Harry's questions

Can I do this:

1. mv an email out of the Postfix hold queue to say, /tmp/foo/.

2. Keep the email in /tmp/foo/ for an arbitrary period of time (ranging from seconds to days). During this period, Postfix server could even get bounced one or more times.

3. And, then, at a time of my choosing, mv this email back from /tmp/foo/ to the Postfix hold queue... all without any queue ID clashes and resulting email overwrites?

According to this link, a Queue ID can be guaranteed to be unique only within 1-second intervals! I'm not sure if this is still true.

If I cannot do the above let's say, then can I do this instead:

4. Generate a new 11-char Queue ID outside of Postfix (say, using mktemp) that is unique within the Postfix hold queue (at the time of its generation), and

5. mv the message back from /tmp/foo/ to the Postfix hold queue with this new Queue ID?

Essentially, my requirement is to hold certain emails for arbitrary periods of time; only that, instead of holding them in the Postfix hold queue, hold them elsewhere.

Many thanks in advance.

I would like to prevent 2 non-root users on the same Linux system from sharing files with each other (via their use of /tmp). Is this possible somehow?

If I restrict /tmp to 0770 (root:root as the owner:group) and define a user-specific TMPDIR via an export TMPDIR=~/tmp; mkdir -p $TMPDIR early on in the boot process (say, via an rc[35].d script), then GConf2 starts having problems. A typical error I then get is:

/usr/libexec/gconf-sanity-check-2 exited with status 256

Everything seems to work fine in Run Level 3 (non GUI)... though I could be wrong in concluding this prematurely, and problems could surface later in Run Level 3 as well.

My experience so far with TMPDIR seems to indicate that it is either broken, or is not sufficiently documented, or is not being embraced by all Gnome applications.

I'm not the System Administrator of our corporate network, but I've got two Linux workstations (hosts A and B) with root access to both.

Both hosts can see each other fine (ssh, ping, etc works from one to the other). However, only host A can reach out of our corporate firewall and access the Internet etc; host B cannot.

Question: How could I have all (and not just HTTP) outgoing and incoming network traffic at host B routed via host A, without involving my System Administrator? Right now, I don't know if I would need to use NAT for host B, and/or make host A a proxy server, and/or make host A a router.

On Host B, I tried issuing a route add -host <HostA> gw <HostA's Gateway> command, but it didn't work: I was unable to ping www.google.com from Host B. Please pardon my ignorance on this subject of routing/networking.

In order to speed up JBoss startup and use, I copied the contents of my <jboss-home> dir to a big enough tmpfs 'disk'. With this, I was expecting significant speedup.

However, to my surprise, I saw not one bit improvement - neither in startup time, nor in subsequent application use.

How I created tmpfs?

$ mkdir /usr/local/tmpfs-disk
$ mount -t tmpfs -o size=2048m tmpfs /usr/local/tmpfs-disk
$
$ cd /usr/local
$ ln -s tmpfs-disk foo
$ ls -ld foo
lrwxrwxrwx 1 root root 9 Jul 21 00:09 foo -> tmpfs-disk
$
$ cp -a <jboss-home>/* foo/

Verification

$ mount
   ...
tmpfs on /usr/local/tmpfs-disk type tmpfs (rw,size=2048m)
$ df -h
Filesystem            Size  Used Avail Use% Mounted on
   ...
tmpfs                 2.0G  1.3G  785M  62% /usr/local/tmpfs-disk

I'm using Fedora 12.

What am I missing here?

TIA...

Why does the BSD version 1.10 of nc disable the -e option found in other, so-called insecure distributions when the same dangerous feature could be trivially achieved as follows even with the 'secure' version of nc:

$ # Machine A
$ mkfifo pipe
$ nc -l 4000 <pipe | bash >pipe

$ # Machine B
$ nc MachineA 4000

Now, if I were to wrap-up the incantation on Machine A in a script (that, if passed a `-e' argument, effectively does the above), I have essentially introduced the 'gaping security hole' without having to step down to the Makefile and build level.

So, why go to the extent of #define-ing GAPING_SECURITY_HOME in netcat.c?

I recently got myself a Seagate Free Agent Go 500GB USB hard-disk drive for use with my Fedora 12 workstation.

The device is USB powered and looks very small and delicate to me.

Can I,

1. ... leave this connected 24x7 to my Fedora workstation? Or, should I unplug it / turn it off when not actively using it, in order to prolong the device's life?

2. ... cold reboot my workstation (with this HDD connected) without damaging the HDD? Or, should I always unplug it and only then reboot?

Finally,

3. Are there any special commands / options in the Linux toolset that I could use to get maximum performance and less wear & tear from this device? Anything I should not do to decrease its lifespan, etc.

I'm asking all these questions because I was using Western Digital MyBook (250GB) for about 2 years, and it suddenly developed problems a few days back with Linux not anymore recognizing it on plug in. I eventually had to disassemble the external HDD and extract the IDE drive out of it. Now, I used to leave this device connected 24x7, and used to reboot my workstation with it connected... so I'm not sure if it broke down because of this usage pattern of mine!

I'm posting this question to this forum because many system administrators and power users of server-side hardware and software would have great knowledge and insight on how not to break the peripherals connected to their machines, how to prolong the device life, how to get maximum performance out of the device, etc.

Many thanks,

/HS

EDIT: The only green LED on this HDD is always on, even when I'm not reading/writing from/to it. So, I'm not sure if its disk inside is always spinning just by virtue of the external HDD being hooked on to the workstation.

Can someone good at NTP configuration please share which method is the best/easiest to implement a secure, tamper-proof version of NTP? Here are some difficulties...

1. I don't have the luxury of having my own stratum 0 time source, so must rely on external time servers.

2. Should I read up on the AutoKey method or should I try to go the MD5 route?

3. Based on what I know about symmetric cryptography, it seems that the MD5 method relies on a pre-agreed set of keys (symmetric cryptography) between the client and the server, and, so, is prone to man-in-the-middle attack.

4. AutoKey, on the other hand, does not appear to work behind a NAT or a masquerading host. Is this still true, by the way? (This reference link is dated 2004, so I'm not sure what is the state of art today.)

   4.1 Are public AutoKey-talking time servers available?

5. I browsed through the NTP book by David Mills. The book looks excellent in a way (coming from the NTP creator after all), but the information therein is also overwhelming. I just need to first configure a secure version of NTP and then may be later worry about its architectural and engineering underpinnings.

Can someone please wade me through these drowning NTP waters? Don't necessarily need a working config from you, just info on which NTP mode/config to try and may be also a public time server that supports that mode/config.

Many thanks,

/HS