Regarding 'The Free World', 'The Internet' and You.

It's not often that politics gets my back up about something that I feel the need to post it here, but while watching Question Time in the Senate last night, the topic of the great firewall of Australia came up -- again.

For International Readers: This isn't exactly new, compulsory ISP-level filtering was tried in closed-quarters in 1999 and 2001 -- however, these were opt-out and focused on guarding against underaged illicit content.

For Local Readers: There's a protest going on in the state capitals for the weekend of the 13th and 14th of December, if you care -- you should be there.

For everyone: The EFA has a very well researched document into why said filtering of this type is a flawed exercise, which you should read.

This time around, there's at least two lists -- one banning underaged illicit content and the other banning 'undesirable content'.

Couple this with the fact both of these lists are privately built, without public consultation -- and the fact -- there's no ability to opt-out.

"Canberra, We may have a problem."

(oh, and the rest of the world is laughing at you, just by the by.)

Anyway...

While Conroy was discussing porn and blocked keyword sites that the ACMA list comprises of during the trial run (beginning on December 24th).

Senator Bernardi said:

I note that the minister failed miserably to answer that question, which was specifically about the number of people needed for a trial to be credible. I also note that in the expression of interest documents the second stream of the trial includes a filtering of other unwanted content. I ask the minister:
Has this unwanted content been identified, and by whom?

Senator Conroy came up with an interesting number in regards to the number of blocked sites, that i'd not heard before:

The list could contain 10,000 [potential sites].
When you look around the world at Interpol, the FBI, Europol and other law enforcement agencies and you look at the size of the lists that they are actually using at the moment, 1,300 would not be sufficient to cover the URLs that we would have supplied to us with the purpose of blocking.

(Quotes from Australian Government Senate Hansard - 03/12/2008) (any emphasis mine)

I wonder, Supplied by whom?

Given the ACMA already have a link for people to report prohibited content, one wonders if the government plans on listing these sites as well as the ones supplied by law enforcement verbatim, or at least vetting them to ensure rogue parties aren't submitting them for their own ends.

Repairing an Apache 2.2 Modules Installation.

note: This article is intended for a technical audience -- you should use caution when modifying a production system -- caveat emptor.

Sometimes, Ubuntu (and before it, Debian) drives me up the wall.

Recently, an apache2.2-common upgrade saw fit to blow away my /etc/apache2/mods-enabled directory, but not recreate the defaults, so I was left with an empty directory and a server that wouldn't restart due to various errors that looked similar to:

"Invalid command 'Order', perhaps misspelled or defined by a module not included in the server configuration"?"

Looking around on the web, this doesn't appear to be a new issue, but it doesn't appear to be terribly well answered either -- all I knew, was that I had a box that needed SSL, PHP, Expiry Headers and well, that's it -- aside from the basic functionality.

My first test was to purge the package and re-install it, which did give me back the functionality I wanted, together with a bunch of other modules I didn't need -- I proceeded to leave it and go to bed, only to be greeted with a message from the hosting provider telling me i'd overblown my shared-hosting's RAM quota for the day and that my account was temporarily suspended.

So, I removed the directory and started working piece by piece to put things back together until both Wordpress and OSCommerce booted up and ran correctly.

note: You can also do this with Apache's handy a2enmod program, but i'm a purist -- so i'm going to do it here via 'ln -s'.

First, to obtain basic functionality, you'll need to log in as root (or sudo to root) and issue the following commands, depending on which error your Apache 2.2 installation gives you.

If you see: "Invalid command 'Order', perhaps misspelled or defined by a module not included in the server configuration?", run:

ln -s /etc/apache2/mods-available/authz_default.load /etc/apache2/mods-enabled/authz_default.load
ln -s /etc/apache2/mods-available/authz_host.load /etc/apache2/mods-enabled/authz_host.load

If you see: "Invalid command 'DirectoryIndex', perhaps misspelled or defined by a module not included in the server configuration?", run:

ln -s /etc/apache2/mods-available/dir.load /etc/apache2/mods-enabled/dir.load

If you see: "Invalid command 'Alias', perhaps misspelled or defined by a module not included in the server configuration?", run:

ln -s /etc/apache2/mods-available/alias.conf /etc/apache2/mods-enabled/alias.conf
ln -s /etc/apache2/mods-available/alias.load /etc/apache2/mods-enabled/alias.load

If you see: "Invalid command 'AddType', perhaps misspelled or defined by a module not included in the server configuration?", run:

ln -s /etc/apache2/mods-available/mime.conf /etc/apache2/mods-enabled/mime.conf
ln -s /etc/apache2/mods-available/mime.load /etc/apache2/mods-enabled/mime.load

If you don't see any of those, but Wordpress 2.6.x (or 2.7.x) will not let you login (ie. you can install it, and you see the admin screen, but you get 'permission denied', 'forbidden' or a directory index -- rather than your admin dashboard) then try running:

ln -s /etc/apache2/mods-available/asis.load /etc/apache2/mods-enabled/asis.load

and restart Apache.

update [12-12-2008]: Wordpress 2.7 will fail to install unless you have the 'env' module installed, so you may also need to run:

ln -s /etc/apache2/mods-available/env.load /etc/apache2/mods-enabled/env.load

Once you've restarted, your Apache installation should basically work -- to add advanced functionality, you should visit the Apache 2.2 Modules Documentation pages and adapt the lines above to suit the function you need.

