Binarus's questions

We have setup Microsoft's implementation of OpenSSH server on a Windows server 2019 (v1809) and have activated authentication based on public keys. We would like to deploy forced commands and are struggling with space characters in the path of such commands.

A minimal example:

User user1 has the following authorized_keys file:

command="C:\Program Files\SomePath\SomeProgram.exe" ssh-ed25519 AAAAC3N...

When we try to ssh into that machine as that user, the following happens:

$ ssh -i <user1_key_id> [email protected]

'C:\Program' is not recognized as an internal or external command,
operable program or batch file.
Connection to server.example.com closed.

(Please note that we have an SSH agent running so that there is no passphrase query in the above terminal session snippet.)

IMHO, it's quite clear that the problem is due to the space character in the path of the program which should be executed. However, we are unsure why the double quotes around the command in the authorized_keys file don't prevent the problem. We have tried to add a further pair of double quotes using the well-known escaping methods:

command="\"C:\Program Files\SomePath\SomeProgram.exe\"" ...

command="^"C:\Program Files\SomePath\SomeProgram.exe^"" ...
command="""C:\Program Files\SomePath\SomeProgram.exe""" ...

The first one lead to the same error as described above. The second one and the third one lead to another error message:

[email protected]: Permission denied (publickey).

Now we are stuck and have the following question:

How do we need to write the command above in the authorized_key files for Microsoft OpenSSH server for Windows?

I am currently trying to configure an LSI SAS 12G HBA with the 3108 chip (it is a 9361-8i, but I am nearly sure that my question relates to similar HBAs as well).

I have understood the differences between the JBOD and the RAID personalities, but there is another related setting which I currently can't make sense of. This setting is called behavior mode and is only available when the controller is in JBOD personality.

In JBOD personality, the behavior mode can be set to JBOD or None. Could somebody please shortly explain what this is about?

I have studied the manual linked below, and several more from Broadcom's web site, and have tried hard to find an explanation elsewhere as well, but to no avail.

The manual is here: https://docs.broadcom.com/doc/pub-005110

What I am talking about is shown e.g.

• In chapter 5.3.3 on page 111

"JBOD- The Behavior modes available under this mode are JBOD and None."

• In the last row of table 29 on page 135

• In the third-to-last row of table 42 on page 196

... and eventually a few more.

On one of my Windows Servers (Windows Server Standard 2019), I'd like to remove multicast handling completely. Completely really means completely - completely ignore incoming multicast traffic, and completely disable sending of outgoing multicast traffic, under any circumstances and regardless of what applications try to do.

I have found many similar questions and answers. However, all of them were only asking or answering how a specific part of multicast could be configured or turned off, for example, how to prevent Windows from sending unicast answers to multicast packets, or how to remove IGMP subscriptions, or how to disable or block IGMP. But none of them shows how to disable multicast handling completely.

My own ideas:

1. Remove the multicast routes (as administrator, just run route delete 224.0.0.0 in a cmd window; a subsequent route print indeed shows that those routes now are gone, but I am not sure if this is sufficient or whether they could be re-added automatically in the case of certain events, for example when connecting via VPN to another server and thereby creating a new interface where Windows will automatically add a multicast route to).

2. Block all inbound and outbound traffic to 224.0.0.0/4 in Windows Firewall (however, I am not sure whether this will work at all; perhaps Windows firewall only handles unicast traffic ...).

What do you think about that? Are there other ways (I'd still like to completely remove multicast instead of fight against it)?

I have got a chassis with the Supermicro BPN-SAS3-826EL1 backplane. This backplane allows 12 HDDs to be attached. However, I obviously haven't yet understood the cabling between the HBA and the backplane which I need to actually use all 12 HDD ports.

According to the first drawing on page 3-1 in the manual, PRI-J1 and PRI-J2 should be connected to the HBA (and thus are "inputs"), while PRI-J3 and PRI-J4 are "outputs" which can be connected to a cascaded backplane, which I don't have.

