Archive

open source

To get rid of spam on your Qmail mail server:

  1. Make sure that all domains have the Mail to nonexistent user option set to Reject.This option is available since Parallels Plesk Panel 7.5.3 and can be changed for all the domains using group operations: select the domains, click Modify Selected, in the Preferences section select Switch on for the Mail to nonexistent user option and select the Reject value for it.
  2. Make sure that there are no untrusted IP addresses or networks in the white list.To do this, go to Home > Mail Server Settings > White List tab. To remove untrusted IP addresses or networks, select them in the list and click Remove Selected.
  3. Check how many messages there are in the Qmail queue with:# /var/qmail/bin/qmail-qstat

    messages in queue: 27645

    messages in queue but not yet preprocessed: 82

    If there are too many messages in the queue, try to find out where the spam is coming from. If the mail is being sent by an authorized user, but not from a PHP script, you can find out which user sent most of the messages with the following command:

    # cat /usr/local/psa/var/log/maillog |grep -I smtp_auth |grep -I user |awk '{print $11}' |sort |uniq -c |sort -n

    Note that the SMTP authorization option should be enabled on the server to see these records. The path to maillog may be different depending the OS you use.

  4. Use the qmail-qread utility to read the messages headers:# /var/qmail/bin/qmail-qread

    18 Jul 2005 15:03:07 GMT #2996948 9073 <user@domain.com> bouncing

    done remote user1@domain1.com

    done remote user2@domain2.com

    done remote user3@domain3.com

    ….

    The qmail-qread utility shows messages’ senders and recipients. If a message has too many recipients, then it is most probably spam.

  5. Try to find the message in the queue by it’s ID (for example, the message ID is #1234567):# find /var/qmail/queue/mess/ -name 1234567
  6. Look into the message and find the first from the end Received line. It is where the message was initially sent from.
    • If you find something like:Received: (qmail 19514 invoked by uid 12345); 10 Sep 2008 17:48:22 +0700

      it means that this message was sent via a CGI script by user with UID 12345. Use this UID to find a corresponding domain:

      # grep 12345 /etc/passwd

    • Received lines like:Received: (qmail 19622 invoked from network); 10 Sep 2008 17:52:36 +0700

      Received: from external_domain.com (192.168.0.1)

      mean that the message was accepted for delivery via SMTP and the sender is an authorized mail user.

    • If Received line contains an UID of an apache user (for example invoked by uid 48), it means that the spam was sent via an PHP script. In this case you can try to find the spammer using information from the spam e-mails (from/to addresses, subjects, etc). But usually to find the spam source is very hard in this case. If you are sure that some script is sending spam at the current moment (the queue grows very fast), you can use this little script to find out what PHP scripts are running in real-time:# lsof +r 1 -p `ps axww | grep httpd | grep -v grep | awk ‘ { if(!str) { str=$1 } else { str=str”,”$1}}END{print str}’` | grep vhosts | grep php

      To try to find out from what folder the PHP script that sends mail was run, create /var/qmail/bin/sendmail-wrapper script with the following content:

      #!/bin/sh

      (echo X-Additional-Header: $PWD ;cat) | tee -a /var/tmp/mail.send|/var/qmail/bin/sendmail-qmail “$@”

      Note, the paths can slightly differ depending on your OS and Parallels Plesk Panel version.

      Create a log file /var/tmp/mail.send and grant it a+rw rights, make the wrapper executable, rename old sendmail and link it to the new wrapper:

      # touch /var/tmp/mail.send

      # chmod a+rw /var/tmp/mail.send

      # chmod a+x /var/qmail/bin/sendmail-wrapper

      # mv /var/qmail/bin/sendmail /var/qmail/bin/sendmail-qmail

      # ln -s /var/qmail/bin/sendmail-wrapper /var/qmail/bin/sendmail

      Wait for about an hour and revert sendmail back:

      # rm -f /var/qmail/bin/sendmail

      # ln -s /var/qmail/bin/sendmail-qmail /var/qmail/bin/sendmail

      Examine the /var/tmp/mail.send file. There should be lines starting with X-Additional-Header pointing out to domains’ folders where the script that sends the mail is located.

