technology, networking, virtualization and IP telephony
I’ve just recently been playing around with KVM on a HP DL360 running CentOS 6.2 x64. I had a very difficult time finding the VirtIO paravirtualized drivers for Windows in a virtual floppy format (vfd). I was looking for the vfd format so I could easily install the drivers in a Windows XP guest I was building and testing.
I’m going to post a link here to the file, not quite sure why it was pulled from RedHat’s site.
virtio-win-1.1.16.vfd (MD5SUM: 7437f5d81fc43e8da3be01802fa4e9fb)
Cheers!
I’m continually amazed by how much hands on effort it takes to run even a small blog or community these days. The SPAM bots are continually spewing their useless garbage everywhere, the hackers and script kiddies are continually trying to break down the front door and somewhere in there is the appreciative reader in search of an answer to his/her question or just genuinely interested in the topic at hand.
Every now and then a genuine (system administration) issue or problem surfaces that deserves some time and effort. Since I’m utilizing a virtual private server (VPS) running CentOS 5.5, I’m responsible for administering and managing the server myself. I was an IBM AIX (long live SMIT) and Solaris System Administrator in a previous life so it’s not a big challenge but it can be a time consuming task. The benefits of managing my own server are still significant enough for me and I’ve learned so much about Linux, MySQL, PHP, Perl, etc. that the experience has been well worth the investment in my view.
I recently noticed that I was getting a lot of bounced email messages on the server from a number of readers that had subscribed to posts on my blog. Here’s a quick snippet of the bounced error message;
Action: failed
Status: 5.1.7
Remote-MTA: dns; mx.acme.org
Diagnostic-Code: smtp; 550 5.1.7 ... We
systematically reject 'apache@...'It seems that a few domains (example above is acme.org – changed to protect identity) were rejecting any email message with the Return-Path set to apache@hostname. In my case the Return-Path was set to apache@michaelfmcnamara.com although the From address was set to noreply@michaelfmcnamara.com. Unfortunately you can’t set (not to my knowledge anyway) the Return-Path from within WordPress administration portal. You need to manually edit wp-includes/class-phpmailer.php and set the variable $Sender to the same email address you setup within WordPress to use as your From address.
/** * Sets the Sender email (Return-Path) of the message. If not empty, * will be sent via -f to sendmail or as 'MAIL FROM' in smtp mode. * @var string */ var $Sender = 'noreply@michaelfmcnamara.com';
With that change complete I can see from the server logs (/var/log/maillog) that the Return-Path is now being properly set.
Feb 12 08:29:56 michaelfmcnamara postfix/pickup[9770]: 2B8FD2C3BB: uid=48 from=<noreply@michaelfmcnamara.com>
Feb 12 08:29:56 michaelfmcnamara postfix/cleanup[11068]: 2B8FD2C3BB: message-id=<67fa95dc7fd22d7c6cfd481d506bfd87@blog.michaelfmcnamara.com>
Feb 12 08:29:56 michaelfmcnamara postfix/qmgr[2647]: 2B8FD2C3BB: from=<noreply@michaelfmcnamara.com>, size=1729, nrcpt=1 (queue active)
Feb 12 08:29:56 michaelfmcnamara postfix/local[11070]: 2B8FD2C3BB: to=<whowhatwhen@michaelfmcnamara.com>, relay=local, delay=0.07, delays=0.04/0.01/0/0.02, dsn=2.0.0, status=sent (forwarded as 321C72C37A)
Feb 12 08:29:56 michaelfmcnamara postfix/qmgr[2647]: 2B8FD2C3BB: removedWith that change those domains that were rejecting email from my server are now accepting them again. Just another day where I’ve learned something new.
Cheers!
Update: Thursday February 24, 2011
It seems the upgrade to WordPress 3.1 has overwritten the change I made in the file… had to update the file again!
Update: Friday April 22, 2011
It seems the upgrade to WordPress 3.1.1 has overwritten the change I made in the file again!
I came across an interesting problem recently with the CentOS Linux server I use to host this blog. I encountered a problem when upgrading from CentOS 5.4 to 5.5. I had performed this upgrade on a fair number of physical servers without issue but this was the first time I was upgrading a XEN based VPS running CentOS.
Every package upgraded without an issue expect for rpm itself which error-ed out as detailed below;
[root@michaelfmcnamara sysconfig]# yum update rpm Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * addons: yum.singlehop.com * base: yum.singlehop.com * extras: mirror.raystedman.net * updates: mirror.skiplink.com Setting up Update Process Resolving Dependencies --> Running transaction check ---> Package rpm.i386 0:4.4.2.3-18.el5 set to be updated --> Finished Dependency Resolution Dependencies Resolved ====================================================================================================================== Package Arch Version Repository Size ====================================================================================================================== Updating: rpm i386 4.4.2.3-18.el5 base 1.2 M Transaction Summary ====================================================================================================================== Install 0 Package(s) Upgrade 1 Package(s) Total download size: 1.2 M Is this ok [y/N]: y Downloading Packages: rpm-4.4.2.3-18.el5.i386.rpm | 1.2 MB 00:00 Running rpm_check_debug Running Transaction Test Finished Transaction Test Transaction Test Succeeded Running Transaction Updating :rpm 1/2 Error unpacking rpm package rpm-4.4.2.3-18.el5.i386 error: unpacking of archive failed on file /etc/cron.daily/rpm: cpio: rename Failed: rpm.i386 0:4.4.2.3-18.el5 Complete!