Signs Of The Future.

Since Luis Villa first mentioned it, i've been following the election blog at Princeton -- I don't read many political blogs anymore, but it does have to be one of the better ones I keep on my list, the posts are impartial and the graphs and charts are clear and concise.

I'm not an American, so I can't vote -- but having dealt with Americans on a near daily basis for the last eight years, i'd like to think there'll be enough people with enough power to enact some serious change in the political landscape, for the people, for the country and for the world.

It'll be interesting to watch the live graphs on the Princeton site over the next few hours.

update [05/11/2008 16:15 GMT+11]: Looks like Obama Wins -- the people have made their choice.

Smart-ISP Configuration for Postfix.

note: This is another 'no-brainer, don't forget this again' type post, but I thought i'd put it here incase anyone else can make use of it.

Recently, I was told that a client needed to forward all their corporate mail via their local ISP and that I should set that up for them using their existing, internal-only mail handling Postfix server.

The key additions to their /etc/postfix/main.cf file was (aside from configuring SASL, which you should do anyway and setting the relayhost parameter correctly) was:


+++ mydestination =
+++ local_recipient_maps =
+++ local_transport = error: no local delivery service


and:


+++ myorigin = the outbound domain name you need.


Then, you need to comment out (with a #) the local transport method in your /etc/postfix/master.cf file.

Remember that, brain!

Clickjacking, 1999 Called...

Betanews isn't something I read often anymore, but this article intrigued me.

It's amazing that after nearly 10 years of active development on the web, standards and the rest -- and the best idea people can come up with for preventing clickjacking is using security=restricted to break frames (aka. frame busting code).

Using mod_security, you can at least write filtering rules that eliminate iframes and other annoying content at the server level and for Firefox users, NoScript does an excellent job of handling it at the desktop level (after, of course enabling the "Forbid IFRAME" option.)

For Internet Explorer users, I don't know what to tell you -- something tells me that's why the Internet remains as it is.

I often wonder if the whole IFRAME tag will be removed from HTML 5.0 -- with all the forward-thinking ideas that CSS 2.1 and 3.0 bring to the table, the only people seeming to use frames on new pages now, seem to be those wishing to exploit it.

VSFTPd Configuration for Non-Interactive Users

note: This article is intended for a technical audience -- you should use extreme caution when modifying a production system -- caveat emptor.

This is one of those 'it's not broken until you trip over it' things that I wish i'd known about earlier, in posting it here -- i'm hoping other people can find it without wasting the amount of time I did.

So, I had reason to set up a new VPS box with the LAMP stack, SSH/SCP and VSFTPd for FTP use -- my usual command says something like:

useradd -n --gid www-data -s /bin/false [username]

In a nutshell, this:

• 
  Does not create a new group specific to the user.
  


• 
  Makes the user's primary group www-data (useful for users being able to access / upload / modify their own web code).
  


• 
  Sets the default shell to /bin/false, which does not allow the account to login interactively.
  

However, when you use an FTP client, it bails out with a 530 error, telling the user either their username or password are wrong.

So, the next step is to reset their password and try again -- nope, no difference.

Try changing the shell from /bin/false to /bin/bash with chsh though:

chsh -s /bin/bash [username]

... and everything works correctly.

We don't want to use /bin/bash though, because (amongst other things) it allows interactive logins via SSH or the console, which poses a security risk for the other users of the box.

Ubuntu & Red Hat (and probably a whole bunch of others) include the nologin command, which does exactly what we want (provides a message that the user cannot login, and exits).

OK:

chsh -s /sbin/nologin [username]

Try FTP.

It still errors.

As it turns out, the reason it errors is due to it not being included in the /etc/shells file that VSFTPd and other system daemons use to determine if your shell is valid.

Turns out, it's a very easy thing to fix -- simply:

echo /sbin/nologin >> /etc/shells

note: Some distributions ship this as /usr/sbin/nologin -- you may wish to run whereis nologin first to determine where your copy is.

Try FTP again.

:)

Disabling Control-Alt-Delete on Linux Servers

A colleague rebooted a server unintentionally by having the keyboard plugged into the wrong machine (or, more correctly, typing on a keyboard not connected to the box he was looking at)

After the users swore at him a little, he rang for advice -- luckily, in these days of event driven machines, on a recent Linux distribution (RHEL 5 / Ubuntu 8.04) disabling the C-A-D on critical machines is easy.

First, open /etc/event.d/control-alt-delete.

Now, change the line:


--- exec /sbin/shutdown -r now “Control-Alt-Delete pressed”


To:


+++ exec /bin/echo "Control-Alt-Disable has been disabled"


Save the file and restart the machine, the next time you press Control-Alt-Delete, you'll get a nice message saying things were disabled, rather than a bunch of angry users.