      You can see all the folders where mail PHP scripts were run from with the following command:

      # grep X-Additional /var/tmp/mail.send | grep `cat /etc/psa/psa.conf | grep HTTPD_VHOSTS_D | sed -e ‘s/HTTPD_VHOSTS_D//’ `

Advertisements

Mozilla is edging closer to releasing a new version of Firefox that could increase the use of open-source video software.

Firefox 3.1, the next major release due by early next year, will likely include support for a new HTML tag specifically for embedding video in Web pages. Firefox 3.1 will also support royalty-free video codec Ogg Theora.

Firefox developers at a summit this week in Whistler, British Columbia, said they’ve started working on native Theora support, and test builds of the browser incorporating the new feature are available.

The code committed so far is a work in progress, wrote Chris Double, a Mozilla engineer who has been handling the project, “but it’s a start towards using a common codec across all platforms and will improve as we get towards the 3.1 release.”

When the upgrade is finalized, Firefox users won’t have to download a plugin to play Theora content. Another cited advantage is that Web developers can just use a <video> tag to mark content, rather than needing JavaScript to launch a video.

Video on the Web these days is a jumble of different software formats and products, with major ones including Apple‘s QuickTime, Microsoft‘s Windows Media, Adobe‘s Flash and RealNetworks‘ RealPlayer multimedia players. The plugins are free. The companies make money by selling streaming servers and encoding software.

Some see that commercial interest as potentially harmful to the Internet, since content locked up in a particular format could become inaccessible due to a change in a vendor’s product development plans.

Videos in formats such as.AVI can be converted to Theora using VLC, an open-source streaming media server, video player and converter from the VideoLAN Project. Another open-source converter is ffmpeg2theora.

Firefox’s work will streamline the delivery of video to users, wrote a user by the name of J5 on his blog.

“That to me is freedom– to allow for those who prefer open formats the ability to deliver their content without any barriers between them and their end users,” J5 wrote.

Opera Software, which makes a browser by the same name, has also implemented the video HTML tag. The company said last month that it has released versions of its latest browser that support Ogg Theora for Windows, Linux and Mac OS X operating systems.

“It’s such an obvious improvement over the previous state of affairs of dealing with online video that it really makes you wonder why it took so long,” wrote Ben McIlwain, an IT consultant, on his blog. “We’re several years into the online video revolution now (led by such giants as YouTube), so it’s only fair that we finally get native browser support for videos.”

The moves by Mozilla and Opera can be seen as a strike against Microsoft, which dominates the browser market. Figures from Net Applications from last month show Internet Explorer with a 73 percent market share, compared to Firefox at 19 percent and Opera at.69 percent.

Ogg Theora isn’t supported in Internet Explorer 7. It is an older compression specification compared to Adobe’s Flash 9, which uses the latest H.264 technology and is used on prominent Web sites such as Google‘s YouTube.

However, the Wikimedia Commons is using Ogg Theora for video.

~GGG~

The Debian project announced the fourth update of its stable distribution Debian GNU/Linux 4.0 (codename etch). In addition to correcting several security problems and a few serious defects in the stable release, for the first time in Debian’s history an update for a stable distrubtion also adds support for newer hardware by giving users the option to install newer drivers.

Existing Debian GNU/Linux 4.0 installation CDs and DVDs can continue to be used to install this update. After installation, upgrading via an up-to-date Debian mirror will cause any out of date packages to be updated. However, users of the network-console installation method are strongly encouraged to update their media, see the “Debian Installer” portion of this announcement for more information.

Those who install updates frequently from security.debian.org won’t have to update many packages and most updates from security.debian.org are included in this update.

New CD and DVD images containing updated packages and the regular installation media accompanied with the package archive respectively will be available soon at the regular locations.

Upgrading to this revision online should be done by directing the aptitude (or apt) package tool (see the sources.list(5) manual page) at one of Debian’s many FTP or HTTP mirrors. A comprehensive list of mirrors is available at:

About etch-and-a-half

Etch and a half is Debian’s desire to support hardware that requires updated drivers. This marks the first time the Debian project updates several core packages in its stable distribution without security implications and demonstrates its huge dedication for their users.