So what was wrong with /etc/cron.daily/rpm that the package was failing to install.
Wouldn’t you know that the immutable attribute had been set on the file?
[root@michaelfmcnamara ~]# lsattr /etc/cron.daily/rpm ----i-------- /etc/cron.daily/rpm
Let’s remove that attribute;
root@michaelfmcnamara ~]# chattr -i /etc/cron.daily/rpm
With that fixed let’s try running that update again;
[root@michaelfmcnamara cron.daily]# yum update rpm Loaded plugins: fastestmirror Determining fastest mirrors * addons: yum.singlehop.com * base: yum.singlehop.com * extras: mirror.raystedman.net * updates: mirrors.netdna.com Setting up Update Process Resolving Dependencies --> Running transaction check ---> Package rpm.i386 0:4.4.2.3-18.el5 set to be updated --> Finished Dependency Resolution Dependencies Resolved ====================================================================================================================== Package Arch Version Repository Size ====================================================================================================================== Updating: rpm i386 4.4.2.3-18.el5 base 1.2 M Transaction Summary ====================================================================================================================== Install 0 Package(s) Upgrade 1 Package(s) Total download size: 1.2 M Is this ok [y/N]: y Downloading Packages: rpm-4.4.2.3-18.el5.i386.rpm | 1.2 MB 00:00 Running rpm_check_debug Running Transaction Test Finished Transaction Test Transaction Test Succeeded Running Transaction Updating : rpm 1/2 Cleanup : rpm 2/2 Updated: rpm.i386 0:4.4.2.3-18.el5 Complete!
Success!
Last week there was a flurry of information revolving around a new security flaw in the Domain Name System — software that acts as the central nervous system for the entire Internet.
On Tuesday July 10, 2008 a number of vendors including Microsoft, Cisco, Juniper and RedHat released patches and/or acknowledged the flaw existed. The Internet Software Consortium, the group responsible for development of the popular Berkeley Internet Domain Named (BIND) server from which nearly all DNS offshoots are based, also acknowledged the flaw and released a patch.
I personally spent about 90 minutes on last Wednesday updating several internal and external systems including numerous CentOS v5.2 servers and Windows 2003 Service Pack 2 servers. I was unable to find any mention of the DNS flaw on the Alcatel-Lucent website so I’ll probably need to place a call concerning Alcaltel-Lucent’s VitalQIP product.
I used yum to patch the CentOS Linux servers [“yum update”] and then just restarted the named process [“service named restart”]. On the Windows 2003 Service Pack 2 servers I used Windows Update to download and install KB941672 after which I rebooted the servers.
Here are some references:
http://www.theregister.co.uk/2008/07/09/dns_fix_alliance/
http://www.networkworld.com/news/2008/071008-patch-domain-name-servers-now.html
http://www.networkworld.com/news/2008/070808-dns-flaw-disrupts-internet.html
http://www.networkworld.com/podcasts/newsmaker/2008/071108nmw-dns.html
http://www.us-cert.gov/cas/techalerts/TA08-190B.html
http://www.microsoft.com/technet/security/bulletin/MS07-062.mspx
I would strongly suggest that all network administrators start looking into patching their DNS servers as soon as possible.
Cheers!
UPDATE: July 14, 2008
Here’s an update from RedHat concerning the configuration (named.conf) of BIND;
We have updated the Enterprise Linux 5 packages in this advisory. The default and sample caching-nameserver configuration files have been updated so that they do not specify a fixed query-source port. Administrators wishing to take advantage of randomized UDP source ports should check their configuration file to ensure they have not specified fixed query-source ports.
It seems that a check of the configuration file would be in order. Let me throw in a quick warning though if your DNS server is sitting behind a firewall you may need to check with the firewall administrator to understand how the firewall will behave if you randomize your source ports. I believe there are quite a few firewalls out there that only expect to see DNS traffic sourced from a DNS server on UDP/53.
Good Luck!
The folks over at CentOS released v5.2 on Tuesday June 24, 2008. I’ve been running six different HP Proliant DL360s over the past 24 months acting as a public WiFi Hotspot portal servers. The solution has been met all my expectations and almost manages itself entirely (I still need to apply patches and security updates). CentOS 5.2 adds the same functionality that RHEL 5.2 adds including the latest virtualization support. If you’re looking for a Linux distribution for that brand new server hardware and you don’t have the budget to afford RedHat then CentOS is for you. CentOS is essentially a clone of RedHat Enterprise Linux compiled from the RHEL source files provided under GPL licensing terms. If you’re looking for a Linux distribution to run on that brand new laptop/desktop then I don’t think CentOS if for you. I would probably suggest Ubuntu as a solution for any laptop/desktop.
Just visit the current Mirrors list to start downloading today.
Note: Just be warned that if your running CentOS v5.0 or v5.1 you will be upgraded to CentOS v5.2 if you issue a “yum update“. I believe the release notes indicate you need to issue a “yum upgrade” in order to upgrade but that wasn’t my experience.
Cheers!