15,573 reputation
11030
bio website systemajik.com
location Gatineau, Canada
age 59
visits member for 5 years, 1 month
seen 15 hours ago
I have over 30 years experience in all phases of software development and delivery. I have administered a variety of midrange servers, and worked with systems from PCs to Mainframes.

Mar
24
comment Creating a self signed certificate for demonstration purposes on Centos 7 server
@liv2hak Yes, you will be your own CA. Tomcat should use the Java keystore. Follow their documentation for generating a certificate and getting it signed. Sign it with your CA certificate, then import the signed certificate.
Mar
18
comment Cron errors routing to external mail server instead of local
@JPL It looks like someone changed a cronjob to send logs to an external user. The headers indicate that it is not the CRON daemon sending the email.
Mar
18
comment Cron errors routing to external mail server instead of local
@JPL The messages looks like they were generated by the script not by CRON. Check the user's scripts. It may be better to configure your server so the messages can get delivered.
Mar
14
comment PHP Mail Delayed Shared Hosting
@jchwebdev The delay on the first hop from your server. Examine your Exim log, likely /var/log/exim*/mainlog. You can used exigrep to retrieve the log messages for a single email.
Mar
14
comment Change dnsmasq from .dev to .local
.local has been co-opted for use by auto-config (bonjour, avahi, ...). I would recommend not using it for DNS. The traditional name would be localnet, but lan is often used.
Mar
13
comment Have a valid SPF record but still can spoof my email
@MadHatter Yes I reviewed the revised documentation with that clarification. It wasn't clear in earlier documentation, and I believe I encountered implementations that appeared not to make the distinction. Not all implementations handle edge cases like that in a standard manner. I believe that may be why the clarification was needed.
Mar
13
comment Subdomain with different ip on same server
@PrivatMamtora I've updated my answer to provide a possible use. Adding additional IPs won't resolve an I/O bottleneck, but isn't likely to cause one either.
Mar
13
comment Subdomain with different ip on same server
@PrivatMamtora Either of the first two paragraphs would be reasons to add a second IP address for the sub-domain. I clarified the first case. If neither applies, I can't think of a reason to add the second IP address.
Mar
13
comment “NTP socket is in use” messages from ntpdate in syslog
Remove or disable ntpdate it may be leftover from an old version. ntp now does everything that used to require ntpdate.
Mar
13
comment Have a valid SPF record but still can spoof my email
Because you included _spf.google.com your policy is likely to be evaluated ~all not -all. You likely need only one of MX, A, and PTR.
Mar
12
comment How to block IP addresses from port 25
It can be easily done in a connect ACL which denies all connections not from the desired IP addresses. I haven't used the McAfee spam solution, but they should have the requisite A and PTR records in place to pass rDNS validation. You can use then block any incoming connection on port 25 not from their domain. (This is should be more reliable than blocking by IP address.)
Mar
10
comment Catch incoming email and then deliver to original recipient on sendmail
Email aliases can handle incoming mail. It should be possible to add an alias that copies the email to a second address.
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@mahai Websites with access restrictions don't publish what addresses they accept connections from. (This is critical security data.) While I may know the address of the website. I don't get a list of address than I can connect from. This is valuable as cracking any one of them may be an easier way to attack the site than trying to attack the site directly.
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@mihai Hosts listed in SPF are usually already public (MX). SPF limits the hosts that can send for the domain, not who can access. And yes, mail server do get hacked.
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@mihai I can't think of any reason to publish your security policy in DNS. Web servers already handle the restrictions, and there are a number of other services than can restrict which addresses/domains can connect. If people can look up the TXT records, they can lookup up the IP. It just tells me where I need to break into so I can pivot onto your systems.
Mar
3
comment Do the SSH or FTP protocols tell the server to which domain I am trying to connect?
@kasperd For IPv4 the client would need credentials of some sort for the intermediate server. This could be a key which is configured on the intermediate server to force the forwarding, with a separate key for each host. Its a little difficult to configure but once working may simplify the dual stack requirement.
Mar
3
comment Do the SSH or FTP protocols tell the server to which domain I am trying to connect?
@kasperd You may be able to do this by configuring the client to use the ssh tunneling option '-W' to chain the connection to the appropriate server.
Feb
18
comment mx server: multiple domains on one ip
@sebix I did specify hard fail (-all) which I use everywhere. I did grab the wrong SPF specification from my web server, instead of the the correct one from my mail server. I've updated using the A record rather than the MX record as there is no MX for the mail server. The domain should use MX but I didn't include it, but have now.
Jan
25
comment hdparm serial number is garbage
The emulation of cylinders, heads, sectors, etc. is essential to being able to use the device as modeled by software. The serial number and many of the other items reported by hdparm are related to the physical implementation of the device. (Serial number is not even required at that level.) Many are related to the hardware controller software not the device itself.
Jan
25
comment hdparm serial number is garbage
Virtual machines generally have virtual devices. Using a tool intended for physical devices is likely to get invalid results.