This is a canonical question about hostname-awareness and proxying.
I know that some protocols are hostname-aware; that is, when I connect to the HTTP server at www.example.com it knows I want www.example.com's HTTP service, not www.example.net's, even though they are on the same IP address. How can I do this for protocol foo?
(Temporary note: this question appears pursuant to this meta discussion.)
I have a sendmail server. Periodically (ie, several times an hour) I get log entries like this:
Sep 3 10:06:49 lory sendmail[30561]: v8396nsQ030561: [37.49.226.159] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA-v6
Sep 3 10:06:49 lory sendmail[30564]: v8396nmv030564: [37.49.226.159] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA-v6
[29 very similar lines deleted]
Sep 3 10:06:50 lory sendmail[30654]: v8396or0030654: [37.49.226.159] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA-v6
Sep 3 10:06:50 lory sendmail[30657]: v8396ou3030657: [37.49.226.159] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA-v6
This particular server went on for a bit at that rate, then got bursty, notching up in total some 600 connections in 110s; others are less prolix. They don't cause my server any problems; fail2ban gets a bit exercised, watching the mail log file for SMTP AUTH failures as it does, and having to ignore all these new entries, but it's nothing to make the server sweat.
What I'm curious about, and what I'm asking, is why anyone would do such a thing. Are they hoping my relaying/greylisting/SPF engine has a very small brain, and after 500 connections it says to itself gosh, they're really keen to talk to me, I'd better accept anything they send now? Are they hoping my server has no spare VM, and sendmail will bloat and invoke the OOM killer, thus DoSsing me? I presume someone's doing this sort of thing for a reason, but does anyone have the faintest idea what that reason might be?
What I want to do is set up a sendmail server that accepts mail from everyone to a particular domain (say, example.com), then for a list of defined recipients sends that mail onto specified third-party addresses, and relays everything else onto a specific IP address.
I've tried this:
[root@splitter mail]# cat relay-domains
example.com
[root@splitter mail]# cat virtusertable
[email protected] [email protected]
and forwarding of most of the domain works fine - it's delivered to the host specified by example.com's MX - but the exception ([email protected]) is ignored
I've tried this:
[root@splitter mail]# cat local-host-names
example.com
[root@splitter mail]# cat mailertable
example.com esmtp:[1.2.3.4]
[root@splitter mail]# cat virtusertable
[email protected] [email protected]
and then the exception mail is correctly split off, but any other user is bounced locally (User unknown). I've tried adding this to virtusertable:
@example.com %[email protected]
but (probably unsurprisingly) this results in rewrite: excessive recursion (max 50), ruleset canonify errors.
I'd prefer sendmail-based solutions, because I can try those quickly. If I don't get any luck with that, I'll open this up to other MTAs. If anyone has any ideas about how to do this, I'd really appreciate them.
Part of my network estate has a fairly important dependency on a host whose availability is difficult to check. I have a number of hosts behind it, and my NAGIOS VPS provider occasionally has routing problems that cut off the provider where all these hosts are located. When it's unavailable I'd much prefer the hosts behind it to show UNAVAILABLE than DOWN, because they're not DOWN.
But its availability is difficult to detect, because it can't be PINGed
[me@nagios systems]$ ping -c 1 -w 1 205.251.232.153
[...]
1 packets transmitted, 0 received, 100% packet loss, time 1000ms
and there seem to be no network services on it that respond to queries:
[me@nagios systems]$ nmap -P0 -sT 205.251.232.153
[...]
All 1000 scanned ports on 205.251.232.153 are filtered
It does, however, participate in and respond to traceroutes, which led me to discover that it will return ICMP-port-unreachable when I try to talk to a select range of UDP ports. This is the tcpdump output while I do echo foo|nc -u 205.251.232.197 33459:
[me@nagios systems]$ sudo tcpdump -n -n -i p1p1 host 205.251.232.197
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on p1p1, link-type EN10MB (Ethernet), capture size 65535 bytes
15:04:01.278269 IP a.b.c.d.36139 > 205.251.232.197.33459: UDP, length 4
15:04:01.448659 IP 205.251.232.197 > a.b.c.d: ICMP 205.251.232.197 udp port 33459 unreachable, length 36
So it seems to me that what I need is a test that emits a UDP packet to a host and port and regards ICMP-port-unreachable as evidence of success (hearing nothing constitutes failure). Does anyone know of a way to do this? How do others handle comparable monitoring problems?
