De symptomen

Waarom is de mail niet van de bank? Afgezien van een ogenschijnlijk echte inhoud zijn er een aantal zaken waaruit blijkt dat dit een nepmail, ofwel Hoax, is:

• De mail is niet rechtstreeks aan mij geadresseerd. Daarbij komt dat een afzender adres eenvoudig te vervalsen is.
• Een bank zal dergelijke mails niet snel versturen. Heb je argwaan kan je gerust de versturende partij even bellen voor opheldering.
• Als je de link in de mail kopieert en plakt in je kladblok zie je dat de url heel ergens ander naar verwijst.

De link bevatte de volgende url: http://64.15.147.205/~abverify/secure

Dit geeft de doorslag want ze vroegen daar vervolgens al je gegevens in te vullen. Als daar niet de domeinnaam van je bank staat dan is er vast en zeker iets niet pluis.

Ik heb (in minder dan een week) nog twee andere mails ontvangen en wel met de volgende afzender en titel:

From:     RABO BANK <info@rabobank.nl>
Subject:     Klanten Service

en

From:     ABN-AMRO Bank <ABNAMRO_Alert@accountant.nl>
Subject:     ABN-AMRO Alert – Uw Internet Bankieren is geblokkeerd

Ook beiden met een link die niet lijdt naar de website van de betreffende bank, en zoals we zojuist hebben geleerd dus beiden een hoax.

Uit nieuwsgierigheid een link gevolg en daar kom je inderdaad op een website die LIJKT op de website van de bank.  Dat is hij niet en vul ook zeker niets in.

Surf veilig!

Heb je vragen over je website, je CMS, je hosting provider, of hoe nu verder? Stel ze op de Web-In-Sight fan-page.

WebTip #1: “Hou je website overzichtelijk voor je bezoekers. Minder zoeken draagt bij aan de effectiviteit.”

In WordPress 3.3.1 the extra ‘return’ now stays in your text after saving your pages and posts.

Ever wanted to have an extra white line in your post just because it looks nice? Searched the forums and all you got was replies to go straight into the CSS code? … But I just want that 1 line d*mned …

Mind you, It’s beyond dirty but very effective. Here’s how:

Put a “.” (dot) on a new line and give it the same color as the background.

.

Regards,

Gerard.

P.S. noticed the space above “Regards,” …

Ever had the pleasure of supporting a development team in their efforts to reach deadlines and therewith smoothing out the deployment process? It can be a complex task when the deployment covers multiple servers at once. From a sysadmin point of view you are concerned with network and naming conventions of your web-, database- and possibly other servers.

The context

Nevertheless, you need to communicate with the developers about this without overloading them with network details. Practically a set of server names should be enough for their deployment configuration. Of course I’m primarily talking about framework based application deployment running on Django, Rails and so on.

When handling SSL only websites there’s the IP address per website restriction (not taking SNI into account). Then there’s the gray area; The configuration parts that are both server and application related. Doing an article on Apache 2.x trickery I’m talking about the VirtualHost setup, but there are others to consider like logrotation, cron vs. application framework jobs, etc.

Having peeked, this article indeed describes a setup that involves Apache and how to ease the work of the development team. Before taking of I’d like to add one more detail into the mix. For design reasons I consider it good practice to have a seperate IP to address a server besides the ones you use for your services as web, database, file uploads or any other. This separates traffic to your server for e.g. monitoring, backups, abuse filtering, security, etc. next to your regular service traffic.

Having such a clean setup, but also for security reasons, setting up Apache with 0.0.0.0:443 or *:443 doesn’t fit in my opinion (better explicit then implicit).

Having set the context I’ll get into the technical details.

The setup

As was written we need a ‘VirtualHost’ setup that is transparent to the developers but should contain all information for Apache to operate properly.  Besides necessary modules and what not the snippet below displays the minimal required configuration directives.

NameVirtualhost 1.2.3.4:443
Listen 1.2.3.4:443

<Virtualhost 1.2.3.4:443>

    # Your vhost config

</Virtualhost>

Note: I’m putting the listen statement in the virtualhost config file and not in Apache’s ports.conf to keep things contained with the application’s configuration. Here’s the first conflict because this would mean different configs in de developers codebase for every server they deploy on. We’ll resolve that in a minute.

Apache symlink intermezzo

More on keeping things contained along side your application, mainly for upscale portability, we put the file with Apache’s vhost config in an etc directory under the application codebase. E.g: [app basedir]/etc/apache.conf

Usually, with Apache, site configurations are stored in /etc/apache2/sites-available and they are enabled when symlinked to from /etc/apache2/sites-enabled.

