Mike B's questions

I've got a CentOS 5.10 (32-bit) server running on VMWare. It's allocated 4 GB of RAM.

If I run dmidecode -t 17 | grep Size | grep MB I see:

Size: 4096 MB

Yet when I run free, I see:

             total       used       free     shared    buffers     cached
Mem:       3107140    1239244    1867896          0        332     400464
-/+ buffers/cache:     838448    2268692
Swap:      2096472          0    2096472

Why is there a discrepancy between the total amount of memory free reports and the dmidecode output?

The kernel I'm running is:

2.6.18-371.4.1.el5 #1 SMP Thu Jan 30 06:09:24 EST 2014 i686 i686 i386 GNU/Linux

Admittedly, the kernel is not running PAE but I thought that was only necessary for memory exceeding 4 GB.

I know I'm missing something simple - can someone please elaborate?

Additional Notes/Observations

It definitely looks like my kernel is reserving a bunch of memory for other stuff. Here's what I see in /var/log/dmesg:

Linux version 2.6.18-371.4.1.el5 ([email protected]) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-54)) #1 SMP Thu Jan 30 06:09:24 EST 2014
BIOS-provided physical RAM map:
 BIOS-e820: 0000000000010000 - 000000000009f800 (usable)
 BIOS-e820: 000000000009f800 - 00000000000a0000 (reserved)
 BIOS-e820: 00000000000ca000 - 00000000000cc000 (reserved)
 BIOS-e820: 00000000000dc000 - 0000000000100000 (reserved)
 BIOS-e820: 0000000000100000 - 00000000bfef0000 (usable)
 BIOS-e820: 00000000bfef0000 - 00000000bfeff000 (ACPI data)
 BIOS-e820: 00000000bfeff000 - 00000000bff00000 (ACPI NVS)
 BIOS-e820: 00000000bff00000 - 00000000c0000000 (usable)
 BIOS-e820: 00000000e0000000 - 00000000f0000000 (reserved)
 BIOS-e820: 00000000fec00000 - 00000000fec10000 (reserved)
 BIOS-e820: 00000000fee00000 - 00000000fee01000 (reserved)
 BIOS-e820: 00000000fffe0000 - 0000000100000000 (reserved)
 BIOS-e820: 0000000100000000 - 0000000140000000 (usable)
Warning only 4GB will be used.
Use a PAE enabled kernel.
3200MB HIGHMEM available.
896MB LOWMEM available.
found SMP MP-table at 000f6bf0
Memory for crash kernel (0x0 to 0x0) notwithin permissible range

I'm on CentOS 5.9.

I'd like to determine from the linux shell if a remote web server specifically supports TLS 1.2 (as opposed to TLS 1.0). Is there an easy way to check for that?

I'm not seeing a related option on openssl but perhaps I'm overlooking something.

A linux server of mine is trying to establish a LDAPS connection to a global catalog server and the connection is getting dropped (presumably by the GC side).

For the purpose of discussion, let's say that 1.1.1.1 is the Linux server and 1.2.3.4 is the global catalog server.

If I try to use telnet from the Linux box, I see:

[root@foobox ~]# telnet gcfoo.exampleAD.local 3269
Trying 1.2.3.4...
Connected to gcfoo.examplead.local.
Escape character is '^]'.
Connection closed by foreign host.

There's no delay between the 4th and 5th lines. It just immediately drops the connection.

I thought that telnet results might be a little misleading (since it's not actually appropriate for any type of secure communication) so I collected a packet capture of the actual connection attempt from the appliance (using the actual program requiring LDAPS).

Here's what I see (again, IPs and source ports have been renamed to protect the innocent):

No.     Time      Source     Destination      Protocol    Length    Info
1       0.000000  1.1.1.1    1.2.3.4          TCP         66        27246 > msft-gc-ssl [SYN] Seq=0 Win=5840 Len=0 MSS=1460 SAC_PERM=1 WS=128
2       0.000162  1.2.3.4    1.1.1.1          TCP         62        msft-gc-ssl > 27246 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 SACK_PERM=1
3       0.000209  1.1.1.1    1.2.3.4          TCP         54        27246 > msft-gc-ssl [ACK] Seq=1 Ack=1 Win=5840 Len=0
4       0.003462  1.1.1.1    1.2.3.4          TCP         248       27246 > msft-gc-ssl [PSH, ACK] Seq=1 Ack=1 Win=5840 Len=194
5       0.007264  1.2.3.4    1.1.1.1          TCP         60        msft-gc-ssl > 27246 [RST] Seq=1 Win=64046 Len=0

I'm a bit rusty with TCP/IP so please forgive my ignorance... I see the three-way handshake taking place in packets 1-3. That makes sense. What's going on in packet #4 though? What does [PSH, ACK] mean? This seems like a redundant acknowledgement that's unnecessary. Is actual data being sent in this 4th packet? Or is this some weird continuation of the handshake?

