ConfigServer Services Blog

MailScanner Script v2.29 Released

Changes in this new release to the script are:v2.29 – New version of MailScanner 4.49.7Upgrades can be done by following upgrade instructions.Details of the MailScanner Changes:

The full Change Log is this:* New Features and Improvements *- Speed improvements for sendmail systems by changing the

OS Updates breaking perl and therefore MailScanner

We have had a lot of reports about MailScanner failing with perl module errors. We’re finding that this has nothing to do with MailScanner at all. It’s because clients are not excluding perl updates from their OS providers update utility (e.g. yum or up2date). There was a recent update to RH based OS’s with a new iteration of perl which fixes some security bugs. Most likely this has downgraded installed version of perl (perhaps v5.8.7) to v5.8.0 which won’t contain all the perl modules needed to run many things including MailScanner, cPanel and it will almost definitely break cPanel stats.The fix is fairly simple:

cd /usr/bin ls -la perl*

establish which version of perl you should be using:

cp -avf perl5.x.x perl

Check it’s correct with:

perl -v

Check that /usr/local/bin/perl is a symlink to /usr/bin/perl. Then stop and restart MailScanner, cPanel and any other daemons running through the perl interpreter.

Moving to IMAP and away from Microsoft

Well, with the advent of courier-imap and multi-session login for IMAP now available we’ve decided to move our sales@waytotheweb.com joint mailbox from POP3 access using Public ShareFolder to using an IMAP account on our local server. I’ve moved over to Thunderbird and am enjoying using it. There are some important functions from Outlook that I miss, especially having it remember frequently used folders to move mail items to, though there is a workaround. I am enjoying being able to view emails in the format they arrived in rather than the bastardised format that Outlook stores email – it still amazes me how an email client can both store email bodies in a different format to which they were delivered and to also ruin email headers to make them next to useless. Unfortunately, Outlook is a well featured email client, but I’m not sad to see the back of it.The move was important to us. We keep all email, going back to before 1998 when we started this business and so it needs to be a robust solution. The main gotcha was that courier-imap doesn’t like you using either a slash or a dot in folder names, which meant for a lot of renaming for some parts of our folder structure. Other than that, the only real issue with Thunderbird/IMAP is the somewhat flaky new email detection, but I’m getting used to it 😉

Blog Mailing List

Due to popular demand, I have added a mailing list for this blog. It’s for announcement of new blog entries only and emails will be a simple title and link to the new blog entry. Access to the list is always available from the menu on the right or here.

Firefox v1.5 and Googlebar

I upgraded to Firefox v1.5 yesterday without any problems. Quite a few extensions were disabled, but either upgrading or simply reinstalling them fixed them all up except for the excellent googlebar. Since they no longer seem to be developing it anymore, I decided to hack the XPI file and it works just fine in v1.5 of firefox now.For those that are desperate for their Googlbar, you can download my hacked version of googlebar-0.9.12.01-fx.xpi. Just install it and then restart Firefox.

mod_security v1.9.1 released

There’s a new version of mod_security that has just been released. Here are the details:

ModSecurity 1.9.1 is a bug-fix release. It fixes four minorissues discovered in 1.9.Changes (since 1.9)——————-* Variables OUTPUT and OUTPUT_STATUS are no longer silently

APF antidos

With a wide range of experience in dealing with issues and problems caused either directly or indirectly by APF, I’ve come to the conclusion that the antidos (AD) feature of APF is much more trouble than it is worth. With it enabled, it’s apparent that the iptables rules can very quickly become dangerously full. This can lead to at least two issues:

  • Ethernet traffic is slowed down due to the large number of lookup checks required
  • A server can be rendered unbootable

That last point is the most dangerous. I’ve seen several servers with around 1000 IP addresses in the firewall preventing a server from booting. IIRC, this happens because APF is taking so long to load up the iptables rules, the boot sequence basically stalls and goes no further.Details on disabling antidos if you have it enabled follow…Steps to disable AD:

  • Edit /etc/apf/conf.apf and set: USE_AD=”0″
  • Empty out the AD rules: cat /dev/null > /etc/apf/ad/ad.rules
  • Restart APF: apf -r
  • Remove the root crontab entry that mentions antidos, also check /etc/crontab
  • Make sure that antidos isn’t still running in cron: killall -9 antidos

Apologies

Apologies to those that had added comments. I decided to switch
to different blog software that made my life easier. Please feel free
to post again if you wish 🙂

Vulnerabalities and Viruses

Added a new page to the site that lists the latest bugs and vulnerabilities from Security Focus and the most current virus threats from ESET

I must say that I really do like NOD32 for windows-based virus scanning and we use it on our main PC’s. Our servers are, of course, all protected by ClamAV which works excellently at filtering out email borne viruses 🙂