02-Oct-2016

All as usual
Back from the OpenVMS Bootcamp, found everything in working order – except for the front page that looked weird. But in general all is well. Apart from the usual stuff:

PMAS statistics for September
Total messages    :   9390 = 100.0 o/o
DNS Blacklisted   :      0 =    .0 o/o (Files:  0)
Relay attempts    :   7221 =  76.9 o/o (Files: 28)
Accepted by PMAS  :   2169 =  23.0 o/o (Files: 29)
  Handled by explicit rule
         Rejected :   1220 =  56.2 o/o (processed),  12.9 o/o (all)
         Accepted :    203 =   9.3 o/o (processed),   2.1 o/o (all)
  Handled by content
        Discarded :    351 =  16.1 o/o (processed),   3.7 o/o (all)
     Quarantained :    244 =  11.2 o/o (processed),   2.5 o/o (all)
        Delivered :    151 =   6.9 o/o (processed),   1.6 o/o (all)

there has been some attempts to relay, using a forged grootersnet.nl account, to one (!) address: xiaonanzi11165@vip.163.com, which is a Chinese address, renowned for it’s bad behaviour. This time on three days, on two addresses (both Chinese as well):

  • 07-sep-2016    103.240.124.28  05:42:31.68 – 09:57:18.53 (2400)
  • 09-sep-2016    103.240.124.17  07:01:50.77 – 11:19:44.45 (2400)
  • 30-Sep-2016    183.240.203.46  18:12:17.81 – 22:07:42.44 (2300)
  • every sixth minute in these time frames. They were not yet included in the new list of networks to be blocked, so I added them, so I should no longer see them.

    During the bootcamp, I also took a look to the new WordPress version (4.6.1) that I already had installed and accessible, and it seemed all well working, so there is no real issue updating the blogs – that will be done later tonight.
    Update
    Done.
    There is one minor issue: the stats plugin – very out-of-date but still present. Removal via Plugin pages failed (obviously: the site is read-only) so I have to remove it myself – from the database…

    Some other issue handled during the bootcamp: I had a problem with PMAS: normally, I would get a mail back from the [INFO-WASD] mailing list when I sent a message but this didn’t happen anymore after I added a rule to block any incoming mail that has the grootersnet.nl domain in the “From:” header line. Since there is ONE source where mail from this domain can come from, which is MY server, these are all forged; I had tons of them so I blocked it. But as it turned out, this list is setup by another fine Process.com package: PMDF, which takes the incoming message, adds “[INFO-WASD]” in front of the subject (if it isn’t there already) and sends them to all subscribers, with “From:” unchanged. The maintainer of the list (Jeremy Begg), was also on the bootcamp and we tried to figure out what may have caused it. Contacted Hunter Goatley of Process also for help, and he gave me a method to check how the scan can be observed: Set debug to a high level, have the file at hand like it arrives, and run pmas.exe interactively.
    I had a message from Mark Daniel at hand, could now observe how the rule scan went as it was acceptyed; then changed the “From:” line as if I sent the message, and bingo: the mail got rejected – because I set it to reject regardless any other rule (‘megareject’). Changed the rule to ‘reject’ and now the message was accepted due to another rule, based of the “received:” header line, containing a value that is acceptable.
    So: problem solved.

    Tested it against the test address that Jeremy had set up, and I got the reply as expected.

    Then there was the issue with the home page: The text wasn’t displayed as it should. Turned out to be a number of typos in the text; corrected them today and now all show now as it was intended. At least: This bit.

    Last but not least: Since I’m back home, the laptop sitting in front of the servers as a console system can be removed. It’s no big deal to start the systems after a power outage in the evening following the issue, but it is a bit cumbersome to do so when you’re in the US…

    What’s next
    I learned a few things on bootcamp, and one is worth some experimentation, so I’ll pick that one up. I will give my remarks in this blog as well – since my aim is to do some changes in signalling.

    To be continued