Worklog

LDAP read only mode

The LDAP server was in read only mode all night, making minor things not work right.

The object cn=userRoot,cn=ldbm database,cn=plugins,cn=config has an attribute, nsslapd-readonly, that was set to on. Changing it to off put the directory back in read-write mode and made password changes (and other stuff) start working again. As far as I can tell, this object is not accessible through the GUI console.

LDAP unhappiness

Spent this afternoon and evening chasing down a strange problem in LDAP.

At about 4:00 this afternoon, ASHTI went into a tailspin, with a load average of about 24. After some poking, I determined it was Samba at fault, and that it was having horrendous performance on searches for rid attribute matches. My first thought, that it was a lack of index on that attribute was correct, but it wasn’t immediately obvious.

I did increase the All IDs number, but that, of course, didn’t do anything. I found out how to export and import the database, though.

I finally figured out how to rebuild the indices from the command line, and noticed that rid and uidnumber weren’t among them. I added those indices via ldapadd and rebuilt.

Adding an index:

ldapadd:

dn: cn=rid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
objectClass: top
objectClass: nsIndex
cn: rid
nsSystemIndex: false
nsIndexType: pres
nsIndexType: eq

and then to regenerate: db2index.pl -D ‘CN=Manager’ -w password -n userRoot

Regeneration takes a long time, and may require a restart of the LDAP server at the end (and be careful for crashes in the middle).

It occurs to me to wonder whether this information might have any bearing on the MacOS X login issue…

NetReg updates

Added a pre-register check in NetReg for new aut-registers.

The pre-register displays links to the AUP and privacy policies and the Vexira download page before explicitly having them click an “I agree” link to get registered.

MyDoom.M

Caught a few copies of a new virus sent to opf-l and held (return address was postmaster).

Redirected to my account and sent copies to Vexira. They had sig updates shortly afterwards.

Moodle off and running

The new version of Moodle is all ready to go.

I made the old instance of Moodle available under the /old URL, copying the code and data from the moot server that it was on. The database for it is still on SHANTI.

Sun ONE Calendar conversions

Starting to do mass conversions for various people.

Rewrote rcm2ical to deal with multiline description fields and some timezone issues. Sun ONE didn’t do the right thing with respect to daylight savings. Now I convert all times to UTC using Date::Manip and make a hash structure for the calendar with a separate entry for each event (keyed by the event UID). After the hash is complete I walk it and print out the results.

HEDD installation

I’ve been getting HEDD up and running for Moodle.

Jumpstarted yesterday from the Moodle definition. The main gotcha is that this box has no CD-ROM, so the disks ar c0t0 and c0t1 rather than c1 based.

Today I got PostgreSQL and PHP installed. PostgreSQL is using /data/pgsql as its data directory, and I essentially copied the startup script from the FreeBSD port for Solaris.

PHP was simple and straightforward, after modifying the apxs perl script to point to the right perl location (/usr/bin rather than /usr/local/bin).

—

Update: having to recompile PHP with OpenLDAP support. I made OpenLDAP without slapd support, since we aren’t going to be running any LDAP server here and this takes out the requirement for Berkeley DB.

Virus Observations

Some observations about viruses on campus, from looking at the MIMEDefang stats on KE…

• We haven’t had a day where we have caught and dropped less than 100 e-mail viruses and worms since January 2, 2004.

• We haven’t had a period of seven days where each day saw a total of less than 100 viruses or worms per day since July 21-August 1, 2003.

• The highest number of viruses we have dropped in a single day is 14,906 on September 8, 2003. Most of the viruses this day were Sobig.F (14,823 copies).

• We have seen viruses arrive at greater than one copy per second during peak infection periods.

• The virus we have dropped the most is Sobig.F at a total of 189,863 copies. Other high scorers are MyDoom.A2 (73,895 copies), NetSky.P (42,735 copies), and Klez.E (33,942 copies).

• The most prevalent virus families are Sobig (192,293 copies), NetSky (121,960 copies), MyDoom (74,514 copies), Klez (33,942 copies, all Klez.E), and Bagle (26,517 copies).

• The virus family with the most number of variants is Bagle, with 31 variants. NetSky only comes in at 20 variants.

• The longest running virus is Klez.E, with the first copy arriving the first day we started keeping statistics (February 22, 2003) and continuing to the present.

• 35 viruses have only had one copy come through our mail server.

• In the time we have been scanning for viruses and keeping track of which ones we get (and drop), we have dropped 514,058 viruses or slightly over 4% of the messages we’ve handled.

NetSQUID fine tunings

Getting some fine tunings for the NetSQUIDs, finding some new viruses, and thinking about tape libraries.

NetSQUID good

I’ve got a decent semi-auto install of NetSQUID.

I’ve got the install script debugged decently and burned to CD. All the later customization can probably be easily enough done with the update scripts. At this point we can install Slackware 9.1 with the tagfile floppy, chroot to /mnt on the new system, mount the NetSQUID CD, and then run install.sh from there, answering customization questions as appropriate. It sets up the update script to run every 15 minutes and pull updates (if they’ve changed) from SHANTI and install them. Since the updates are just tarballs based from /, we have the ability to modify just about anything on the system fairly easily.

I think we’re going to try putting the NetSQUID test box on the link between the Lilly Alpine and the Black Diamond soon to see how well it holds up.

NetSQUID prototype

There’s a NetSQUID prototype almost completely working.

I had to add some shared libs for the perl IPTables module that weren’t in the TAMU package, and the DNS server parsing in the netsquid perl program was slightly broken. I got some snort rules that should detect various worms and added a simple test one for HTTP to make sure it was working right. The main thing at the moment is that HTTP redirection on blocking is not working properly. I’m not sure about the network topology, iptables, or thttpd, so we’ll see what happens Monday.

MIMEDefang working

Working on updates for MIMEDefang/ECSanitizer.

Seems like the best thing to do might be to rewrite ECSanitizer from scratch and clean up a lot of its internals. I started doing that earlier today.

NetSquid

Getting further with NetSquid.

NetSquid is now at netsquid.tamu.edu. They’ve got a quick install tagfile set for Slackware 9.1, so I’m downloading the 9.1 ISO images. Ellenm reports that she’s working on a Slackware package that will include the appropriate perl version and modules. Other stuff should be coming on the web site soon.

We’re using Linksys gigabit ethernet adapters for the bridge, product code EG1032. Linux seems to have decent drivers for these, and we’ve got a box working with the two test cards we got (in bridging, not yet using snort, etc.). Next is to install Slackware on these and get the TAMU style setup working.