- luv-main - luv.asn.au

SPF and DKIM checks on mail to the list
by Russell Coker 24 Dec '15

24 Dec '15

The list server is configured to reject mail that fails DKIM or SPF checks. It is not supposed to receive mail from other list servers or forwarding services so there's no reason for mail to fail such checks. If you have a problem with mail from your ISP going to the list then contact me off-list and I'll help you file a bug report. If you have a problem with your own personal domain then I am happy to send you log entries related to your issue and help you debug it. Don't claim that there's something wrong with the LUV server though. If you setup your server to DKIM sign mail and it doesn't do it correctly or setup a SPF entry that doesn't include your sending address then it's your issue. I'm happy to help you solve your issues, just don't claim that they are my issues. While we are having a debate about whether list servers should send out mail that fails DKIM and/or SPF checks I think that there is no reason that a mail server should receive such mail unless it is configured to receive mail from another list server. Of course if a list server receives mail from another list server it should be configured to whitelist such mail. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

5 8

DMARC, SPF and DKIM
by Jason White 24 Dec '15

24 Dec '15

I've spent time today trying to configure SPF, DKIM and DMARC for my domain. Experience will determine how successful I have been. The next step is to configure my mail system, running Postfix, to check inbound mail using these mechanisms. Which tool do others prefer for this purpose? My DMARC record may be too strict; I essentially copied an example from http://www.zytrax.com/books/dns/ch9/dmarc.html (with a slight modification to change the address to which reports are sent). If necessary, I can switch to a "quarantine" rather than a "reject" policy for SPF, DKIM or both. Mailing list servers and their treatment of DKIM would be my main concern, although in such cases, if I understand rightly, the recipient should use the list server's DMARC record to determine the policy rather than mine, since it's the list server which is actually sending the mail out.

2 2

Getting systemd to not use cpuacct cgroup on RHEL 7.2
by Chris Samuel 22 Dec '15

22 Dec '15

/* No systemd religious wars please - thank you */ Hi folks, I'm trying to get Slurm working on a RHEL7.2 system and I've hit an issue where systemd is already using the cpuacct cgroup hierarchy and that prevents Slurm from using it as it seems to be the one case where it can only be in use once. I.e. having this mount create by systemd: cgroup /sys/fs/cgroup/cpu,cpuacct cgroup rw,nosuid,nodev,noexec,relatime,cpuacct,cpu 0 0 causes: 12725 mount("cgroup", "/cgroup/cpuacct", "cgroup", MS_NOSUID|MS_NODEV|MS_NOEXEC, "cpuacct") = -1 EBUSY (Device or resource busy) Anyone got any ideas on how to stop systemd from using it? All the best, Chris -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC

4 6

Is my root partition dying?
by David Zuccaro 21 Dec '15

21 Dec '15

Hi, I'm running fsck on my root partition and getting lots of io errors as shown in the link. What should I do? Is my disk dead or can it still be used? https://www.dropbox.com/s/d3m019akv70xihs/2015-12-17%2000.50.59.jpg?dl=0 Thanks, David

11 32

Fixing the LUV list?
by Chris Samuel 21 Dec '15

21 Dec '15

Hi folks, I tried emailing the committee, but that just got moderated and I've not heard anything since, so I was wondering are was any progress on fix the LUV mailing list to not rewrite the From: header? thanks, Chris -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC

7 15

hosting etc
by Russell Coker 21 Dec '15

21 Dec '15

In 3-5 weeks the LUV server will no longer be running at it's current location due to V3/VPAC closing. We are in the process of making other hosting arrangements. One issue that is yet to be discussed is where to host the lists, in the past Linux Australia offered to host lists for us and we may take them up on that offer if it's still available. If anyone knows of an organisation that might offer us free hosting then please email the committee. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

3 4

Re: Backups with rsync [Was: Is my root partition dying?]
by Adam Bolte 18 Dec '15

