jimp's questions

When Apache (v2.4) assigns a request to a vhost, it will use the first matching ServerName/ServerAlias across all configs, but if nothing matches it will use the first (ignoring the ServerName/ServerAlias definitions).

https://httpd.apache.org/docs/2.4/vhosts/details.html

The first name-based vhost in the configuration file for a given IP:port pair is significant because it is used for all requests received on that address and port for which no other vhost for that IP:port pair has a matching ServerName or ServerAlias.

The problem I'm having is on a shared host with a control panel. Some domains have a SSL certificate and others do not. When someone tries to access their domain without a certificate using HTTPS, I'd rather return a 404 instead of someone else's content after a security warning.

I've tried setting up a *:443 vhost that matches ServerAlias * and that didn't work. I have successfully setup a catch-all vhost matching each IP:443 individually, but this means I'll have to remember to edit this file when an IP is added to the server.

Is there a way to configure explicit ServerName/ServerAlias matches only so vhost only matches specific hostnames, or is configuring a higher priority "catchall" vhost with a shared SSL certificate the only way to workaround this issue?

I am using pvmove to migrate LVM extents from one PV to another. It works like it should, however, the physical volumes are actually thin provisioned disks from two separate storage arrays. Both disks are 20G (5119 LVM extents), but the source disk had only 5GB of stored data on the storage array. After pvmove is finished, the destination disk has 20GB used on the second storage array, eliminating the benefit of thin provisioning.

Can pvmove be instructed to only copy the extents that have ever had data written to them? Does LVM even have that info, or is it just a side effect of the storage array allocating space on demand?

I am transferring some hosting accounts from CentOS 6 with Apache 2.2 to CentOS 7 with Apache 2.4.34. Some of these accounts symlink to files through a directory symlink inside the DocumentRoot to files outside the DocumentRoot.

Like this:

root:root /var/lib/common/html/
user:user /home/user/app/           => /var/lib/common/html/
user:user /home/user/html/file.html => /home/user/app/file.html

It works on Apache 2.2. On Apache 2.4 I get a 403 permission denied response. I can find no evidence that SymLinkIfOwnerMatch is set, only FollowSymLinks via grepping the config files. The 403 error goes away if I set the /home/user/html/file.html ownership to root:root. (Note that the "middleman" directory symlink ownership does not matter. Apache will follow it either way.)

Are there situations where Apache 2.4 will always require the symlink ownership to match? It seems that direct access, mod_rewrite, and even Alias are enforcing ownership matching and I cannot figure out why.

I am debugging a custom Autodiscover implementation that works fine with MS Outlook and also passes the MS Remote Connectivity Analyzer.

However, I am having trouble with Windows Mail. I attempted to setup an account at a domain that didn't have the correct DNS records yet, and while the web server logs initially showed some remote requests from Microsoft servers to learn the Autodiscover settings, it apparently has decided to remember the protocol failure and never try again. This was days ago, and even now when I try to setup the account again I have found absolutely no Autodiscover activity in the logs. In contrast, MS Outlook and the Outlook iOS/Android app request the settings (also originating from a MS server, not the device) every time an account is being setup.

How can I get Windows Mail (or Microsoft's provisioning service?) to retry Autodiscover like other clients do?

I have a pool of XenServers that I am upgrading to 7.0. I have been doing fresh installs to switch to the new 46 GB partitioning layout, but unfortunately some of these servers only have 32GB SSD drives for root. I would like to know if anyone has had any negative experiences with 7.0 and the 4G/4G partition layout, otherwise I will probably skip the long trip to the data center at this time and proceed with the upgrades.

If I opt to not replace the 32GB drives with larger ones at this time, will I run into any serious issues with v7.0? (4GB vs 18GB for / makes me wonder if Citrix will be making plans to use that additional 14GB I won't have.)

I have a thin VPS running Ubuntu 14.04 with automatic security updates. It has filled up the /boot partition with a lot of kernel updates. I am trying to remove the older ones, but I'm running into an "unmet" dependencies error demanding I fix another package before I can continue. Unfortunately, the unmet dependency wants to install a new kernel to the partition that is 100% full.