I do some mail forwarding, but I'm also a big fan of SPF; I'm aware that I have a problem.
While my mail server was running Centos5, I was using pysrs as a milter, and it worked well - but it hasn't been updated for python 2.6 (much less the 2.7 that C7 will require) - so I reluctantly had to stop using SRS when I upgraded to C6 (which I needed to do for DNSSEC support, before anyone suggests going back to C5!).
Does anyone have SRS working with sendmail in a C6 environment, and how do you do it? Or should I bite the very painful bullet and change MTAs to one that more directly supports SRS?
I'm running into a problem with a NAGIOS system sending emails to a popular email-to-SMS service. The email-to-SMS service takes emails with text in the Subject: line, and sends them on to the mobile number encoded in the To: field. So far so good. Sadly, sendmail (and postfix before it) seem to be inserting a gratuitous CRLF into the (necessarily long) Subject: line, and that's causing my SMS messages to be truncated at the CRLF if and only if the Subject: line contains one or more colons past the gratuitous CRLF.
I am confident that the messages are being created correctly, but just to be sure, here's me creating a completely noddy test message to myself, with a long Subject: line:
echo "foo" | mail -s "1234567 101234567 201234567 301234567 401234567 501234567 601234567 701234567 801234567 90123456789" [email protected]
Note there's no extra colon in this Subject: line; all I'm doing here is showing that an extra CRLF is inserted on the wire. Here's the result of sudo ngrep -x port 25:
44 61 74 65 3a 20 46 72 69 2c 20 33 31 20 4d 61 Date: Fri, 31 Ma
79 20 32 30 31 33 20 31 30 3a 34 33 3a 35 35 20 y 2013 10:43:55
2b 30 31 30 30 0d 0a 54 6f 3a 20 72 65 61 70 65 +0100..To: reape
72 40 74 65 61 70 61 72 74 79 2e 6e 65 74 0d 0a [email protected]..
53 75 62 6a 65 63 74 3a 20 31 32 33 34 35 36 37 Subject: 1234567
20 31 30 31 32 33 34 35 36 37 20 32 30 31 32 33 101234567 20123
34 35 36 37 20 33 30 31 32 33 34 35 36 37 20 34 4567 301234567 4
30 31 32 33 34 35 36 37 20 35 30 31 32 33 34 35 01234567 5012345
36 37 0d 0a 20 36 30 31 32 33 34 35 36 37 20 37 67.. 601234567 7
30 31 32 33 34 35 36 37 20 38 30 31 32 33 34 35 01234567 8012345
36 37 20 39 30 31 32 33 34 35 36 37 38 39 0d 0a 67 90123456789..
55 73 65 72 2d 41 67 65 6e 74 3a 20 48 65 69 72 User-Agent: Heir
6c 6f 6f 6d 20 6d 61 69 6c 78 20 31 32 2e 34 20 loom mailx 12.4
37 2f 32 39 2f 30 38 0d 0a 4d 49 4d 45 2d 56 65 7/29/08..MIME-Ve
72 73 69 6f 6e 3a 20 31 2e 30 0d 0a 43 6f 6e 74 rsion: 1.0..Cont
65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 ent-Type: text/p
6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 73 lain; charset=us
About half way down (marked in bold+italic), between the 501234567 and the 601234567 in the original Subject: header, you can see a CRLF being inserted (0x0d 0x0a, on the left-hand side hex dump, .. on the right-hand side plain text).
