SYSMGR in the attic

02-May-2012

SYSMGR — Wed, 02 May 2012 19:59:16 +0000

Maintenance
Nothing strange this time.
PMAS statistics for April Total messages : 7208 = 100.0 o/o DNS Blacklisted : 1522 = 21.1 o/o (Files: 30) Relay attempts : 53 = .7 o/o (Files: 26) Accepted by PMAS : 5633 = 78.1 o/o (Files: 30) Handled by explicit rule Rejected : 4831 = 85.7 o/o (processed), 67.0 o/o (all) Accepted : 292 = 5.1 o/o (processed), 4.0 o/o (all) Handled by content Discarded : 82 = 1.4 o/o (processed), 1.1 o/o (all) Quarantained : 246 = 4.3 o/o (processed), 3.4 o/o (all) Delivered : 182 = 3.2 o/o (processed), 2.5 o/o (all)
Apart from this, there have been the usual bogus users that have been removed last month, I’ll clean the wiki cache so I get rid of these disabled accounts.

Now I have the T4-viewer-over-the-web installed (time to clean T4$DATA as well, that contains files from years back - it slows starting up the analyzer since it collects the whole lot….) I found something remarkable. A change, anyway: there used to be some peaks every 20 minutes, and all of a sudden, this was gone. But finding out what that statistic this was, is troublesome with this amount of old files…

24-Apr-2012

SYSMGR — Tue, 24 Apr 2012 07:43:47 +0000

Bogus users - again
Today, I removed about 15 bogus accounts. All residing from domains I’ve seen as spam related elsewhere, and mainly from China:
163.com
21cn.com
yeah.com

and some seem to have a Hotmail acount, but the names simply don’t match.

As a precaution - I don’t want to cleanup the mess every day - I have disabled the creation of accounts, for now.

Spam?
There are still loads of messages that seem to pass the SPAM filter and are next handled by the SMTP settings - at least: it looks that way. If I relate these OPER signals with times in the router logs, these seem to reside from outside the local network - and they are rejected by PMAS. But why do I see them in my OPERATOR.LOG? I’ll ask Process, but I wonder whether I will receive an answer: I have no support….

13-Apr-2012

SYSMGR — Fri, 13 Apr 2012 08:51:15 +0000

Mail bomber blocked?
For weeks, I’ve been receiving - as shown in operator.log - many, many messages that for some reason were accepted by the spam filter but were caught by the SMTP-client itself. They never made it to the inbox. Quite likely they were passed since the enveloppe_from was from within my own domain, but these headers were al forged: they were not sent from my domain:

X-PMAS-MAIL-FROM: backpedaledsupw@siaminet.com Received: from unknown ([188.54.93.212] EXTERNAL) (EHLO device.lan) by diana.INTRA.GROOTERSNET.NL ([192.168.0.200]) (PreciseMail V3.2); Mon, 09 Apr 2012 02:18:37 +0000 Received: from 188.54.93.212 (account HELO grootersnet.nl) by grootersnet.nl (CommuniGate Pro SMTP 5.2.3) with ESMTPA id 712770485 for ; Mon, 9 Apr 2012 05:18:36 +0300 From:

(I don’t use Communigate - I know the product, I even tested it)

X-PMAS-MAIL-FROM: undecipherablex63@realliving.com Received: from HSI-KBW-095-208-015-185.hsi5.kabel-badenwuerttemberg.de ([95.208.15.185] EXTERNAL) (EHLO HSI-KBW-095-208-015-185.hsi5.kabel-badenwuerttemberg.de) by diana.INTRA.GROOTERSNET.NL ([192.168.0.200]) (PreciseMail V3.2); Mon, 09 Apr 2012 11:09:39 +0000 Received: from apache by mdbaensicmbdedm.iztzg.hr with local (Exim 4.67) (envelope-from < >) id MHY1YI-HP2T4L-B6 for ; Mon, 9 Apr 2012 12:09:38 +0100 To:

(I don’t use apache or Exim)

These are just two examples, but the majority have similar signatures..All have been forged!

What caused this flood to stop, all of a sudden? It might be an addtional rule in the filter, rejecteing any text that I found in the messages that were quarantained (I think PMAS did its job in a second pass?)…
Bogus accounts?
I need to shift attention a bit.
Where it was rather usual to find bogus users in the Wiki (and requiring me to de-spam the wiki on a regular (almost daily…) basis, It seems this blog attracts ‘users’. Probably assuming they can abuse the blog, but the default role is ’subscriber’ so they are not able to spoil the blog with ther ‘content’. Though there is a possibility to tyry to abuse the comments - but again, I have taken precautions: there is a spam-test in place and comments need to be approved before publication.
The last additions seem to originate in China, based on names and domains: a few of the latter are well know to me: the PMAS anti-relay feature logs these domains quite often if there are\ large numbers of relay attempts….
To mention that latest I’ve seen:
126.com
163.com
yeah.com
These are not forged: there is a mail check in the program and if an email-address is fake, I’ll be noticed. (I would like MoinMoin to have the same feature…)
I don’t mind subscribers…But these are known to me to be domains accepting abusive Internet users. So I’m quite willing to rule ANY user from these domains off the blog.

