I recently added a Pix 501 to my ADSL connection and all my outbound PPTP VPN connections from my Windows XP PC stopped working.
I eventually worked out how to re-enable them.
On the Pix 501 just enable PPTP fixup on port 1723.
All works!
Monday, 14 July 2008
Monday, 14 April 2008
Configure MailScanner to skip checking local mail
Every day our system creates thousands of mails we send to customers and we keep a BCC so we can prove we have sent the email. Its pointless MailScanner checking these emails for virus and spam.
On checking the MailScanner configuration files I found it was very simple.
Simply edit MailScanner.conf and then change
Scan Messages = yes
to read
Scan Messages = %rules-dir%/scan.messages.rules
Then create scan.messages.rules in your rules directory and add your rules like the following example
From: /^192\.168\.12\./ no
FromOrTo: default yes
This means that any message from 192.168.12.* will not be checked
After that simply restart MailScanner, send some test messages and check the mail headers to confirm that internal messages are no longer scanned and external messages are still scanned.
For more information on rules see the EXAMPLES or README file in the rules directory.
On checking the MailScanner configuration files I found it was very simple.
Simply edit MailScanner.conf and then change
Scan Messages = yes
to read
Scan Messages = %rules-dir%/scan.messages.rules
Then create scan.messages.rules in your rules directory and add your rules like the following example
From: /^192\.168\.12\./ no
FromOrTo: default yes
This means that any message from 192.168.12.* will not be checked
After that simply restart MailScanner, send some test messages and check the mail headers to confirm that internal messages are no longer scanned and external messages are still scanned.
For more information on rules see the EXAMPLES or README file in the rules directory.
Wednesday, 19 March 2008
How to configure yum to use a particular mirror
So you have an out of date version of Fedora installed but you still want to make sure its as up to date as possible and Redhat (and many others) have removed the repositories. If you can find an old mirror, http://fedora.mirror.facebook.com/ for instance then you should be able to run up2date and use yum to install software.
First however you need to tell yum to look at the mirror you have found and not rely on download.fedora.redhat.com.
Go to the /etc/yum.repos.d directory.
Here you will find the definitions of the repositories. On Fedora Core 4 I commented out the mirrorlist option and added in my own values for baseurl.
Clearly the system is still out of date and a newer version of fedora would be better but at least you can get it to the latest update and install software as required.
If you come across an issue where yum FC4 is looking in FC3 directories then do the following:-
$ cd /usr/share/rhn/up2date_client
First however you need to tell yum to look at the mirror you have found and not rely on download.fedora.redhat.com.
Go to the /etc/yum.repos.d directory.
Here you will find the definitions of the repositories. On Fedora Core 4 I commented out the mirrorlist option and added in my own values for baseurl.
$ cat fedora.repo
[base]
name=Fedora Core $releasever - $basearch - Base
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/$releasever/$basearch/os/
baseurl=http://fedora.mirror.facebook.com/linux/core/$releasever/$basearch/os/
#mirrorlist=http://fedora.redhat.com/download/mirrors/fedora-core-$releasever
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora
$ cat fedora-updates.repo
[updates-released]
name=Fedora Core $releasever - $basearch - Released Updates
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/core/updates/$releasever/$basearch/
baseurl=http://fedora.mirror.facebook.com/linux/core/updates/$releasever/$basearch/
#mirrorlist=http://fedora.redhat.com/download/mirrors/updates-released-fc$releasever
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora
$ cat fedora-extras.repo
[extras]
name=Fedora Extras $releasever - $basearch
#baseurl=http://download.fedora.redhat.com/pub/fedora/linux/extras/$releasever/$basearch/
baseurl=http://fedora.mirror.facebook.com/linux/extras/$releasever/$basearch/
#mirrorlist=http://fedora.redhat.com/download/mirrors/fedora-extras-$releasever
enabled=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-extras
gpgcheck=1
Clearly the system is still out of date and a newer version of fedora would be better but at least you can get it to the latest update and install software as required.
If you come across an issue where yum FC4 is looking in FC3 directories then do the following:-
$ cd /usr/share/rhn/up2date_client
$ vi sourcesConfig.py and comment out the releasever="3" below #FIXME:0
Wednesday, 5 March 2008
Content-type application/pdf does not work using Firefox on Mac
Today we had a customer complain they could not open our invoices which are pdf's produced via a cgi script.
It quickly became apparent that it only happens in Firefox on a Mac. Firefox on other platforms has no issues, nor does Safari on a Mac.