When putting the vhost configuration under your app codebase you simply link from ‘sites-enabled’ to that location.

$ cd /etc/apache2/sites-enabled
$ ls -l
total 0
lrwxrwxrwx 1 root root   74 2011-05-04 19:47 www.example.com -> /home/appuser1/sites/www.example.com/config/etc/apache.conf
lrwxrwxrwx 1 root root   79 2011-05-04 19:48 www.other.com -> /home/appuser2/sites/www.other.com/config/etc/apache.conf
lrwxrwxrwx 1 root root   71 2011-06-10 15:22 another.other.com -> /home/appuser2/sites/another.other.com/config/etc/apache.conf

The thing to lookout for when running multiple apps: the symlink sourcename must be set different from the name ‘apache.conf’ otherwise you get a name conflict in the /etc/apache2/sites-enabled directory. This is done with the ‘ln’ command in de following manor:

$ cd /etc/apache2/sites-enabled
$ ln -s /home/appuser1/sites/www.example.com/config/etc/apache.conf www.example.com

Now that we know what goes where we can work on the relation between the IP adresses and the different applications or vhosts.

Installing the glue

We need mod_define for this, found here: mod_define. With this module we have the ability to set $variables within the Apache configuration files.

Installation is rather simple. Download it and run (as root):

$ apxs2 -i -a -c mod_define.c

Good chance the module is automatically enabled using the apxs2 command but that might depend on your distro. Otherwise you can either use a2enmod or simply symlink between /etc/apache2/mods-available and /etc/apache2/mods-enabled. The file your looking (linking) for contains the following:

$ cat /etc/apache2/mods-enabled/define.load
LoadModule define_module      /usr/lib/apache2/modules/mod_define.so

Enable the module linking it like so:

$ cd /etc/apache2/mods-enabled
$ ln -s ../mods-available/define.load

Note that your installed module, as configured in ‘define.load’, might end up elsewhere under ‘/usr/…. ‘ depending on your distro.

The glue in effect

Besides the seemingly complicated context it simply comes down to a list of variable names containing IP adress/port number combinations. The below example should explain this.

<IfModule define_module>
    # IP's are example public addresses
    Define bind_address_www_example_com 1.2.3.4:443
    Define bind_address_www_other_com 2.3.4.5:443
</IfModule>

After making sure the module is enabled we place the ‘vhost_bind_adresses.conf’ file in ‘/etc/apache2/conf.d’. After this file has been set up we can use the defined variables in our VirtualHost configuration. These are about the only thing that the development team should stick to (assuming the vhost file is included in their codebase). Considering the file wherein we defined the variables a vhost file looks like this:

Listen $bind_address_www_example_com
NameVirtualHost $bind_address_www_example_com

<VirtualHost $bind_address_www_example_com>

    ServerName www.example.com
    ServerAdmin webmaster@example.com

    LogLevel warn
    CustomLog /home/appuser1/sites/www.example.com/log/apache.access.log combined
    ErrorLog /home/appuser1/sites/www.example.com/log/apache.error.log

    DocumentRoot /home/appuser1/sites/www.example.com/

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/www.example.com.cert
    SSLCertificateKeyFile /etc/ssl/certs/www.example.com.key

    # <-- SNIP -->

</VirtualHost>

Note: As said, the Listen and NameVirtualHost directives are in de vhost file instead of the ports.conf.

The beauty of this setup is that we can shuffle our server configuration without any changes to the developers code base. Creating/deploying new apps simply means adding a variable to ‘vhost_bind_adresses.conf’ and updating the development team about the name.

Gotcha’s

Not much I can think of. If you agree on a variable name with the development team that is unambiguous, for instance: $bind_addr_www_domain_com there’s not much that can go wrong.

One more tip: Learn yourself to use apache2ctl -t after changing stuff because restarting Apache while having syntax errors results in only stopping Apache. Which in it’s turn causes already running websites being unavailable for your audience.

Any comments or questions are welcome.

GrtzG

Case exploration

In this example I use my own setup but it should be doable on any host/guest OS combination. My setup is a Macbook running OSX snow leopard with a guest OS running Ubuntu server. Before getting into the details; The trick is to hook up Ubuntu’s eth0 to one of your normal interfaces (physical or wifi) and link Ubuntu’s eth1 to a virtual network device in your host OS. In this setup you always have local (back-end) access to your virtual guest OS and whenever you have Internet access so does your guest OS.

