Rohan's questions

So in SES - there are two ways to verify identities as I can see:

1. Email identities
2. Domain identities

With domain identiies - it is easier to fix the "signed-by" and "mailed-by" headers in the outgoing mails. If the DKIM/SPF DNS records are set properly - it works well.

But with email identities - AWS SES adds something like "via amazonses.com". Now I am looking to fix this with my app's branding instead. So that when my clients only want to verify email identities and not whole domains - they can send emails via my app (and behind the scenes via SES) but when the emails go out - instead of saying "via amazonses.com", it should put my apps brancing like "via example.com" instead for the email identities.

How can I achieve this? :)

EDIT:

1. Someone verifies an email identity - [email protected] - I want it to say "via mydomain.com" instead of "via amazonses.com"
2. Someone verifies clientdomain.com - I want it to say "signed-by: clientdomain.com" and the "via...." will be removed

Number 2 is simple and I can achieve that with EasyDKIM in SES but I am having trouble figuring out how to achieve number 1

I am working on a tool that helps the users send emails. I plan on using an MTA (Mail Transfer Agent) in the back end like AWS-SES or Sendgrid etc. In order for the emails to arrive successfully in the recipeints inboxes, the users will have to set up DKIM/SPF by configuring the DNS settings of their respective domains.

Now if I take SES for example, I know they have an API that allows me to add an "Identity" and fetch back all the necessary DNS records for it using the API. I am sure Sendgrid and other MTAs have similar APIs that allow to add identities and give back the DNS records for the user to apply.

I show the returned DKIM DNS settings to the user, and they add it to their DNS provider, and after that when they send emails, the recipeints get it correctly (without any "via amazonses.com" stuff in the headers)

Now for the sake of example - let's assume that the tool I am building is hosted on chillybilly.xyz and one of the users that uses my tool, they have a domain called frankthetank.xyz which they want to use to send emails via my platform.

When the user tries to verify his domain via my platform, I will hit that API mentioned above in AWS SES - and show something like this to the user:

After which they can add these CNAMES and TXT records for successful DKIM/SPF and can start sending emails. But if you look closely, they can see I am using SES because of the values of those CNAMES and TXT records. And that is something I want to avoid, instead I want to have those called something like 7nuk24xywyawocu6ctqjxmjasiaiq3vq.dkim.chillybilly.xyz which would show my branding, but in the background it will still point to the correct SES one.

Now I am aware, that such a thing is possible because when I signed up for ConvertKit, they showed me something like so:

Those two values in there, as you can see, are pointing towards converkit.com BUT when I run them through a DNS lookup:

https://dnschecker.org/all-dns-records-of-domain.php?query=spf.dm-5mk8zo6m.sg7.convertkit.com.&rtype=ALL&dns=google

https://dnschecker.org/all-dns-records-of-domain.php?query=dkim.dm-5mk8zo6m.sg7.convertkit.com.&rtype=ALL&dns=google

I can see that in the background it points to MX and TXT records that belong to Sendgrid. How can I achieve this? (I believe the same principles will apply for SES or any other MTA as well too)

EDIT: I tried a few things - And I set the CNAME, MX and TXT in chillybilly.xyz (my project's domain) and I pointed two CNAMES to it from frankthetank.xyz called spf.frankthetank.xyz and dkim.frankthetankxyz

https://dnschecker.org/all-dns-records-of-domain.php?query=spf.frankthetank.xyz&rtype=ALL&dns=google

https://dnschecker.org/all-dns-records-of-domain.php?query=dkim.frankthetank.xyz&rtype=ALL&dns=google

As you can see, I was able to achieve very similar results to what ConvertKit is doing with Sendgrid. But it is not getting verified this way. :(

The only difference I see when I check those DNS lookups (links above) is that the CNAMEs also show up in the lookup for me, but not in the case of convertkit. So I think I am close to a solution, but not sure what I am missing, any ideas? :)

Trying to learn more about the recently discovered 0 day exploit

This is a list of affected software I found -> https://github.com/NCSC-NL/log4shell/tree/main/software

It only says nginx in a note for F5.

If I am using an Ubuntu server with nginx to serve files over the internet, do I need to worry?

We had an old Ubuntu 14 server, on which we install certbot and let's encrypt certificates for SSL. Then we upgraded the server to ubuntu 20.