$ sudo apt-get remove [an old linux-image* package]
Reading package lists... Done
Building dependency tree
Reading state information... Done
You might want to run 'apt-get -f install' to correct these:
The following packages have unmet dependencies:
 linux-image-extra-3.13.0-88-generic : Depends: linux-image-3.13.0-88-generic but it is not going to be installed
 linux-image-generic : Depends: linux-image-3.13.0-88-generic but it is not going to be installed
E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution).

With the partition full, there is no way I can apt-get -f install to correct anything. Is there a way to tell apt-get to not check for unmet dependencies in the database, which have nothing to do with the packages I need to remove? Once I free up some space, I can actually solve the broken packages too.

My alternate solution is to manually free up space by moving some kernels out of the way (to /kernels), fix the dependency issue, remove some kernel packages, and move /kernels/* back if I cannot instruct apt-get to cooperate otherwise.

EDIT

I tried apt-get -f remove PACKAGENAME, but it hit the dep error. But apt-get -f autoremove ignored the dep problems. Without -f, autoremove hit the dep error. With it, some kernels were found for removal and it is working on it. So while my immediate problem is resolved, I still would like to know if the regular apt-get -f remove PACKAGENAME can have the same capability of ignoring unrelated dependency issues.

I am handling vulnerabilities reported by a PCI-DSS scanner, and one of them is new to me:

Title
Firewall UDP Packet Source Port 53 Ruleset Bypass
Synopsis:
Firewall rulesets can be bypassed.
Impact:
It is possible to bypass the rules of the remote firewall by sending UDP packets with a source port equal to 53. An attacker may use this flaw to inject UDP packets to the remote hosts, in spite of the presence of a firewall.
See also :
http://archives.neohapsis.com/archives/fulldisclosure/2003-q2/0352.html
http://www.nessus.org/u?4368bb37

The first linked article gives a proof of exploit command, nmap -v -P0 -sU -p 1900 ${IP} -g 53, which does in fact return one 56 byte packet if the source port is 53. But why? In this example, it reports port 1900 is "closed" but a 56 byte reply was returned. In contrast, a request to port 1900 with UDP source port 123 (also open) returns 0 bytes.

#
# Source port 53:
#
$ sudo nmap -v -P0 -sU -p 1900 ${IP} -g 53

Starting Nmap 6.47 ( http://nmap.org ) at 2015-11-24 20:19 CST
Initiating Parallel DNS resolution of 1 host. at 20:19
Completed Parallel DNS resolution of 1 host. at 20:19, 0.00s elapsed
Initiating UDP Scan at 20:19
Scanning *HOST* (*IP*) [1 port]
Completed UDP Scan at 20:19, 0.21s elapsed (1 total ports)
Nmap scan report for *HOST* (*IP*)
Host is up (0.038s latency).
PORT     STATE  SERVICE
1900/udp closed upnp

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.25 seconds
           Raw packets sent: 1 (28B) | Rcvd: 1 (56B)

#
# Source Port 123:
#
$ sudo nmap -v -P0 -sU -p 1900 ${IP} -g 123

Starting Nmap 6.47 ( http://nmap.org ) at 2015-11-24 20:20 CST
Initiating Parallel DNS resolution of 1 host. at 20:20
Completed Parallel DNS resolution of 1 host. at 20:20, 0.00s elapsed
Initiating UDP Scan at 20:20
Scanning *HOST* (*IP*) [1 port]
Completed UDP Scan at 20:20, 2.42s elapsed (1 total ports)
Nmap scan report for *HOST* (*IP*)
Host is up.
PORT     STATE         SERVICE
1900/udp open|filtered upnp

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 2.46 seconds
           Raw packets sent: 2 (56B) | Rcvd: 0 (0B)

This Linux server is running a control panel (InterWorx-CP) that is managing an APF installation, which in turn generates the iptables rules. Here they are:

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
REFRESH_TEMP  all  --  anywhere             anywhere
TALLOW     all  --  anywhere             anywhere
TGALLOW    all  --  anywhere             anywhere
TDENY      all  --  anywhere             anywhere
TGDENY     all  --  anywhere             anywhere
DROP       tcp  --  anywhere             anywhere            tcp dpts:epmap:netbios-ssn
DROP       udp  --  anywhere             anywhere            udp dpts:epmap:netbios-ssn
DROP       tcp  --  anywhere             anywhere            tcp dpt:sunrpc
DROP       udp  --  anywhere             anywhere            udp dpt:sunrpc
DROP       tcp  --  anywhere             anywhere            tcp dpt:login
DROP       udp  --  anywhere             anywhere            udp dpt:who
DROP       tcp  --  anywhere             anywhere            tcp dpt:microsoft-ds
DROP       udp  --  anywhere             anywhere            udp dpt:microsoft-ds
DROP       tcp  --  anywhere             anywhere            tcp dpt:ms-sql-s
DROP       udp  --  anywhere             anywhere            udp dpt:ms-sql-s
DROP       tcp  --  anywhere             anywhere            tcp dpt:ms-sql-m
DROP       udp  --  anywhere             anywhere            udp dpt:ms-sql-m
DROP       tcp  --  anywhere             anywhere            tcp dpt:search-agent
DROP       udp  --  anywhere             anywhere            udp dpt:search-agent
DROP       tcp  --  anywhere             anywhere            tcp dpt:ingreslock
DROP       udp  --  anywhere             anywhere            udp dpt:ingreslock
DROP       tcp  --  anywhere             anywhere            tcp dpt:ctx-bridge
DROP       udp  --  anywhere             anywhere            udp dpt:ctx-bridge
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:lmtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imaps
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3s
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:autodesk-nlm
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:powerclientcsf
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:50000:51000
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:submission
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ftp-data
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ftp
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ntp
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable limit: avg 14/sec burst 5
ACCEPT     icmp --  anywhere             anywhere            icmp redirect limit: avg 14/sec burst 5
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded limit: avg 14/sec burst 5
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply limit: avg 14/sec burst 5
ACCEPT     icmp --  anywhere             anywhere            icmp type 30 limit: avg 14/sec burst 5
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request limit: avg 14/sec burst 5
DROP       tcp  --  anywhere             anywhere            tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
ACCEPT     tcp  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere            udp spt:domain dpts:1023:65535
ACCEPT     tcp  --  anywhere             anywhere            tcp spt:domain dpts:1023:65535
DROP       tcp  --  anywhere             anywhere
DROP       udp  --  anywhere             anywhere
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
REFRESH_TEMP  all  --  anywhere             anywhere
TALLOW     all  --  anywhere             anywhere
TGALLOW    all  --  anywhere             anywhere
TDENY      all  --  anywhere             anywhere
TGDENY     all  --  anywhere             anywhere
DROP       tcp  --  anywhere             anywhere            tcp dpts:epmap:netbios-ssn
DROP       udp  --  anywhere             anywhere            udp dpts:epmap:netbios-ssn
DROP       tcp  --  anywhere             anywhere            tcp dpt:sunrpc
DROP       udp  --  anywhere             anywhere            udp dpt:sunrpc
DROP       tcp  --  anywhere             anywhere            tcp dpt:login
DROP       udp  --  anywhere             anywhere            udp dpt:who
DROP       tcp  --  anywhere             anywhere            tcp dpt:microsoft-ds
DROP       udp  --  anywhere             anywhere            udp dpt:microsoft-ds
DROP       tcp  --  anywhere             anywhere            tcp dpt:ms-sql-s
DROP       udp  --  anywhere             anywhere            udp dpt:ms-sql-s
DROP       tcp  --  anywhere             anywhere            tcp dpt:ms-sql-m
DROP       udp  --  anywhere             anywhere            udp dpt:ms-sql-m
DROP       tcp  --  anywhere             anywhere            tcp dpt:search-agent
DROP       udp  --  anywhere             anywhere            udp dpt:search-agent
DROP       tcp  --  anywhere             anywhere            tcp dpt:ingreslock
DROP       udp  --  anywhere             anywhere            udp dpt:ingreslock
DROP       tcp  --  anywhere             anywhere            tcp dpt:ctx-bridge
DROP       udp  --  anywhere             anywhere            udp dpt:ctx-bridge
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:1024:65535 state RELATED,ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere            udp dpts:1024:65535 state RELATED,ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere            udp spts:1023:65535 dpt:domain
ACCEPT     tcp  --  anywhere             anywhere            tcp spts:1023:65535 dpt:domain
ACCEPT     all  --  anywhere             anywhere

Chain PROHIBIT (0 references)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

Chain REFRESH_TEMP (2 references)
target     prot opt source               destination

Chain RESET (0 references)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset

Chain TALLOW (2 references)
target     prot opt source               destination

Chain TDENY (2 references)
target     prot opt source               destination

Chain TGALLOW (2 references)
target     prot opt source               destination

Chain TGDENY (2 references)
target     prot opt source               destination

The server is also a DNS authority for the domains it hosts, replicating to slave servers, so incoming DNS queries could be disabled. But even when I did that in the CP, the exploit still was successful. My guess is APF is generating some rules outside of my indirect control.

