Ugo's Blog

http://www.msrbl.com/ Looks promising.

I'm starting to test this out today: http://www.sanesecurity.com/clamav/index.htm I hope there won't be too many false positives... Anyone using them already?

It didn't take much time until I found pitfalls with VPSs. Today, I got bit by memory problem. My VPS had 128 MB RAM max. Before installing my usual packages, the memory usage was around 20 MB. Nothing! :). But then I installed my packages, forgot to tweak apache to minimize memory requirement. Installed mysql for cacti, configured cacti... Then, this morning, I realize that many processes were missing on my VPS. Why? I had enabled the yum daily cronjob.... mistake! Do you have an idea of how much memory yum uses? Too much. Tektonic told me that they stopped selling UM0 packages because of that: too many clients having memory problems. I upgraded my plans to UM1. I'm wondering though... how does Vpslink do with the smallest plan, only 64 MB RAM! I can't end this post without adding again how much helpful the folks at Tektonic have been up to now.

Hi, Time for another knowledge-sharing post. I recently discovered a very good alternative to shared, reseller, or dedicated hosting: A virtual private server (VPS). In fact, a VPS is a virtual machine running, with many other virtual machines (VM). There are many packages, but the cheapest are: Tektonic (Based on Virtuozzo. I own 3 VPS from them. Very, very nice and responsive people. They've been very supportive for me in my beginnings with VPSs. OpenHosting (Based on linux Vserver, fedora core 4 only for now, interesting utility billing system) Vpslink (Based on OpenVZ, the open-source version of Virtuozzo, never tried yet) Tektonic puts limit on outbound bandwidth that can be sometimes harsh. (Unmetered 1 mbps max for the smallest plan (15$/month)). That is more interesting for applications that don't need much outbound traffic (like remote backup, you have an unmetered 100mbps!) or e-mail, which don't really need an instant transfer, but can be problematic for web...

This is just a quick post to encourage people to try SnertSoft's excellent anti-spam milters. If you're running a spam-filtering gateway, you may want to try milter-ahead. It checks at the backend mail server if the user exists before accepting the message. Milter-sender is also very interesting, it checks for the existence of the sender's e-mail before accepting the message. Milter-link checks for URL in message bodies againsts URI blacklists. And this one is free! (most are). All the milters' descriptions are here . Anthony, the author, is very kind and offers good support. Have a look at his website . There are many other milters that may help you reduce the load on your spam-filtering system and reduce the number of spams that make it to your user's mailbox!

I started using syndication recently. I like the idea of reading the news in Thunderbird instead of having to go to 10 websites. Of course you can read this blog via RSS :). http://lubik.blogspot.com/atom.xml

I have been using PfSense for a month now, so I thought I should post about it... I ran into a few problems that I'd like to share: Unexpected crashes caused by a PSU that was not powerful enough All my devices/computers lost their IP address (DHCP) I solved the first problem using an 1.5A PSU (I was using a 0.8A PSU). It only crashed once since then, but my target is more... 0 (a firewall shouldn't crash). For the second problem, I increased my lease time to 1 week. Logs show nothing about what could have caused this incident (according to the logs, PfSense's DHCP server was still serving clients correctly). NOTE: RC2 is out, I'm trying that right now...

I just started playing with Nagios, an open-source monitoring software package (GPL). I used to use monit instead, but there are two limitations of monit that made me switch: It can only do port/protocol checks on remote hosts It has no tolerance setting for check failures (it sends a warning as soon as there is one failure) On the other hand, Nagios has tools that allows a Nagios server to perform "local" checks on remote servers, via the network (check_snmp, check_nt, check_nrpe and check_ssh). It has as side effect that it can monitor Windows servers quite well. The web interface enough for my needs. Note: I'm still using monit for process checks, as Nagios can't do that as well as monit does (monit uses the information in the lockfile to see if the process is still in memory, and uses user-defined commands to restart the process if it is not in memory). Here is how Nagios works, basically: The tools that do the checks are called plugins Objects have to be defi...

I finally made the switch from m0n0wall to PfSense today. It all went well (PfSense can import the m0n0wall config file directly), except for one thing: After the switch, I didn't have any audio when calling through one of my VoIP provider. I fixed the problem by enabling advanced outbound NAT, and enabling the static port feature for the default rule. I needed that because PF, the packet filter used in PfSense, scrambles automaticallly the source port for more security, but VoIP needs it to be the same port to know what session it is part of. Next step is to enable it only for my Asterisk server and my Vonage ATA, instead of my whole lan. In the end, PfSense is worth the try. I think the VoIP traffic shaping is still not perfect, but it'll probably be fixed before it is released as stable (it is now RC1). Feel free to share your experiences with firewalls :).