03-Apr-2012

SYSMGR — Tue, 03 Apr 2012 18:52:23 +0000

Disk full

Before I was able to check the results of the montly maintenance job yesterday - done remotely this time - I found out the system didn’t respond at all. I could acess the router and that showed me a number of connections on the different ports, but hardly any traffic. I could start a VPN session to the home network, but all I could do was ping. No other access was possible. Would it again be a problem with the quorum disk, that I had some weeks ago - no way to tell….
This evening, it turned out there was nothing worng with the quorum disk, but the DecWindows sessions that I have opened didn’t show up after I switched on the monitor. I would expect the unlock panel top show up, but it was just the background of the window and the system was not responsive at all.
After having started my other node in the cluster, it happily joined the cluster, and there seemed nothing wrong with the disks. Bot any of them. Now I tried to mount the system disk of the main system - but that failed. Not any disk could be mounted….So the systen ran, but was unable to react.
Not even CTRL-P on the console…So the only option was to use the reset button.
Next, I rebooted. The process continues as usual - until, in the end, the main part is started in batch.
Now the real issue was obvious: the queue manager couldn’t start because free space was exhausted.
The procedure ended normally, but again, the system did not respond to teh keyboard, but now I knew what caused the problem.
So I started the system in MIN mode, but once mre, I couldn’t enter the system because it didn’t respond to the keyboard….
The last resort: Start from CD, choose option 8 to do some DCL, Mounted the system disk to find out what caused it. It must have been files created since yesterday after 18:00 system time, so
$ DIR/SIN=yes/SIZE/unit=byte DKB100:[...]
woud show what caused it.
BINGO. Almost immediately.

It turned out to be the backup of the public webs: that contains a load of photographs, the backup is now over 10Gb in size. Pushing that onto e 33Gb disk - well, you can expect trouble.
Removed these files end rebooted - back to normal - solved the problem
Now I’ll have to find a way to backup these files. But I doubt Í really need to, since all files are copied to DVD anyway.
Back to what I would have done yesterday
Maintenance
First of all: mail statistics:
PMAS statistics for March
Total messages : 7950 = 100.0 o/o
DNS Blacklisted : 1191 = 14.9 o/o (Files: 31)
Relay attempts : 28 = .3 o/o (Files: 16)
Accepted by PMAS : 6731 = 84.6 o/o (Files: 31)
Handled by explicit rule
Rejected : 5899 = 87.6 o/o (processed), 74.2 o/o (all)
Accepted : 287 = 4.2 o/o (processed), 3.6 o/o (all)
Handled by content
Discarded : 86 = 1.2 o/o (processed), 1.0 o/o (all)
Quarantained : 415 = 6.1 o/o (processed), 5.2 o/o (all)
Delivered : 44 = .6 o/o (processed), .5 o/o (all)
Quite a number of blacklisted domains (15% of all), these don’t pass the first phase of filtering. But the next large group is the number of rejected messages based on their content: almost 3/4 of all. These are the messages seem the ones that clutter operator.log, because they seem to pass the filter for some reason - where I would expect them to be hidden - something to ask Hunter about. Less tham 1 percent is Ok…. And on relay-attempts: there is only one file exceeding 4 blocks; A bit (it’s just 6 blocks in size): I guess March 19th was the big day in relay attempts.
Cleanup and archiving show no problems at all.

28-Mar-2012

SYSMGR — Thu, 29 Mar 2012 20:01:37 +0000

Minor glitches on startup
There were still a few gltches in accessing the vmswiki, but it was fairly easy so find the cause: A wrong logical diskname for the LD-device holding Python and moinmoin (the wiki software) and a typo in defining moin_static - that I define as a searchlist, so I don’t have to move around with files when installing a new moinmoin version….
After that was settled and repaired, the wiki works like before - a slow starter but once started, pretty fast.
Blogs more responsive
The blogs are more responsive as well, and suffer less partial crashes - so far. More important: I have less trouble logging in into the admin pages. I must have cleaned up quite some things in the attempt of updating and reversing the whole activity.
But now I got the answers on what the heck had happened, I coud give it a try once more. In which case I may decide to upgrade WP as well. That normally is easy, no trouble at all, though I’ll have to prepare a thing or two. But every update went nice and smoothly. But I’ll take Mark’s suggestion: have a look first what changed between 5.2 (supplied by HP and ported by Mark Berryman - which is the current version I’m using curently) and 5.3 (as ported by Mark Berryman). Anyway I’ll have to use the version op PHPWASD that comes with this kit…

27-Mar-2012

SYSMGR — Tue, 27 Mar 2012 17:55:08 +0000

Power loss
Shortly after 17:44 local time (the system is set to UTC, no DST, so in nreal time, it’s two hours later) power was llost. The system didn’t restart automaticly since the HSX50 was - once again - too slow. So I had to reboot by hand. By luck, the startup of the web-based stuff didn’t mention the new PHP confuguration so all blogs started as usual.