A quick google uncovered this known bug.
https://bugzilla.mozilla.org/show_bug.cgi?id=416094
It appears firefox on Max ignores the Content-Type header and will only automatically open a pdf when presented with a .pdf file extension.
I managed to 'solve' the problem by adding the following http header to the output.
Content-Disposition: inline; filename="invoice.pdf"
This just tells the browser the default file name and thus gets round the issue. Still works in IE and Firefox on a PC and fixes the issue on a Mac.
It quickly became apparent that it only happens in Firefox on a Mac. Firefox on other platforms has no issues, nor does Safari on a Mac.
A quick google uncovered this known bug.
https://bugzilla.mozilla.org/show_bug.cgi?id=416094
It appears firefox on Max ignores the Content-Type header and will only automatically open a pdf when presented with a .pdf file extension.
I managed to 'solve' the problem by adding the following http header to the output.
Content-Disposition: inline; filename="invoice.pdf"
This just tells the browser the default file name and thus gets round the issue. Still works in IE and Firefox on a PC and fixes the issue on a Mac.
Friday, 21 December 2007
IE7 Upgrade Woes
Well although I generally use Firefox I had to upgrade to IE7 today as a customer has spotted a problem with our website (www.ippatrol.com) whereby a redirect was looping.
It turns out IE7 is a little more picky about the REFRESH meta tag.
In all previous versions of IE and Firefox the following worked.
<meta equiv="REFRESH" content="1; anotherpage.html">
Under IE7 this just causes the page to constantly refresh. Adding the URL option fixes the issue.
<meta equiv="REFRESH" content="1; URL=anotherpage.html">
I've also seen comments on various blogs that this tag doesn't work or is disabled in IE7 and that somewhere in IE7 is an option to turn support on and off. I haven't seen this issue but then I only redirect internally within the site so perhaps it only takes affect when you redirect off site.
Just in case I've added some javascript code to do the redirect as well. Hopefully one or other method will fire otherwise the visitor can click on the link displayed to get to the contact page.
The second issue I had with IE7 was that PDF's no longer worked and just came up with a page error saying object required.
I quickly guessed this might be because my Acrobat Reader was also well out of date (V6.0.2 from 2004) even though it works fine in Firefox and worked in IE6.
So I bit the bullet and upgraded to Acrobat Reader V7.0 and now both Firefox and IE7 work with PDFs.
I have to say I am quite impressed with the speed of IE7 and the speed of the new version of Acrobat Reader. There are a few enhancements in IE7 most of which are just catching up with Firefox plus a few others which are useful if annoying such as the certificate checker/warnings and the fact that such errors are displayed on the address bar if you decide to ignore them - a nice reminder.
I did however notice that the IE7 pop up blocker is turned off by default which I find a little odd. The phishing facility warns you that its not turned on the first time you start IE7 but for some reason the pop up blocker doesn't - not very consistent or helpful.
It turns out IE7 is a little more picky about the REFRESH meta tag.
In all previous versions of IE and Firefox the following worked.
<meta equiv="REFRESH" content="1; anotherpage.html">
Under IE7 this just causes the page to constantly refresh. Adding the URL option fixes the issue.
<meta equiv="REFRESH" content="1; URL=anotherpage.html">
I've also seen comments on various blogs that this tag doesn't work or is disabled in IE7 and that somewhere in IE7 is an option to turn support on and off. I haven't seen this issue but then I only redirect internally within the site so perhaps it only takes affect when you redirect off site.
Just in case I've added some javascript code to do the redirect as well. Hopefully one or other method will fire otherwise the visitor can click on the link displayed to get to the contact page.
The second issue I had with IE7 was that PDF's no longer worked and just came up with a page error saying object required.
I quickly guessed this might be because my Acrobat Reader was also well out of date (V6.0.2 from 2004) even though it works fine in Firefox and worked in IE6.
So I bit the bullet and upgraded to Acrobat Reader V7.0 and now both Firefox and IE7 work with PDFs.
I have to say I am quite impressed with the speed of IE7 and the speed of the new version of Acrobat Reader. There are a few enhancements in IE7 most of which are just catching up with Firefox plus a few others which are useful if annoying such as the certificate checker/warnings and the fact that such errors are displayed on the address bar if you decide to ignore them - a nice reminder.
I did however notice that the IE7 pop up blocker is turned off by default which I find a little odd. The phishing facility warns you that its not turned on the first time you start IE7 but for some reason the pop up blocker doesn't - not very consistent or helpful.
Monday, 10 December 2007
Sendmail backup mx relay
I have used sendmail for a number of years. We use it on our main mail server and on our backup mx servers.