The details

I’m assuming you’re already running Virtualbox on OS X and an Ubuntu installation as guest OS. First we need to create a virtual network interface to which we can ‘link’ our eth1. For this we need a driver that emulates a network device. Typically we need a tun/tap driver. Therefore download and install Tuntap for OS X. In the Virtualbox network configuration for the guest OS we need to configure (and enable) the second ethernet adapter and set it as ‘host only’.

NB: the name vboxnet0 will be changed to be tap0 but that will be handled in a minute.

To setup the virtual interface you need to download and run the following script: tap.sh. Running tap.sh (as root) will create a virtual network device that can be used for Ubuntu’s eth1 to hook into. Whilst having the tap0 device operational with IP address 10.10.10.1 the following commands will set the Virtualbox settings for Ubuntu to bind to it.

List your VM’s and pick the right one:

$ VBoxManage list vms

Enable the 2nd network interface of your VM

$ VBoxManage modifyvm [VM name] --intnet2 hostif

Set the interface to ‘host only’:

$ VBoxManage modifyvm [VM name] --hostonlyadapter2  tap0

Note: The last command(s) seem obsolete since the release of Virtualbox version 4.0.4 r70112 or later. In older versions the tap0 used to fallback to vboxnet0 after closing Virtualbox. But the network configuration is now persistent when set to device tap0. So, depending on the version you use your mileage may vary. Test it with restarting Virtualbox and see if your VM network config looks similar to this:

Running that last command once will suffice for the long run instead of between every Virtualbox or workstation startup (besides the tap.sh script that is).

That being said, you’re now ready to start the Ubuntu VM. You should probably access Ubuntu via the front-end nic the first time since the back-end nic in the guest OS isn’t configured yet. Having logged into Ubuntu you should setup your interfaces as follows. For eth0 you can either choose static or dhcp, whatever runs easiest on your network. Setup Eth1 as static in network segment 10.10.10.0/24, e.g. 10.10.10.2 with 10.10.10.1 being your tap0 hosts OS interface.

Either reboot your Ubuntu VM, or nicer, restart the network with:

$ /etc/init.d/networking restart

You should now be able to login on Ubuntu with:

$ ssh you@10.10.10.2

Now unplug your physical network connection in your host OS (that’s Ubuntu’s eth0) and you can still login on your VM via the 10.10.10.0/24 network.

Gotcha’s

The only one I can think of is the need to manually add the default route to the outside world over etho. This happens when the host OS’s physical network has been disconnected. I assume it’s because Ubuntu’s eth0 has been down with which the route is dropped. You can easily resolve this with the following command:

$ ip route add default via [your gateway's IP]

If you have any questions or comments please feel free to drop me a line.

References

- The inspiration for this article: http://tinyurl.com/6z29w45
- OSX’s TunTap driver: http://tuntaposx.sourceforge.net/
- Tun/Tap info on wikipedia: http://en.wikipedia.org/wiki/TUN/TAP
- The tap.sh script: tap.sh

I Developed this commandline tool to make it easier to maintain stuff on a groing amount of servers. nexec is a tool that can help you gather ad-hoc info when it’s needed quickly. nexec is written in python, it depends on codespeak’s pylib, and does all it’s communication over SSH. The only thing you need on ‘the other side’ is a python interpreter. (that’s right, no further libs or modules). Oh, and you need your SSH key pairs in place, otherwise it’s ‘password galore’.

Of course, the bash-ers out there would say that the same functionality can be achieved with a for loop. True! But that’s exactly what nexec does for you so you can concentrate on what you’re doing remote. And ofcourse you can have nightly cron-ed scripts in place that do this every day. But nexec aids in all those things that are not ‘in place’.

Examples

Before getting into any details, first some tricks of the ‘nexec’ trade to get you warmed up …

Are my server systems running the proper time:

$ ./nexec.py -n 'server1 server2  server3' -c 'date'
server2: Fri May 23 16:21:18 CEST 2008
server1: Fri May 23 16:21:17 CEST 2008
server3: Fri May 23 16:21:19 CEST 2008

See if all your servers are running ssh protocol 2 only:

$ ./nexec.py -n 'server1 server2  server3' -c 'cat /etc/ssh/sshd_config | grep -v ^# | grep Protocol' | sort
server1: Protocol 2
server2: Protocol 2
server3: Protocol 2

(You could also do a “-n ALL”, then nexec reads your server list from a config file. More on that in a minute)

Get a list with all different kernel versions that are running on your systems:

$ ./nexec.py -n ALL -q -c 'uname -r' | sort -u
2.6.18-5-686
2.6.18.8-xen

(The “-q” parameter suppresses the ‘per line’ hostname prefix).