What is the difference between dnl and dnl # in a /etc/mail/sendmail.mc file? If I want to enable something what needs to be in front? Likewise, if I want to "comment out" something, what prefix do I need?

For example:

dnl # masquerade not just @mydomainalias.com, but @*.mydomainalias.com as well
dnl #
dnl FEATURE(masquerade_entire_domain)dnl
dnl #
dnl MASQUERADE_DOMAIN(localhost)dnl
dnl MASQUERADE_DOMAIN(localhost.localdomain)dnl
dnl MASQUERADE_DOMAIN(foo.com)dnl
dnl MASQUERADE_DOMAIN(foo2.lan)dnl
MAILER(smtp)dnl
MAILER(procmail)dnl
dnl MAILER(cyrusv2)dnl

A remote recipient domain is rejecting mail on the grounds of SPF and I think it's because the sender has SPF configured incorrectly.

When I run dig, I see:

[fooadm@box ~]# dig @8.8.8.8 -t TXT foosender.com

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> @8.8.8.8 -t TXT foosender.com
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30608
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;foosender.com.              IN      TXT

;; ANSWER SECTION:
foosender.com.       14039   IN      TXT     "v=spf1 include:spf.foo1.com -all"
foosender.com.       14039   IN      TXT     "v=spf1 include:_spf.bob.foo2.com -all"

;; Query time: 26 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Jan  7 09:45:38 2014
;; MSG SIZE  rcvd: 146

Is this a valid setup? It seems strange to me that there are two separate records (each with hard fails). Shouldn't everything be in a single record?

I would expect the proper TXT record to be:

v=spf1 include:spf.foo1.com include:_spf.bob.foo2.com -all

Windows Server 2008 R2 (fully patched)

I'm trying to run a scheduled task to move a specific type of files from C:\Windows\Temp to E:\Foo_blah_blah_blah_blah\Foo2 and for some reason am getting the following error:

Task Scheduler failed to start instance "{fe0f148a-cece-44a0-a4d1-914aaf21daa8}" of "\Move Temp Files" task for user "FOOBOX\Administrator". Additional Data: Error Value: 2147942402

Any idea why this is happening?

Additional details:

• The task is configured to run as an account that has authority to move the file.
• The task is configured to run whether user is logged on or not. It fails for both scenarios - same errors.
• The task is configured to run for the local OS (Windows Server 2008)
• The command is broken up into two parts. Program/script: move Add Arguments: C:\Windows\Temp\*.foo E:\Foo_blah_blah_blah_blah\Foo2\

If I run this same command move C:\Windows\Temp\*.foo E:\Foo_blah_blah_blah_blah\Foo2\ from the windows command prompt, it works fine.

What am I missing?

CentOS 5.9

For testing purposes, I want my CentOS server to listen on a secondary virtual IP (eth0:0). I'm familiar with nc -l -p <port> but it only listens on the primary. Is there a way I can specify a specific IP for the listener to use?

If not, is there another "stock" utility in CentOS 5.9 that can do this?

I'm using CentOS 5.x trying to wrap my mind around the following iptables rule on one of my servers:

-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

On another server I have:

-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 3 -j ACCEPT

I understand that both of these rules are designed to allow (and throttle) incoming ping requests but what is the limit-burst option about? And are these allowances on a per host basis? Or do they apply to any/all incoming ICMP connections at all?