The receiving MTA seems happy to post-process this, and when I look at the on-disc stored mail at the receiving end, I see only a LF (0x0a) in the Subject: line, and the line is parsed correctly and in its entirety by, eg, alpine. Nevertheless, the CRLF is there on the wire, and between me and the (excellent) email-to-SMS support people, we've established that these are the cause of the problem.
So my question is: is it lawful for an MTA to insert a gratuitous CRLF on the wire?
If it is, and I can prove it, then it's the email-to-SMS house's problem, because they are being intolerant. If it isn't, or it is but I can't prove it, then it becomes my problem, so an answer with references would be most useful.
Edit: I can now come clean that the email-to-SMS service in question is kapow. Once this problem was explained to them, they got it, worked with me to develop and test a fix, and have deployed the fix. My long subject lines with colons in now get relayed correctly into SMSes. I don't normally trumpet individual companies, especially not on SF, but I thought it worthy of note that kapow Did The Right Thing. (Disclaimer: I have no connection with kapow except as a paying customer who's happy about the way they dealt with his problem.)
I have a disc with several partitions on, each of which has a different kind of file system (ext3, ext4, and, let's say, NTFS). I want to know if I can copy the whole disc to a new one (which is of larger capacity) using dd, preferably in a single operation.
To forestall unnecessary effort, let me clarify a few things. I'm not interested in other ways to do it (I know the right way, and third-party software is not desirable). I'm not all that interested in theoretical answers ("it ought to work"). I'm extremely interested in anyone else's experiences trying to do such a thing.
I know the real right answer is "try it and see", but I'm 250 miles from the disc in question.
Like many of us, I have an apache server (2.2.15, plus patches) with a lot of virtual hosts on it. More than I have IPv4 addresses, to be sure, which is why I use NameVirtualHost to run lots of them on the same IPv4 address.
I'm busily trying to get everything I do IPv6-enabled. This server now has a routed /64, which gives me an awful lot of v6 addresses to throw around. What I'm trying to find is a simple way to tell each v4-NameVirtualHost that it should also function as a VirtualHost on a unique ipv6 address. I really, really don't want to have to define each virtual host twice.
Does anyone know of an elegant way to do this? Or to do something comparable, in case I've embedded any dangerously-ignorant assumptions in my question?
I'm banging my head on this, and I can't understand why it's not working. I'm hoping that someone can shed light on this, or failing that, give me some suggestions for avenues of investigation.
I've got a Red Hat 7.3 system (don't ask) where it's desirable to increase the open files limit for the wls81 user. I thought that I was just not able to control it, but it increasingly looks as if I've only got the problem with the user I need to change. I've added the following lines to /etc/security/limits.conf:
wls81 soft nofile 10100
wls81 hard nofile 10240
madhatta soft nofile 10100
madhatta hard nofile 10240
pam_limits.so is being properly invoked, as far as I can tell:
[madhatta@server madhatta]$ sudo grep limits /etc/pam.d/*
/etc/pam.d/login:session required /lib/security/pam_limits.so
/etc/pam.d/sshd:session required /lib/security/pam_limits.so
/etc/pam.d/su:session required /lib/security/pam_limits.so
/etc/pam.d/system-auth:session required /lib/security/pam_limits.so
When I ssh in as myself, I get the new soft limit, and can increase up to the hard limit:
desktop> ssh server
Last login: Thu May 10 13:20:13 2012 from a.b.c.d
[madhatta@server madhatta]$ ulimit -n
10100
[madhatta@server madhatta]$ ulimit -n 10200
[madhatta@server madhatta]$ ulimit -n
10200
[madhatta@server madhatta]$ ulimit -n 10300
bash: ulimit: cannot modify open files limit: Operation not permitted
but when I ssh in as the wls81 user, I can't:
desktop> ssh wls81@server
Last login: Wed May 9 22:29:33 2012 from a.b.c.d
[wls81@server wls81]$ ulimit -n
1024
[wls81@server wls81]$ ulimit -n 10000
bash: ulimit: cannot modify open files limit: Operation not permitted
The same happens when I su - to each user. I honestly can't see why this user's not able to have its ulimits reset. Anyone have any ideas?
