- Roundtable - muug.ca

weird apache hit
by Trevor Cordes 24 Feb '20

24 Feb '20

I have a mystery hit on my apache server that is giving weird results that by config should never happen... and I can't figure it out. What's happening is very rarely a hit will "break out" of the dirs that I think all hits should be limited to. And I can't reproduce it with telnet tests. Somehow a hit is getting access to /var/www/html/ when that should be impossible. Yes, it's my document root in the global area, but immediately in my virtualhost for that IP and port I redefine docroot to a sub dir of that. There should be no way someone can hit the site and get to the original docroot. Yes, I am probably going to change the default global docroot to just be the same as my subdir one in the virthost, but I really want to figure out why the request can break out the way it is. The only thing weird about the hit, based on my customized logging details, is that they are hitting a ServerAlias of the virthost, which is a bit odd because that particular alias isn't public knowledge (though it's not really hidden either). Oh ya, and the IP is in HK and is trying fuzzing attacks again me. Here's the hit (IPs/hostnames changed): 1.2.3.4 - - [17/Feb/2020:02:40:07 -0600] "GET / HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" 80 9-w1.foo.com /var/www/html/ Note port 80, note the serveralias they hit us with, note the resulting directory /var/www/html Here's the error it generates: [Mon Feb 17 14:43:13.444291 2020] [autoindex:error] [pid 16365:tid 140334311606016] [client 2.3.4.5:54603] AH01276: Cannot serve directory /var/www/html/: No matching DirectoryIndex (index.phtml,index.html,index.phtml,index.php) found, and server-generated directory index forbidden by Options directive It's ok it's forbidden (in fact, might have saved my bacon) as I have dirindex forbidden globally. The thing is no hit should ever be trying to find a index.html in /var/www/html! When I try to recreate the hit to match the above manually with telnet, no matter what I do I can't get the serveralias to match their hit: telnet foo.com GET / HTTP/1.1 Host: 9-w1.foo.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 Gives me a log result which matches what I expect the correct behaviour to be: 50.71.247.87 - - [17/Feb/2020:15:48:21 -0600] "GET / HTTP/1.1" 302 136 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" 80 www.foo.com proxy:fcgi://localhost/var/www/html/Foo/Live/index.phtml What on earth are the other parameters or headers they are passing in that results in a different result than my test? I'm truly stumped. I could try to capture packets of a hit, but the "attacks" only happen 2-3 times a day and always from different IPs in Asia.

6 12

Bitcoin talk from the Long Con
by athompso＠athompso.net 13 Feb '20

13 Feb '20

2 1

Shaw blocking port 25 on business line
by Gerald Brandt 11 Feb '20

11 Feb '20

Hi, I've been fighting with Shaw for days on this. I have what they call a business account with 8 static IPs. I can telnet mail.shaw.ca 25 and get a connection. So, inside their network, SMTP works. If I try to telnet to any other server on port 25, i get no connection. e.g. telnet to google email servers fails, telnet to my server in Montreal fails.). To test that port 25 was open, they had me start Firefox, login to gmail, and send an email from my gmail to my gmail account. that was proof they weren't blocking port 25... Yeah. Right now, in order to get email out, i am using mail.shaw.ca as a relay. That is not supported, so they are asking me to not do that. I told them if I don't use them as a replay, i can't get email out. They did not understand. Does anyone have any idea how to get these guys to understand what is going on? Am i using the wrong terminology? I can't see how I can make it any clearer to them that they are blocking port 25 access to any system outside of their network. Gerald

7 19

Seeking rides to MUUG meetings to/from East Kildonan
by Hartmut W Sager 10 Feb '20

10 Feb '20

Hi folks. I am seeking rides to MUUG meetings to/from East Kildonan during the cold season. I live at the corner of Watt & Munroe. Can anyone help? I've been a MUUG member since 1988, but over the decades, I have had ever increasing difficulties operating in our cold climate, so I've had to miss most MUUG meetings for a number of years now. For this coming meeting on 11 Feb 2020, I would only need a ride back home after the meeting, since I have an appointment downtown (and very nearby the UofW) in the late afternoon and will be staying in the area right through to the MUUG meeting. Oh, I do need a smoke-free air during such rides (I'm quite allergic to smoke). Thanks! Hartmut W Sager - Tel +1-204-339-8331