The manual further says that PRI-Jn are SFF-8643 connectors, which can transport the signals for 4 SAS or SATA drives. That means that I can use 8 HDDs with the backplane, although it mechanically provides 12 drive connectors.

What do I need to do to use 12 HDDs with that backplane?

Please forgive me if the question is dumb, but I have no experience with backplanes yet, and I have studied this and other Supermicro manuals several times, but still don't understand the situation.

Update / Clarification

I am very sorry that I have not been clear enough:

I'd like to use SATA drives (not SAS), and I already have a LSI 9361-8i connected to the backplane, using two cables with SFF-8643 connectors at each end. That way the controller is seeing 8 drives. Now I'd like to know how I can use the remaining 4 drives.

The board I am using has two SATA / SAS controllers integrated, each of which can handle four drives. Do I just need to connect one of them to PRI-J3 of the backplane?

In my network, there is a Windows 2008 R2 server with network name Dax. On that server, I have (among others, of course):

• a hard disk drive, mounted as E:\
• a folder E:\odo
• an SMB share \\Dax\odo which provides the folder E:\odo to the network
• a user account Dax\Backup

The user Dax\Backup is member of the Dax\Backup Operators group and additionally has full permissions on the share \\Dax\odo as well as on the folder E:\odo.

I also have some client PCs running Windows 10 x64 Enterprise (version 1809). Each client PC has

• multiple user accounts which are different from the user accounts on the server (i.e. there is no AD, the client PCs are not joined to a domain)
• a complex and deeply nested data folder with carefully crafted permissions, i.e. every user on a client has access to different parts (subfolders) of the data folder
• a user account Client\Backup which has the same password as the server's account Dax\Backup, and which also is member of the respective client's Client\Backup Operators group.

On the client PCs, I have a software which is able to copy the whole data folder mentioned above, including all permissions, owner info, alternate streams, junctions and so on onto the share \\Dax\odo. I let this software run under user account Client\Backup so that it can read the data folder regardless of the ACLs which are in effect there.

Indeed, folders, files, junctions and so on (i.e. the actual contents of the data folder) are copied without any problem, but adjusting the metadata (e.g. ACLs, ownership) on the destination fails.

I would like to understand why, and of course what I can do about it.

My thoughts and tests so far are:

• My client software is copying those files and folders onto the server's share while running as user Backup. Since that user (on the server) is in the Backup Operators group, there should be no problem with changing the metadata while copying or even after having copied a file or folder, because that's exactly the purpose the Backup Operators group should serve.

• If (on the server) I make the user Backup a member of the Administrators group, the problem persists.

• If (on the server) I give the user Dax\Administrator full permission for the share \\Dax\odo as well as for the respective folder E:\odo, and if I run my client software under the account Client\Administrator (that account also has the same password on the clients and the server), the problem does not persist, and the process works as intended.

Furthermore, I have tracked down what I believe is the cause of the problem on the server: Using Sysinternals' process monitor, I have seen that obviously the user Backup on the server, or more precisely, its impersonation by the network service / system process, does not have sufficient privileges. At least, this is what I would make out of the event properties shown below:

High Resolution Date & Time:    04.05.2019 09:27:37,2077520
Event Class:    File System
Operation:  IRP_MJ_CREATE
Result: PRIVILEGE NOT HELD
Path:   E:\Odo\d-LSE\d\temp\test - 2019-05-04 09-27-40\bla.txt
TID:    2812
Duration:   0.0000581
Desired Access: Generic Write, Read Attributes, Write DAC, Write Owner, Access System Security
Disposition:    OpenIf
Options:    Complete If Oplocked
Attributes: n/a
ShareMode:  Read
AllocationSize: 0
Impersonating:  DAX\Backup

In the past few days, I also have learned that for members of certain groups (among them Administrator and Backup Operators) there are two tokens: a normal one and an elevated one, where only the latter enables the special privileges of such groups.