Since then, whenever I try to renew or generate new certificates using sudo certbot --apache or the renew command, I get this error:

Bootstrapping dependencies for Debian-based OSes... (you can skip this with --no-bootstrap)
Hit:1 http://us-west-2.ec2.archive.ubuntu.com/ubuntu focal InRelease
Hit:2 http://us-west-2.ec2.archive.ubuntu.com/ubuntu focal-updates InRelease                                
Hit:3 http://us-west-2.ec2.archive.ubuntu.com/ubuntu focal-backports InRelease                              
Hit:4 https://download.docker.com/linux/ubuntu focal InRelease                                                                             
Hit:5 http://ppa.launchpad.net/deadsnakes/ppa/ubuntu focal InRelease                                                                       
Hit:6 http://ppa.launchpad.net/ondrej/php/ubuntu focal InRelease                       
Get:7 http://security.ubuntu.com/ubuntu focal-security InRelease [114 kB]
Fetched 114 kB in 2s (72.8 kB/s)   
Reading package lists... Done
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Note, selecting 'python-is-python2' instead of 'python'
Note, selecting 'python-dev-is-python2' instead of 'python-dev'
Package python-virtualenv is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Package 'python-virtualenv' has no installation candidate

I have tried endless forums and tricks including this top google hit -> https://stackoverflow.com/questions/62314556/how-to-install-virtualenv-on-ubuntu-20-04-gcp-instance, but no luck yet :( Any ideas?

I have a Laravel application running in production, and there are a few APIs that used a lot. Something was creating a bottleneck and it used to stall our servers (3 with Load Balancer). After optimising the basics in Laravel, caching config, routes, data and so on, even resolving all n+1 issues, we were still having issues in peak times. Someone suggested we run strace on one of the nginx workers to see what is happening on the system level, so we did, and interesting enough, there are lots of redundant system calls where nginx tries to find files when APIs are called:

Part of trace:

240498 stat("/var/www/html/myProject/current/public/APIRequest/3d4f7518e04e9", 0x7ffc7ee6ff70) = -1 ENOENT (No such file or directory)
240498 stat("/var/www/html/myProject/current/public/APIRequest/3d4f7518e04e9", 0x7ffc7ee6ff70) = -1 ENOENT (No such file or directory)
240498 lstat("/var", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
240498 lstat("/var/www", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
240498 lstat("/var/www/html", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
240498 lstat("/var/www/html/myProject", {st_mode=S_IFDIR|0777, st_size=4096, ...}) = 0
240498 lstat("/var/www/html/myProject/current", {st_mode=S_IFLNK|0777, st_size=48, ...}) = 0
240498 readlink("/var/www/html/myProject/current", "/var/www/html/myProject/release"..., 4095) = 48
240498 lstat("/var", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
240498 lstat("/var/www", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
240498 lstat("/var/www/html", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
240498 lstat("/var/www/html/myProject", {st_mode=S_IFDIR|0777, st_size=4096, ...}) = 0
240498 lstat("/var/www/html/myProject/releases", {st_mode=S_IFDIR|0775, st_size=4096, ...}) = 0
240498 lstat("/var/www/html/myProject/releases/20201202085755", {st_mode=S_IFDIR|0775, st_size=4096, ...}) = 0
240498 lstat("/var/www/html/myProject/releases/20201202085755/public", {st_mode=S_IFDIR|0775, st_size=4096, ...}) = 0

Now the API is called with the ID 3d4f7518e04e9 in this case, and it tries to loop through the directories to find that file instead. But it is not a file, it is an API. We ran strace for less than 30 secs, and we have 5k such calls which don't make sense to me.

So, are these calls necessary? I don't think so, but tell me if I am wrong. And if I am right, how can I configure my nginx better so that these calls can be "caught in time" and resolved appropriately. Any ideas are welcome. :)

PS: We have tried apache with similar config also, same problem in strace appears.

Edit: Do I simply need some sort of a location directive in my site conf to solve this? I am using the basic nginx conf from the official docs https://laravel.com/docs/8.x/deployment#nginx with a few more additions like:

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;

        fastcgi_buffer_size 128k;
        fastcgi_buffers 256 16k;
        fastcgi_busy_buffers_size 256k;
        fastcgi_temp_file_write_size 256k;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }

    client_body_buffer_size 10K;
    client_header_buffer_size 1k;
    client_max_body_size 8m;
    large_client_header_buffers 4 16k;

    client_body_timeout 12;
    client_header_timeout 12;
    keepalive_timeout 15;
    send_timeout 10;

EDIT:

location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

I do have try files as suggested by Danila Vershinin in an answer

I am trying to connect to an EC2 instance and it has a .ppk security key. I am not an expert on server frankly and I am still try to figure things out by trail and error.

I usually connect to my server by opening up the native command line in ubuntu and then issuing the following command:

ssh -i path/to/my_security_key.pem user_name@ip_address

But I am now trying to connect to another server which has a ppk security key instead of pem and when I try to connect it asks me to enter a passphrase. I asked the admin of the server and he says that he connects to the server using Putty and is never asked the passphrase. I tried this and it works but I want to know why wouldn't it work otherwise. Is there a special parameter I am supposed to pass so that it connects using the command line?

I have 2 different servers and one domain name. Can I use 2 different sub domains to point to the two servers? Is it possible?

I have a standard SSL certificate I just purchased from Godaddy. Now it won't let me use a wild card for issuing the certificate for my domain. It says that the * wild card is not included in my product. Which means that I can only secure one domain like subdomain.example.com.

Now my question is that if I get the certificate issued for subdomain.example.com, will it be valid for subdomain2.subdomain.example.com also?