2 1

MUUG Meeting, Feb 11, 7:30pm -- Performance Tuning the MUUG Server, Bare-Minimum Samba
by Gilbert E. Detillieux 04 Feb '20

04 Feb '20

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting on Tuesday, February 11. The meeting topic for this month is as follows: Performance Tuning the MUUG Server Adam Thompson will talk about the recent Debian updates to the MUUG server that triggered a wave of unexpected upgrades and performance tweaks. pecial attention will be paid to the ZFS filesystem and Apache-to-Nginx conversion. Other collaborators will be introduced and their roles in this work described. Daemon-Dash: Bare-Minimum Samba Kevin McGregor will show you how to setup Samba file sharing in 5 minutes: for when you need files shared in a hurry and don't care about much else. The group holds its meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. ******************************************************************* Please note our meeting location for this month: *Room 1M28* Manitoba Hall, University of Winnipeg, entrance on Ellice Ave. between Spence and Balmoral St. Parking is available on the surrounding streets and in the lots on nearby streets. Look for signage once you're at the building, or ask a security guard. ******************************************************************* For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board: https://muug.ca/meetings/MUUGmeeting.pdf -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.ca> c/o Gilbert E. Detillieux Web: http://muug.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0

PostgreSQL vs MariaDB
by Alberto Abrao 04 Feb '20

04 Feb '20

I am in the process of rebuilding my Nextcloud setup. My current one uses MariaDB, which is the recommended one by NextCloud. I had a few issues that needed database repair since then, but other than that it works fine. That said, as I am going to do it all from scratch - my aim is to set it up integrated with e-mail - I was wondering if I should use PostgreSQL instead. I know nothing at all about databases, so I was wondering if one - or many - of our wise fellows here could chime in and give an informed opinion on the matter. Thanks! -- Kind regards, Alberto Abrao 204-202-1778 204-558-6886

4 4

Re: [RndTbl] Shaw blocking port 25 on business line (Gerald Brandt)
by Vijay Sankar 23 Jan '20

