bsd.m3th.org
Yet another *nix admin blog

This a just a short note for my own reference.

1) Install postfix
# yum install postfix

2) Set default MTA to Postix via this command
# alternatives –set mta /usr/sbin/sendmail.postfix

3) Autostart Postfix (Optional but you really want to do it)
# chkconfig –levels 235 sendmail off
# chkconfig –levels 235 postfix on
# /etc/init.d/sendmail stop
# /etc/init.d/postfix start

If you are on FreeBSD 7.0 and have problem booting up HeX LiveCD with qemu, try this

kldload aio

and add -std-vga option to qemu command line. For example:-

qemu -boot d -cdrom hex-i386-1.0.2.iso -localtime -std-vga

Have fun!

With the release of OpenBSD 4.2, you will find that cdrom42.fs was not provided in OpenBSD official ftp sites. However, it is relatively easy to custom build your own OpenBSD 4.2 bootable installer CD. I will show you the steps in making your own puffer fish El Torito.

CREATE CD STRUCTURE
Create the OpenBSD bootable CD structure with this command,

%mkdir -p ~/OpenBSD/4.2/i386

DOWNLOAD OPENBSD FILES
Use ncftp or wget to download the necessary files off OpenBSD ftp site.

%cd ~/OpenBSD/4.2/i386 && ncftp ftp://ftp.jp.openbsd.org/pub/OpenBSD/4.2/i386
ncftp /OpenBSD/4.2/i386 > get *

Note : install42.iso is a bootable OpenBSD installer by itself. You should exclude that file.

CREATE CDROM42.FS
As this file is absent, creation of cdrom42.fs is required in order to make bootable OpenBSD iso. Bootable “El Torito” CDROMs usually use a boot loader. The loader will boot disk image located inside the iso9660 filesystem. This cdrom42.fs is the file that contains both boot loader and disk image. Not too worry. It is trivial.

Thanks to Rainer Krienke for creating a nice El Torito boot image extractor in PERL, called “geteltorito“. Grab a copy/make executable and extract El Torito boot image from the file cdemu42.iso with this simple command.

%geteltorito cdemu42.iso > cdrom42.fs
Booting catalog starts at sector: 29
Manufacturer of CD: Copyright (c) 2007 Theo
Image architecture: x86
Boot media type is: 2.88meg floppy
El Torito image starts at sector 30 and has 5760 sector(s) of 512 Bytes
Image has been written to stdout ....

CUSTOMIZATION
You can add whatever files you want them to be included. Just copy them to ~/OpenBSD/ . I normally will put stuff like ports.tar.gz, src.tar.gz, sys.tar.gz and etc.

CREATE OPENBSD BOOTABLE INSTALLER CD
mkisofs comes handy in creating our bootable CD. Just issue this command and wait for it to be generated.

%cd ~/OpenBSD && mkisofs -vrTJV "OpenBSD 4.2" -b 4.2/i386/cdrom42.fs -c boot.catalog
-o OpenBSD42.iso ~/OpenBSD/

Now you will have OpenBSD42.iso. Burn it to a blank CD-R and Volia! Do support the OpenBSD project. Buy CD/T-shirt. They look really cool!!

Our (xwings and I) poor, _soon_to_be_removed_ webserver box at Brickfields netmyne datacentre was under DDOS attacked this morning around 11:30am MYT. The box with 512MB of RAM running FreeBSD survived the attack. However, system resources were running extremely low. More than 100 instances of httpd were running! The system was extremely busy and lag. It barely responded to my ssh connection request.

My pf rule’s stateful tracking limit seemed to be too lenient and not suitable for the box with low system resource.

pass in quick on $netif inet proto tcp from any to ($netif) port {80, 443}
   \ keep state(source-track, max-src-states 100, max-src-nodes 999}

I have decided to head on to more aggressive approach, with use of pf max-src-conn-rate, table and filtering.

table  persist
block in quick on $netif from 
pass in quick on $netif inet proto tcp from any to ($netif) port {80, 443}
   \ keep state(max-src-conn 100, max-src-rate 15/5, overload  flush}

After stopping all httpd instances, I loaded new pf rule. pfctl -f /etc/pf.conf. It worked nicely. table was full of sons/daughters of bitch’s IP addresses.

pfctl -t dos -T show
221.194.136.38
220.181.19.176
72.232.190.82
61.135.162.18
202.190.250.2
64.26.63.19


Happy and back to sleep again. Grow up, kids! Shame on you. You couldn’t even kill a poor little box with 512MB of RAM! But thanks anyway for helping me to test area where I overlooked.

