email - Yahoo Domain Keys setup, getting dkim=permerror (no key)

I'm working on getting DKIM installed on my outgoing mail server, to help my email deliverability to my Yahoo clients (all legit emails, etc, no spamming).

I've got DKIM-Signature: and DomainKey-Signature: headers being generated, but a test mailer to my Yahoo account had this line in the headers:

Authentication-Results: mta250.mail.re2.yahoo.com from=example.com;

domainkeys=permerror (no key); from=example.com; dkim=permerror (no
key)

Any ideas what I may have missed?

Answer

You do not have the proper dns records set up.

You can test it youself with policy checker and selector checker.
Here is a good tutorial for setting the right records.
and also and online form for doing the same.

It seems that you have SPF records. You should definitely remove them!
Here is a case against spf.

networking - DNS resolution failing over to secondary DNS - why?

We have large number of branch offices connected via VPN, but without any kind of server infrastructure. The client machines in each office get their network configuration from an ASA 5505, which is also used for the VPN connection.

The Windows XP client machines are configured to use one of our corporate DNS servers as the primary, with the DNS server of the ISP as the secondary. The idea is that if the VPN connection fails for any reason, staff in the office will still be able to access the internet, and access our webmail and home access portal. In the majority of cases this works fine.

However, for offices based in South America we are seeing DNS resolution on the client machines regularly being done against the ISP DNS server - this results in our corporate resources being effectively unavailable to staff in the offices.

The client machines are able to ping the corporate DNS server ok. When doing an nslookup of a corporate hostname, I get a reply.

I'm thinking one of the following (or a combination) is happening:

• our corporate DNS server is not always replying to requests in a timely fashion (although why this would only affect clients in one geographic region I don't know)


• DNS queries from Latin America are somehow delayed, causing the client to treat it as failed (although we have offices at the end of much slower VSAT connections which do not have this issue)


• a single failure is resulting in a DNS cache entry in Windows that somehow results in the lookups not happening on subsequent tries

Has anyone else come across this issue? Any ideas for resolutions?

Answer

Windows queries DNS in this order:

• hosts file


• local DNS cache


• Preferred DNS servers


• Other DNS servers

MS also has an article describing how the DNS server list is obtained:

The DNS Client service uses a server search list, ordered by preference. This list includes all preferred and alternate DNS servers configured for each of the active network connections on the system.

The list is arranged based on the following criteria:

• Preferred DNS servers are given first priority.


• If no preferred DNS servers are available, then alternate DNS servers are used.


• Unresponsive servers are removed temporarily from these lists.

Windows has an escalating timeout for DNS requests:

Value      Default value  Attempt
1st limit       1 second  Query the preferred DNS server on a preferred connection.
2nd limit      2 seconds  Query the preferred DNS server on all connections.
3rd limit      2 seconds  Query all DNS servers on all connections (1st attempt).
4th limit      4 seconds  Query all DNS servers on all connections (2nd attempt).
5th limit      8 seconds  Query all DNS servers on all connections (3rd attempt).
6th value                 (Must be 0.)

I could not find a clear answer on this exact point, but it sounds like if it doesn't get a response from your primary DNS in 1 or 2 seconds (1st or 2nd attempt, respectively), then that server will be removed from the DNS server lookup list for 15 minutes, and so it will use the secondary DNS servers. Since those servers have up to an 8 second timeout, they are much more likely to respond. (It's unclear to me if it continues to query the preferred DNS server during the 3rd+ attempt if it's already failed).

I also suspect that you do indeed have a WAN latency issue for this geographical area, as it would explain why the timeouts are working.

---

One solution is to change the DNS query timeouts, using the DNSQueryTimeouts registry parameter. See also http://drewthaler.blogspot.com/2005/09/changing-dns-query-timeout-in-windows.html

---

Another solution is to put a local caching DNS server on the network, and have the clients use that. You can use a DNS server that may be built in to a router, or install something like dnsmasq.

apache 2.2 - Apache2 - mod_expire and mod_rewrite not working in httpd.conf - serving content from tomcat

I am using apache2 server running on debian which forwards all the http request to tomcat installed on same machine.

I have two files under my /etc/apache2/ folder

apache2.conf and httpd.conf

I modified httpd.conf file to look like following.

# forward all http request on port 80 to tomcat
ProxyPass / ajp://127.0.0.1:8009/
ProxyPassReverse / ajp://127.0.0.1:8009/

# gzip text content
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html

AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
DeflateCompressionLevel 9
BrowserMatch ^Mozilla/4 gzip-only-text/html

BrowserMatch ^Mozilla/4\.0[678] no-gzip
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html


# Turn on Expires and mark all static content to expire in a week
# unset last modified and ETag 
ExpiresActive On
ExpiresDefault A0

 ExpiresDefault A604800

 Header unset Last-Modified
 Header unset ETag
 FileETag None
 Header append Cache-Control "max-age=604800, public"


RewriteEngine On

# rewrite all www.example.com/content/XXX-01.js and YYY-01.css files to XXX.js and YYY.css
RewriteRule ^content/(js|css)/([a-z]+)-([0-9]+)\.(js|css)$ /content/$1/$2.$4


# remove all query parameters from URL after we are done with it
RewriteCond %{THE_REQUEST} ^GET\ /.*\;.*\ HTTP/
RewriteCond %{QUERY_STRING} !^$
RewriteRule .* http://example.com%{REQUEST_URI}? [R=301,L]

# rewrite all www.example.com to example.com
RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
RewriteRule ^(.*)$ http://example.com/$1 [R=301,L]

I want to achieve following.

