Craig Watson's questions

After migrating hosting providers last year, I have ended up with many emails that show up with a "Date" of the migration, rather than the message delivery date, see screenshot:

This date shows up both on my local clients (Mail.app in OS X 10.11.6 and iOS 10 beta) and also webmail (Roundcube).

The back-end mailserver is Dovecot, and all messages in the Maildir directory have the correct Delivery-date headers.

Is there any way to correct this, or have Dovecot re-read or re-compile its message databases?

I currently have two Apache servers running here and here, both use SSL certs signed by StartSSL. Apache SSL configuration below:

  ## SSL directives
  SSLEngine on
  SSLCertificateFile      "/etc/certificates/thor.vikingserv.net/certificate.crt"
  SSLCertificateKeyFile   "/etc/certificates/thor.vikingserv.net/private.key"
  SSLCertificateChainFile "/etc/certificates/intermediate/startssl-class-1.crt"

Both the server certificate and the intermediate certificate are SHA-256, but the CA cert is SHA-256 on my Linux workstation, but SHA-1 on my MacBook.

I could use the SSLCACertificatePath directive within Apache to force the SHA-256 CA cert, but would this override the root certificate distributed with the OS?

We have a GoDaddy wildcard certificate that we have installed into Exchange 2010 and is successfully used on IIS connections for OWA.

We have assigned this certificate to the SMTP Service as well as IIS, but that doesn't seem to have unassigned the default self-signed certificate.

The self-signed certificate is already assigned to SMTP, IMAP and POP (we can't use the wildcard certificate for IMAP and POP due to it being a wildcard). Is it possible to unassign a self-signed certificate from just the SMTP service?

The only documentation I've found relates to removing a certificate completely.

We have just taken delivery of a new JBOD chassis, with 14 x 2TB NL-SAS drives - 2 have already been earmarked for enclosure spares, so we have 12 drives available.

I have several options for setting up the RAID10 array (unfortunately the head unit won't allow odd-numbered spans):

• 6 x 2-disk spans (12TB raw)
• 3 x 4-disk spans (6TB raw)
• 2 x 6-disk spans (4TB raw)

I would like to get the most usable space so 6x2 is looking favourable and 2x6 doesn't give anywhere near enough space, but I'm wondering if there's any performance or risk hit with going with 6x2 over 3x4.

I think that 6x2 is more risky because each span can only lose one drive - but are the two hot-spares enough to mitigate this?

Can someone sanity-check my reasoning or give me any pointers?

Head unit is an FC Infortrend ES-DS 3024 SAN, and workload will be Veeam backup storage if it makes any difference.

I run an MTA consisting of the standard Postfix, SpamAssassin, ClamAV, SPF/DKIM checks etc. This MTA is used for inbound email only, doesn't host any accounts and forwards any mail that passes said checks to a shared webhost.

I'm aware that a few email services are starting to attempt TLS connections before plain-text when attempting to deliver mail to my server.

I realise that not all services will support TLS, but I'm wondering how well-adopted it is so that I can satisfy the OCD security side of my brain (yes, I know SSL isn't as secure as we once thought it was ... ).

The Postfix documentation for smtpd_tls_security_level states that RFC 2487 decrees that all publicly-referenced (i.e. MX) mailservers do not force TLS:

According to RFC 2487 this MUST NOT be applied in case of a publicly-referenced SMTP server. This option is therefore off by default.

So: How applicable/relevant is the documentation (or the 15 year-old RFC for that matter), and can I safely force TLS on all inbound SMTP connections without locking out half of the world's ISPs?

Please excuse the brain-dump - trying to solve a problem that's had be running around in circles for an entire day!

TL;DR - Clients on two networks separated by a L3 switch can see and ping eachother, but only VLAN 99 can access the Internet, despite a default gateway being set (and routable) on the switch. Packets end up reaching the gateway and go no further, proven by traceroutes.

VLANs:

• 192.168.50.0/24 (Legacy - VLAN 99)
• 10.50.1.0/24 (New - VLAN 1)

Kit:

• SonicWALL NSA220 with a LAN interface on 192.168.50.1 and a WAN address. The SonicWALL is configured to NAT all LAN addresses to the WAN.
• HP 2920 Layer 3 switch, with interfaces on 192.168.50.254 and 10.50.1.254 and default gateway set to 192.168.50.1.

Default gateways:

• VLAN 99: 192.168.50.1 (SonicWALL)
• VLAN 1: 10.50.1.254 (HP)

Implementation details:

• I have pushed a static route via DHCP for 10.50.1.0/24 with the gateway 192.168.50.254 to avoid ICMP redirects from the SonicWALL to 2920.
• I have 10.50.1.0/24 statically routed to 192.168.1.254 and zoned as a LAN network on the SonicWALL.