CentOS 5.8 | VMWare ESX 5.1

When I run ethtool eth0 I see the following:

[root@foo ~]# ethtool eth0
Settings for eth0:
         Current message level: 0x00000007 (7)
         Link detected: yes

Is there any way to get the rest of the details? Particularly speed and duplex? I'm used to ethtool output being more verbose. For example:

# ethtool eth0
Settings for eth0:
        Supported ports: [ TP ]
        Supported link modes:   10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Full
        Supports auto-negotiation: Yes
        Advertised link modes:  10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
                                1000baseT/Full
        Advertised auto-negotiation: Yes
        Speed: 100Mb/s
        Duplex: Full
        Port: Twisted Pair
        PHYAD: 1
        Transceiver: internal
        Auto-negotiation: on
        Supports Wake-on: d
        Wake-on: d
        Link detected: yes

I'm wondering if this is related to running on a VMWare platform? Current adapter type in ESX is "Flexible" and VMWare tools is not installed on the server.

CentOS

Is there an easy way to convert HTML special entities from a data stream? I'm passing data to a bash script and sometimes that data includes special entities. For example:

"test" & test $test ! test @ # $ % ^ & *

I'm not sure why some characters show up fine and other don't but unfortunately, I don't have control over the data coming in.

I'm thinking I might be able to use SED here but that seems like it would be cumbersome and possibly prone to false positives. Is there a Linux command I could pipe to that specializes in decoding this type of data?

Two different third-party email products we have are reacting differently to the presence of a content-id header in the MIME source of an email. This is resulting in an inconsistent user experience that we're trying to resolve.

Here's an example:

--boundary-example
Content-Location: CID:somethingatelse 
Content-ID: <foo4atfoo1atbar.net>
Content-Type: IMAGE/GIF
Content-Transfer-Encoding: BASE64

R0lGODlhGAGgAPEAAP/////ZRaCgoAAAACH+PUNv
cHlyaWdodCAoQykgMTk5LiBVbmF1dGhvcml6ZWQgZHV
wbGljYXRpb24gcHJvaGliaXRlZC4A etc..

One email product interprets this as an embedded image. The other interprets this as an ordinary attachment (not embedded). If we completely remove the Content-ID line, both products think the attachment is not embedded.

Is there a specific RFC that definitively concludes which behavior is correct? A colleague and I reviewed RFC2392 which in the opening abstract says:

The use of [MIME] within email to convey Web pages and their
associated images requires a URL scheme to permit the HTML to refer
to the images or other data included in the message. The Content-ID
Uniform Resource Locator, "cid:", serves that purpose. […] The "cid" scheme refers to a specific body part of a message; its use is generally limited to references to other body parts in the same message as the referring body part. The "mid" scheme may also refer to a specific body part within a designated message, by including the content-ID's address.

So, while not absolute, we're inclined to believe that since all embedded items need a cid to reference them, and that it is “generally limited to other body parts in the same message,” and that attachments don’t need a cid, it is reasonable behavior for an email product to treat the presence of a cid, as an indicator of “intent to embed”.

Can I get confirmation on this?

A third-party email gateway relay is refusing to process a message for an email address we're sending to. The address is in the format of [email protected] (note the two periods). Is this allowed by RFC guidelines?

RFC 2822 seems to object to this in section 3.4.1:

The locally interpreted string is either a quoted-string or a dot-atom. If the string can be represented as a dot-atom (that is, it contains no characters other than atext characters or "." surrounded by atext characters), then the dot-atom form SHOULD be used and the quoted-string form SHOULD NOT be used. Comments and folding white space SHOULD NOT be used around the "@" in the addr-spec.

Furthermore, in that same section, it references this:

addr-spec = local-part "@" domain

local-part = dot-atom / quoted-string / obs-local-part

I interpret this to mean that the localpart can have content separated by dots but there cannot be two successive dots, and it cannot start or end with a dot. That being said, I'm not familiar with dot-atom syntax so maybe I'm mistaken here.

Can someone please confirm and explain?

CentOS 5.x

Mq question seemed similar to this one but I wasn't sure...

I have two servers (completely isolated from each other), each with a directory and sub-directories that should have the same exact contents.

For example the directory layout could be something like:

SERVER A -

/opt/foo/foob/1092380298309128301283/123.txt
/opt/foo/foob/5094380298309128301283/456.txt
/opt/foo/foob/5092380298309128301283/789.txt
/opt/foo/foob/1592380298309128301283/abc.txt

SERVER B -

/opt/foo/foob/1092380298309128301283/123.txt
/opt/foo/foob/5094380298309128301283/456.txt
/opt/foo/foob/5092380298309128301283/789.txt
/opt/foo/foob/1592380298309128301283/abc.txt

Ideally I'd like a way to do a recursive check and have something confirm that everything matches.