23 Jan '20

Hi, Tried to simulate your situation on one of our Shaw Cable modems. FWIW, it looks to me like your firewall is probably using a DHCP address instead of the static address you may have configured. Here is what I did and why I think you possibly could be using a DHCP address even though you are paying for static addresses. Hope the following is helpful. nps2245.foretell.ca# ifconfig em2 em2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500 lladdr ob:fu:sc:at:ed:00 index 3 priority 0 llprio 3 groups: egress media: Ethernet autoselect (1000baseT full- duplex,rxpause,txpause) status: active inet 184.71.76.158 netmask 0xfffffffc broadcast 184.71.76.159 nps2245.foretell.ca# telnet gmail-smtp-in.l.google.com 25 Trying 173.194.197.26... Connected to gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP j12si2239041iok.52 - gsmtp quit 221 2.0.0 closing connection j12si2239041iok.52 - gsmtp Connection closed by foreign host. nps2245.foretell.ca# dhclient em2 em2: 24.78.147.49 lease accepted from 24.78.144.1 (00:01:5c:88:aa:46) nps2245.foretell.ca# telnet gmail-smtp-in.l.google.com 25 ^C SMTP does not work as you experienced, once I used a DHCP address.reported So set the interface back to the static address nps2245.foretell.ca# sh /etc/netstart nps2245.foretell.ca# ifconfig em2 em2: flags=808843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,AUTOCONF4> mtu 1500 lladdr ob:fu:sc:at:ed:00 index 3 priority 0 llprio 3 groups: egress media: Ethernet autoselect (1000baseT full- duplex,rxpause,txpause) status: active inet 184.71.76.158 netmask 0xfffffffc broadcast 184.71.76.159 nps2245.foretell.ca# telnet gmail-smtp-in.l.google.com 25 Trying 74.125.142.27... Connected to gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP g30si2236902pfr.206 - gsmtp quit 221 2.0.0 closing connection g30si2236902pfr.206 - gsmtp Connection closed by foreign host. SMTP port accessible once the interface goes back to using static addresses. Quoting roundtable-request(a)muug.ca: > Send Roundtable mailing list submissions to > roundtable(a)muug.ca > > To subscribe or unsubscribe via the World Wide Web, visit > https://muug.ca/mailman/listinfo/roundtable > or, via email, send a message with subject or body 'help' to > roundtable-request(a)muug.ca > > You can reach the person managing the list at > roundtable-owner(a)muug.ca > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Roundtable digest..." > > > Today's Topics: > > 1. Re: Shaw blocking port 25 on business line (Trevor Cordes) > 2. Re: Shaw blocking port 25 on business line (Gerald Brandt) > 3. Re: Shaw blocking port 25 on business line ( > athompso(a)athompso.net) > > > ------------------------------------------------------------------- > --- > > Message: 1 > Date: Thu, 23 Jan 2020 03:42:30 -0600 > From: Trevor Cordes <trevor(a)tecnopolis.ca> > To: Gerald Brandt <gbr(a)majentis.com> > Cc: Continuation of Round Table discussion <roundtable(a)muug.ca> > Subject: Re: [RndTbl] Shaw blocking port 25 on business line > Message-ID: <20200123034230.2af68ad8(a)pog.tecnopolis.ca> > Content-Type: text/plain; charset=US-ASCII > > On 2020-01-21 Gerald Brandt wrote: > > Hi, > > > > I've been fighting with Shaw for days on this. I have what they > > call > > a business account with 8 static IPs. > > > > I can telnet mail.shaw.ca 25 and get a connection. So, inside their > > network, SMTP works. > > > > If I try to telnet to any other server on port 25, i get no > > connection. e.g. telnet to google email servers fails, telnet to my > > server in Montreal fails.). > > There is no reason your business account should have port 25 blocked, > in either direction. If they have done that to you, complain and get > them to fix it. If they gave you a static range, make sure you are > using it and not grabbing one of their residential DHCP addresses by > accident. > > Also, the business side has some smart people working there, so > there's > no reason you shouldn't be able to get it resolved by people who > understand your language. > > I just checked and my customers on Shaw business have port 25 > outgoing > unblocked. > > > ------------------------------ > > Message: 2 > Date: Thu, 23 Jan 2020 07:49:28 -0600 > From: Gerald Brandt <gbr(a)majentis.com> > To: Trevor Cordes <trevor(a)tecnopolis.ca> > Cc: Continuation of Round Table discussion <roundtable(a)muug.ca> > Subject: Re: [RndTbl] Shaw blocking port 25 on business line > Message-ID: <11A03F6F-111F-4DA9-8A91-529665360579(a)majentis.com> > Content-Type: text/plain; charset="utf-8" > > > > On January 23, 2020 3:42:30 a.m. CST, Trevor Cordes > <trevor(a)tecnopolis.ca> wrote: > > On 2020-01-21 Gerald Brandt wrote: > > > Hi, > > > > > > I've been fighting with Shaw for days on this. I have what they > > > call > > > a business account with 8 static IPs. > > > > > > I can telnet mail.shaw.ca 25 and get a connection. So, inside > > > their > > > network, SMTP works. > > > > > > If I try to telnet to any other server on port 25, i get no > > > connection. e.g. telnet to google email servers fails, telnet to > > > my > > > server in Montreal fails.). > > > > There is no reason your business account should have port 25 > > blocked, > > in either direction. If they have done that to you, complain and > > get > > them to fix it. If they gave you a static range, make sure you are > > using it and not grabbing one of their residential DHCP addresses > > by > > accident. > > > > Also, the business side has some smart people working there, so > > there's > > no reason you shouldn't be able to get it resolved by people who > > understand your language. > > > > I just checked and my customers on Shaw business have port 25 > > outgoing > > unblocked. > > I agree with everything you said, except the smart people comment. > If you tell me to login to my gmail account via web, and send and > email to myself (from gmail to gmail) and use the successful > delivery of the email as proof of port 25 being open, you have no > idea what you're talking about. > > Guaranteed not using a DHCP address. Incoming port 25 works, > outgoing fails to leave their network. > > The first person I talked to thought the 24.x.x x addresses they > gave me placed me in India. WTF? > > Seven days, and this issue is still not resolved. > > Gerald > > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. >

