Phrogz's questions

I have a mail server on Ubuntu using Postfix and Dovecot and SpamAssassin. In Postfix I am using "plus addressing" via the recipient_delimiter option. So, for example [email protected] and [email protected] are valid and actually deliver to the foo account.

Some of those addresses have gotten scraped/sold and are now heavy sources of spam (such as [email protected]). I'd like to block all email addressed to a specific list of addresses.

I edited /etc/spamassassin/local.cf to:

1. Uncomment this line: shortcircuit USER_IN_BLACKLIST_TO on
2. Add this line (above the shortcircuit): blacklist_to [email protected]

After I restarted spamassassin (/etc/init.d/spamassassin restart) emails sent to the blacklisted address still come through unharmed.

How can I hard-nuke these emails so I never see them?

I have an Ubuntu web server running Nginx. I had never configured logfile rotation and have just discovered some multi-gigabyte monolithic log files.

I have configured log rotation now per these tips. However, I'd rather not wait a week (my rotation period) before the rotation occurs.

Is there a way to force immediate rotation of either a specific file, or all files specified by the logrotate configuration?

I have a web server on a coloc host. All 'planned' activity is over HTTP. (There's no FTP server, no bittorrent client, no IRC bots, etc.)

My inbound traffic is consistently 5-10 times higher than my outbound traffic. (For example, over the past 24 hours I have served 228MB of data, but received 1.94GB.)

1. Is this standard/expected for a web server? (Am I perhaps getting slammed with thwarted nefarious attempts whose packet size versus a 0-byte response overwhelms the normal inverse relationship?)

2. If this is not expected, what tools should I use to investigate where the traffic is coming from? (The server is running Ubuntu 10.04.)

I have a web server (Thin) running on a non-standard port on my Ubuntu 10.04 Server box. I can access the web server via the loopback interface, but not the public IP. Why, and how do I fix the configuration so that other machines on the LAN can access it?

phrogz@planar:~$ curl -s -I http://localhost:9011/login | grep HTTP
HTTP/1.1 200 OK

phrogz@planar:~$ curl -s -I http://192.168.0.84:9011/login | grep HTTP
phrogz@planar:~$ curl -I http://192.168.0.84:9011/login
curl: (7) couldn't connect to host

phrogz@planar:~$ ifconfig eth0 | grep "inet addr"
          inet addr:192.168.0.84  Bcast:192.168.0.255  Mask:255.255.255.0

phrogz@planar:~$ ping 192.168.0.84
PING 192.168.0.84 (192.168.0.84) 56(84) bytes of data.
64 bytes from 192.168.0.84: icmp_seq=1 ttl=64 time=0.020 ms
64 bytes from 192.168.0.84: icmp_seq=2 ttl=64 time=0.013 ms
^C
--- 192.168.0.84 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.013/0.016/0.020/0.005 ms

phrogz@planar:~$ uname -a
Linux planar 2.6.32-33-server #71-Ubuntu SMP Wed Jul 20 17:42:25 UTC 2011 x86_64 GNU/Linux

I have a working intranet server that:

1. Properly serves some content from http://hqmktgwb01/
2. Is currently properly configured to reverse proxy from http://hqmktgwb01/dashstats to a round-robin of localhost:3000 - localhost:3003
3. Also has the DNS name dashstats (going to the same IP)

The current working configuration file can be found here: http://pastie.org/1426082

I would like to modify the configuration so that:
   4. http://dashstats/ performs the same reverse proxying http://hqmktgwb01/dashstats.

I tried to achieve #4 by modifying the config like this: http://pastie.org/1426047 (added lines 90-98) but this is not a valid Apache config.

Please help me to modify the original config file to accomplish 1-4 above.