I also want to avoid using any third-party tools.

Any ideas?

I've got a web server that isn't quite ready for general availability but I'd still like to test some things remotely. Can I leverage an SSH tunnel to connect to the server and then use the tunnel to route to the web service that is operating on the same server? If so how?

I realize that implementing firewall exceptions would be easier but that isn't an option at this time.

Sorry if this is confusing. I agree that it's a unique scenario.

CentOS 5.x

I have a quick question regarding SPF records: Do they need to be present for all subdomains?

Lets say that I have a TXT record with SPF info for domain.com

Let's also say that I have a seperate email domain for subdomain.domain.com

Will the SPF policy/info for domain.com also apply to the subdomain? Or do I need to add a separate TXT record for that too?

I've got a CentOS 5.x box running on a VPS platform. My VPS host misinterpreted a support inquiry I had about connectivity and effectively flushed some iptables rules. This resulted in ssh listening on the standard port and acknowledging port connectivity tests. Annoying.

The good news is that I require SSH Authorized keys. As far as I can tell, I don't think there was any successful breach. I'm still very concerned about what I'm seeing in /var/log/secure though:

Apr 10 06:39:27 echo sshd[22297]: reverse mapping checking getaddrinfo for 222-237-78-139.tongkni.co.kr failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 10 13:39:27 echo sshd[22298]: Received disconnect from 222.237.78.139: 11: Bye Bye
Apr 10 06:39:31 echo sshd[22324]: Invalid user edu1 from 222.237.78.139
Apr 10 06:39:31 echo sshd[22324]: reverse mapping checking getaddrinfo for 222-237-78-139.tongkni.co.kr failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 10 13:39:31 echo sshd[22330]: input_userauth_request: invalid user edu1
Apr 10 13:39:31 echo sshd[22330]: Received disconnect from 222.237.78.139: 11: Bye Bye
Apr 10 06:39:35 echo sshd[22336]: Invalid user test1 from 222.237.78.139
Apr 10 06:39:35 echo sshd[22336]: reverse mapping checking getaddrinfo for 222-237-78-139.tongkni.co.kr failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 10 13:39:35 echo sshd[22338]: input_userauth_request: invalid user test1
Apr 10 13:39:35 echo sshd[22338]: Received disconnect from 222.237.78.139: 11: Bye Bye
Apr 10 06:39:39 echo sshd[22377]: Invalid user test from 222.237.78.139
Apr 10 06:39:39 echo sshd[22377]: reverse mapping checking getaddrinfo for 222-237-78-139.tongkni.co.kr failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 10 13:39:39 echo sshd[22378]: input_userauth_request: invalid user test
Apr 10 13:39:39 echo sshd[22378]: Received disconnect from 222.237.78.139: 11: Bye Bye

What exactly does "POSSIBLE BREAK-IN ATTEMPT" mean? That it was successful? Or that it didn't like the IP the request was coming from?

Wireshark | Windows

I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a search or filter for the specific string I'm looking for.

Is there a way to do this in Wireshark?

CentOS 5.2

My VPS host rebooted (checking with host support now) and I noticed the following in /var/log/messages

Aug 28 11:57:52 echo avahi-daemon[21633]: **Found user 'avahi' (UID 70) and group 'avahi' (GID 70).**
Aug 28 11:57:52 echo avahi-daemon[21633]: **Successfully dropped root privileges.**
Aug 28 11:57:52 echo avahi-daemon[21633]: **avahi-daemon 0.6.16 starting up.**
Aug 28 11:57:52 echo avahi-daemon[21633]: WARNING: No NSS support for mDNS detected, consider installing nss-mdns!
Aug 28 11:57:52 echo avahi-daemon[21633]: dbus_bus_get(): Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory
Aug 28 11:57:52 echo avahi-daemon[21633]: WARNING: Failed to contact D-Bus daemon.
Aug 28 11:57:52 echo init: no more processes left in this runlevel

What exactly is avahi? Is this a standard message?

Is there any reason why I would want to have

iptables -A INPUT -j REJECT

instead of

iptables -A INPUT -j DROP

I hear about needing to chroot BIND all the time. Fair enough. But what about other programs? What are the "rules" (either personal or widely accepted/established) for deciding which programs should be jailed?

-M