joxl's questions

Is it possible to configure ntpd to fudge the stratum level of a network source?

Upon first glance, I thought the fudge directive could accomplish this, however after browsing the ntp.conf(5) man pages, I found this directive only applies to Reference Clocks.

A few details:

I have a local server running ntpd as the primary time source for clients on the LAN. This server is pointed at the ntp.org pool, and usually maintains a stratum level 3.

In addition to my main server, I have a 3rd party network device whose primary job is synchronizing wall clocks wirelessly via. RF transmission. The device's specification says that it is a "RFC2030 compliant Time Server", but otherwise it's pretty much a black box. I have configured the device to use my main server as it's only time source:

black box config http://www.freeimagehosting.net/uploads/21bafb12bd.png

My problem surfaced when I configured ntpd on my personal computer to use both my main NTP server, and the wireless transmitter as time sources. When querying my local ntpd, I noticed that the "black box" (10.x.x.Z) was the favored time source:

$ ntpq -pn
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
x10.x.x.X        69.164.222.108   3 u   48   64  177    0.501  370.029   1.530
*10.x.x.Z        10.x.x.Z         2 u   50   64  377    1.354  -23.681  14.179

Since server 10.x.x.Z's only time source is server 10.x.x.X (which is stratum 3), it should be stratum 4. I believe the manufacturer has hard-coded its stratum level.

Is there any way to get my machine to favor the "good" (10.x.x.X) server despite it's higher stratum level? I also tried the prefer directive in my local ntp.conf file, but to no avail, the little black box always wins :/

For what it's worth, my local machine is running Mac OS X 10.6.

$ ntpq -c rv | grep version
version="ntpd [email protected] Mon May 18 19:38:25 UTC 2009 (1)",

The question I have may be more of principle than anything else, but here's my dilemma.

I manage an email system for a small company (about 20 email users). We own a plain-letter .com domain name through Network Solutions. Our email service is hosted by Google Apps.

Recently (Feb. 2011) we've been having customers report that they aren't getting our emails. Upon further investigation it seems that the failed emails are all to a common (well known) domain. We have not received any bounce messages for the emails. We've also contacted a few of the intended recipients, who have reported that the messages are not in their spam box; they simply did not receive anything. In these cases we re-sent the same email to an alternate address on another domain, which was successful received.

One customer contacted their email provider about the issue. The provider recommended that we submit a form to be white-listed by their domain.

Here's where my problem begins. I feel like this is heading down a slippery slope. Doesn't this undermine the very principle of email? If this is the appropriate action to take in these situations where will it end? In theory (following this model) it could be argued that eventually one will first need to "whitelist" (or more appropriately termed "authenticate") themselves with an email host before actually sending any messages. More to this point, what keeps the "bad" spammers from doing the same thing...? We've just gone full circle.

I know avoiding anti-spam measures is a big cat-and-mouse game, but I think this is the wrong way of "patching" the problem. Email standards say that messages should not just disappear silently. I have a problem supporting a model that says "you must do < this > to make sure your emails aren't ignored".

I have a notion to call the provider and voice my complaint, although I have a feeling it will probably fall on deaf ears. Am I missing something here? Is this an acceptable approach to email spam problems? What should I do?

I have an Xserve G5 running Mac OS X Server 10.5.8 configured as an Open Directory master. I have also enabled and configured Software Update service on the machine. The SUS is configured to serve Tiger, Leopard and Snow Leopard clients (see http://discussions.apple.com/message.jspa?messageID=10297359#10297359)

The clients bound to the OD are a variety of Mac's running OS X 10.4, 10.5 or 10.6. In Workgroup Manager, I have created 3 machine groups for each client OS. Each group is configured with a custom SUS URL, and the managed client computers are members accordingly (see http://discussions.apple.com/thread.jspa?messageID=10493154#10493154)

My problem is that the server pushes the SUS settings to some of the client machines, but not all. When I first configured all this stuff on the server (a few weeks ago) I was closely monitoring a few of the client machines to confirm that they received the custom settings. I noticed that some of the clients (10.4/5/6 alike) seemed to get the settings immediately, others didn't show the new settings until after a reboot. As I said, results are mixed across OS's, but some clients will not "sync" at all.

My immediate thought was to unbind/rebind the problematic machines. I did this on several client computers with no success.

For example, today I was working on one of the Tiger clients. I noticed it was not pointed at my local SUS, so I checked the OD binding; it was fine. Just to be sure I unbound the machine. Next, I checked WM and confirmed the computer record was gone. I noticed the machine group still had a residual (broken?) member from the unbound client; I manually removed this. Finally, I re-bound the client to OD and re-added the machine to it's correct group in WM. Unfortunately, the client still pings apple's SUS for updates. Just to play it safe I rebooted the client, but to no avail, it will not see my local SUS.

