dtech's questions

I have a provider (A) that wants to send us data through an incoming TCP connection. Unfortunately the consuming service (B) cannot receive inbound TCP connections. Also it does not have a static IP, another requirement.

One way to solve this would be a service that connects the incoming TCP A port to another TCP port B, so that the consumer can make an outbound connection to B.

This is not a unique problem [1] [2], and with socat I can make something very close to what I want:

socat -d -d -d -u TCP4-LISTEN:PORT-A,reuseaddr TCP4-LISTEN:PORT-B,reuseaddr

However, this has the following problems:

• If B disconnects, it cannot re-connect. With TCP4-LISTEN:PORT-B,reuseaddr,fork, it can connect but does not receive data.
• B cannot connect before A has established a connection (surmountable)
• Only one connection can be established to PORT-B (surmountable)

Is there a way to adjust the command so that is becomes "permament" and resistent to failures?

I've recently added a new (client) server to my NIS. For a month or so this worked fine, but since today I suddenly can't login through SSH anymore. Some other services (e.g. IMAP) on the same server work fine. The other NIS client seems to work fine.

The SSH session is terminated immediately after successful login:

some.nis.user@nismaster:~$ ssh faultyserv
some.nis.usern@faultyserv's password:
Connection to faultyserv closed by remote host.
Connection to faultyserv closed.

/etc/log/auth.log contains:

Aug 31 12:42:22 faultyserv sshd[27909]: pam_unix(sshd:session): session opened for user some.nis.user by (uid=0)
Aug 31 12:42:22 faultyserv sshd[27909]: fatal: login_get_lastlog: Cannot find account for uid 1234

If I set UseLogin yes in /etc/ssh/sshd_config I can login, but get a weird shell:

I have no name!@faultyserv:~$ pwd
/home/s/some.nis.user
I have no name!@faultyserv:~$ sudo echo
sudo: unknown uid 1234: who are you?
I have no name!@faultyserv:~$ id some.nis.user
uid=1234 gid=1975(some.nis.user) groups=4294967295,2177(somegroup),/*snip a long grouplist*/

I think there is something wrong with the NIS, but have no idea how to fix this, does anyone have an idea?

My /etc/nsswitch.conf contains (among more entries without nis):

passwd:         files nis
group:          files nis
shadow:         files nis
netgroup:       nis

I'm having a problem with emails with many (>20) To or Cc recipients being sent trough my mailserver. Worse these are mailing-lists so reach hunderds of people. People then reply-all causing irritating massive messages.

User education is not an option (they do this on purpose). Can I filter these messages in the mailserver? E.g. with Exim ACL.

recipient_max is not an option, as this will also limit Bcc'ed mails which should go through.

I'm configuring a new mail server, but have trouble with the e-mail: gmail marks it as spam. I've checked all the obvious things (SPF, DKIM, Reverse DNS, IP adress blacklisted or known spammer). OS is Debian 7 wheezy (rc-2) and MTA is exim4. Exact same message is not marker as spam from current mail server.

The gmail message is something like "looks like spam based on content" (don't have it at hand), but that is strange as the email with almost the same content goes trough if my main mta is used.

I don't know what I can check anymore, does anyone know what is going wrong?

The headers of a message are as follows:

Delivered-To: [email protected]
Received: by 10.231.19.205 with SMTP id c13csp30281ibb;
        Thu, 2 May 2013 13:57:59 -0700 (PDT)
X-Received: by 10.14.100.1 with SMTP id y1mr24043617eef.9.1367528278598;
        Thu, 02 May 2013 13:57:58 -0700 (PDT)
Return-Path: <[email protected]>
Received: from karolina2.sintjansbrug.nl (karolina2.sintjansbrug.nl. [149.210.129.77])
        by mx.google.com with ESMTPS id g47si9932355eem.247.2013.05.02.13.57.58
        for <[email protected]>
        (version=TLSv1.2 cipher=RC4-SHA bits=128/128);
        Thu, 02 May 2013 13:57:58 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 149.210.129.77 as permitted sender) client-ip=149.210.129.77;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email protected] designates 149.210.129.77 as permitted sender) [email protected];
       dkim=pass [email protected]
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sintjansbrug.nl; s=sjb;
    h=Content-Type:MIME-Version:Message-ID:Subject:To:From:Date; bh=Ccc4FRDI9WGZkTIFmUXwyCQ++Xa+9o/z/+IaeiXjS4s=;
    b=NXjcr0uLHdeGWZd/8u4zOTWSO7O3uNymchBHNBrcS6Atrfb3iwtB0lurznJ242lLSHdzihdTNSOusO1ep+sCeiX4ojST2iVvES5fijwD8S/QM2V2XYRm0LJFH/3aaOnfkJNNQYyIhB5vPf92qyVsXQRzh5o4mi1VcP8waRy8Bg7wU3eSxOTcloCNxE7so868Eu0TxW/6H6u9lKoAjQjuVeqXXfVaCLB/XrRBkTjNETHhgn8cRobEtKzZ8GAlY7WRJDbp3HVrKyMHmJFW6vkg3fZFLkEW/W4b5VD2PnK80H7nifVDYcBk/vmnJdSrT+PPbUwFPCEbkqoTjJ0Cd9m66F6YdkEwPVJgcCQ09zyqFXHVrJOuSqT0FCsh4qb0NiasSt/8mgDFxfHHYVLu2MbyJuR3j6cwQnbyWRHbMQ6SDamFdyFC0f3Rk1H1SeVKgtaWSnp+s5ngt9PKDkIEriEBMZSSmXzIhTXcapP/F5GmOcQQC0MyPT7S1SOJ9254S0Iac5rBHHM9XmYiYFyci9u5iWE3Zt19m0MY30ustczVMHNjOy+89dUy1ue5xInPOE+iJs/IOqB96e8HcSTwz7Kret+Z2c0koK61c/0I81wOG4WiRAqTEjNjivo/rI068pai87x1O+90Ziu4zi00Hl5Q/IN97bhuxT/yQdbuJZuaGCU=;
Received: from root by karolina2.sintjansbrug.nl with local (Exim 4.80)
    (envelope-from <[email protected]>)
    id 1UY0Zi-0005Zm-5T
    for [email protected]; Thu, 02 May 2013 22:57:58 +0200
Date: Thu, 2 May 2013 22:57:58 +0200
From: root <[email protected]>
To: [email protected]
Subject: This is a test message
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.21 (2010-09-15)

I do not know what went wrong

I run an apache2 server with some vhosts (50-100). A lot of these do not have favicon.ico files, cluttering the error logs with messages like

[Thu Mar 21 14:07:40 2013] [error] [client 84.xx.xx.xx] File does not exist: /var/www/somevhost/public_html/favicon.ico

Is there a way to disable logging of these errors if the file is favicon.ico? I've read this question but the problem is that for that to work all vhost files need to be altered, which isn't very convenient.

I have a debian server which uses exim4 as mta and courier-imap to allow users to read main. Mail is usually either delivered locally or an aliases file is used to forward mail to another adress. e.g.

# Local account: foo receives mail for [email protected]
somealias: [email protected]
otheralias: foo, [email protected] # Deliver both locally and remote

We now have an emailadres which we would like to be accesible through imap, but also be forwarderded to another e-mail address. This can be achieved by renaming the account and using the aliases file, but is this also possible with the local account having the same name? Renaming the account would require quite some reconfiguration in several systems.

# [email protected] needs to be de delivered to both [email protected] and the "buz" local account
# Possible solution, rename buz account to buzdummy, but this would case other problems
buz: [email protected], buzdummy

Is it possible to create multiple Certficate Authorities in Windows Server 2012? Specifically: I'd like to create a standalone root CA which will have its private key in offline secure storage. The main issuing (Enterprise) CA should have a certificate signed by the root CA.

Is this possible with just 1 Windows Server 2012 installation or do you really need to create multiple VM's with one CA each?

I'm playing around with Hyper-V on a Windows Server 2012 machine. It has 3 NIC's. #0 is dedicated to the host, #1 is on a virtual switch with all VM's on it.

I want NIC #2 to be dedicated to a particular VM, e.g. the host shouldn't bother with it and it should only have 1 MAC and IP for the client VM. (as if the VM was a physical machine with that particular NIC)

The only way to do this I see now is to create a "external" virtual network and place only that VM on the network. This of course has advantages but also leaves me to deal with 2 IP's and 2 MAC's: one for the host and one for the VM.

Is this possible and if so how (and is it recommended?)

I have a current use case in which remote computers query a central PostgreSQL database over a internet connection (read-only). We would like to implement a "stand-alone" system for these terminals so that they will still be usable when internet connection is not available. Replication will have to be done over a slow (~10 Mbps) link.

It is only important that the data can be accessed read-only, it is not a problem if the data is somewhat outdated.

My current solution would be to install a PostgreSQL database on the remote computer which replicate the master server over the internet. The software will then query the local database. Based on the information from postgreSQL (especially this presentation) Slony seems to be the best solution. Is this true or are there other, better/simpler solution like streaming replication?

On our server we've got a problem with spamassassin/exim4 blocking email from our mailing list software as spam. This because (usually) the headers the software (ecartis) adds add points to make it go over the boundary.

e.g.
Mail from [email protected] -> server. 4.0 spam points
Mailing list software -> Exim 4, +2.5 spam point
Exim blocks email as having a score of 6.5

We've disabled the rules that usually trigger, but would like to whitelist all incoming mails. We've already tried a few things but it doesn't work. We do not want to raise the spam score limit because that lets real spam through. Is this possible and if yes, how?

