Bit Decay - Software

Spam Analysis, Part 2

nospam@example.com (Thomas Pfau) — Sun, 09 Sep 2007 10:38:57 -0400

After yesterday's report, I made a few changes to my mail configuration and restarted the log. Here's an update on the results.
Continue reading "Spam Analysis, Part 2"

Spam Fighting Analysis

nospam@example.com (Thomas Pfau) — Sat, 08 Sep 2007 10:44:00 -0400

I have been analysing my new mailserver's log files to determine how effective various methods are at attacking spam. I think the results are quite interesting.

Continue reading "Spam Fighting Analysis"

The Joys of Running a Mail Server

nospam@example.com (Thomas Pfau) — Fri, 07 Sep 2007 10:59:57 -0400

Last weekend, I noticed my mail server constantly getting hung up. There were 15 processes in 'cmd read' state and sendmail had a limit of 15 processes. Several times I had to shut down and restart sendmail. There was nothing in the logs indicating why it was hanging.

I figured this would be a good time to switch my mail to my other machine. A while back I installed qmail but never had the guts to throw the switch. Now that my mail system was hanging I figured I had nothing to lose. I guess I had set it up correctly because it worked fine.

I had found a real good greylisting program that plugged into sendmail. When I originally turned it on, it seemed to cut my spam by about 90%. So I went looking for a greylisting program for qmail. Qmail can be built with a patch that allows the smtpd program to accept plugins and one of the plugins is a greylisting program. Fortunately, Gentoo has a USE flag that builds qmail with this patch applied. I downloaded and installed the greylisting plugin and noticed a sudden drop in the rate of spam messages to my inbox.

One thing that's nice about this particular greylisting program is that it uses a database. You can look in the database to see what hosts are trying to send you mail. If you can determine the system's legitimacy, you can drop the system's IP address and some other information into another table and the node is whitelisted or blacklisted.

I threw together a web page to allow me to monitor what's getting through my mail server into inboxes. If the node names look phony, I plug the name into my browser to see what comes up. Most of the time it appears to be an email marketing company. I blacklist these and any other IP addresses mentioned in the system's MX and SPF records. It's so nice of the spammers to post a list of their machines in an SPF record. I can knock off an entire class C with one blacklist record.

I'm surprised that many of these addresses don't show up in the DNSBL servers. My configuration references about five of them but the only one that actually seems to flag spam is spamcop.net.

In researching spam control methods, I started looking into SPF a little more. From what I've seen, many SPF entries are practically worthless. I guess it's too hard for some folks to figure out a comprehensive list of machines that can send mail for their domains so they end the SPF entry with '~all' (probably not but maybe) or '?all' which basically says "we won't confirm or deny whether any other addresses may or may not send mail for this domain". Also, if I understand the SPF documentation correctly, a 'ptr' entry would allow anyone that has control of their own reverse mappings to pump email from your domain. Google's SPF entry? "ptr ?all". Worthless.

Anyway, the mail is flowing again. I need to check what gets through the greylist a few times a day and move some entries to the black/whitelist but the only spam that appears to be getting through are 419 and lottery scams. The marketing stuff has pretty much dried up.

Continue reading "The Joys of Running a Mail Server"

Uptime Passes 1 Year

nospam@example.com (Thomas Pfau) — Wed, 11 Jul 2007 11:00:30 -0400

I just noticed last night that my main server at home has surpassed 1 year of uptime.

fogey:~\$ uptime
6:00pm up 385 days, 22:25, 1 user, load average: 0.26, 0.10, 0.10

This is a 200MHz Pentium Pro with 160M of RAM. It is my main web, mail and print server. It is running SuSE Linux 7.2.

It came close twice before. Once it was foiled by a power failure. Another time my daughter accidentally kicked the power switch. Both times it was within two months of a year's uptime.

Gentoo Upgrade on Slow Processor

nospam@example.com (Thomas Pfau) — Mon, 19 Feb 2007 12:07:33 -0500

I have been dreading the prospect of sitting through an Gentoo upgrade on my old 333MHz Celeron system. It's mostly used as an X terminal to log into one of the other faster machines so it wasn't bothering me too much. But the longer I put it off, the worse it was going to be when I finally got around to it.

I had been thinking of NFS mounting the root partition from one of my other machines and chrooting into it to do the upgrade. I finally bit the bullet and decided to try it after finding someone else that did it successfully. I started emerge this morning and it's half done using my new AMD X2 4200 as the build engine.

