29-Nov-2007

Additional software?
Just considering some extra’s, depending on the load they put on Diana.
CIFS (AKA Samba) FT 3.0 is just out. I have to consult the installation guides to see what the requirements are, it might be useful to install it. I just hope it takes less resources than Advanced Server. If so, it might be a nice addition – for testing at least. I have downloaded it, just in case.
ClaMav must be checked as well, to protect the innocent (or stupid ;)) it could be a nice addition to PC security. Not that it’s really needed, because most junk is blocked by PMAS for several reasons – being originated from a black-listed domain, mostly.
Logging and access
I found an older version of TCPIP$FTP_RUN.LOG with a higher version number than is current based on date. No wonder I couldn’t see anything. This file has been deleted so now I can see who’s trying to force his way in.
I changed a number of passwords, just in case, because I’ve seen suspicious traffic in the weblog: attempting to login into the admin pages of the blog. No harm done, I guess it all failed. Weird: it’s the main server log that showed it, because PHPhad an error – again.

25-Nov-2007

New version of webmail
Mark Daniel has sent a mail that a new version of the web mail-program SoyMail is available – some minor enhancements and minimal bug fixes (it is a good program so no need for these :)) so I downloaded and installed it. Within a few minutes, BUILD and INSTALL were successful, so I now run Soymail 1.4.0
For the rest, there is nothing more to tell. As far as i can tell, all is fine now.
Web content updates
The last 3 walks have still to be published. That is: I have prepared the pictures of two of them: a 4-day trip to Germany (Walking two legs of the Rheinsteig near Boppard), and of a walk we did the week after. The few images of yesterdays walk, as well as the tracklog, need to be uploaded – but I’ve been too busy programming to do the blogs by a native program (that is: some modules needed) :). It will be done next week. (time permitting)

22-Nov-2007

Webserver tuning
WASD has a facility called “Throttle” – if there are too many concurrent requests on a resource, requests can be queued in a first-in-first-out queue, untill a given period has expired – these rquests time out with a 503 error: Server too busy.
I wanted to enable this on the PHP code because it requires rather a lolt of memory, but much to my surprise, I got 8 instances of WASD at the time. This didn’t feel too well so I reversed the changes and asked a question on the matter on the WASD mailing list.
Mark Daniel – the author – responded this was bizarre. I cannnot agree less. It is.

It’s not what should have happend, and he gave some hints to get around it, if it happens again. So I re-enabled and reloaded the mapping. Much to my surprise (and relieve) it works as expected: still one instance.

This looks better, I’ll left it running.

I also wanted to see if directory browsing could be disabled. Of course it can: in the server configuration is one entry whene directory lsiting can be enabled or disabled. Normally it will be enabled.
So I tried the effect – and the operator logs were no longer accessable, so that was not the right thing to do, for the moment. I may use a CGI-script, similar to the on ethat creates the listing of the weblogs. A good thing since that will allow access to multiple versions. Just what I need, but I still need to create it.

So I’ll keep an eye on the webserver and the system.

20-Nov-2007

Riddles: Crash? Power failure?
All of a sudden, at about 10:00 this morning, Diana seemed gone. I was warned by the fact that all of the webs – including webmail – appeared unreachable, and by a phone call by my daughter that there was no Internet access from any PC. Instructing her by phone, I learned the console was on the console prompt, with a message that DKB0 (the boot device) could not be found.
Some way, the system tried to recover from an error but couldn’t reach the boot device….
I had my daughter restart the HSZ50 controller and boot Diana – which worked fine from there.

Except for this blog and the VMS forum. The others worked just fine.

When I got home, I found the cause of the failures of the blog and the forum were what I expected: the logicals weren’t defined properly, so I corrected the startup procedure and defined the logicals by hand. That solved that issue.

What caused the breakdown could not be found. OPERATOR.LOG didn’t mention anything, not did Diagnose – no appearant errors in ERRLOG.SYS. There was no system dump either, and today’s CLUE CRASH logging showed a dump of a long time ago.

I had been thinking of a power failure, but is seems none had occurred: all electrical clocks (that would normally blink) were showing the right time…. So what cuased it will remain a mistery.

Forum issues
One of the tests I did after re-enabling the forums, was creating a new member, hoping to get an email to notify the registration. The message came in when I used the company e-mail address, using the numbered personal domain – a relic of years past – failed – but that is an issue with VMS’s SMTP engine. That I didn’t see these messages is caused by the fact that the company’s SPAM filter filters them as spam. I have to ask the system manager to take action on that….

It’s weird that the system did return “invalid name : ;” causing a non-CGI conform request message, breaking the session – have to dig into that.

The new software does not block additions. It just prevents them to show up if a non-admin user checks the memberlist – by that, their spam misses target. Yet, I would like to have these bogus additions be blocked, the question remains: how to achive that? It would be nice if new registrations were stored in a separate table, a mail to be sent to the supplied e-mail address with a link for confirmation. If that is received within, say: 1 week, their registration can be ectivated and only than a web address can be added.

It has some advantages, but the problem persists.

What I expected to be there but is missing: a way to delete members directly from the memberlist. Well, there is a script that removes all inactive users from the database, to be run on regular intervals. So I’ll get that.