To confirm that there is nothing wrong with the server, or the client's connection to it, forcefully pointed the machine at my SUS:

sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate CatalogURL "$LOCAL_SUS_URL"

and the machine successfully updated off my local server.

Great, successful updates, but problem not solved.

I've done exhaustive reading on discussions.apple.com (not saying I read everything, I'm just saying I have read a lot) without a good answer. The discouraging thing is that a lot of OD problems I've read about only result in the sysadmin completely reinstalling the server, or OD, or some other similarly heavy-handed operation. At this point, I am not willing to go that route. I still have hope that I can find the reason for this flaky behavior.

If anyone can point me in a helpful direction it would be much appreciated.

EDIT:

Indeed, some files are being pushed to the client:

# from client machine:
$ sudo find /Library -type f -name com.apple.SoftwareUpdate.plist 
/Library/Managed Preferences/com.apple.SoftwareUpdate.plist
/Library/Managed Preferences/username/com.apple.SoftwareUpdate.plist
/Library/Preferences/com.apple.SoftwareUpdate.plist

A few weeks ago, prior to my (previously mentioned) modifications, the SUS was still running "stock". Which meant it could not serve SL (10.6) machines. At that time, the Software Update settings were setup in WM under User Groups. This didn't make any sense because some users work on multiple machines with different OS's.

Before creating Machine Groups in WM, I deleted all the SU settings from the User Group Preferences. This just makes the whole thing more confusing, because when I see a file here:

/Library/Managed Preferences/username/com.apple.SoftwareUpdate.plist

I assume it's still remaining from the "old" settings, because I wouldn't think a Machine Setting belongs there.

Despite all the com.apple.SoftwareUpdate.plist hanging around under the Managed Preferences, why does the client machine still call home to Apple and not my SUS?

# on client machine:
$ date
Tue Jan 25 17:01:46 EST 2011
$ softwareupdate --list
Software Update Tool
Copyright 2002-2005 Apple

No new software available.

switch terminals...

# on server:
$ tail -n1 /var/log/swupd/swupd_access_log
10.x.x.x - - [25/Jan/2011:15:54:29 -0500] XXXX POST "/cgi-bin/SoftwareUpdateServerStats" 200 13 ...

Notice the date of the client softwareupdate and the latest access to the SUS server; the server never heard a peep from that client.

Recently (July 13, 2010) I had a firewall rule that started blocking traffic that had previously been allowed. I have an FTP server running on a non-standard port serving files to the LAN. I had configured exceptions for the server application as well as the connection port in the XP firewall.

Original configuration:

Name: My FTP Server
Port Number: 1234
Scope: My network (subnet) only

Screenshot http://www.freeimagehosting.net/uploads/49c1717c8e.jpg

This configuration had been working for over a year. And oddly enough it had been working for clients on VLAN1 (10.1.1.x, the same subnet as the server) as well as clients on VLAN2 (10.1.2.x). Then suddenly two days ago it stopped working for clients on VLAN2 only. After troubleshooting the failed connections I determined that the problem was the firewall, and reconfigured the exception as follows:

Updated configuration:

Name: My FTP Server
Port Number: 1234
Scope: Custom list: 10.1.0.0/255.255.0.0

alt text http://www.freeimagehosting.net/uploads/a301aa85b9.jpg

Some other background details: Windows Update is set to automatically install updates, and it received a single update on the evening of July 12th.

WindowsUpdate.log excerpt:

*************
** START **  Agent: Installing updates [CallerId = AutomaticUpdates]
*********
  * Updates to install = 1
  *   Title = Definition Update for Windows Defender - KB915597 (Definition 1.85.1905.0)
  *   UpdateId = {1C89B156-DCC2-4A34-BAFC-7B5E5B20C460}.100
  *     Bundles 1 updates:
  *       {584242DE-8E71-4F88-A9C6-BB3C7F13773A}.100

The KB article here gave no indication of the firewall being updated (indeed, it's only a Definition update for Windows Defender). Other than automatic updates, no new software was installed on the server for months, and the firewall rules had not been changed since the FTP server was originally configured over a year ago.

Why did the firewall exceptions work for the entire LAN before but then suddenly began blocking connections from clients on VLAN2 two days ago?

EDIT: Additional details: I have an Xserve running Mac OS X Server 10.5 set up as the DHCP server. DHCP is configured to assign a static IP to this particular XP machine. This configuration has not changed since the windows box was initially set up over a year ago.

System details: Windows XP Pro Version 2002 Service Pack 3