Speaking the PHP: I got the answers I was looking for. When I use Mark Berryman’s PHP port, I am to use the PHPWASD file he supplies with the kit because Mark Daniel’s PHPWASD kit is not compatible with PHP 5.3, that needs to be called in a different way. Also, some mpdules are built=in where HP delivers them as separate modules.
And I have to do something with PHHP.INI to get the current version of WP running….

So I have to do it again. Perhaps it’s time to upgrade WP as well. meaning I have to do some serious reading. BEFORE the update…

26-Mar-2012

SYSMGR — Mon, 26 Mar 2012 19:55:50 +0000

PHP update reversed

It looked right but in short term it turned out the update had severe flaws…As I found out soon after the update, there is big trouble on this update. It comes with a new version of PHPWASD.EXE thnat complains about the NEW function that seems to be deprecated (is it a procedure noewadays?) and a missing module….Building the PHPWASD version 1.4.3 is even more troublesome. It crashed on an Access violation….

WIth some trouble I returned to the previous version…

25-Mar-2012

SYSMGR — Sun, 25 Mar 2012 14:46:45 +0000

PHP updated
Taking the big plunge: updated PHP on Diana. Using Mark Berryman’s 5.3 port and WASDPHP 1.4.3, I did an update ‘on the fly’ - fingers crossed. This time, I followed the description to the letter.
You may have noticed.
It’s faster (it seems so anyway) and looks more stable; looking at Wordpress anyway. And as the site administartor and maintainer: I got rid of the nasty login-failures.

Does it mean that I can - finally - update Wordpress as well? the new setup works on the testbed…But I never tried it with locat MySQL on that box…Well, I’ll have to do the update there as well.

08-Mar-2012

SYSMGR — Thu, 08 Mar 2012 21:03:18 +0000

Mail problem solved
Weird: I changed ISP quite a few months ago, and I used their SMTP-server ever since, without a problem - until last weekend:Their server refused relaying…Their suggetsion: use the smtp server at you new ISP. Duh. I could have guessed - but I’ve asked for a postbox, and seems to have never used it…And I had just one receipt for domain registration and DNS; where I would expect more….
That’s administrative, still to be handled, with some other things. But I chnaged the alternate gateway to the current ISP’s server, restarted SMTP and now mail works again.

07-Mar-2012

SYSMGR — Wed, 07 Mar 2012 21:41:34 +0000

Monthly maintenance
The automated maintenancejob runs like a charm, each month. Just a pity it doesn’t mail the PMAS statistics yet, I need to get to the log file to get them…
PMAS statistics for February Total messages : 9891 = 100.0 o/o DNS Blacklisted : 1405 = 14.2 o/o (Files: 29) Relay attempts : 2468 = 24.9 o/o (Files: 29) Accepted by PMAS : 6018 = 60.8 o/o (Files: 29) Handled by explicit rule Rejected : 5448 = 90.5 o/o (processed), 55.0 o/o (all) Accepted : 226 = 3.7 o/o (processed), 2.2 o/o (all) Handled by content Discarded : 95 = 1.5 o/o (processed), .9 o/o (all) Quarantained : 230 = 3.8 o/o (processed), 2.3 o/o (all) Delivered : 19 = .3 o/o (processed), .1 o/o (all)
over 90% rejected by explicit rule. These come from different sources, so blocking the addresses is troublesome…And since a few months already, the logfiles are cluttered with messages that are come in - and are rejected on second thought….Though I added a rule to prevent them to arrive anyway, a slight change causes them to penetrate. So that means adding yet another rule - and another one…
We’ll see where it ends.
Mail problems
On 29-Feb-2012, in the afternoon, it suddenly became impossible to send mail to other domains, like gmail, or my employer vxcompany.com. The domains were no longer recognized by the mailserver, for some reason. In trying to figure out what the heck was going on, I decided to check using TCPIP$CONFIG, in the SMTP and BIND configuration but couldn’t find anything. DIG didn’t find these domains either so it must have been a DNS issue; but the weird part is that the web worked fine….
I won’t rule it out that it was caused by the update of the router firmware, but days after that update? That doesn’t make sense…
Anyway, I made a stupid mistake and shut down TCPIP allthogether, and before I could stop it, the connection was gone, and I had to wait another day to get it straight on the next Thursday evening….
That wasn’t as straight as I would expect:
$ @sys$startup:tcpip$startup
didn’t show an error but most services weren’t started, and most had to be started separately. But in the end, all services were up and running again.
Mail now worked fine for a few days.
On 06-Mar-2012, out of the blue, is was impossible to send messages, all mail bounces:

