Jack M.'s questions

I'm trying to upgrade both Apache and OpenSSL at the same time. I've gotten Apache compiled with all the modules I need, and it pops up and runs, but still shows an old version of OpenSSL.

Here is my config command:

./configure --prefix=/usr/local/apache2.2.24/ --with-ssl=/usr/local/openssl-1.0.1e/ --enable-mods-shared="all [sic] ssl rewrite"

The OpenSSL in that directory is correct:

$ /usr/local/openssl-1.0.1e/bin/openssl version
OpenSSL 1.0.1e 11 Feb 2013

Yet, when I query the server I still get an old version of OpenSSL in the header:

$ curl -I http://www.mydomain.com/
HTTP/1.1 200 OK
Date: Thu, 09 May 2013 14:51:59 GMT
Server: Apache/2.2.24 (Unix) DAV/2 mod_ssl/2.2.24 OpenSSL/1.0.0g

I've recompiled a few hundred times over the last few days, and cannot figure out what I'm missing. Each of the directories has been deleted and made from scratch (including the source directories I'm compiling in).

The system is an older version of FreeBSD with a broken ports install, so I cannot use ports for the compile.

I'm trying to upgrade OpenSSL, OpenSSH, and Apache22 on a FreeBSD 8.1 system. I'm already running OpenSSH-Portable, so that's not really a problem.

Where I run into trouble is that openssh-portable is trying to install libXext. How can I tell this port to ignore X11 requirements?

I'm getting ready to deploy a new SMTP server, and I'm not sure how to ensure that it is using strong encryption. The server software is Postfix running only SMTP. I've added the following to the main.cf file (stolen from here):

smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5
smtpd_tls_security_level = encrypt
smtpd_tls_mandatory_protocols = TLSv1
# Also available with Postfix ≥ 2.5:
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3

Restarted the daemon and everything seems to work as intended, but I'm not sure how to test that only the strong cyphers are enabled. The following allows me to connect, but I'm not sure which combination of flags (-no_ssl3, -no_tls1, etc) to use in order to ensure that only the strong encryption is enabled.

openssl s_client -starttls smtp -crlf -connect mail.mysite.com:25

I'm trying to secure an install of RabbitMQ, and am not sure how to secure the Erlang EPMD port. I only have one machine running anything, so I'd like to make it listen only on the loopback device. Per the docs, I've added:

ERL_EPMD_ADDRESS=127.0.0.1

to /etc/rabbitmq/rabbitmq-env.conf, but this has no effect, as the port still shows open in nmap from a remote system.

Is there a way to lock down this port that I won't be using?

I'm trying to remotely monitor temperature sensors within two Dell PowerEdge 6850's. I have a fear that the building we are in is turning off the air conditioning on the weekends to save power, which doesn't bode well for a server room which normally sits around 75 degrees anyway.

Google has lead me to looking into freeipmi and the ipmi-sensors command, which I got installed from ports but doesn't help much. I get this output:

# ipmi-sensors
Segmentation fault: 11 (core dumped)

I'm at a loss on how to move forward. I no longer have physical access to the building on the weekends, so I need to do this monitoring remotely.

I have a server running Ubuntu 9.10, with Apache 2.2.12 being the latest available package for apache2. I see, however, that 2.2.14 is available for Lucid. Is there a way to continue using dpkg and get 2.2.14 (or preferably 2.2.15, since it was a security release back in March) running, or do I have to resort to a manual compile?

I would simply upgrade the OS to Lucid, but the machine sits 8 hours away and doesn't have a backup (blame management tightwads).

I'm trying to work out how I can get postfix to accept email for any sub-domain of my main site. I don't have virtual domains, just a long list of sub-domains for local delivery. In specific, I'm feeding python@*.mydomain.com into a Python using the alias file:

python:    |/www/proc_email.py

The Python can handle delivery from there. I envision this looking something along the lines of:

mydestination = encendio, localhost.localdomain, localhost, *.mydomain.com

I'm running the latest version of postfix on Ubuntu (not rightly sure how to check the version).

Thanks in advance.

I'm trying to find a few options of ways to do high availability DNS hosting for a few existing websites. This morning, the company I work for was brought to its knees because the DNS hosting we have for our domains through our registrar (bulkregister.com) went down. I'm now being tasked with finding an alternative which will not put us at the mercy of a single DNS provider.

What we're looking for:

• No single point of failure.
• Time effective.
  • One solution that has been suggested is to do multiple DNS hosts. This seems like a great alternative, but we have over 20 domains, and updating an IP address on all of those domains across two providers is prohibitive.
• Cost effective.
  • I have to sell this to upper management. Joy is me.

So what methods exist which support this? I'm more of a programmer myself, but they've tasked me with this, so I wanted to get the opinion of people more experienced than I am.

Does anyone know of a way to turn on the identification light on a Dell rack-mount server. This is the light which you can switch on locally by pushing the (i) button on the front of the server which turns on lights in the front and rear of the server?

The machine is a Dell Poweredge 860.

I'm trying to identify a server in Utah from AZ. Haven't had much experience with it, so forgive me if this is a newb question.

I'm having some trouble making a Cisco ASA device block certain social networking sites which have become time sinks in our office. This question is really in two parts:

1. Is there a reliable way to retrieve all of the IP addresses for these sites?
   • It seems that Facebook's DNS servers respond with random IP addresses. A dig followed by an nslookup yield two different IP addresses for www.facebook.com.
2. Is there a trick to letting me add host names to Cisco ASA through Adaptive Security Device Manager (ASDM).
   • I have found the URL filter, but that requires a third-party piece of software that I doubt I'll get funding for just to block these sites.

We're looking for a temporary solution until I can get Squid up and running, which may be as far out as six months (we need a network administrator, bad).

I'm trying to view a user in LDAP which was recently added to a Windows 2000 Active Directory Service. I'm not seeing the user when I query LDAP, and I'm guessing I need to reboot the service. Any advice for how to do this?