Components newer than the first release of Debian GNU/Linux 4.0 (etch) that were not supported yet will be detected by an updated installation routine which is able to install a newer Linux kernel (2.6.24) on the freshly installed system. This revision includes packages that are based upon the Linux 2.6.24 kernel as well. Installation of these additional packages is not required and will not occur by default. The existing 2.6.18-based kernel will continue to be the default kernel for the etch release.

A more recent version of X.org, the X window system, also contains new drivers that add support to e.g. Geforce 8 series GPUs, intel 965GM, 965GME, G33, Q35, Q33 cards. Dual-head setups are also supported rudimentary.

These packages have been updated or newly introduced through etch-and-a-half:

Package Reason
linux-2.6.24 Updated for new kernel for etchnhalf
linux-kbuild-2.6.24 Updated for new kernel for etchnhalf
linux-latest-2.6-etchnhalf New kernel for etchnhalf
xserver-xorg-video-nv Supporting more hardware
xserver-xorg-video-intel Supporting more hardware
aboot Fix alpha build, add support for kernels newer than 2.6.23
b43-fwcutter Fix wrongly encoded es.po
debconf Make debconf-apt-progress compatible with the Lenny installer
sysvinit Update shutdown to work with libata in linux newer than 2.6.23
wireless-tools Update to claim support for WE API in etchnhalf kernel

Release notes covering the special features of etch-and-a-half have been written as well as a short update for the installation instructions.

Debian-Installer Update

The Debian-Installer was updated to repair an issue with the network-console installation option. Due to a lack of entropy in how the host key is generated, earlier Debian GNU/Linux 4.0 installers are vulnerable to a man-in-the-middle attack. Two other issues regarding installation on already existing RAID setups and recognizing PowerPC64 system have been fixed as well.

Miscellaneous Bugfixes

This stable update adds several binary updates for various architectures to packages whose version was not synchronised across all architectures. It also adds a few important corrections to the following packages:

Package Reason
apache2 Fix possible segfault introduced by patch for CVE-2007-6421
balsa Fix for stack-based buffer overflow
base-installer Correctly recognize powerpc64 systems
cbrpager Backported security fixes from upstream 0.9.18 for CVE-2008-2575
chkrootkit ‘Enye’ check was killing random applications
debian-installer Rebuilt images containing network-console
dns-flood-detector Actually write a pid file for start-stop-daemon
exiv2 Fix regression in security update
fai-kernels Rebuilt against linux-2.6_2.6.18.dfsg.1-21
firmware-nonfree Build-depend on new kernel ABI 2.6-6
glibc Fix nscd host caching and linker script for libraries using TLS
grub Fix 1 TiB disk addressing limit
hal Allow mounting ntfs volumes from within KDE
initramfs-tools Fix MBR checking on md devices and booting with Xen
kiosktool Correct the path to the KDE menu file
licq Fixing ‘ICQ version too old’ connection failure
linux-2.6 Fix several issues
partman-lvm Fix installation with already existing RAID
pdftohtml Transition users to poppler-utils
python-django Fix cross-site scripting vulnerability
qsynth Fix wrongly named desktop file
qt-x11-free Ease updates of KDE by hardcoding the unames
trac Fix multiple issues
tzdata New timezone information
user-mode-linux Rebuilt against linux-2.6_2.6.18.dfsg.1-21
vzctl Fix file permission transfer on migrations
wxmaxima Fix connection problems making the package unusable
xpdf Remove strict versioned dependency on xpdf-utils to fix upgrade
xpenguins-applet Avoid double free
znc Fix NULL pointer dereferences leading to crashes

These packages were updated on the specified architecture to bring the architectures back in sync:

Package Architecture — Reason
apache2-mpm-itk s390 amd64 sparc powerpc arm i386 mips ia64 alpha mipsel hppa — Rebuilt against updated apache2
gtimer amd64 — Rebuilt against Etch libraries
kdebase arm
kdelibs arm
sage ia64 — Rebuilt against libsdl1.2_1.2.11-8 to kill off dangling .la references
sear ia64 — Rebuilt against lib3ds-dev 1.2.0-4.1+etch1

Security Updates

This revision adds the following security updates to the stable release. The Security Team has already released an advisory for each of these updates:

Advisory ID Package Correction(s)
DSA-1484 xulrunner Fix several vulnerabilities
DSA-1485 icedove Fix several vulnerabilities
DSA-1492 wml Clean up temporary files
DSA-1497 clamav Fix several vulnerabilities
DSA-1498 libimager-perl Fix arbitrary code execution
DSA-1499 pcre3 Fix arbitrary code execution
DSA-1500 splitvt Fix privilege escalation
DSA-1501 dspam Fix information disclosure
DSA-1502 wordpress Fix multiple vulnerabilities
DSA-1505 alsa-driver Fix kernel memory leak
DSA-1506 iceape Fix several vulnerabilities
DSA-1507 turba2 Fix permission testing
DSA-1508 sword Fix insufficient input sanitising
DSA-1509 koffice Fix multiple vulnerabilities
DSA-1510 gs-gpl Fix arbitrary code execution
DSA-1511 icu Fix multiple problems
DSA-1512 evolution Fix arbitrary code execution
DSA-1513 lighttpd Fix CGI source disclosure
DSA-1514 moin Fix several vulnerabilities
DSA-1515 libnet-dns-perl Fix several vulnerabilities
DSA-1516 dovecot Fix privilege escalation
DSA-1517 ldapscripts Fix information disclosure
DSA-1518 backup-manager Fix password disclosure
DSA-1519 horde3 Fix insufficient input sanitising
DSA-1520 smarty Fix insufficient input sanitising
DSA-1522 unzip Fix programming error
DSA-1523 ikiwiki Fix cross-site scripting
DSA-1524 krb5 Fix multiple vulnerabilities
DSA-1525 asterisk Fix several vulnerabilities
DSA-1526 xwine Fix several vulnerabilities
DSA-1527 debian-goodies Fix insufficient input sanitising
DSA-1528 serendipity Fix cross site scripting
DSA-1530 cupsys Fix multiple vulnerabilities
DSA-1531 policyd-weight Fix insecure temporary files
DSA-1532 xulrunner Fix several vulnerabilities
DSA-1533 exiftags Fix several vulnerabilities
DSA-1534 iceape Fix several vulnerabilities
DSA-1535 iceweasel Fix several vulnerabilities
DSA-1536 xine-lib Fix several vulnerabilities
DSA-1537 xpdf Fix multiple vulnerabilities
DSA-1538 alsaplayer Fix arbitrary code execution
DSA-1539 mapserver Fix multiple vulnerabilities
DSA-1540 lighttpd Fix denial of service
DSA-1541 openldap2.3 Fix denial of service
DSA-1542 libcairo Fix arbitrary code execution
DSA-1543 vlc Fix several vulnerabilities
DSA-1544 pdns-recursor Fix cache poisioning vulnerability
DSA-1545 rsync Fix arbitrary code execution
DSA-1546 gnumeric Fix arbitrary code execution
DSA-1547 openoffice.org Fix arbitrary code execution
DSA-1548 xpdf Fix arbitrary code execution
DSA-1549 clamav Fix several vulnerabilities
DSA-1550 suphp Fix local privilege escalation
DSA-1551 python2.4 Fix several vulnerabilities
DSA-1552 mplayer Fix arbitrary code execution
DSA-1553 ikiwiki Fix cross-site request forgery
DSA-1554 roundup Fix cross-site scripting vulnerability
DSA-1555 iceweasel Fix arbitrary code execution
DSA-1556 perl Fix denial of service
DSA-1557 phpmyadmin Fix several vulnerabilities
DSA-1558 xulrunner Fix arbitrary code execution
DSA-1559 phpgedview Fix cross site scripting
DSA-1560 kronolith2 Fix cross site scripting
DSA-1561 ltsp Fix information disclosure
DSA-1562 iceape Fix arbitrary code execution
DSA-1563 asterisk Fix denial of service
DSA-1564 wordpress Fix several vulnerabilities
DSA-1566 cpio Fix denial of service
DSA-1567 blender Fix arbitrary code execution
DSA-1568 b2evolution Fix cross site scripting
DSA-1569 cacti Fix multiple vulnerabilities
DSA-1570 kazehakase Fix arbitrary code execution
DSA-1571 openssl Fix predictable random number generator
DSA-1572 php5 Fix several vulnerabilities
DSA-1573 rdesktop Fix several vulnerabilities
DSA-1574 icedove Fix several vulnerabilities
DSA-1576 openssh Fix predictable randomness
DSA-1577 gforge Fix insecure temporary files
DSA-1578 php4 Fix several vulnerabilities
DSA-1579 netpbm-free Fix arbitrary code execution
DSA-1580 phpgedview Fix privilege escalation
DSA-1581 gnutls13 Fix potential code execution
DSA-1582 peercast Fix arbitrary code execution
DSA-1583 gnome-peercast Fix several vulnerabilities
DSA-1584 libfishsound Fix arbitrary code execution
DSA-1585 speex Fix arbitrary code execution
DSA-1586 xine-lib Fix several vulnerabilities
DSA-1587 mtr Fix arbitrary code execution
DSA-1589 libxslt Fix arbitrary code execution
DSA-1590 samba Fix arbitrary code execution
DSA-1591 libvorbis Fix several vulnerabilities
DSA-1593 tomcat5.5 Fix missing input sanitising and cross site scripting issue
DSA-1594 imlib2 Fix buffer overflows in XPM and PNM loaders
DSA-1595 xorg-server Fix several vulnerabilities
DSA-1596 typo3-src Fix several vulnerabilities
DSA-1597 mt-daapd Fix several vulnerabilities
DSA-1598 libtk-img Fix buffer overflow
DSA-1599 dbus Fix programming error
DSA-1600 sympa Fix denial of service
DSA-1601 wordpress Fix several vulnerabilities
DSA-1602 pcre3 Fix arbitrary code execution
DSA-1603 bind9 Fix cache poisioning
DSA-1606 poppler Fix arbitrary code execution
DSA-1608 mysql-dfsg-5.0 Fix authorization bypass
DSA-1611 afuse Fix privilege escalation
DSA-1612 ruby1.8 Fix several vulnerabilities
DSA-1613 libgd2 Fix multiple vulnerabilities