Hi, I played with SquidGuard in the past few days to control what users can access on the net and when. Is it quite a great package, as it did what I needed to do. That is basically how it works: You can define Time Spaces You can define source groups (hosts or networks, or IP addresses ranges, or users) You can define destination groups (domains, urls, regex) Finally, you define acls with all those parameters You can add blacklists to the mix I have recommendations for people who would like to try squidguard: Don't forget that SquidGuard is a redirector, if you don't configure a redirect URL, it will do not block anything Check all the logs You need to know that when SquidGuard encounters a problem (config or else), it goes into emergency mode, in with it does nothing (nothing is blocked) I suggest you avoid using the webmin module. I can't tell it is 100% sure you'll have trouble with it, but I lost many hours because of it. If I can find some time eventually, ...

I was looking for a way to satisfy a group of users who were used to work with Microsoft Exchange, but are familiar with the performance and reliability of Linux, and would like to save money in the process of getting their own collaborative server. I had a list of potential replacement packages: Kolab Open-xchange Scalix OSMER Opengroupware Egroupware Horde Gordano @mail Bynari Kerio Zimbra Which one is the best? I can't tell... Which one won? Well, Scalix. Why? Because of native Outlook connectivity(note: you have to install a free software on your Windows PC, free for up to 25 users Ease of installation No database required Very nice (AJAX-based) webmail interface We're still testing it, so I'll keep you posted on the results.

Recently, I (re)discovered a very nice lizard species: Skinks. In fact, I knew blue-tongued skinks, and I discovered prehensile skinks. Prehensile are especially nice, since they have a prehensile tail, their tail can support the weight of the lizard. Here is a picture of a magnificent one (see left): I really think it is the ideal lizard: Vegetarian or omnivore (many people don't like feeding their pet with live insects), and very calm. I wish I could beed them, but I don't think it is realistic. They cost about 200$ each, and it requires a lot of time and care. I can just hope that skink reproduction will raise in my area.

I now have a PBX at home, based on Asterisk, and it is amazing... It is incredible the quantity and quality of features that it includes. I really love it. I've been helped by someone who works with that all day long, but I'm getting more and more comfortable at configuring it and the related hardware (IP phones, ATAs). Hopefully, I'll be completely able to install Asterisk servers on my own.

... Ornate climber. Or maybe is it a blue-eyed crested climber... Not sure. It doesn't have a name yet, so please feel free to send me ideas. It is a male. I think I'll call him Brutus.

Hey! Insecure Mag just published an article I wrote some time ago for them about MailScanner and server-side spam and virus filtering. You can read it in the new issue (1.5). Have fun, and... your comments are welcome!

Je considérais le Greylisting comme un sujet assez important pour traduire mon article sur ce mécanisme anti-spam: Voici une explication du "Greylisting", un mécanisme très efficace contre les spams: Basé sur des " triplets " (adresse de courriel de l'expéditeur, adresse de courriel du destinataire, adresse IP du serveur d'origine). Quand un serveur recoit une connexion SMTP d'un autre serveur, il vérifie le triplet. Si le triplet est connu, le message continue son chemin. Sinon, le serveur refusera la connexion à l'aide d'un message SMTP 450 (échec temporaire), donc disant au serveur d'origine: Je ne peux accepter le message présentement, veuillez revenir plus tard. La plupart des serveurs de courriel respectent cette règle ( RFC821 ) et ré-essayent une connexion quelques minutes plus tard (Microsoft Exchange et Hotmail: normalement 1 minute, Yahoo: ~5, Sendmail: ~7, Postfix: ~1, Exim: ~3). Les délais sont normalement minimes, si perce...

Finally, an easy-to-use and friendly stats engine for my blog... Thanks to http://www.sitemeter.com/ . See my stats here .

I really need this shower notepad ! No kiddin'. ;-)

What is a hoax? The sound you make when you sneeze? Nah... It is a false rumor. You probaly receive e-mails saying, for example, that a little boy in a foreign country will earn 5 c ents every time you forward this e-mail... Or that a new virus has been announced by Microsoft? Those are not true, but forwarded by people who just don't know how to check. There is nothing good with these e-mail messages and their only consequences are losses of time for a lot of people. Please don't forward these e-mails before checking if the information they contain is real and true. But how to do that? I'll give you the means today. You need to know if a message is real or a hoax? Go see HoaxBuster (french) this other site . Anti-virus vendors also have such sections on their website ( Mcafee and Symantec ) You want to be aware of virus trends? Every anti-virus vendor has a database of viruses ( Mcafee , Symantec , Kaspersky ). Microsoft is not (as of today) an anti-virus vendo...

Computer security is important for everyone. People often underestimate the cost of computer labour and think that when they buy a computer, there will be no other costs other than the purchase cost. Wrong! But you can easily reduce the risk of needing computer specialists' services with a few tips (there is no cost associated with those). Short version: get AVG anti-virus , free edition, and MS Anti-Spyware . Long version: Get a free anti-virus. I recommend AVG, Free Edition . Not really because it is the best... I haven't tested them all. However, it is the one I've been using at home for a long while and I'm pretty satisfied with it. It is also easier for me to help anyone who's using the same software as I use. Note: AVG Free Edition can not be used in a business context. It is only allowed for personal use at home. Please respect licences. WinClam is an open-source virus-scanner Get a free anti-malware program. If you have a legal copy of Windows...