However, there is a major PHP problem with the forum:

%HTTPD-W-NOTICED, 20-NOV-2007 19:02:46, CGI:1969, not a strict CGI response
-NOTICED-I-SERVICE, http://www.grootersnet.nl:80
-NOTICED-I-CLIENT, 192.168.0.33
-NOTICED-I-URI, GET (62 bytes) /vmsforum/admin/index.php?sid=<HEX session ID>
-NOTICED-I-SCRIPT, /vmsforum/admin/index.php vmsforum:[admin]index.php (cgi_exe:phpwasd.exe) VMSFORUM:[admin]index.php
-NOTICED-I-CGI, <HEX session code> (129 bytes) %SYSTEM-F-HPARITH, high performance arithmetic trap, Imask=00000000, Fmask=00000002, summary=02, PC=00000000001E9C94, PS=0000001B
-NOTICED-I-RXTX, err:0/0 raw:876/0 net:876/0

I had this before, but this happens since I’m logged in as forum administrator, and want to logout – or have the admin panel show up.
Nasty.

Last week’s FTP hack attempts

Just three since last reboot.
The first to occur was rather standard – a script running just within 20 seconds:

%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 87-205-178-181.adsl.inetia.pl at 15-NOV-2007 07:43:23.94
%TCPIP-I-FTP_NODE, client host name: 87-205-178-181.adsl.inetia.pl
%TCPIP-I-FTP_USER, user name: anonymous
%TCPIP-I-FTP_OBJ, object: WEB_DISK2:[public.anonymous.071115074346p]
%TCPIP-I-FTP_CHINFO, TCPIP$FTPC0000F: Failed to create directory
%SYSTEM-F-NOPRIV, insufficient privilege or object protection violation
%TCPIP-I-FTP_NODE, client host name: 87-205-178-181.adsl.inetia.pl
%TCPIP-I-FTP_USER, user name: anonymous
%TCPIP-I-FTP_OBJ, object: /pub/
%TCPIP-I-FTP_OBJ, object: /public/
%TCPIP-I-FTP_OBJ, object: /_vti_pvt/
%TCPIP-I-FTP_OBJ, object: /_vti_txt/
%TCPIP-I-FTP_OBJ, object: /_vti_cfg/
%TCPIP-I-FTP_OBJ, object: /_vti_log/
%TCPIP-I-FTP_OBJ, object: /_vti_cnf/
%TCPIP-I-FTP_OBJ, object: /_private/
%TCPIP-I-FTP_OBJ, object: /incoming/
%TCPIP-I-FTP_OBJ, object: /pub/incoming/
%TCPIP-I-FTP_OBJ, object: /public/incoming/
%TCPIP-I-FTP_OBJ, object: /public_html/
%TCPIP-I-FTP_OBJ, object: /upload/
%TCPIP-I-FTP_OBJ, object: /wwwroot/
%TCPIP-I-FTP_OBJ, object: /mailroot/
%TCPIP-I-FTP_OBJ, object: /ftproot/
%TCPIP-I-FTP_OBJ, object: /home/
%TCPIP-I-FTP_OBJ, object: /images/
%TCPIP-I-FTP_OBJ, object: /web/
%TCPIP-I-FTP_OBJ, object: /www/
%TCPIP-I-FTP_OBJ, object: /html/
%TCPIP-I-FTP_OBJ, object: /cgi-bin/
%TCPIP-I-FTP_OBJ, object: /usr/
%TCPIP-I-FTP_OBJ, object: /usr/incoming/
%TCPIP-I-FTP_OBJ, object: /temp/
%TCPIP-I-FTP_OBJ, object: /~temp/
%TCPIP-I-FTP_OBJ, object: /tmp/
%TCPIP-I-FTP_OBJ, object: /~tmp/
%TCPIP-I-FTP_OBJ, object: /outgoing/
%TCPIP-I-FTP_OBJ, object: /anonymous/
%TCPIP-I-FTP_OBJ, object: /anonymous/_vti_pvt/
%TCPIP-I-FTP_OBJ, object: /anonymous/_vti_cnf/
%TCPIP-I-FTP_OBJ, object: /anonymous/incoming/
%TCPIP-I-FTP_OBJ, object: /anonymous/pub/
%TCPIP-I-FTP_OBJ, object: /anonymous/public/

%TCPIP-I-FTP_SESDCN, FTP SERVER: session disconnection from 87-205-178-181.adsl.inetia.pl at 15-NOV-2007 07:43:41.08

and two other ones, that broke and logged out on failure:

%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 91.186.25.132 at 15-NOV-2007 09:17:38.43
%TCPIP-I-FTP_NODE, client host name: 91.186.25.132
%TCPIP-I-FTP_USER, user name: anonymous
%TCPIP-I-FTP_OBJ, object: WEB_DISK2:[public.anonymous.test]
%TCPIP-I-FTP_CHINFO, TCPIP$FTPC00010: Failed to create directory
%SYSTEM-F-NOPRIV, insufficient privilege or object protection violation
%TCPIP-I-FTP_USER, user name: anonymous
%TCPIP-I-FTP_SESDCN, FTP SERVER: session disconnection from 91.186.25.132 at 15-NOV-2007 09:17:39.04

%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from 202.181.208.119 at 15-NOV-2007 19:47:28.53
%TCPIP-I-FTP_NODE, client host name: 202.181.208.119
%TCPIP-I-FTP_USER, user name: anonymous
%TCPIP-I-FTP_OBJ, object: WEB_DISK2:[public.anonymous.test]
%TCPIP-I-FTP_CHINFO, TCPIP$FTPC00011: Failed to create directory
%SYSTEM-F-NOPRIV, insufficient privilege or object protection violation
%TCPIP-I-FTP_USER, user name: anonymous
%TCPIP-I-FTP_SESDCN, FTP SERVER: session disconnection from 202.181.208.119 at 15-NOV-2007 19:47:31.94

Each failure in creating the directory is signalled in Operator.log.