Added to spamassassin local.cf:
trusted_networks 127/8

Exim rule that fires:

deny
  spam = Debian-exim:true
  message = This message scored $spam_score spam points.
  condition = ${if >{$spam_score_int}{59}{1}{0}}

Example of a rejected mail:

2011-12-20 12:04:21 1RcxUb-0002GM-EP H=localhost (xxx.xxx.xx) [127.0.0.1] U=ecartis F= rejected after DATA: This message scored 6.6 spam points.
....
P Received: from localhost
        ([127.0.0.1] helo=xxx.xxx.xx ident=ecartis)
        by xxx.xxx.xx with esmtp (Exim 4.72)
        (envelope-from )
        id 1RcxUb-0002GM-EP; Tue, 20 Dec 2011 12:04:21 +0100

When currently working on a linux server (I sysadmin 2) I have the 3 following use-cases:

1. End-user use (e.g. personal or normal project groups)
2. User problem solving and low-risk changes (e.g. Apache vhost changes)
3. Real sysadmin work (e.g. configurig daemons)

We have 1 user account for everything (which is configured with detailed and correct groups for almost everything) in the NIS and generally it goes well.

The problem is that we currently open a root shell (sudo -i) for 2 & 3. This introduces risk because of full-access. Also we encounter errors from people with root access who overestimate their abilities (non-profit organisation so it's generally meant well).

I'd like to separate 2 & 3 by granting groups rights correctly (e.g. site team full access to apache but nothing else). Problem is I also don't want to grant the user accounts rights , i'd like to them to enter "admin mode" like is done now because it's easily loggable and makes people realise that they can cause damage now.

Is it possible to create multiple levels of power instead of just the normal user/root differentiation?

Other suggestions are ofcourse also welcome

I want to run a specific (perl) CGI script on my webserver. This works reasonable, but it would work immensely better if the CGI script would be running as the currently authenticated user.

Is there a way to do that, e.g. with a wrapper and sudo?

The virtualhost config is as follows:

    DocumentRoot /path/to/script
    <Directory /path/to/script>
            Options FollowSymLinks +ExecCGI
            AddHandler cgi-script .cgi

            AuthType Basic
            AuthName "Authenticate"

            # This authenticates against the local NIS
            PerlAuthenHandler Apache2::AuthenNIS
            PerlAuthzHandler Apache2::AuthzNIS
            PerlSetVar AllowAlternateAuth no

            Require valid-user
    </Directory>

I have a strange problem on an debian lenny server. The server is a NIS client to share users/groups with another server and in the sudoers file the following is placed:

%groupX ALL=(ALL) ALL

So that members of groupX have sudo rights. Furthermore I have a user that is part of the group:

uid=1234(user.name) gid=1234(user.name) groups=1234(user.name),1001(groupX),<snip>

But still when the user tries to sudo he gets an error. The other group users can sudo perfectly fine.

This has happened once before, but then it was enough to remove, synchronise and re-add the user to the group. This didn't work this time.

In /var/log/auth.log the following default error is noted:

Jul  6 11:08:35 servername sudo: user.name : user NOT in sudoers ; TTY=pts/1 ; PWD=/home/u/user.name ; USER=root ; COMMAND=/bin/bash

Does anyone know how to fix this?

We use a batch file with the following content to activate our windows domain computer after imaging:

slmgr.vbs -ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
slmgr -ato

This works well, but there is a problem: after each command a dialog box appears and the file does not continue until you closed it.

Is there a way to supress the dialog boxes? (on success, not on error). A way so that at least both commands are executed without user intervention would be fine too (it gets boring to walk past 50+ computer and pressing enter on each of them)

I want to force users sending mail to my server to use BCC (we're getting a lot of internal spam created by mailings to 30+ mailing lists which then reply to all).

I thought spamassassin could be a good place to start since it is already used for spam filtering. However, I'm not sure how to do this (or if spamassassin is really the right place to do it). My idea was to just make a bccfilter.cf which checks the number of To+Cc recipients and mark the mail as spam if it is larger than a number (e.g. 10). What is the best way to do this?

The only thing I came up whit is something like this:

header  LOCAL_FORCE_BCC_TO      To =~ /(.*?,){9,}/
header  LOCAL_FORCE_BCC_CC      Cc =~ /(.*?,){9,}/
meta    LOCAL_FORCE_BCC         (LOCAL_FORCE_BCC_TO || LOCAL_FORCE_BCC_CC)
score   LOCAL_FORCE_BCC         15.0

It basically counts the number of comma's in the To and Cc header and if either one is larger than 9 (=10 recipients) is marks the message as spam. However I don't really like the approach and have the feeling it can be done better. Also I'd like to count the total number of recipients (To+Cc) instead of seperatly.

Does anyone know how to do that? Also I'd like to return a custom error message but that doesn't really matter much.