18 Dec '15

On 17/12/15 23:06, Erik Christiansen via luv-main wrote: > On 17.12.15 21:33, Russell Coker via luv-main wrote: >> There are a variety of backup systems that start with rsync and manage >> trees of links. It's not difficult to write your own, rsync the >> files, run "cp -al" to make a copy with hard links and use today's >> date in the directory name, and then delete backup directories that >> are too old. > > I'm not grokking the benefit of doing the rsync _and_ a "cp -al". I just > include -aH in my rsync options, the -H to preserve hard links. Seems to > work. At my workplace, we use this rsync option: --link-dest=DIR hardlink to files in DIR when unchanged where DIR would be the most recent successful backup directory. I wrote aboute 500 lines of Bash for my workplace years ago which is basically an rsync wrapper that also reads hosts and directories to backup from a config file, and does some basic directory management to make it easy to browse backups and see what you are restoring. Today after reading this thread, I asked and was granted permission to make the git repo public. It's a bit hackish, but it has served us well and might be worth a look. https://github.com/sitepoint/abs Since it backs up hosts on the network using rsync over SSH via pubkey authentication, we use the rrsync wrapper script (typically installed at /usr/share/doc/rsync/scripts/rrsync.gz in the rsync package), with authorized_keys files like: command="/usr/local/sbin/rrsync -ro /" ssh-rsa <key> <host comment> and PermitRootLogin forced-commands-only in the /etc/ssh/sshd_config option on targeted hosts to improve security. Cheers, Adam

1 0

Re: Backups with rsync [Was: Is my root partition dying?]
by andrew＠mcnaughty.com 17 Dec '15

17 Dec '15

-----Original Message----- From: Erik Christiansen via luv-main <luv-main(a)luv.asn.au> To: luv-main(a)luv.asn.au Sent: Thu, 17 Dec 2015 11:06 pm Subject: Backups with rsync [Was: Is my root partition dying?] > On 17.12.15 21:33, Russell Coker via luv-main wrote: > > There are a variety of backup systems that start with rsync and manage > > trees of links. It's not difficult to write your own, rsync the > > files, run "cp -al" to make a copy with hard links and use today's > > date in the directory name, and then delete backup directories that > > are too old. > I'm not grokking the benefit of doing the rsync _and_ a "cp -al". I just include -aH in my rsync options, the -H to preserve hard links. Seems to work. > It's almost enough to make one wonder why it's a little bit fiddly to make rsync "just shuddup & copy the listed bits of the filesystem _as_is_, so they can be restored unaltered." > > What I'm doing for backups at the moment is to rsync to files on a > > BTRFS filesystem and then create a snapshot. If I want to retrieve a > > file that was deleted then I just copy it from a suitably old > > snapshot. > A bit more basic here. Just a rsync -Hauv to one of several flash sticks, then a diff -qr to confirm the copy's OK, and show any deletions which should be done, usually 0-3 per backup. But then my precious data is diminutive by most standards. Most important is that they come with me off-site. rsnapshot, rdiff-backup and duplicity are all good alternatives, with different advantages. The approaches being discussed here tend to approximate to rsnapshot. In fact there's a succinct description of what rsnapshot does here: http://serverfault.com/questions/136861/which-is-best-for-backups-rsync-vs-… . Basically there's no reason why you can't do it as well yourself, but there's probably a higher chance of making a mistake. Where rdiff-backup comes into its own is when a file changes frequently. E.g. The one where you keep the latest dump of your database. With a hard link based approach you wind up keeping a full copy of each day's dump, even though the changes might be small. With rdiff-backup you only have to store a compressed diff each day. Duplicity is less efficient, but it handles keeping everything on the remote system encrypted, and can back up to remote systems where you can't run any sort of remote software agent (like rsync). So you can back up to FTP or Amazon's S3. The cost of traffic has come down enough to make backing up to s3 quite reasonable, so long as you can tolerate a long recovery time. I also find backup-ninja useful for scheduling backups. Andrew

1 0

Tacacs+ - console access works, ssh does not
by Peter Ross 17 Dec '15

17 Dec '15

Hi, I am installing TACACS+ on a CentOS7 server (to replace a Win 2003 based Tacacs) I could not find a Tacacs+ server in the repositories so I installed this one: http://www.shrubbery.net/tac_plus/ Installation was not a problem, and this test configuration: key = <key> user = tester { login = PAM service = exec { default attribute = permit priv-lvl = 15 } } gives the user tester (local to the server) access on a HP Blade Center switch (a Nortel switch) via /c/sys/tacacs prisrv <ip> on cmap enabled if I use the serial console. A list of commands appears and I get a prompt. However, if I try ssh, the login seems to work but I do not get a list of commands and no prompt. The terminal is completely quiet after the login (but it stays connected). I played around a bit but have not been successful. Do you have an idea what may be missing? Thanks for answers Peter

5 9

free PC
by Russell Coker 14 Dec '15

14 Dec '15

E2140 dual-core 64bit desktop PC with 4G of RAM. Has built in sound and VGA on the motherboard. Has full height PCI and PCIe slots for expansion. Has run for a year or so as a Xen server. I can give you a SATA disk too if you need it. Contact me off-list if you are interested. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

1 0