How do I go about closing this hole in the firewall?

What is the impact of this vulnerability from 2003, which the PCI scanner is just now reporting (years of scans already)?

Historically, we have handled SMTP traffic across a handful of multipurpose servers each with their own local spam-fighting stack. We've grown and this is no longer feasible to maintain. Now we have a single anti-spam gateway in place which is performing well, but spammers still send messages directly to the SMTP endpoints as before. Most of our users connect to their server via mail.example.com for SMTP, IMAP, and POP, which points directly to their server IP.

How can I forward the "spammer" traffic, which completely ignores the MX records for the domains, while still leaving port 25 available to user SMTP traffic? Traffic from the users' MTA is supported on port 587 (auth required) and 25. I basically need the email traffic routed to the server to be forwarded to the anti-spam gateway for inspection, while allowing user SMTP traffic (their outgoing email) to be allowed and not take a trip through the anti-spam gateway. I'm using qmail on the endpoints. Is this possible?

UPDATE

I actually do not need to forward the spam to the remote spam filter. That would be good for learning spam (honey pot), but it's not necessary and I can do without it.

The endpoint SMTP servers need to...

1. Allow users to send mail through the SMTP server, with authentication only, on ports 587 and 25. In an effort to not break legacy configurations, I still need port 25 open for authenticated sessions.
2. Configure port 25 to accept unauthenticated mail from the anti-spam filter IP without accepting mail from any other unauthenticated IPs. The incoming filtered mail does not have authenticated. It is simply relayed through the filter by the MX records.

We are storing files on FreeNAS 9.2 using ZFS. I love the data integrity claims made by ZFS, having randomly lost data in the past on servers using ext3, XFS, and ReiserFS that were not mistreated (power outages, etc). It was rare, but disastrous when a server needed a reboot, fsck kicked in, and found lots of errors.

We are also using this same NAS as a shared storage target for XenServer virtual machines. At first I was thinking about how nice it is to have our VMs backed with ZFS, but now I'm second guessing the integrity is really that failure proof.

If a VM's virtual disk is just a large file containing its own file system (assume the default recommended ext4), then what prevents it from becoming corrupted within that virtual disk? Perhaps a network cable becomes faulty and iSCSI doesn't know it received a few bad bytes to store (resiliently in ZFS)? I'm guessing there are other possible faults that can occur between the VM and the shared storage that a "trusting" file system wouldn't detect. Is the only solution to also use an error correcting file system within the VM, such as ZFS or btrfs?

I am comparing two rackmount server chassis (Norco RPC-4220 and Norco RPC-4020, FWIW), which are identical except for the backplane connectors. One has 20 SATA connectors and the other has 5 Mini SAS (SFF-8087) connectors.

Is there any advantage to having 20 separate SATA connectors? I haven't come across a controller with 20 SATA connectors, so mini SAS breakout cables would be needed (I think) and not to mention all the extra cables to tuck away from the fans. Would an application actually prefer or need individual SATA connectors over the more advanced SFF-8087 connectors?

Does one connection method offer any advantage, such as performance, or is it really just a preference determined by the storage controller choice?

I have a lot of experience using OpenVZ, but I want to give LXC a try on a server where perfect isolation is not a concern. The main reason for the switch is preferring Ubuntu Server LTS as the base OS, but the OpenVZ project currently only supports the RHEL kernel and the latest kernel patch is for 2.6.32.