1 0

muug.ca server and paypal updates
by Trevor Cordes 21 Jan '20

21 Jan '20

As many of you may know, we've been having problems with the muug.ca mirror server for a couple of months. We've been working hard to get it working (mostly Adam!) at a reasonable level, and we're getting close. It's probably at the stage people can use it as their mirror again and performance should be reasonable. It should get better as we keep tweaking it. A new big NVMe ZFS cache is really helping to ameliorate our biggest bottlenecks. We've also upgraded the OS and this required a newer PHP version. Due to certain libraries being unsupported in the new PHP, some code had to be rewritten and as a result the paypal MUUG renewal links sent out via email prior to today will no longer function. If you are up for renewal, you will receive another email in a few weeks with a new renewal link which will work correctly. If you want to renew with paypal before that time, feel free to email board(a)muug.ca and we can manually email you a link right away. Also, some bugs may remain after our big PHP change, so if you see any errors or even warnings, please email board(a)muug.ca so we can fix them right away! Thanks!

1 0

MUUG Meeting, Jan 14, 7:30pm -- Running Linux as a Windows App
by Gilbert E. Detillieux 07 Jan '20

07 Jan '20

The Manitoba UNIX User Group (MUUG) will be holding its next monthly meeting on Tuesday, January 14. The meeting topic for this month is as follows: Running Linux as a Windows App Windows Subsystem for Linux (WSL) allows the installation of any of several different Linux distributions. They all utilize the Windows kernel. In this talk we discuss the good (really easy to get started) and the bad (where did X go?) with an emphasis on several demonstrations of the software capabilities. Michael Doob will be presenting. The group holds its meetings at 7:30pm on the second Tuesday of every month from September to June. (There are no meetings in July and August.) Meetings are open to the general public; you don't have to be a MUUG member to attend. ******************************************************************* Please note our meeting location for this month: *Room 1M28* Manitoba Hall, University of Winnipeg, entrance on Ellice Ave. between Spence and Balmoral St. Parking is available on the surrounding streets and in the lots on nearby streets. Look for signage once you're at the building, or ask a security guard. ******************************************************************* For more information about MUUG, and its monthly meetings, check out their web server: https://muug.ca/ Help us promote this month's meeting, by putting this poster up on your workplace bulletin board or other suitable public message board: https://muug.ca/meetings/MUUGmeeting.pdf -- Manitoba UNIX User Group E-mail: <gedetil(a)muug.ca> c/o Gilbert E. Detillieux Web: http://muug.ca/ University of Manitoba Phone: (204)474-8161 Winnipeg MB CANADA R3T 2N2 Fax: (204)474-7609

1 0

Wrong time of night for doing regex?
by Hartmut W Sager 06 Jan '20

06 Jan '20

This might be the wrong time of night for doing regex (i.e., my mistake), or my trusty Vedit text editor has a bug in its regex implementation. Original search string: ^(From AncientBBS[1-2])\s+(Sun|Mon|Tue|Wed|Thu|Fri|Sat)[\s\,]+(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+([0-9][0-9]|\s[0-9])[\s\,]+(19[0-9][0-9])[\s\,]+([0-9][0-9]\:[0-9][0-9]\:[0-9][0-9])\s*$ Replacement string: <Nah, skip it> The above search string gives a syntax error. I am a bit suspicious of the ([0-9][0-9]|\s[0-9]) group re operator precedence of the "or", and proceeded to stepwise simplification to narrow it down. I finally got down to: Search string: (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+([0-9])[\s\,]+ Replacement string: \1\s0\2\s The new search works fine (as did some of the previous stepwise simplified ones), but the replacements are baffling me. The line >From AncientBBS1 Thu Jan 2, 1986 20:50:00 gets changed to >From AncientBBS1 Thu 02 1986 20:50:00 I.e., the variable \1 seems to get lost. In my previous stepwise simplified cases, multiple variables got lost when the search worked at all. Why am I doing this? I need to massage some old BBS messages into the retarded mbox format, whose date format (on the "From " line) of "Tue Nov 05 19:02:00 1985" is particularly illogical. Be that as it may, The two sources of these messages I am processing had further sloppiness in their dates, done by some ancient BBS bozos. I did successfully fix a lot of that already with regex. Hartmut W Sager - Tel +1-204-339-8331

4 9