See if ‘john’ is a member of the sudo group on servers 1 and 2:

./nexec.py -v -q -n 'server1 server2' -c 'cat /etc/group | grep sudo | grep -v john'
Host:  server1.example.com
sudo:x:27:jane,jerry
Host:  server2.example.com
sudo:x:27:jane

(The”-v” adds the “Host: ….” header, per server output. Note that “-v” and “-q” are interchangeable)

As you can see, by combining local and remote greps and using the -v and/or -q parameters there are some interesting ways to obtain live data from your server.

Lets look at the configuration.

Configuration

Run without parms, nexec shows help output. Furthermore the only two files nexec depends on (and not even necessarily) are a “~/.nexec.conf” file and a possible “~/.ssh/config”.

The “~/.nexec.conf” does not contain much, just “key: value” pairs under a hosts section. The actual ‘value’ is only obtained when using the “-v” option to display the header above each server output “Host: server1.example.com“.

$ cat .nexec.conf
[hosts]
server1:   server1.example.com
server2:   server2.example.com
#server3:   server3.example.com

Other then that, nexec simply expands “-c ALL” to all available keys under the “[hosts]” section, skipping the usual hashsign ‘#’ being a comment. In this case the “ALL” parameter given to “-c” would be expanded to “server1 server2″ in the previous example. After that the full name is taken from the “~.ssh/config” file.

$ cat .ssh/config
# server1
Host server1
Hostname server1.example.com
User john
Port 4321
# server2
Host server2
Hostname server2.example.com
User john
Port 4321

I deliberately left all that in there so other usernames and port numbers can be specified. Besides, that’s all access related and shouldn’t be anywhere else anyway.

Then one more note on the “-q” and “-v” option. What they basically do is mark (or suppress mark’s) on the output that get’s returned. So you can mark output per server adding the “-v”, and output get’s marked per line (default) if not suppressed with “-q”.

Download

The script can be downloaded here: nexec-10.tgz

Set the ‘execute’ bit with chmod and put it in your $PATH somewhere. And for the “ALL” parameter, set up the config file as the example shows in the Configuration section.

Gotcha’s

Escape your backticks with with a backslash if you want remote expansion.

This runs the uname part locally and then sends the command to the other side.

$ nexec.py -n ALL -c "date | mailx -s `uname -n` root"

This also executes the uname command on the other side.

$ nexec.py -n ALL -c "date | mailx -s \`uname -n\` root"

Todo

There’s two things still on my list.

• Catch a non-existing hostname when taken from the “.ssh/config” file. The script breaks if a host is not resolvable. (Being a sysadmin you should know what your doing ..
• Make the “Host: server1.example.com” header not show when no output is returned from a host. That is when using the “-c ALL”.

New tricks might be added in the future, so if there’s stuff that you think should be added drop me a reply.

That’s all folks …

—
Het valt me op dat de status updates op linkedIn steeds vaker gebruikt worden voor berichtgeving als “ik ben vanavond tennissen”, of wat zakelijker “ik ben naar een seminar”. Je ziet dit heel veel op Twitter gebeuren maar LinkedIn heeft toch een wat zakelijker karakter.

Nog even over voornoemd seminar; Het lijkt me zinvol om, naast waar je geweest bent, bijvoorbeeld een resumeetje te plaatsen over wat je gehoord/gezien hebt. Zo hebben anderen er ook wat aan naast de mededeling dat je geweest bent

Voorts bezigt me over voornoemde categorie Twitter posts overigens de vraag waarom iemand neer zet “Ik ben naar tennissen geweest”. Er zijn in dit land duizenden mensen die tennissen op een avond dus zo spannend is dat niet. En als mensen van achter hun scherm bij houden wat vrienden doen is dat toch wel een sociale verarming te noemen. Face-2-face gesprekken zijn toch immers veel levendiger, mooier en intrigerende. Om nog maar niet te spreken van gezonder en behulpzaam bij het mentaal afwikkelen van dagelijkse bezigheden.

Dit ruikt naar psychologie, maar dan zou je denken dat mensen het posten omdat ze door het drukke leven zichzelf geen tijd gunnen om na te denken of (bijvoorbeeld met partner) te praten over wat hun beweegt. Wat ik hier probeer aan te geven is het verschil tussen aan iemand iets vertellen omdat de andere persoon dit horen wil versus aan iemand iets vertellen omdat je het zelf kwijt moet. De richting van de boodschap is dezelfde kant uit alleen ligt de initiatie ervan aan de andere zijde.