White Papers for Success
Decisions related to web hosting should be taken after going through the current web hosting review. Having an old record of past webhosting review magazines might help a bit. For services like ix web hosting and powweb however, one does not need to go through reviews.

Another way of fighting images spam is by Realtime Black List lookup. This tactic is probably one of method which is inexpensive to server resource.

With postfix, you could just add reject_rbl_client images.rbl.msrbl.net to smtpd_client_restrictions section of postfix’s main.cf.

For instance:

smtpd_client_restrictions = permit_mynetworks,
    reject_rbl_client images.rbl.msrbl.net,
    ....

For qmail, you could just add -r images.rbl.msrbl.net as tcpserver option of your qmail smtp startup script.

Note : images.rbl.msrbl.net – Hosts found sending mail contaning spam images. Check out MSRBL for more info.

On my previous post, I have discussed some of the anti image/PDF spam. I have tried clamav with Sanesecurity’s phishing and scam signatures.

On FreeBSD, I downloaded update shell script by Dan Larsson and made a slight modification as I do not wish to install/use rsync on production servers just to download signature files. I have added these two lines to update shell script under “http_source_urls” and commented out “rsync_source_urls“.

http://download.mirror.msrbl.com/MSRBL-Images.hdb

http://download.mirror.msrbl.com/MSRBL-SPAM.ndb

http_source_urls="

http://www.sanesecurity.com/clamav/phishsigs/phish.ndb.gz

http://www.sanesecurity.com/clamav/scamsigs/scam.ndb.gz

http://clamav.securiteinfo.com/vx.hdb.gz

http://download.mirror.msrbl.com/MSRBL-SPAM.ndb

http://download.mirror.msrbl.com/MSRBL-Images.hdb

http://www.malware.com.br/cgi/submit?action=list_clamav,fetch_interval=86400,target_file=mbl.db

"#rsync_source_urls="
#   rsync://rsync.mirror.msrbl.com/msrbl/MSRBL-Images.hdb
#   rsync://rsync.mirror.msrbl.com/msrbl/MSRBL-SPAM.ndb
#"

(more…)

A lot of spam image/PDFs were slipping through my office MXs since this spamming technique has gained its popularity and it was getting really out of hands. I have decided to put an end to this madness and experimented various tactics to curb image/PDF spam. Generally, this can be achieved with spam scoring from SpamAssassin or clamav via Sanesecurity’s Phishing and Scam Signatures for ClamAV.

On this post, I will share some of the tactics that I have tried with SpamAssassin. With SpamAssassin, fighting image/PDF spam was trivial.

(more…)

Previously on my post on pidgin msn switch error, a lot of pidgin users were affected by the bug/defect. However, there are simple workaround suggested.

1. edit your msn account information

2. click on the advanced tab

3. clear “use HTTP method”

4. make proxy type: no proxy.

Well, it works for me. This won’t help in corporate network environment though. (Outgoing connection on port 1836 is not commonly allowed).

In case you are using Pidgin and using “HTTP method” (In fact that is the only way to get connected to MSN), you might find that you are not able to send message to your friends. You will always get this error message whenever you try to send them message. “Message could not be sent because a connection error occurred:“.

Guess have to wait for next update of pidgin. There is an open ticket on this issue 4 days ago.

White Papers for Success
The free web hosting services may not be able to provide the best email hosting, but they certainly deliver the job. For effective web hosting, ignoring such flaws is important. With the advent of wireless internet, everyone is claiming to provide dedicated hosting, and it is up to us to pick up the best service.

In my previous post on FreeBSD : Compaq Presario V3010AU, the Ricoh SD/MMC card reader attached to my laptop was not functioning on FreeBSD 6.2R. Following the post by Hajimu UMEMOTO on freebsd-mobile mailing list, I’ve tested his driver and able to write on Kingston SD card.

Update :
New driver at http://www.agt.ne.jp/~a-gota/programs/driver/FBSD6.2R/memcard/sdmmc-20070627.tar.gz

Writing speed

coeus# mount_msdosfs /dev/sd0s1 /mnt/card
coeus# cd /mnt/card
coeus# dd if=/dev/zero of=test.img bs=1k count=10k
10240+0 records in
10240+0 records out
10485760 bytes transferred in 10.765308 secs (974033 bytes/sec)

(more…)