Jay M's questions

I have a makefile that calls external build scripts.

Some of these scripts (which I can't change) make use of commands that are forked / backgrounded (or asynchronous as the bash manual names them)

That means that the next line in the makefile can start before some of the previous command finishes - creating a race condition.

I somehow need to either wait on the forked process and all it's children, or simply prevent any command or subcommand of subsequent scripts running in the background.

Is there a way to prevent this, i.e. disable the ampersand '&' suffix to commands in the current and child subshells?

In order to support automatic LetsEncrypt certificate renewal certbot uses the --apache handler.

e.g.

certbot renew --apache

This handler installs a temporary VirtualHost for */.well-known/acme-challenge/ on the Apache server in order authenticate the renewal.

The problem is that this mechanism does not work if the existing virtual server uses HTTPS and Django over WSGI mounted on the http server root.

The temporary VirtualHost fails to capture the URL and so Django tries to service the request (and fails) as the URL is not in it's list of URLs.

I've noticed a flood of spam that is related to the same range of IPs.

All the spam email has different HTML text (which is english but meaningless) and a few embedded pictures (which I block) but actaully is clearly machine generated and the internal formatting is very similar. BTW all link and external pictures are blocked by my mailer.

What I have noticed is that the MX for the 'from' address domain all reside in a small range of IPs, all of them are on the same VPS service 'Node Outlet India LLP'. So somebody is using this service to host a farm of spambots.

I would like to generate a spamassassin rule that says something like:

• Extract the 'from' domain
• Look up MX of that domain
• Look up IP of that MX
• Does it look like 36.255.24.x/21
• Give it a high score, e.g. +2

I use spampd proxy and spamassassin running on Linux.

To clarify, here is an example: The spam email is from [email protected]

The source email passes SPF, DMARC and is DKIM signed - all legit - but it's spam. By just those checks alone it scores well as ham.

The only thing spammy about it is the content. Mostly HTML and out of domain link embedded pictures and little text, only those features makes it have a spam score at all, but not a large one. These emails are clearly designed to avoid anti-spam measures.

I do an MX RR DNS lookup on stufftobuy.com and you get mail.stufftobuy.com, do a A RR DNS lookup on mail.stufftobuy.com and it returns an IPV4 from one a handful of address rages that all the from domain MX records point to.

I need to do more analysis but it seems to be from just two server farms, one in India the other in Turkey.

Of 1000 emails, a single IPV4 may only appear twice.

I can't just score or block stufftobuy.com as that actual domain name may only be used once. The next message may be from makecatvids.com or whatever.

Equally I can't just blindly block thousands of IPV4 in postfix as that would make the assumption that the ISP is bad rather than one of their customers.

UPDATE: I can see the askdns plugin exists, but I can't see how one rule can feed into another. A single DNS lookup is not enough.

I'm trying to install OpenDKIM on Ubuntu 18.04.3 LTS

It simply does not start. First I was starting it through the systemd service, but running it from the command line produces the same result.

I run with strace and it shows it loading a bunch of shared libraries, opening /etc/passwd then quitting with return code 0.

No log messages, no errors, it just silently quits.

Tried running as root and as opendkim, same result.

What other tests can I do? It seems to have little in the way of logging options.

AuFS (another union file system) allows us to merge two trees into one, even when those trees overlap. We can then direct writes to the merged tree towards one of the branches and reads to another.

The classic use of this is with a flash file system and a ram disk, like this (ref 1) to create a read-only root file system that does not break Linux. All file writes go to ram. After a reboot the system restore itself to the as-shipped configuration.

• /dir1 = read only
• /dir2 = read/write
• /aufs = merge of /dir1 and /dir2

/aufs is then re-mounted with --move to make it / (root)

Simplified, the example in (ref 1) just does this

mount -t aufs br=/dir2:/dir1 /aufs
mount --move /aufs /

However, I want to use it such that the writable (/dir2) is on a real disk, not a ramdisk. That way after a reboot it will retain it's data.

But I need to ensure certain files in dir2 are not preserved and are restored to their (/dir1) defaults. This ensures future boots always use the as-shipped files. Without loosing user and logging data.

e.g. Changed files in /etc, /bin, /boot, /usr should not survive a reboot.

The AUFS web page (ref 2) has very few examples.

So to the question: What is the correct way to do this using AuFS?

I can think of the following:

1. Modify the first mount command in some way
2. Add more mount commands using the aufs add/del before second mount
3. Simply delete the trees that should not be preserved from /dir2 at boot time
4. Partial tree (etc, bin, boot, lib, etc) in tmpfs

Ref 1: https://help.ubuntu.com/community/aufsRootFileSystemOnUsbFlash
Ref 2: http://aufs.sourceforge.net/aufs.html

We have Aras Innovator PLM running on an IIS Server within our LAN.

We'd like to make this available on the Internet, for access to our partners and sub-contractors, but for logistical reasons can't simply connect the server to the public Internet.

To enhance security it has been decided that it MUST run SSL with client certificates, so even a misconigured proxy or server won't leak data.

As a test, I have successfully used a VPS located on the Internet running Apache as a web proxy (SSL) which is connected to the webserver within the LAN via a VPN to browse MoinMoin.

Client <-> Internet <-> VPS <-> Proxy <-> VPN <-> WebServer <-> MoinMoin

But I can't do the same with Aras, it gets to the login page and refuses to go any further. Obviously it works internally.

So:
https://server.domain.net/wiki works
but
https://server.domain.net/InnovatorServer does not work

I've tried TCPDUMPS and Wireshark and can't see any traffic when the LOGIN button is pressed.

Here is my apache config (altered for security reasons)

Any suggestions what to try next?

<VirtualHost _default_:443>
    ServerAdmin [email protected]
    ServerName server.domain.net

    DocumentRoot /var/www

    <Directory />
      Options FollowSymLinks
      AllowOverride None
    </Directory>

    <Directory /var/www/>
     Options Indexes FollowSymLinks MultiViews
     AllowOverride None
     allow from all
     Order deny,allow

     SSLRequireSSL
     SSLVerifyClient require
     SSLVerifyDepth 1
    </Directory>

    ProxyRequests off
    ProxyPreserveHost on

    SSLOptions +StdEnvVars +ExportCertData

    RewriteEngine On
    ReWriteCond %{SERVER_PORT} !^443$
    RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]

    <Location /wiki>
     Order deny,allow
     Allow from all
     SSLVerifyClient require
     SSLVerifyDepth 1

     ProxyPass              http://server1.lan:80/wiki
     ProxyPassReverse       http://server1.lan:80/wiki
    </Location>

    <Location /InnovatorServer>
     Order deny,allow
     Allow from all
     SSLVerifyClient require
     SSLVerifyDepth 1

     ProxyPass              http://server2.lan:80/InnovatorServer
     ProxyPassReverse       http://server2.lan:80/InnovatorServer
     ProxyPassReverseCookieDomain server2.lan server.domain.net
    </Location>

    SSLEngine on

    SSLCACertificateFile /etc/ssl/certs/CA.pem
    SSLCertificateFile    /etc/ssl/certs/server.domain.net-cert.pem
    SSLCertificateKeyFile /etc/ssl/private/server.domain.net-cert.key

</VirtualHost>

<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName server.domain.net

    ReWriteEngine On
    RewriteRule ^/InnovatorServer/(.*) https://%{HTTP_HOST}/InnovatorServer

</VirtualHost>