This new server is running Ubuntu 12.04 LTS. I found it's very simple to create a container using the provided container templates, i.e., lxc-create -t ubuntu -n testvps -B lvm --vgname vps --fssize 20G --fstype ext4. However, I have yet to find any substantial information that explains how to take a precreated OpenVZ template and use it as the base for a LXC container. The articles I've seen basically recommend OpenVZ templates as a good option for LXC containers. But how? This article comes close, but it uses paths Ubuntu 12.04 does not and extracts directly to the filesystem instead of a LVM logical volume. Being so new to LXC, I'm sure I must be missing something. I need to know where I should put the OpenVZ template tarball (or extract it) so the lxc-create -t` command can initialize from it.

I need to create a LXC container, on a LVM volume, under Ubuntu 12.04 from the OpenVZ precreated CentOS 6 template. Any help pointing me in the right direction would be greatly appreciated. Thank you!

Occassionally a user's email password will become compromised and the spammer will flood the Qmail queue with 10,000+ emails sent through a specific user's account. I know how to use qmqtool to remove messages that match a specific string:

qmqtool -d -f "[email protected]"

However the -f argument matches anywhere in the message.

-f 'STRING' display comma separated list of message number(s) containing STRING.

That means messages to, from, and even mentioning that email address will all be deleted. Does qmqtool (or another qmail tool) have a command for matching messages from a specific envelope sender?

Note: I only want to match the authenticated sender, not the "From:" which is always forged in this case anyway.

We have a Rackable Systems server used for backup storage. Recently we purchased a couple 3TB drives to expand the storage, but they are only showing a capacity of 746.52 GB as reported by 3ware's tw_cli utility and the 3ware card's BIOS. I have been searching, but I cannot find a spec sheet that lists the card's maximum single drive capacity supported. I also cannot figure out why the drive shows 746.52 GB instead of 2 TB, if in fact the 2TB compatibility barrier has been reached.

Storage controller: 3ware 9500S-4LP (Firmware: FE9X 2.08.00.009)
Two new drives: Seagate SV35 ST3000VX000 3TB drives.

Are the new drives too large?
Why do the 3TB drives report smaller than the 1TB drive (listed as 931.51 GB)?

Output from tw_cli:

/c1 show

Unit  UnitType  Status         %RCmpl  %V/I/M  Stripe  Size(GB)  Cache  AVrfy
------------------------------------------------------------------------------
u0    SINGLE    OK             -       -       -       372.519   OFF    OFF
u1    SINGLE    OK             -       -       -       931.312   OFF    OFF
u2    RAID-1    OK             -       -       -       745.048   ON     OFF

Port   Status           Unit   Size        Blocks        Serial
---------------------------------------------------------------
p0     OK               u0     372.61 GB   781422768     *snip*
p1     OK               u1     931.51 GB   1953525168    *snip*
p2     OK               u2     746.52 GB   1565565872    *snip*
p3     OK               u2     746.52 GB   1565565872    *snip*

Edit: Added 3ware card firmware version.

We have a nice corporate email signature (NOT a huge disclaimer document, just a consistent 4-line email signature) that we have configured our email clients to use. It is small, tasteful, and degrades very well for plain text emails, too.

There are three problems with our setup.

1. It is possible to accidentally modify the signature and no one here actually wants to do that, ever. We like consistency. :)
2. Every machine has to be reconfigured if any changes are needed, such as adding a new social network, for example.
3. Mobile Email: This is the real problem. iOS Mail gives one email signature for ALL mailboxes. That means no replying from the "support" or "sales" box without revealing you are out of the office and discarding your company brand in the process. Or it means having all personal emails require editing so the company name doesn't get pushed to all friends and relatives.

I would like to use a wrapper script to pattern match on the email body, looking for an email token such as {{{auto-signature-from-fullname}}} and replace it with the actual signature content. Server-side, the script would consider the email "From" (support? sales? webmaster?) and MIME section (html? plain?) to determine which email signature to inject. Client-side, the email application would still be determining where the signature belongs, so AFAIK we won't risk corrupting email attachments with this approach. Additionally, email clients with single-signature support (iPhone, iPad) will get the benefit of a proper signature since the signature token is consistent per-employee.

We are using qmail v1.06 with patches, although we are not opposed to using a different Linux MTA or an extra SMTP relay, if necessary. A wrapper script, piping stdin/stdout, is really what we need over source patching.

Note: I have seen questions similar to this on Server Fault that are only getting "don't do it" replies. I am posting my question because my need/idea is a bit different than just a blind automatic email footer. Any help offered is very much appreciated. Thanks!