En nu maar hopen dat e.e.a. wat bewustwording teweeg brengt

Ik ben overigens voor twitter nog op zoek naar een manier om bepaalde berichten op trefwoord (denk aan gowalla.com) te onderdrukken. Dus a la google’s zoeken: “+woord1 -woord2″. Met “-” sluit je dan posts uit. En dan als ‘raw input’ gewoon de twitteraars die je ‘followed’. Als iemand daar een oplossing voor heeft dan hoor ik die graag.

Gezonde groet!

—

Maar dan daarbij de kerst groet aan allen!

GrtzG

I needed this functionality for a web application. There are some variations found on the net from which I constructed this simple but effective python function to get ‘the other’ value.

Based on the original image dimensions “i_…” it figures out whether the image is portrait or landscape and calculates either the width or height.

def calculate_image_resize(i_width, i_height, max=0):

    i_width = float(i_width)
    i_height = float(i_height)
    ratio = i_width / i_height

    print 'w:', i_width, 'h:', i_height, 'r:', ratio

    if i_width < i_height:
        print 'portrait'
        c_height = max
        c_width = max * ratio
    else:
        print 'landscape'
        c_width = max
        c_height = max / ratio

    c_width = int(c_width)
    c_height = int(c_height)

    return c_width, c_height

Dropping the function in a python shell and calling it results in this output:

In [2]: calculate_image_resize(1700, 330, max=150)
w: 1700.0 h: 330.0 r: 5.15151515152
landscape
Out[2]: (150, 29)

In [3]: calculate_image_resize(170, 330, max=150)
w: 170.0 h: 330.0 r: 0.515151515152
portrait
Out[3]: (77, 150)

I deliberately left in the obvious 150 so you know instantly which dimension was calculated “c_…”.

Hope this saves people the trouble to figure it out by them selves.

GrtzG

You can of course create distributable modules or packages but with simple local workstation like maintenance this seems overkill … yep, you are allowed to disagree

So, we need a place to put code that is easy to import in our used scripts and it should be easy to maintain. Dropping it in my homedir in a directory called “.python” seems well suited for this.

The Setup

Create the directory “.python” in your $HOMEDIR. Then add a line to your “.bashrc” to export $PYTHONPATH so when you do an import in python it is actually found.

PYTHONPATH=~/.python
export PYTHONPATH

Python picks up the paths from this variable and adds them to “sys.path” so there’s no need to add the path in every script you make. In individual cases you can of course do it like it is explained here.

Then create a file in “~/.python/” for instance “userconfig.py”.

To make it available in your script simply import it and execute one of your functions.

import userconfig as mystuff
mystuff.function(with, parms)

I’ll give an example of a userconfig.py function to easily send out emails.

import os
import sys
import pynotify
import smtplib
from email.mime.text import MIMEText

# Settings << These are the "Sensible defaults" 
MAILSERVER = 'localhost'
MAILFROM = 'somebody'
MAILTO = 'you@yourdomain.com'

def send_mail(subject, body, fro=MAILFROM, to=MAILTO):
    """
    Stripped function to send mail from local code
    """
    msg = MIMEText(body)
    msg['Subject'] = subject
    msg['From'] = fro
    msg['To'] = to

    s = smtplib.SMTP(MAILSERVER)
    s.sendmail(msg['From'], msg['To'], msg.as_string())
    s.close()

The code above composes and sends an email. Doing all this in the script you are writing results in quite a bunch of these lines ending up in every one of your scripts.

Sensible defaults

How about not having to enter those ‘always the same defaults’? Well … When using the setup described in this article most can be omitted and parameters only need to be added when you deviate from your sensible defaults.

For argument sake I’ll give an example script that just mails something and calls the “send_mail()” function.

import userconfig as user

body = """Some multiline triple quoted body mass\n\nwith lot's of

funky stuff in it."""

fish = 'whale'
subject = 'something fishy: %s' % fish

user.send_mail(subject, body)

So that’s only 1 line for the actual ‘send my mail’ command. Should you want a different FROM address then you just change the function call to this.

user.send_mail(subject, body, 'notme')

Thus, add parms when you need them or rely on your “Sensible Defaults” from your userconfig.py.

You can build a world of functionality in your “~/.python”. Import and use system wide installed packages in there, test if they are present on your system, etc.

Gotcha’s

When using scripts under CRON you need to add the PYTHONPATH to the definition like below because CRON does not read your “.bashrc”.

*/1 * * * *  (PYTHONPATH=~/.python; /path/to/your/script.py)

NB: Mind the parenthesis and semicolon on the line above.

Besides the fact that you should watch for name clashes, I can’t think of any other gotcha’s. If you do, then please teach me something and drop me a line

GrtzG