Distcc doesn't quite cut it in this situation. Only the compilation step is offloaded with distcc. This machine is too slow to feed multiple compilation hosts with preprocessed source. It can't keep my other machines busy while it consumes 100% of its own processor just doing precompilation.

Distcc can also be turned off by certain ebuilds but that may not stop make from honoring the '-j5' you stuck in make.conf. That means this lowly 333MHz Celeron with 320MB of RAM is now executing 5 simultaneous builds on its own.

It would be nice if some additional steps could be offloaded. I did a test yesterday between my 700MHz P3 and the new machine. I compressed a large text file on the P3 and timed it. I then used ssh to fire up the compressor on the X2 and return the compressed file to the P3. The X2 was 3x as fast even though the data made two trips across the network through an encrypted channel.

Anyway, this has been a significant improvement for upgrading this machine. I have already set up a run-level to turn off unnecessary services on the Celeron. I'll set up some scripts to do the mounts required from the X2 and maybe this machine will stay somewhat updated from now on.

Changing Market Dynamics

nospam@example.com (Thomas Pfau) — Thu, 07 Sep 2006 10:27:15 -0400

This Bruce Schneier post illustrates the changing dynamics in markets. Microsoft is no longer interested in selling operating systems to users as an end unto itself. The operating system Microsoft sells is now only a delivery vehicle for the company's new customers - the media industry. The old customer is now just a consumer of the new customer's products.

Last week, a hacker developed an application called FairUse4WM that strips the copy protection from Windows Media DRM 10 and 11 files.

Now, this isn't a "vulnerability" in the normal sense of the word: digital rights management is not a feature that users want. Being able to remove copy protection is a good thing for some users, and completely irrelevant for everyone else. No user is ever going to say: "Oh no. I can now play the music I bought for my computer in my car. I must install a patch so I can't do that anymore."

But to Microsoft, this vulnerability is a big deal. It affects the company's relationship with major record labels. It affects the company's product offerings. It affects the company's bottom line. Fixing this "vulnerability" is in the company's best interest; never mind the customer.

So Microsoft wasted no time; it issued a patch three days after learning about the hack. There's no month-long wait for copyright holders who rely on Microsoft's DRM.

Microsoft is reacting to a threat to their new primary customers. If there is a security issue in a browser that can affect end users, Microsoft doesn't really care much since there isn't that much money there anymore. But Microsoft can make a lot of money by keeping the media companies happy. If DRM doesn't work, Microsoft angers these new customers and that's a bigger threat to their bottom line. As a result, those patches get fast-tracked.

MythTV

nospam@example.com (Thomas Pfau) — Wed, 15 Mar 2006 10:30:55 -0500

A while ago, I bought a Happauge PVR-150MCE television tuner card for my PC. I have been manually scheduling recordings which means writing a script to run the capture program, invoking cron to schedule the script to run at the right time, programming the satellite receiver box to tune to the program at the right time, and praying that everything was done right so I'd get the show I wanted.

Over the last few days, I started playing with MythTV. I had installed it previously but didn't devote enough time to figuring out how it works. Last night I finished the setup and now have a fully functional PVR system. I have scheduled the recording of several programs by picking them out of a programming guide.

Continue reading "MythTV"

Nothing to see here...

nospam@example.com (Thomas Pfau) — Sat, 12 Nov 2005 23:13:55 -0500

A ham sandwich is better than complete happiness. You see, nothing could be better than complete happiness and a ham sandwich is certainly better than nothing.

I think I detect a division by zero somewhere in this train of logic.

Hang during linux shutdown when stopping postgresql

nospam@example.com (Thomas Pfau) — Tue, 08 Nov 2005 15:06:35 -0500

For quite some time now, my laptop has been having problems when shutting down. It would get to the point where it was attempting to shutdown postgresql and it would hang for a few minutes before stopping the database and continuing the shutdown. When it continued, the message "Authentication service cannot retrieve authentication info (Ignored)" would be displayed. This all started happening after an 'emerge -u system; emerge -u world'. I played around with various ldap/slapd and pam settings but could not get this to go away.

Today, a google search turned up the answer. Someone else had a similar problem and figured it out. The passwd file entry for postgres contains an 'x' in the password field. This means that the password is in the shadow file. There was no shadow file entry for postgres.

I added an entry in the shadow file for postgres and the error went away.

I think gentoo changed their passwd format for some reason. I don't remember those 'x's being there before.