October 2004 - KCLUG

ITEC Handout
by djgoku 27 Oct '04

27 Oct '04

-- dj_goku -www.djgoku.com- -www.tektronic.org-

1 0

Sendmail Help
by Jon Moss 26 Oct '04

26 Oct '04

I really don't want to be an e-mail administrator. Nor do I want to host an e-mail server. There are too many liabilities (spam viruses) associated with it. But (you knew there would be one) I'm hosting the eGroupware package for my church, which includes fudforum (which I really like). It's really odd. The Calendar application sends e-mail notifications/alarms just fine. FudForum isn't sending out notifications of subscribed forums or topics. Here's my maillog file (or today's portion of it after noon): Oct 26 12:01:03 mosslinux sendmail[25538]: i9QG13fG025538: to=jon(a)mossfam.net, ctladdr=apache (48/48), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30179, relay=[127.0.0.1] [127.0.0.1], dsn=5.0.0, stat=Service unavailable Oct 26 12:01:03 mosslinux sendmail[25538]: i9QG13fG025538: i9QG13fH025538: DSN: Service unavailable Oct 26 12:01:03 mosslinux sendmail[25538]: i9QG13fH025538: to=apache, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=31383, relay=[127.0.0.1], dsn=5.0.0, stat=Service unavailable Oct 26 12:01:03 mosslinux sendmail[25538]: i9QG13fH025538: i9QG13fI025538: return to sender: Service unavailable Oct 26 12:01:03 mosslinux sendmail[25538]: i9QG13fI025538: to=postmaster, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=32407, relay=[127.0.0.1], dsn=5.0.0, stat=Service unavailable Oct 26 12:01:03 mosslinux sendmail[25538]: i9QG13fH025538: Losing ./qfi9QG13fH025538: savemail panic Oct 26 12:01:03 mosslinux sendmail[25538]: i9QG13fH025538: SYSERR(apache): savemail: cannot save rejected email anywhere Oct 26 13:37:57 mosslinux sendmail[25931]: i9QIbvek025931: from=apache, size=358, class=0, nrcpts=1, msgid=<200410261837.i9QIbvek025931(a)mossfam.net>, relay=apache@localhost Oct 26 13:37:57 mosslinux sendmail[25933]: i9QIbvc8025933: tcpwrappers (mossfam.net, 127.0.0.1) rejection Oct 26 13:37:57 mosslinux sendmail[25931]: i9QIbvek025931: to=andreart(a)juno.com, ctladdr=apache (48/48), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30181, relay=[127.0.0.1] [127.0.0.1], dsn=5.0.0, stat=Service unavailable Oct 26 13:37:57 mosslinux sendmail[25931]: i9QIbvek025931: i9QIbvel025931: DSN: Service unavailable Oct 26 13:37:57 mosslinux sendmail[25931]: i9QIbvel025931: to=apache, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=31382, relay=[127.0.0.1], dsn=5.0.0, stat=Service unavailable Oct 26 13:37:57 mosslinux sendmail[25931]: i9QIbvel025931: i9QIbvem025931: return to sender: Service unavailable Oct 26 13:37:57 mosslinux sendmail[25931]: i9QIbvem025931: to=postmaster, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=32406, relay=[127.0.0.1], dsn=5.0.0, stat=Service unavailable Oct 26 13:37:57 mosslinux sendmail[25931]: i9QIbvel025931: Losing ./qfi9QIbvel025931: savemail panic Oct 26 13:37:57 mosslinux sendmail[25931]: i9QIbvel025931: SYSERR(apache): savemail: cannot save rejected email anywhere Oct 26 13:39:23 mosslinux sendmail[25934]: i9QIdNCT025934: from=apache, size=361, class=0, nrcpts=1, msgid=<200410261839.i9QIdNCT025934(a)mossfam.net>, relay=apache@localhost Oct 26 13:39:23 mosslinux sendmail[25936]: i9QIdNc8025936: tcpwrappers (mossfam.net, 127.0.0.1) rejection Oct 26 13:39:23 mosslinux sendmail[25934]: i9QIdNCT025934: to=andreart(a)juno.com, ctladdr=apache (48/48), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30181, relay=[127.0.0.1] [127.0.0.1], dsn=5.0.0, stat=Service unavailable Oct 26 13:39:23 mosslinux sendmail[25934]: i9QIdNCT025934: i9QIdNCU025934: DSN: Service unavailable Oct 26 13:39:23 mosslinux sendmail[25934]: i9QIdNCU025934: to=apache, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=31385, relay=[127.0.0.1], dsn=5.0.0, stat=Service unavailable Oct 26 13:39:23 mosslinux sendmail[25934]: i9QIdNCU025934: i9QIdNCV025934: return to sender: Service unavailable Oct 26 13:39:23 mosslinux sendmail[25934]: i9QIdNCV025934: to=postmaster, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=32409, relay=[127.0.0.1], dsn=5.0.0, stat=Service unavailable Oct 26 13:39:24 mosslinux sendmail[25934]: i9QIdNCU025934: Losing ./qfi9QIdNCU025934: savemail panic Oct 26 13:39:24 mosslinux sendmail[25934]: i9QIdNCU025934: SYSERR(apache): savemail: cannot save rejected email anywhere I can send my sendmail.mc file too if you like. I have it masquerading as mossfam.net. Any suggestions are appreciated. -- Thanks very much, Jon Moss jon.moss(a)cnonline.net