Up until recently we simply allowed the backup mx servers to relay all mail to the domains they serve. Unfortunately spammers tend to target backup mx servers in the belief they are less well protected.
One of the side effects of this is that you end up accepting mail for lots of invalid addresses, which not only results in more spam (as the spammer thinks the address is valid) but also means you then end up trying to send non delivery receipts to some random reply address when the backup mx tries to deliver the mail to the main server and gets refused as the address doesn't exist.
I finally worked out that there is a nice feature in sendmail to only relay certain addresses thus refusing all the other junk and preventing the erroneous non delivery receipts.
By default we used to add the following to out access database
TO:dcl.co.uk RELAY
which simply means relay all email addressed to the domain dcl.co.uk
It is possible to be more selective but first you have to add the following to your sendmail configuration (sendmail.mc). Suggest you save a copy of sendmail.cf first for later comparison.
dnl #
dnl #Use access db with undocumented feature
dnl #
define(`_RELAY_FULL_ADDR_', `1')
Then do a make. Compare your new sendmail.cf with your old one just to ensure you've not lost anything.
You can now specify specific email addresses in the TO field rather than just the domain.
It means you have to remember to update your backup mx servers whenever you add or remove an email account but that is a small price to pay for the empty mail queues. I guess you could easily automate it.
Don't for get to rebuild your access database once you've edited the text file.
# hash /etc/mail/access.db < /etc/mail/access
PS. I also set DoubleBounceAddress to nothing (O DoubleBounceAddress=) to get rid of all those non delivery receipts of non delivery receipts!
Up until recently we simply allowed the backup mx servers to relay all mail to the domains they serve. Unfortunately spammers tend to target backup mx servers in the belief they are less well protected.
One of the side effects of this is that you end up accepting mail for lots of invalid addresses, which not only results in more spam (as the spammer thinks the address is valid) but also means you then end up trying to send non delivery receipts to some random reply address when the backup mx tries to deliver the mail to the main server and gets refused as the address doesn't exist.
I finally worked out that there is a nice feature in sendmail to only relay certain addresses thus refusing all the other junk and preventing the erroneous non delivery receipts.
By default we used to add the following to out access database
TO:dcl.co.uk RELAY
which simply means relay all email addressed to the domain dcl.co.uk
It is possible to be more selective but first you have to add the following to your sendmail configuration (sendmail.mc). Suggest you save a copy of sendmail.cf first for later comparison.
dnl #
dnl #Use access db with undocumented feature
dnl #
define(`_RELAY_FULL_ADDR_', `1')
Then do a make. Compare your new sendmail.cf with your old one just to ensure you've not lost anything.
You can now specify specific email addresses in the TO field rather than just the domain.
It means you have to remember to update your backup mx servers whenever you add or remove an email account but that is a small price to pay for the empty mail queues. I guess you could easily automate it.
Don't for get to rebuild your access database once you've edited the text file.
# hash /etc/mail/access.db < /etc/mail/access
PS. I also set DoubleBounceAddress to nothing (O DoubleBounceAddress=) to get rid of all those non delivery receipts of non delivery receipts!
Saturday, 8 December 2007
TCP Window Scaling
It appears the lastest versions of Linux and Windows both enable TCP windows scaling by default. This in itself shouldn't present a problem and should improve connection speeds to sites as larger tcp packets can be negotiated.
If however the site you are trying to access if behind and old firewall or router then you might find after upgrading to Windows Vista or a recent version of Linux (Redhat 6 for example) that some sites either crawl along or simply fail. This doesn't necessarily mean your computer is at fault. It could be your router - when did you last flash the rom?
But it could mean that a firewall or router sat somewhere between you and the site is causing the issue.
If you want to prove that its tcp window scaling causing the problem you can turn it off and see if it 'solves' the problem. If it does I suggest you get in touch with the site owner and ask them to get their firewall or router upgraded. Don't forget to turn Windows Scaling option back on after!
How to disable in Windows Vista and Linux
See Wikipedia for more details
If however the site you are trying to access if behind and old firewall or router then you might find after upgrading to Windows Vista or a recent version of Linux (Redhat 6 for example) that some sites either crawl along or simply fail. This doesn't necessarily mean your computer is at fault. It could be your router - when did you last flash the rom?
But it could mean that a firewall or router sat somewhere between you and the site is causing the issue.
If you want to prove that its tcp window scaling causing the problem you can turn it off and see if it 'solves' the problem. If it does I suggest you get in touch with the site owner and ask them to get their firewall or router upgraded. Don't forget to turn Windows Scaling option back on after!
How to disable in Windows Vista and Linux
See Wikipedia for more details
Subscribe to:
Posts (Atom)