some other reasons for this? It's a subdomain, like in sub.example.com and I make it work with wildcard DNS record. Could that possibly be a reason? Maybe some old DNS servers doesn't understand these sort of things? The other reason I can think of is some temporary issues in the internet, like some hosts can't access the other ones? Or some DNS servers filtering out records by some criterion?

UPD The setup is simple, no load balancers, no clusters, no round-robin DNS servers. And I'm talking about publicly available server. The users are the users of the internet. I'm managing both example.com and sub.example.com. They are in one DNS zone.

UPD Or maybe after all it's because of the domain registrar. Its servers respond with a timeout:

>nslookup sub.example.com ns.domain.registrar.com
DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  52.16.198.15

Name:    sub.example.com
Address:  51.59.10.10

I suppose, not all the DNS-servers would tolerate timeouts, don't you think?

I'm trying to backport a package, but dget (dscverify) says that it can't check the signature because of public key not being found:

[root ~/build/openssl] dget -x http://ftp.de.debian.org/debian/pool/main/o/openssl/openssl_0[72/753]
queeze14.dsc
dget: retrieving http://ftp.de.debian.org/debian/pool/main/o/openssl/openssl_0.9.8o-4squeeze14.dsc
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2003  100  2003    0     0  27106      0 --:--:-- --:--:-- --:--:-- 47690
dget: retrieving http://ftp.de.debian.org/debian/pool/main/o/openssl/openssl_0.9.8o.orig.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 3684k  100 3684k    0     0  3507k      0  0:00:01  0:00:01 --:--:-- 3615k
dget: retrieving http://ftp.de.debian.org/debian/pool/main/o/openssl/openssl_0.9.8o-4squeeze14.debia
n.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 94425  100 94425    0     0   371k      0 --:--:-- --:--:-- --:--:--  422k
openssl_0.9.8o-4squeeze14.dsc:
dscverify: openssl_0.9.8o-4squeeze14.dsc failed signature check:
gpg: keyblock resource `/root/.gnupg/secring.gpg': file open error
gpg: Signature made Mon 11 Feb 2013 11:04:16 PM EET using RSA key ID 1A5522DD
gpg: Can't check signature: public key not found
Validation FAILED!!

I've tried updating debian-keyring package, specifying dsc files from different versions of debian. To no avail. How come it can't verify the signature? Can I ignore this messege? Or what an I to do?

I'm running Debian 6.0.3 (squeeze), nginx-0.7.67, fcgiwrap-1.0-1+squeeze1. Here is the test script:

#!/usr/bin/perl
use 5.010;
use warnings;
use strict;

use Data::Dumper;

print "Content-Type: text/html\n\n";
say Dumper {map {$_ => $ENV{$_}} 'SCRIPT_NAME', 'DOCUMENT_ROOT', 'WHATEVER'};
say "$<, $>, $(, $)";

And here's the nginx configuration:

server {
    server_name   domain.com;
    root   /home/yuri/6;
    access_log   /var/log/nginx/domain.com-access.log;
    error_log   /var/log/nginx/domain.com-error.log;

    location /cgi-bin/ {
        fastcgi_pass   unix:/var/run/fcgiwrap.socket;
        fastcgi_param   DOCUMENT_ROOT   $document_root;
        fastcgi_param   DOCUMENT_ROOT   /home/yuri/7/;
        fastcgi_param   SCRIPT_NAME   $fastcgi_script_name;
        fastcgi_param   WHATEVER   1;
        fastcgi_param   WHATEVER   2;
    }

    location /1.php {
        fastcgi_pass   unix:/var/run/php5-fpm.sock;
        fastcgi_param   PHP_ADMIN_VALUE   cgi.fix_pathinfo=1;
        fastcgi_param   REQUEST_METHOD    $request_method;
        fastcgi_param   SCRIPT_FILENAME   whatever;
        fastcgi_param   SCRIPT_FILENAME   $document_root$fastcgi_script_name;
    }
}

Here's what I get in browser if going to url http://domain.com/cgi-bin/1.pl:

$VAR1 = { 'SCRIPT_NAME' => '/cgi-bin/1.pl', 'DOCUMENT_ROOT' => '/home/yuri/7/', 'WHATEVER' => '2' };

So it seems, that fcgiwrap uses the first DOCUMENT_ROOT for looking up for the script, but the script gets the last values of params. If you change the order of DOCUMENT_ROOT directives, web server returns 403. The question is... how come?

php though works as expected: the second SCRIPT_FILENAME overrides the first one.