2 5

Poster for itech booth
by mike＠handuma.com 26 Oct '04

26 Oct '04

A friend of mine, Tom Abelera, and I used an air brush to paint a large penguin on thick foam board. It's 44" by 48". I thought it would add interest to the itech booth. Check it out http://www.handuma.com/poster/penguin.gif http://www.handuma.com/poster/igloo.gif http://www.handuma.com/poster/igloo.jpg Michael handuma.com http://www.handuma.com

1 0

RE: OT RE: long sig (was: PostNuke site cracked)
by Brian Densmore 26 Oct '04

26 Oct '04

I think you're thinking of Teddy's Rough Riders and the charge up San Juan Hill. He wasn't president then. It was however one of the greatest acts of stu<bs><bs><bs>bravery the current age has seen. > -----Original Message----- > From: Jonathan Hutchins > > Didn't we invade Morocco or something like that?

1 0

RE: spamassassin question [with blacklist question]
by Brian Densmore 26 Oct '04

26 Oct '04

The problem there is it is now configured and working. Installing a new exim and a new SA would mean reconfiguring the software due to changes in syntax, options, etc. In other words installing the current SA over top of SA 2.2 would break a working setup. I'd rather play with the one that is working and learn more about SA first, so that when I upgrade I will have some knowledge of what the heck it is I'm doing. ;') I'm not saying that I feel the current SA or exim is the best thing since sliced bread with peanut butter, honey and marshmallow on it, just that it would mean breaking something I don't yet understand well enough to fix quickly and easily on my own. B. D. (shorter .sig) ;') > -----Original Message----- > From: Jonathan Hutchins > > On Tuesday 26 October 2004 01:33 pm, Brian Densmore wrote: > > > Well SA 2.2 is catching about 155 of my spam. I may add some > > customization to see if I can't improve it a bit. I'll > > wait a bit before upgrading. I'd really like to block it up front. > > I'd go with the upgrades before I worked on customizations. > They've been very > reliable for me. > _______________________________________________

1 0

OT: Dialogic board repair
by Brad 26 Oct '04

26 Oct '04

Does anyone have experience repairing dialogic boards that may have taken a power hit? Thanks, Brad

1 0

Blocking IPs from the FW [was RE: spamassassin question [with blacklist question]]
by Brian Densmore 26 Oct '04

26 Oct '04

By the way, anyone have a take on what kind of performance hit this will take on a server? So far I have 22 addresses or address ranges blocked in my blacklist. And is there a better way? Most of the attempts have been to try to gain root access via ssh, which root isn't allowed to ssh anyway, so this would always fail. Some are for non-existent users. Brian Densmore > -----Original Message----- > From: Brian Densmore > > Well you were right about sed. Not something I could do with sed. > I wound up using awk, and temporarily putting the addresses > in a separate file > until I feel comfortable it won't jack up my firewall. > > #!/bin/sh > > # list of ip address to allow always > MYIP=yyy.yyy.yyy.yyy > MYIP2=xxx.xxx.xxx.xxx > > # name of logfile to scan - need to variablize so I can call > it with an alternate > # logfile and default to this > lfl=/var/log/auth.log > > # ugly all on one line, but it works > cat $lfl | grep -i failed\ password | awk '{ print $11 }' > |uniq | grep -v $MYIP | grep -v $MYIP2 >> /etc/illegalips.txt > > # still to do add commands to extract ips from above file > # and add to actual blacklist and call firewall restart > > > > http://kclug.org/mailman/listinfo/kclug > > > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug >

2 1

RE: spamassassin question [with blacklist question]
by Brian Densmore 26 Oct '04

26 Oct '04

Well SA 2.2 is catching about 155 of my spam. I may add some customization to see if I can't improve it a bit. I'll wait a bit before upgrading. I'd really like to block it up front. > -----Original Message----- > From: D. Joe Anderson [mailto:kclug@etrumeus.com] > Sent: Tuesday, October 26, 2004 12:54 PM > To: KCLUG > Subject: Re: spamassassin question [with blacklist question] > > > On Mon, Oct 25, 2004 at 05:54:17PM -0500, Brian Kelsay wrote: > > Brian, since this is a Debian system, why not use > apt-pinning for Spam > > Assassin to get the version from testing? What does Spam Assassin > > depend on? If it doesn't need the latest and greatest of a > bunch of > > pkgs., then you shouldn't have much problem. e.g. if it depends on > > Python, but doesn't need the latest. > > http://www.agnula.org/download/demudi/apt_pinning/view > > http://jaqque.sbih.org/kplug/apt-pinning.html > > Or, for that matter, if it can use i386 packages, why not > pull a > newer spamassassin out of http://www.backports.org? > > > -- > Joe > > > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug >

2 1

OT RE: long sig (was: PostNuke site cracked)
by Brian Densmore 26 Oct '04

26 Oct '04

Wrong Roosevelt! ;') This is the one responsible for the National Park System. And the Boone & Crockett Club. We had no wars during his presidency, probably everyone was scared sh****** of the guy (just kiddin'). > -----Original Message----- > From: Brian Kelsay > > Brian, I nominate you for Longest .sig. This also works for > one of my theories; Roosevelt was a blow-hard. It's quite > possible that the House and Senate agreed w/ his plans out of > sheer boredom and a fight-flight instinctual response. Lucky > for us that the war finally encouraged investment from the > people in charge of spending real and borrowed money. > <flame-retardant suit on> > > Brian Kelsay > > >>> "Brian Densmore" <> 10/26/04 12:34PM >>> > > "The President is ..... > than about any one else." > > --Theodore Roosevelt, Kansas City Star, May 7, 1918 > >

2 1

RE: spamassassin question [with blacklist question]
by Leonard, Phil 26 Oct '04

26 Oct '04

You might want to add some of the spamassassin rules from here http://www.rulesemporium.com/rules.htm . The RulesDuJour script works very well for me. Philip -----Original Message----- From: kclug-bounces(a)kclug.org [mailto:kclug-bounces@kclug.org]On Behalf Of Brian Densmore Sent: Tuesday, October 26, 2004 1:33 PM To: KCLUG Subject: RE: spamassassin question [with blacklist question] Well SA 2.2 is catching about 155 of my spam. I may add some customization to see if I can't improve it a bit. I'll wait a bit before upgrading. I'd really like to block it up front. > -----Original Message----- > From: D. Joe Anderson [mailto:kclug@etrumeus.com] > Sent: Tuesday, October 26, 2004 12:54 PM > To: KCLUG > Subject: Re: spamassassin question [with blacklist question] > > > On Mon, Oct 25, 2004 at 05:54:17PM -0500, Brian Kelsay wrote: > > Brian, since this is a Debian system, why not use > apt-pinning for Spam > > Assassin to get the version from testing? What does Spam Assassin > > depend on? If it doesn't need the latest and greatest of a > bunch of > > pkgs., then you shouldn't have much problem. e.g. if it depends on > > Python, but doesn't need the latest. > > http://www.agnula.org/download/demudi/apt_pinning/view > > http://jaqque.sbih.org/kplug/apt-pinning.html > > Or, for that matter, if it can use i386 packages, why not > pull a > newer spamassassin out of http://www.backports.org? > > > -- > Joe > > > _______________________________________________ > Kclug mailing list > Kclug(a)kclug.org > http://kclug.org/mailman/listinfo/kclug > _______________________________________________ Kclug mailing list Kclug(a)kclug.org http://kclug.org/mailman/listinfo/kclug

1 0