So (please note that this is just naive guessing and that I am not an expert in this field): Could the network service / system process on the server impersonate the non-elevated version of the user account Backup when handling the network traffic on behalf of that user, and could this be the reason for the problem? Could I solve the problem by somehow making the network service / system process impersonate the elevated version of the user account Backup when handling the network traffic on behalf of that user? If yes, how?

P.S. If my above theory is silly, the title of this post will be misleading, so feel free to correct it ...

We have a server which has its system partition C: on one disk and another partition on a second disk. Both partitions are encrypted by VeraCrypt. The partition on the second disk has been added to the system favorite volumes in VeraCrypt, so it gets mounted quite early during bootup via PBA (Pre-Boot-Authentication), and then is accessible as usual by its drive letter (in this case, D:).

We would like to run Acronis Backup 11.7 on that server to -ehm- backup it. While it has no problem with the encrypted system partition, it obviously is not able to deal with the partition on the second disk. It seems that it uses the wrong volume ID, probably because it is querying the OS only for "hardware" disks.

The following image demonstrates the problem:

While it recognized the partitions on the system disk correctly, this is not true for the second disk. The volume ID shown there belongs to the raw (encrypted) partition, not to the partition as mounted (decrypted) by VeraCrypt.

This is clearly demonstrated by the following image (note that the volume ID shown by Acronis indeed is that of the raw partition which has no mount point, while the mount point D: has another volume ID):

Is there any way to make Acronis image the encrypted partition on the second drive correctly?

Some notes:

• Yes, I know that the image will be unencrypted (unless I activate the appropriate option in the backup settings); this does not matter because the images will be stored in a location which is encrypted with VC as well.

• And yes, I know that I will get an unencrypted system / data disk when I restore this image; that also doesn't matter because you can't get around this when you want to image an encrypted partition from within the running system.

• For testing purposes, I have removed the second partition from the backup source, have created an empty folder in C:, and have linked D: to it, by an NTFS junction as well as by mounting the correct volume to it via mountvol. In each case, Acronis has archived the system partition correctly, including the junction, but not the contents (destination) of the junction, so this didn't lead to anywhere.

• And interestingly enough, Acronis is not even able to take a file backup from that second disk; if we try that, we get exactly the same error as with the volume backup, as shown in the following picture:

I it would help, I could provide a full error log.

Disclaimer: I have read some of the questions and articles here and elsewhere which deal with Sendmail rewriting headers. I haven't found an answer to the question below because the other question mostly relate to rewriting headers (instead of adding them), and nearly all of them relate to outbound messages and the envelope sender (instead of the envelope recipient).

Having said this:

I am running a mail server, using Sendmail 8.14.4 under Debian jessie.

There are some email recipient addresses which are mapped to the same O/S user account. When the respective O/S user reads the messages, he can't determine to what email address the messages originally have been sent.

Therefore, I would like to have Sendmail add a custom header containing the envelope recipient(s) to all inbound email messages.

I think I could better explain my problem by example:

Suppose I have two email addresses, [email protected] and [email protected]. Both are mapped to the O/S user account offers. This works so far: The O/S user offers, when fetching his email, gets all messages sent to [email protected] and [email protected].

The problem now is that he can't determine to which email address each message originally has been sent. That means: Although he is seeing all messages which have been sent to both email addresses, he can't tell if a certain message has been originally sent to [email protected] or to [email protected].

Therefore, I would like to add a custom header to each inbound message, perhaps something like that: X-Envelope-Recipient: <Original envelope recipient>.

What would be the easiest way to do this?

Once upon a time, I have written some simple custom rules for Sendmail. But nearly 15 years have passed since then, so I'd like to avoid that, and thus I hope that there is an easy solution or that somebody could point me in the right direction. To be honest, writing a milter to solve my problem currently seems easier to me than re-learning Sendmail's rule syntax ...

