danorton's questions

I'm running puppet and it functions okay, but it's taking about 15 minutes on a sync without any changes, and it seems to me that this shouldn't take more than a minute or two. Here are some stats:

• ping 40ms
• 49 files, 3 MB, largest is 90K
• master is Ubuntu 12.04 (precise) w/ puppet 2.7.11
  • (upgrading to puppet 2.7.23 didn't help)
• agent is Debian 7/64 w/ puppet version 2.7.23
• server is serving one client, only

I have tried with and without Apache tunnel/WEBrick/passenger with the same results.

What are some strategies for diagnosing this and and improving on the sync time?

UPDATE: In my case, in addition to the selected answer for using the --evaltrace option, I used strace and found that TCP connections were timing out and that my firewall was rate-limiting. (Why puppet didn't report the timeout and why it’s not reusing the connection, I don’t know.)

I'm signing email just fine, but I don't want to sign relayed email when the "From" address is one of the domains I'm signing.

What's the right way to configure Postfix/OpenDKIM to sign only from these sources?

• localhost
• traffic via the submission port (which only allows SASL-authenticated sources)
• backup MX servers (authenticated with relay_clientcert)

I can imagine a solution by installing two instances of OpenDKIM, one for a verifying pipeline and another for signing, but I'm hoping there's a simpler and more direct solution.

How do I get Ubuntu upstart to not hang on interactive start & stop?

I have created many upstart scripts that work fine during init, but often hang when I enter them at the console. If I CTRL+C out, all that happens is that the job changes state. The script is never run.

I’m running Ubuntu Lucid on a Xen virtual server with a Linux 2.6.39 kernel.

Below is merely a representative example of many scripts that behave this way:

description "apache2"

start on local-filesystems \
  and (net-device-up IFACE=lo) \
  and (runlevel [2345])
stop on runlevel [016]

respawn
respawn limit 10 5

expect daemon

script
  . /etc/apache2/envvars
  /usr/sbin/apache2ctl start
end script

The error message “saslauthd internal error” seems like a catch-all for saslauthd, so I’m not sure if it’s a red herring, but here’s the brief description of my problem:

This Kerberos command works fine:

$ echo getprivs | kadmin -p username -w password
Authenticating as principal username with password.
kadmin:  getprivs
current privileges: GET ADD MODIFY DELETE

But this SASL test command fails:

$ testsaslauthd -u username -p password
0: NO "authentication failed"

saslauthd works fine with "-a sasldb", but the above is with "-a kerberos5"

This is the most detail I seem to be able to get from saslauthd:

saslauthd[]: auth_krb5: krb5_get_init_creds_password: -1765328353
saslauthd[]: do_auth : auth failure: [user=username] [service=imap]
                 [realm=] [mech=kerberos5] [reason=saslauthd internal error]

Kerberos seems happy:

krb5kdc[](info): AS_REQ (4 etypes {18 17 16 23}) 127.0.0.1:
                 ISSUE: authtime 1298779891, etypes {rep=18 tkt=18 ses=18},
                 username at REALM for krbtgt/DOMAIN at REALM

I’m running Ubuntu 10.04 (lucid) with the latest updates, namely:

• Kerberos 5 release 1.8.1
• saslauthd 2.1.23

Thanks for any clues.

To those of you familiar with the RFC 4366 TLS "Server Name Indication" (SNI) extension, which allows multiple SSL certificates on the same IP address, here’s the scenario:

• URL: http://puny.it/serverfault02 (Redirects to the actual HTTPS URL.)
• As allowed by SNI, the server has multiple certificates at the same IP address.
• This site’s certificate is not the default non-SNI/IP-specific certificate
• Browser: Firefox/3.6.10 (fresh install)
• Client OS: Windows XP

This version of Firefox is known to work with SNI under Windows XP. (list of conformant browsers)

It works with many configurations but in this instance the browser reports:

• This Connection is Untrusted

  You have asked Firefox to connect securely to example.com, but we can't confirm that your connection is secure.

  Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

  What Should I Do?

  If you usually connect to this site without problems, this error could mean that someone is trying to impersonate the site, and you shouldn't continue.

Any suggestions on how to fix this and/or where is the specific incompatibility?

I have a client that is sending email from a Yahoo! Plus account as if from her own domain. Is there a way to set up the SPF record so that it covers all of Yahoo!'s outgoing servers? i.e., what do I put for YAHOO_SPF here in the TXT record?

v=spf1 +a +mx +YAHOO_SPF ?all

Thanks.

Did I screw this up? I don’t even know how this might have happened, so I’d like to learn. I’m trying out HostGator’s reseller service and I bought a domain name through it, but I didn’t want the default name servers and so I changed them during the registration. After registration the domain name record is correct everywhere except at whois-servers.net and whois.crsnic.net and it looks like the DNS network is using that same information.

$ whois -h whois.enom.com. example.com
...
Name Servers:
   dns1.name-services.com
   dns2.name-services.com
   dns3.name-services.com
   dns4.name-services.com
   dns5.name-services.com
...
$ whois -h whois.crsnic.net. example.com
   Domain Name: EXAMPLE.COM
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com
   Name Server: NS1.HOSTGATOR.COM
   Name Server: NS2.HOSTGATOR.COM
   Status: clientTransferProhibited
   Updated Date: 01-jun-2010
   Creation Date: 31-may-2010
   Expiration Date: 31-may-2011

>>> Last update of whois database: Tue, 01 Jun 2010 19:20:47 UTC <<<
...
    $ dig +norecurse @b.gtld-servers.net. example.com. NS
...
;; AUTHORITY SECTION:
example.com.      172763  IN      NS      ns2.hostgator.com.
example.com.      172763  IN      NS      ns1.hostgator.com.
...

My next step is to let HostGator have a look, but first I want to better understand how this happened.

Thanks.