I've a Solaris 8 box which is reporting that a file system is full:
db% tail -2 /var/adm/messages
Nov 22 08:32:27 db ufs: [ID 845546 kern.notice] NOTICE: alloc: /u03: file system full
Nov 22 08:34:51 db last message repeated 12 times
But df says it's not out of free blocks, and it's not out of free inodes either:
db% df -k /u03
Filesystem kbytes used avail capacity Mounted on
/dev/md/dsk/d6 282330903 254957403 24550191 92% /u03
db% df -o i /u03
Filesystem iused ifree %iused Mounted on
/dev/md/dsk/d6 29663278 4230866 88% /u03
So I thought perhaps some process is holding open file descriptor(s) to 20+GB of deleted files. But lsof, sorting by size, reports nothing over 2GB, and that's a legitimate file:
db% lsof /u03 | sort -n +6
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
[...]
oracle 1257 oracle 278u VREG 85,6 2097160192 9685782 /u03/oradata/(redacted)/data/foo_tab_14.dbf
db%
I'd appreciate any pointers to any other resource save free blocks and inodes whose exhaustion can fill up a file system, or some other way to "hide" used blocks/inodes, or any other idea anyone has. Rebooting this box or shutting down oracle is not a valid investigative option.
Edit: Khaled, I couldn't at the time. I can't post the output, because one of the DBAs has freed up about 4GB which means the machine can continue functioning, and if I "fill it up" again as a test, things will break. But this is the second time in 24 hours it's got to about 92% full and "filled up" (as in, new files can't be created, and /var/adm/messages reports "file system full"), and yes, when it happens it definitely breaks the creation or extension of files on that FS.
I run a technical mailman list with a lot of subscribers on it. One company, whose presence on the list is highly desirable, has many of its readers subscribed by an internal "exploder" list; that is, a single address which is itself an internal mailing list is subscribed to my list.
The problem is that people who want to get off the exploder keep accidentally unsubscribing the exploder from the main list, instead of unsubscribing themselves from the exploder.
I have a good working relationship with the tech guys at that company, and they're asking me if there's a way to lock a single subscriber (ie, the exploder) to a mailman list, and prevent just that subscriber unsubscribing without administrative oversight.
Anyone?
I have an ssh server. Some of my users login several times simultaneously; some of those who are doing that should not be, and I suspect account sharing. The ones who shouldn't are all members of a particular unix group.
What I'd like is a way to restrict the number of concurrent logins that members of group 402 can have to "one each", with the most recent login taking precedence.
That last bit is important; these users sometimes legitimately lose their connection to the machine and need to re-establish it, and I don't want them to be locked out of the machine because there's a hanging session which they can't kill. Instead, I want a new authenticated connection attempt to automatically disconnect the old one.
Does anyone do anything like this? Has anyone any clever PAM-based or similar suggestions?
Seven months on SF, and my first question. I do hope someone has an answer, as I'm at my wits' end.
I have a Nokia 6310i connected via RS232 cable to a Solaris 10 system, for sending SMS messages from NAGIOS using smstools3. It works fairly well, but over time people have started to really enjoy the convenience of SMS notification, and the number of messages sent has crept up from 2-3 a day to 30-100 a day, and the GSM phone solution isn't really up to that: every few days it goes unresponsive, starts failing to send messages, etc. My inclination is to get a GSM modem and use that instead, but there are no longer any RS232 GSM modems that I can find, so I have to use a USB one instead. Solaris' documentation is poor on precision about which USB modems it can talk to; it says all modems that honour "Universal Serial Bus Communication Device Class Abstract Control Model (USB CDC ACM) specification" are OK, but I can't find a single modem manufacturer who knows anything about that spec.
I would value any recommendations, positive or negative, anyone can make about USB GSM modems on Solaris; SMS-related recommendations are extra-useful, but I'm keen to know anything. Failing that, recommendations for Linux-compatible ones would be useful, as it's somewhere to start.
Thanks for any light anyone can shed.