A complete list of all accepted and rejected packages together with rationale is available on the preparation page for this revision:

Removed packages

The following packages were removed due to circumstances beyond our control:

Package Reason
glimpse Licensing issues
dcc Incompatible with DCC network, security issues
maxdb-7.5.00 Security issues

URLs

The complete lists of packages that have changed with this release:

The current stable distribution:

Proposed updates to the stable distribution:

Stable distribution information (release notes, errata, etc.):

Security announcements and information:

~GGG~

http://www.debian.org/News/2008/20080726

Microsoft, one of the biggest rivals to open-source programming, has begun funding the Apache Software Foundation, one of open-source software’s biggest supporters.

“Microsoft is becoming a sponsor of the Apache Software Foundation. This sponsorship will enable the ASF to pay administrators and other support staff so that ASF developers can focus on writing great software,” said Sam Ramji, a senior director of platform strategy at Microsoft. He announced the move Friday in a speech at the Open Source Convention, and noted Microsoft’s support of Apache on the software company’s Port 25 blog as well.

Obviously you might think this an opportune moment to cue up the soundtracks of record needles screeching and cars crashing into each other. But hold your horses.

For one thing, some within Microsoft have for years been making various encouraging words about open-source software, even though others have engaged in serious trash-talking. The company has no apparent desire to let the programming world have its way with Windows, as is possible with Linux, but Microsoft has been trying to make nice in some circles.

Playing nice with open source
For example, Microsoft has released its own open-source licenses and has put some technology under its Open Specification Promise, which lets open-source programmers use it. Also on Friday, Ramji said that policy makes it clear the promise applies to commercial uses of the technology, too.

Another example: Microsoft has been working closely with Zend for Windows support of PHP, an open-source project that lets servers create Web pages on the fly.

PHP is often used in conjunction with other open-source components: Linux, the Apache Web server software that’s used to dish up Web pages, and the MySQL database that’s used to store the data used to build Web pages elements such as online catalog pages or online forum postings. In fact, the four are used often enough that there’s an acronym for it: LAMP.

But there’s also the idea of WISP, which substitutes many of Microsoft’s own components: Windows, Internet Information Services for a Web server, and SQL Server for the database. On Friday, Microsoft released a patch to ADOdb, a package PHP uses to access databases. The patch lets PHP use SQL Server.

