singpolyma's questions

I'm running bind9 on a server with recursion on for my home IP to experiment with running my own resolver.

It is working quite well most of the time, but occasionally this command:

nslookup -querytype=SRV _xmpp-client._tcp.sette.ca

Will return:

Non-authoritative answer:
_xmpp-client._tcp.sette.CA  service = 5 0 5222 singpolyma.net.

instead of the normal answer:

Non-authoritative answer:
_xmpp-client._tcp.sette.ca  service = 5 0 5222 singpolyma.net.

This causes resolution with some of my client applications to fail. While DNS should be case-insensitive (I think?) and so maybe this is a bug in the applications I'm using, it still seems strange that occasionally my server would choose a different case to return. Google DNS and my ISP DNS never seem to do this, and most of the time neither does my server.

Has anyone seen something like this before? What could cause bind9 to return a different case than I used in the query?

Some of my users have aliases in /etc/postfix/virtual that forward to other providers (mostly gmail). I believe that the fact that all mail is forwarded (even SPAM) is causing reputation issues for my IP. How can I block forwarding of mail that SpamAssasin says are SPAM, while still delivering SPAM to local (non-forward) users?

I've been running a mailserver for myself and some others for quite some time now. Just recently (since moving to a new host) we've started seeing bounces when we send mail to email addresses that are "groups" on "Google Apps" -- we can email normal gmail and google apps addresses just fine, but when we email a group we get the:

Your email to group ... was rejected due to spam classification.

I'm not sure what I can do here. I have SPF set up and passing, I have DKIM set up and passing, and every other host (including normal Gmail) accepts my mail without issue. Is there some trick to convincing these addresses that I'm not SPAM? (Since they're often company support email addresses, it's even more annoying.)

This just started being a problem (likely after a software upgrade?). The relevant config bits are:

<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName singpolyma.net
    ServerAlias www.singpolyma.net
    RewriteEngine on
    RewriteRule ^/(.*) https://singpolyma.net/$1 [R=301,L]
</VirtualHost>

<VirtualHost 184.107.182.218:443>
    GnuTLSEnable on
    GnuTLSPriorities NORMAL
    GnuTLSCertificateFile /etc/ssl/certs/singpolyma.net2013.crt
    GnuTLSKeyFile /etc/ssl/certs/singpolyma.net2013.key

From everywhere that is not the local box, this works as expected. When I try to connect from the box itself, I get apaching replying on 443 on that IP with non-HTTPS. When I run curl with --interface and ask it to use a different interface than the one that hosts that IP, then it also works fine, even on the box.

So something strange is happening, just when I do a local request.

I am on Ubuntu Server, one server running nfs-kernel-server, and the other mounting the NFS export. On the client, when I use ls -l or stat, everything shows as nobody:nogroup, but the actual permissions are used/respected.

Is this normal? If so, why is this the case?

My server occasionally get massively hit by (probably bots) on a small group of IPs. Is there a good way (probably in iptables) to slow down or temporarily block/tarpit connections coming from an IP that has connected many times recently?

CACert and MyOpenID both do this: they have a form that, when submitted, will cause the browser to generate a key and send the public part up to be signed, then deliver back down the signed certificate containing that public key which the browser binds up in its keystore and uses for authentication in the future. I know how to use SSLVerify and similar to verify the client cert once the user has it, and I know how to generate a CA and client certs normally using the openssl command line tools, but not how to do the browser interaction bit to generate the key etc.

I'm probably using Apache and Ruby/Rack or PHP if that helps :)

Link-local address:

Routers do not forward packets with link-local addresses.

What I want to know is: that makes sense if the destination is a link-local address, but what if I have a box that only has a link-local address trying to reach a global/site scope address? Can the traffic make it back, or will that fail because the return packets will be to a link-local address?

So, I've been given to believe that IPv6-only clients can access IPv4 servers by using addresses like: ::ffff:0:74.125.226.80 (that would be an address for google.com). I'm not IPv6 yet, but I may be soon. I have a miredo/teredo tunnel set up and I can ping normal IPv6 addresses just fine, but when I run:

ping6 ::ffff:0:74.125.226.80

it fails (Destination unreachable: Address unreachable)

Am I misunderstanding something? Can I actually get to IPv4 hosts over my IPv6 connection?

I would like a way (PAM module?) to authenticate local Unix users by adding @domain.tld to the username and trying that with the password against an IMAP server. This way we could allow authentication to our Unix boxes for people who have email addresses with our Google Apps account. If a user did not exist locally on the box (that is, adduser had never been called) I would like for the user to be created (maybe using libpam-mklocaluser?)

Is there any way to do this?

Is it possible to use a Maildir as the mailspool for users on a *nix box? I can get procmail to deliver to a Maildir without any problem, but I want to keep all the nifty features like finger knowing when mail last came in and shells alerting users when they have new mail...