Routing table on the 2920:

core-switch-01# show ip route

IP Route Entries

Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
------------------ --------------- ---- --------- ---------- ---------- -----
0.0.0.0/0          192.168.50.1    99   static               1          1    
10.50.1.0/24       MGMT            1    connected            1          0    
127.0.0.0/8        reject               static               0          0    
127.0.0.1/32       lo0                  connected            1          0    
192.168.50.0/24    OLD_NET         99   connected            1          0    

Please comment if anyone needs further detail.

We have a new storage array consisting of 24 x 600GB 10K SAS disks arriving next week, and I'm trying to decide how best to carve up the available space for our 3-node VMware vSphere cluster which will be accessing the array over 8Gb FC with fully redundant multipathing.

We have two main workloads - in-house MySQL and Exchange 2010 servers which I'll class as high-IO and Windows domain controllers and a fileserver, which I'll class low-IO.

My initial plan was to split the array with 6 disks in RAID10, with the other 18 in RAID50, using either three 6-disk RAID5 silos, or six 3-disk silos. The enclosure doesn't have a "hot spare", but we've ordered an extra disk as an on-site "cold spare".

Now, this works in principle, but I'm unsure how safe it will be in practice - I've read several articles and although the increased space efficiency is swaying me in the direction of RAID50, several posts I've seen essentially say that RAID50 (along with RAID5) has been deprecated in industry due to unreliability and failure risk.

Am I being paranoid unnecessarily, and if not, should I use RAID10 silos instead of RAID50?

TL;DR - Is it possible for a CloudFormation template to insert the subnet-specific internal IP address of a specific ELB into the UserData of an instance within that subnet?

We have a fleet of EC2 web servers in an Amazon VPC with six subnets, one private and one public across each of the three AZ's within EU-West-1. All servers are configured with CloudFormation.

We would like to configure Apache's mod_rpaf to log the X-Forwarded-For header (we can change the LogFormat, but this doesn't translate easily to PHP or Apache error logs; RPAF is the neatest solution for us).

As far as I know, the way an ELB is architected means that it has a 'foot' in each of its configured AZs, and this can change if the ELB is torn down or re-created.

It seems that the version of mod_rpaf in Ubuntu 12.04's repositories hasn't been updated to allow CIDR notation for the ProxyIPS directive, and in theory the ELB's IP address can be anything within our three public subnets.

The one remaining solution is to configure the module via Puppet, using hieradata generated by the instance's UserData. I know that to some degree you can interpolate references and variables within CloudFormation templates, but I'm unsure if it's possible to effectively say "Give me the private IP address for this ELB in this subnet".

I'm sketching out a new network topology and I'm unsure of how to solve the issue of DHCP between two VLANs.

• 10.50.2.0/23 will hold the majority of our users, corporate wifi, printers etc.
• 10.250.3.0/24 will hold a subset of users who need access to our AWS VPN tunnel

I'm planning to use a L3 switch to route between subnets, with ACLs to control which VLAN can access which and in which direction (i.e. 3/24 will be able to access 2/23 but not vice versa).

The issue is DHCP in the 10.50.3.0/24 network. I can either configure a DHCP relay via the switch, or I can give our Windows 2008 R2 DHCP server a NIC in that network.

Which (if either) is the "right" way?

I have my website and email hosted with a shared host. Unfortunately their servers are using CPanel, so they are limited in their spam protection options.

I also have a VPS that I use for testing and hosting several other bits and pieces (Why don't I use the VPS for websites? I don't want to have to worry about backups!) - I can potentially use this as my MX for my domains, with the shared host as transport maps - I used to run my own dedi and so have Puppet modules ready to go for a mailserver.

The VPS host requires me to use a Postfix mail relay to make sure I'm not spamming from their IP ranges.

Can I use Postfix's transport_maps and relay_host directives together to make my MX forward all mail for my domains to the shared host, but via the VPS host's relay?

A further example of my desired outcome:

• example.com has an single MX record (for sanity) of vps.example.com
• vps.example.com receives incoming mail, then consults transport_maps and forwards it to the eventual destination sharedhost.example.com, using the the relay relayvps.example.net as the "next hop"

I've been considering moving my VMware-based dedicated server to Linux using KVM/QEMU. The only major hurdle remaining is networking. My current setup is:

NIC <---> Public vSwitch <--->  Router (IPFire) <---> Private vSwitch <---> VMs

The host has a public IP, as does the router VM.

My question is: is Open vSwitch necessary to replicate this setup, or would two standard Linux bridges suffice - e.g. br0 for public and br1 for VMs, and the router VM having a NIC attached to both?

I have a /29 subnet assigned by my ISP, with an SonicWALL office router and a Cisco voice router hooked up to a 'net-rail' of sorts with untagged VLAN switch ports connecting my ISP router's output and the two firewalls.

I'd like to use this as a routed subnet so that all connections hit my office firewall and I can DNAT to our internal network.

Is there anything that can be done without significant changes on our ISPs router?