EDIT 1

As requested by @AnFi, here is the local mailer definition from sendmail.cf:

Mlocal,         P=/usr/lib/sm.bin/mail.local, F=lsDFMAw5:/|@qPSXnz9, S=EnvFromSMTP/HdrFromL, R=EnvToL/HdrToL,
                T=DNS/RFC822/SMTP,
                A=mail.local -l -h inbox

I have a website served by Apache 2.4 which should serve all contents via HTTPS. I already have appropriate redirections in place which work correctly, but don't catch any pathological case. I wanted to improve that situation, and, when doing my homework, came across the following example in this document:

<If "%{SERVER_PROTOCOL} != 'HTTPS'">
    Redirect "/admin/" "https://www.example.com/admin/"
</If>

I slightly modified this to reflect my situation:

<If "%{SERVER_PROTOCOL} != 'HTTPS'">
    Redirect "/" "https://www.example.com/"
</If>

Now, when trying to view any URL from my site, the browser goes into an infinite redirection loop.

I am suspecting that the example actually is wrong. SERVER_PROTOCOL does not seem to contain the value HTTPS under any circumstances. Instead, according to what I have read in other articles, it contains things like HTTP/1.1 (as the name would let expect).

So my question is: What exactly does SERVER_PROTOCOL contain under what circumstances / in what context? And what could be the reason that Apache's official documentation website is the only one I have found during several hours of research that lists HTTPS as a possible value of SERVER_PROTOCOL?

I am working on a project where I would like to allow certain persons to modify certain entries of Sendmail's virtusertable via a web interface. I originally thought this wouldn't be a problem until I read the following:

/etc/aliases vs virtusertable

The second answer in this post claims that the right hand side of an entry in the virtusertable database could be a file. If this is true, I have to be extremely cautious, because (for example) if it works with a file, it probably works with a pipe as well, and we all know what could happen then.

Although having researched for several hours now, I didn't find one single example of a virtusertable where the RHS is a file, and no other hint regarding this feature or how to use it. So my questions are:

1) Is it true that that the RHS of a virtusertable entry can be a file?

2) If yes, how does Sendmail distinguish if the RHS of an entry is a local user, a full email address or a file (obviously, I can have files named root or [email protected] somewhere in my file system)?

As a side note, I am aware that this post eventually could be moved to security.stackexchange.com, but I've decided to leave it here since the two questions above might be interesting to administrators even when not being in my situation (i.e. when the virtusertable can be changed only by themselves (and not via web interface as well)).

Update (2016-08-21)

Supported by the comments below, I have written an email to the FreeBSD documentation team. I hope they will get back to me soon. I'll add an update when this happens.

Is there a place where I could download as much spam emails as possible, having been sent from as much different worldwide locations as possible?

To clarify: I am not after databases which contain hashes of spam emails or which contain IP addresses of senders / networks which have sent spam. I am just interested in getting hold of as much real spam emails as possible in unaltered form.

For example, this could be a giant mbox file containing thousands or millions of such emails in their original state. Are there some anti-spam organizations or companies who provide access to such data?

UPDATE:

Not being a native English speaker, I just didn't know the right keywords. Just search for "spam corpus" or "spam corpora" on Google. Hoping that this helps others with the same problem and hoping that now there's no reason to downvote any more ...

Suppose there is an instance of Sendmail 8.14.4 which handles incoming and outgoing email messages for domains a.com and b.com.

Now, what I'd like to achieve is the following: If Sendmail sends a message with a FROM of the form [email protected], it should use mx.a.com as HELO name, and if it sends a message with a FROM of the form [email protected], it should use mx.b.com as HELO name, i.e. I'd like to generate the HELO name for every outgoing message dynamically according to the envelope-from (SMTP MAIL FROM) or the From: Header, respectively.

Is this possible? Currently, I have configured the HELO name for all messages to be mx.a.com (using confDOMAIN_NAME or confHELO_NAME, respectively).