UPDATE: So, investigation shows that there is no "default mailspool" on a general level. Finger (the client, not the server) has a hard-coded path. pam_mail is what does the new mail notifications and has its own config, etc... so there is no "one place" to change this.

I have a /etc/postfix/virtual file set up to alias mail to different domains to the right local user, however I also want to use /etc/aliases to alias certain local users (mostly nobody and postmaster to root) -- I have:

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
virtual_alias_maps = hash:/etc/postfix/virtual

But it seems to be ignoring the /etc/aliases (I have nobody: root but mail to nobody@localhost still goes to /var/mail/nobody)

It is my understanding that PPPoE is just PPP wrapped in Ethernet packets. PPTP is PPP tunneled over GRE/IP. So, my question is, is it possible to take incoming PPPoE packets and easily rewrap the PPP inside as PPTP? What I want is for a PPPoE-aware device (such as most home routers) to be able to speak PPTP transparently through another device which "translates".

If I have an open mesh wireless network (or, really, any open access network) and I want to keep the network open access: that is, anyone with the right hardware should be able to connect and talk to other computers on the network, but I want to require authentication for Internet access, what should I use?

PPP seems like the right tool for the job. I thought at first PPPoE, but I've been informed that probably cannot work over wireless. So then I have to tunnel using PPTP? I'm trying to minimize overhead, which is why I initially shied away from PPTP/OpenVPN solutions.

If IPSec can be run in tunnel mode without encryption that may also achieve this, I think.

Are there other good solutions that I'm not thinking of?

Note that I do not consider using an HTTP proxy server or the other sorts of weird hacks you often see at hotel wifi acceptable solutions.

If possible I would like to make it so that people who authenticate are able to have a public IP, and not just sit behind a NAT.

I'm looking for an email host (ideally one who will allow me to use my own domain) that will give me shell (ssh) access to my mail. A lot of webhosts provide shell access, but only to the file storage for web stuff and not to the mailboxes/mailspool/MTA.

I have a VPS with VPSnoc and it is exhibiting some strange behaviour. When I total the %MEM column from a "ps faux" I get around 23%, but when I run free I get 419580/524288 = 80% used. That's a lot of RAM to be being used by non-processes, way more than on any other box I administer, or even my friend's VPS with the same provider.

I've emailed the VPSnoc support a couple of times now, but they don't even seem to be able to understand that this is a very weird thing to have happening on a system.

I wouldn't complain, except that I occasionally get out of memory errors (like when I try to set apache2 workers to >7 threads or >8 simultaneous connections) and those are just not nice.

Is there any way this could be a configuration problem that I could fix/work around, or any way this could be normal? I'm losing hope that VPSnoc will even acknowledge the problem.

They use OpenVZ, if that helps.

Edit: I have tweaked some MySQL settings, and that made what ps reported for it's RAM usage go from 7% to 4%, but the amount of RAM use reported by free dropped about 20%. I'm not longer getting out-of-memory errors, but would still like to understand the reporting better. The current output of free -m is:

             total       used       free     shared    buffers     cached
Mem:           512        320        191          0          0          0
-/+ buffers/cache:        320        191
Swap:            0          0          0

I understand better now the buffers/cache differences that can exist, but none are being shown by this output (or ever were being shown on this box) and that shouldn't cause actual out-of-memory errors.

I am sending email using mail() under PHP5 on Dreamhost (which I believe uses the local sendmail or other MTA) ... bounces are coming back to the sending shell user, instead of to the user in the From:/Reply-To: header. Any ideas?

I'm trying to set up my LAN with OpenDNS, and it seems that my DNS settings are being completely ignored. Even if I set my laptop (running Ubuntu) to have only the OpenDNS primary IP (and verify in resolv.conf that NetworkManager did its job) then

$ host myip.opendns.com
Host myip.opendns.com not found: 3(NXDOMAIN)

Still not using OpenDNS.

My ISP is running a transparent proxy, but that shouldn't affect DNS queries... could they be hijacking my DNS traffic somehow?

I have SquidNT set up on my home network for HTTP caching and it's working great. I want to use it as a transparent proxy server, though. Googling tells me to use Softperfect Bandwidth Manager to do the port redirection stuff that I would normally use iptables for, but it costs $99 after 30 days. I'm wondering if there is a FLOSS (or even freeware) app I can use to forward traffic outbound on port 80 to localhost:3128 on Windows XP?

Internet Explorer (versions 6 and 8, on XP) refuse to load https://theveeb.com, giving a server not found error.

http://wiki.theveeb.com works, so it can talk to the apache2 server I have running there.

The only thing I can think of is that IE is hating my SSL setup... but I can't think of why that would be or what I need to do to fix it.

When I try http://theveeb.com in the same browsers, I get the same effect. They should redirect to https://, but they don't seem to, they just error.

Firefox, Uzbl, curl, wget on Ubunt work fine wget.exe on Windows seems to also work fine