In other words, some parts of Microsoft are learning how to play nice with some parts of the open-source world.

Apache’s liberal license
Second is the Apache License that governs the foundation’s projects. Many of Microsoft’s attacks on open-source software were aimed at the General Public License, which has a reciprocity provision: If you make a change to a GPL project, then distribute software employing that change, you must share the change under the GPL.

The Apache License, though, lets programmers take software and combine it with proprietary software in any way, with no obligation to share. That’s how IBM, for example, uses the Apache Web server software in its proprietary WebSphere product.

For Microsoft, that means Apache’s projects can be used within Microsoft. And there are some that could be of interest.

Apache: Useful projects
Third is what the Apache Software Foundation is up to.

When it began, Apache didn’t have too many projects under its umbrella besides the HTTP Web server that has surpassed Microsoft’s competing products in market share since at least 1995, according to Netcraft’s Web server survey.

Now Apache has dozens of projects.

Here’s one that Microsoft, given its so-far fruitless efforts to catch up to Google in search, might enjoy: Hadoop, an open-source version of Google’s MapReduce algorithm that’s instrumental to processing huge data sets. Yahoo contributes to Hadoop and uses it in its own operations.

There’s nothing stopping Microsoft from using Hadoop or any other Apache project without funding Apache, but sponsorship makes some sense for political and practical reasons.

~GGG~

Billionaire, cosmonaut and founder of the fast-growing Ubuntu Linux distro Mark Shuttleworth dreams impossible dreams.

No, not a return to the stars. He believes in something that’s far harder for mortal open source engineers to achieve.

That dream? To produce a desktop more beautiful to ordinary users than legions of Apple programmers supping on the milk of chief exec Steve Jobs’ alleged brilliance are capable of producing. That includes a desktop not funded by a clutter of annoying banner or Flash-based ads, but paid for by subscription-based services.

Now you’re done dreaming, go home and code for the victory.

the company in the quality of the desktop experience they deliver users.

His company Canonical, Ubuntu’s commercial sponsor, is working to make the Ubuntu desktop “more beautiful” in the next two years, he told OSCON.

“I think the great task in front of us in the next two years is to lift the experience of the Linux desktop from something stable and usable and not pretty, to something that’s art,” Shuttleworth said.

“Think of the way the iPhone uses a pure software experience, it abstracts away all the hardware,” he said. “You can paint anything on the screen because it’s all software.”

There is the tiny question of funding open-source development. Shuttleworth noted the demand is clearly there from companies and individuals for open-source software, but where the money comes from to support such efforts is not clear.

The noise machine of Web 2.0 and software-as-a-service (SaaS) is all about ads-based revenue. Even mighty companies such as Microsoft are willing to stuff their software full of ads, which are irritating to users and cause distractions. Just for the chance to get online ads dollars.

Carrying the banner of the TiVo generation, Shuttleworth dismissed placement of ads in desktop software as “offensive”. He suggested ISVs should make money doing a little hard work selling services, instead.

“There is an emerging emphasis on services – that is the engine to invest in free software applications,” he said. “We [Canonical] are hiring guys to work on the desktop… the rationale is online services. This must be a shared platform.”

According to Shuttleworth, open source provides unparalleled opportunities to generate wealth and create change through innovation. He supported open-source projects like Firefox, which rely on plug-ins to harness other people’s ideas and extend the underlying platform.

He warned that a few challenges exist on the road to greater innovation, wealth and social change via open source.

Platform, tolerance and Linux

First, there’s a need for “platform tolerance”. Open source must figure out how to work with rather than exclude those on Windows. “While we can all be focused on making Linux the winning platform, we need to think about how we work with other people who work across multiple platforms,” he said.

Open source needs the participation of non-experts using tools that are simple enough for non-rock star developers to use. “The bulk of participants in free software projects come from people around the core… We sometimes focus on the rock stars. Choosing tools in our projects that make it easy for people to get stuff done and get out is a winning strategy,” Shuttleworth said.

He also returned to a familiar theme of greater cooperation between disparate projects. Coordination of releases would be beneficial in cases where there are interdependencies, reducing bugs, helping produce a general open-source platform that could bring open source to the attention of the world at large.

~GGG~

as reported by theregister.co.uk