1. forward all traffic to tomcat


2. GZIP all the text content.


3. Put 1 week expiry header to all static files and unset ETag/last modified header.


4. rewrite all js and css file to certain format.


5. remove all the query parameters from URL



6. forward all www.example.com to example.com

The problem is only 1 and 2 are working.
I tried a lot with many combinations but the expire and rewrite rule (3-6) do not work at all. I also tried moving these rules to apache2.conf and .htaccess files but it didn't work either. It does not give any error but these rules are simple ignored.

expires and rewrite modules are ENABLED.

Please let me know what should I do to fix this.
1. Do I need to add something else in httpd.conf file (like Options +FollowSymLink) or something else?

2. Do I need to add something in apache2.conf file?
3. Do I need to move these rules to .htaccess file? If yes, what should I write in that file and where should I keep that file? in /etc/apache2/ folder or /var/www/ folder?
4. Any other info to make this work?

Thanks,
Ankit

raid - Can I move from SAS HDD to SSD?

I have an HP ML350 Gen 8 server with 8 SAS HDDs of 600 GB each. Since the drives are a little bit old now, I would like to replace them with SSDs.

I would like to know if I can do this, and if I should continue the existing RAID setup.

Current RAID setup:

ubuntu - Dovecot Forward Spam

I was wondering if anyone had any knowledge on how this idea can be done. It's not a requirement but more of an idea I came up with that I don't know how to word my google searches to find out if it's been done.

Basically the idea is this. I have an Ubuntu Postfix/Dovecot mail server with Amavis, Postgrey, and Spamassassin. Now I've heard of using Sieve for dovecots spam folders and such. But I'm wondering if there's a way to enable users to forward an email to a spam address, such as spam@example.com, that will basically act as a robot user and file the email away in a kind of universal junk folder and automatically add that address to spamassassin or postgrey. Eventually I would like to have it also clean out the folder ever X amount of days (probably with cron).

So the work flow I'm hoping would go as such:

• USER@EXAMPLE.COM receives email from JUNK@SPAM.COM


• USER@EXAMPLE.COM forwards it to SPAM@EXAMPLE.COM


• SPAM@EXAMPLE.COM moves it to junk folder.


• SPAM@EXAMPLE.COM adds it to spamassasin/postgrey for blocking.



• CRON deletes messages that are 7 days old from junk folder.

Ideas? If I can get this working I might write up a tutorial on it for others if one doesn't allready exist.

Answer

Forwarding spam often isn't really that helpful, users usually do "inline forwards" instead of redirects / forward as attachment. it's almost impossible to get any usable information out of inline forwards (no headers, which means no envelope sender etc).
Fortunately, dovecot has a much cooler feature: you can search through a folder in all user accounts at once, so instead of forwarding they can simply move the false negative to their own Spamreport folder.

You can then do funny things with doveadm, for example:

doveadm search -A mailbox Spamreport 2>/dev/null | while read user guid uid; do  doveadm fetch -u $user text mailbox-guid $guid uid $uid | your_blacklist_script_here.sh ; doveadm expunge -u $user mailbox-guid $guid uid $uid ; done

this would get all messages that are in a folder called Spamreport in any user account, pass them to your_blacklist_script_here.sh and expunge them afterwards.

Note, your idea of blacklisting sender adresses might work in some cases, but usually they change very fast, so it probably wont be very effective.
Consider training the spamassassin bayes database instead. Assuming you have bayes set up, simply replace your_blacklist_script_here.sh with sa-learn --spam

Does DDoS attacks affect victim position in search engine?

I've found most website attacked by mass DDoS has spike increase in alexa rank.
But how about the position in search engine?

Linux - Imaging backup solution?

I want to know is there a way to make a snapshot-like backup of a linux system into a single file and restore it in another system ?

You know in windows there are programs which makes a copy of a drive (like C:\ ) into a single image file. So you can restore this file later incase you are infected or something happens.

Every time I want to migrate my vps into another host, I have to setup the new server from scratch and move the files manually. Can I just make a snapshot backup of the whole system and restore it somewhere else (or on the same server) ?

I am not familiar with linux and I have no idea if this is technically possible or not ? Does the paritions, configs, system files,etc... are individual for each system ?

I heard about rsync, but that's not what I am looking for.

Answer

While snapshot style backups are possible in some situations, they will not be useful in this situation. The main reason for this is that VPS providers rarely give you low enough level access to their system for you to be able to restore data in this fashion.

The real answer here is to use a config management system to manage your servers. Puppet and Chef are two of the most popular configuration management systems at the moment. With systems line these, you specify in a set of text files how you'd like your server to be configured, what packages you want installed, etc. These configurations then can be applied to any server, regardless of its location.