Charles Stewart's questions

From an answer I gave to another question:

There are comment filtering services out there that can analyse comments in a manner similar to mail spam filters (all links to the client API page, organised from simplest API to most complex):

1. Steve Kemp (again) has an xml-rpc-based comment filter: it's how Debian filters comments, and the code is free software, meaning you can run your own comment filtering server if you like;
2. There's Akismet, which is from the WordPress universe;
3. There's Mollom, which has an impressive list of users. It's closed source; it might say "not sure" about comments, intended to suggest offering a captcha to check the user.

For myself, I'm happy with offline by-hand filtering, but I suggested Kemp's service to someone who had an underwhelming experience with Mollom, and I'd like to pass on more reports from anyone who has tried these or other services.

When I started learning how to configure email, SPF existed but there were doubts about whether it was a good thing, and the value of offering SPF records in DNS. Now it seems that it is widely accepted that some form of well-known sender validation is good practice.

Is this really true? Am I being a bad postmaster by not supporting SPF/DKIM/whatever?

Does anyone maintain lists of the most frequently guessed account names that are used by attackers brute-forcing ssh?

For your amusement, from my main server's logs over the last month (43 313 failed ssh attempts), with root not getting as far as sshd:

cas@txtproof:~$ grep -e sshd /var/log/auth* | awk ' { print $8 }' | sort | uniq -c | sort | tail -n 13
     32 administrator
     32 stephen
     34 administration
     34 sales
     34 user
     35 matt
     35 postgres
     38 mysql
     42 oracle
     44 guest
     86 test
     90 admin

Machine: Xen-3.0 image running stable Debian Linux 2.6.18, pretty vanilla.

My VPS provider asks me to deal with some trouble my image is causing, namely handling IP addresses it is not supposed to:

The problem is that your server seems to be configured to use IPs that have not been appointed to you. Your server responds to ARP requests for the IPs 81.171.111.219 and 81.171.111.218. But you are not allowed to use those.

Not explicitly, as far as I can tell! At least, nothing under /etc or /var/tmp mentions these IP addresses. But arp -v says something I can't make sense of:

Address                  HWtype  HWaddress           Flags Mask            Iface
81.171.111.1             ether   00:0C:DB:E3:80:00   C                     eth0
Entries: 1      Skipped: 0      Found: 1

What is it listening to? The possibilities seem to be:

1. It's not my fault: my VPS providers have overlooked something. What might that be?
2. 81.171.111.1 means I'm happy listening in on ARP requests that I shouldn't be: how do I change this? In any case, what does this mean?
3. I'm looking in completely the wrong place for information on what my image is doing. Where should I be looking?

Consider the following two commands:

create-smtp-message | ssh -p 25 serveraccount

create-smtp-message | ssh serveraccount telnet localhost 25

According to my understanding of ssh(1), they should both do the same thing. Instead, the second will send the output of create-smtp-message to port 25 of the server from serveraccount (i.e., it works), whilst the first just hangs.

I'm guessing this is just me misunderstanding what ssh does when it is given the -p flag, but in case there is some configuration error: the client at which analogous commands were issued is osx-tiger with openssh ssh (OpenSSH_5.1p1, OpenSSL 0.9.7l 28 Sep 2006), the server runs a Debian Sarge (really? must upgrade that!) with openssh sshd (OpenSSH_3.8.1p1 Debian-8.sarge.6, OpenSSL 0.9.7e 25 Oct 2004). Authorisation is using DSA, as specified in the .ssh/config file.