---- Transcript of session follows ----


550 5.7.1 >recepient on the internet<... relaying denied for 85.223.43.24
---- Recipients of this delivery ----
>recepient on the Internet< (bounced)
---- Unsent message follows ----

Return-Path: Willem@grootersnet.nl Received: from LOCALHOST (127.0.0.1) by diana.intra.grootersnet.nl (V5.6-ECO5, OpenVMS V8.3 Alpha); Tue, 6 Mar 2012 19:16:20 +0000 (UTC) Received: from SOYMAIL (24-43-223.ftth.xms.internl.net [85.223.43.24]) by diana.INTRA.GROOTERSNET.NL (SOYMAIL AXP-1.5.2) with HTTP; Tue, 06 Mar 2012 19:16:18 +0000 Message-ID: <85.223.43.24.49493.00abdf56125f2bce.soymail@diana.INTRA.GROOTERSNET.NL> Date: Tue, 06 Mar 2012 20:16:22 +0100 Subject: >subject< From: Willem Grooters >my address:)< To: >recepient on the internet< …
What I don’t like is the line:

Received: from SOYMAIL (24-43-223.ftth.xms.internl.net [85.223.43.24])

where I would expect at least a domain name…
So I checked:

$ dig grootersnet.nl


; < <>> DiG 9.3.1 < <>> grootersnet.nl

;; global options:  printcmd

;; Got answer:

;; ->>HEADER< <- opcode: QUERY, status: NOERROR, id: 18457

;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:

;grootersnet.nl.                        IN      A
;; AUTHORITY SECTION:

grootersnet.nl.         3600    IN      SOA     auth10.dns.internl.net. hostmaster.internl.net. 2011101801 28800 7200 604800 3600
;; Query time: 2623 msec

;; SERVER: 127.0.0.1#53(127.0.0.1)

;; WHEN: Wed Mar  7 21:36:28 2012

;; MSG SIZE  rcvd: 101

$

NO ANSWER????
No wonder mail doesn’t accept relay from grootersnet.nl - as it is expected to do, and has done for years… The lucky pafrt is that all my webs work and incoming mail arrives without a problem….
So I contacted my previous ISP - who is my registrar - to get an answer on what happened, why the registration has vanished - and why my mailbox is gone. It shouldn’t have - since I’m still a customer.
Python updated - continued
The pervious post mentioned a problem with the Wiki forms, where I thought it was a matter of browser. There might be some browser-based issues, but I found the CSS-files weren’t loaded bcause the structure of the MoinMoin wiki software has undergone a change, rendering the setting of moin_static to be false - incomplete at least:

$ sho log moin_static/full "MOIN_STATIC" [super] = “$1$LDA11:[MOIN193.share.moin.htdocs.]” [concealed] (LNM$SYSTEM_TABLE) = “WEB_DISK2:[WIKI.wikivms.mywiki.]/t=c” $

The page code for the wiki starting page shows (one of four):
>link rel="stylesheet" type="text/css" charset="utf-8" media="all" href="/moin_static/modern/css/common.css"<
but the css-files are now stored on another location, becasue they arer no longer located on this location:
$ dir $1$LDA11:[MOIN193.share.moin.htdocs...]*.css %DIRECT-E-OPENIN, error opening $1$LDA11:[MOIN193.SHARE.MOIN.HTDOCS...]*.CSS;* as input -RMS-E-DNF, directory not found -SYSTEM-W-NOSUCHFILE, no such file $
It took some searching but I found them in another location:
Directory $1$LDA11:[Moin193.MoinMoin.web.static.htdocs.classic.css]


common.css;1        msie.css;1          print.css;1         projection.css;1

screen.css;1
Total of 5 files.
Directory $1$LDA11:[Moin193.MoinMoin.web.static.htdocs.modern.css]
common.css;1        msie.css;1          print.css;1         projection.css;1

screen.css;1

Total of 5 files.
based on the template: classic, modern, mdernized, rightsidebar and solenoid. NO MORE technical, and that’s the one I had set up for myself…
So after changing moin_static to be:
$ sho log moin_static/full "MOIN_STATIC" [super] = “$1$LDA11:[MOIN193.share.moin.htdocs.]” [concealed] (LNM$SYSTEM_TABLE) = “$1$LDA11:[MOIN193.moinmoin.web.static.htdocs.]” [concealed] = “WEB_DISK2:[WIKI.wikivms.mywiki.]/t=c”
(just to be save, added this new location ..) it all worked, but since the ‘tecnical’ template has disappeared, I had to use another one.