Centroid.EU Blog

(this blog is mostly encrypted - adults only)
  

Previous Page


We know! or More Boogyman stories from the NSA

June 27th, 2018

In this telepolis article (german) the message is reiterated. Yes the NSA is still listening. Great! Didn't we already have confirmation of this in 2013, with the Snowden revelations? I'm not sure that US President Trump is doing anything regarding this, at least I haven't heard of this. What do you do when you are under control such as the NSA? Ignore it. That's all I can conclude right now. Do what you're doing and know that if you do anything illegal over a wire, every bit is registered somewhere. I don't do anything illegal because I know this. I'm against surveillance, but I also have my hands tied behind my back. I can't help the situation any. Have a nice day. Oh btw today is my last day of sick leave.

0 comments

My new SMTPD config

June 22nd, 2018

One aspect of Open Source is that it's a moving target. Things change and so do configs. SMTPD has in the past done a few 180 degree turns in the config (ie. adding filtering and then removing it, now changing the config). I did a test config on my extra workstation theta which has a snapshot from Jun 17th. Before I show my new config though I want to show you the old config (with some domains removed for privacy). So here is the old config from OpenBSD 6.3:

pki mail certificate "/etc/certs/mail.solarscale.de.crt"
pki mail key "/etc/certs/mail.solarscale.de.key"
### listen on 3 addresses
## 1
listen on 108.61.211.139 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 108.61.211.139 port 587 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 108.61.211.139 port 465 smtps pki mail auth-optional hostname "mail.solarscale.de"
## 2
listen on 127.0.0.1 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
## 3
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 587 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 465 smtps pki mail auth-optional hostname "mail.solarscale.de"
# and on the despammed port
listen on 127.0.0.1 port 10025 tag DESPAMMED hostname "mail.solarscale.de"

table aliases db:/etc/mail/aliases.db
table users file:/etc/mail/smtpusers

max-message-size 90000000

accept tagged DESPAMMED for domain "centroid.eu" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "solarscale.de" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "io.solarscale.de" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "virgostar.net" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "schweinfurtdating.de" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "dtschland.eu" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "goldflipper.de" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "freifunk-schweinfurt.de" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "delphinusdns.org" virtual <users> deliver to mbox
accept tagged DESPAMMED for domain "enhancedrisc.de" virtual <users> deliver to mbox

accept for local alias <aliases> deliver to mbox

# domains in order
accept from any for domain "centroid.eu" relay via smtp://127.0.0.1:10024
accept from any for domain "solarscale.de" relay via smtp://127.0.0.1:10024
accept from any for domain "io.solarscale.de" relay via smtp://127.0.0.1:10024
accept from any for domain "virgostar.net" relay via smtp://127.0.0.1:10024
accept from any for domain "schweinfurtdating.de" relay via smtp://127.0.0.1:10024
accept from any for domain "dtschland.eu" relay via smtp://127.0.0.1:10024
accept from any for domain "goldflipper.de" relay via smtp://127.0.0.1:10024
accept from any for domain "freifunk-schweinfurt.de" relay via smtp://127.0.0.1:10024
accept from any for domain "delphinusdns.org" relay via smtp://127.0.0.1:10024
accept from any for domain "enhancedrisc.de" relay via smtp://127.0.0.1:10024

accept for any relay
Now the next release will have the new syntax and I have shortened it a bit and updated it. This is the config for the upcoming 6.4 release:
pki mail cert "/etc/certs/mail.solarscale.de.crt"
pki mail key "/etc/certs/mail.solarscale.de.key"
### listen on 3 addresses
## 1
listen on 108.61.211.139 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 108.61.211.139 port 587 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 108.61.211.139 port 465 smtps pki mail auth-optional hostname "mail.solarscale.de"
## 2
listen on 127.0.0.1 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
## 3
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 25 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 587 tls pki mail auth-optional hostname "mail.solarscale.de"
listen on 2001:19f0:6c00:9041:5400:ff:fe11:3332 port 465 smtps pki mail auth-optional hostname "mail.solarscale.de"
# and on the despammed port
listen on 127.0.0.1 port 10025 tag DESPAMMED hostname "mail.solarscale.de"

table aliases file:/etc/mail/aliases
table users file:/etc/mail/smtpusers
table domains { "centroid.eu", "solarscale.de", "virgostar.net", \
	"schweinfurtdating.de", "dtschland.eu", "goldflipper.de", \
	"freifunk-schweinfurt.de", "delphinusdns.org", "enhancedrisc.de" }

smtp max-message-size 90000000

action "mbox" mbox virtual <users>
action "spampd" relay host smtp://127.0.0.1:10024
action "local" mbox alias <aliases>
action "relay" relay

match for domain <domains> tag DESPAMMED action "mbox"
match for domain <domains> action "spampd"
match for local action "local"
match for any action "relay"
# end
So as you can see it's much smaller as it makes use of tables. If you do notice something wrong with this config please leave a comment and let me know. Or email me at centroid.eu. Thanks!

PS: relaying to another host with self-signed certificate may mean I have to no-verify something. Let me know if you know better.

0 comments

My DNS Infrastructure in 2018

June 22nd, 2018

I don't get DNS from my ISP, I self host. This is what my map looks like:

        My DNS Infrastructure in 2018


                                     +----[phi vps]
        Internal RFC1918 network     |  recursive DNS server at port 8053
            |                        |
        [ uranus ] ----- Internet ---|
        recursive DNS server|        |
                            |        |
                            |        +----[omega vps]   
                            |           recursive DNS server at port 8053
                            |           authoritative DNS server at port 53
                        [psi vps]
                        authoritative DNS server at port 53
If you're interested in the setup I'm going to show you uranus's and phi's setup:
# uranus
server 108.61.211.139 {
        keys { "secret-key"; };
}; 

server 78.47.14.22 {
        keys { "secret-key"; };
};

server 2a01:4f8:d13:1980::22 {
        keys { "secret-key"; };
};

server 2001:19f0:6c00:9041:5400:ff:fe11:3332 {
        keys { "secret-key"; };
};
options {
        version "";     // remove this to allow version queries

        listen-on    { 127.0.0.1; 192.168.42.20; 192.168.180.1; 192.168.181.1; 1
92.168.183.1; 192.168.184.1; };

        listen-on-v6 { ::1;};

        empty-zones-enable yes;

        allow-recursion { clients; };

        querylog yes;

        dnssec-enable yes;
        dnssec-validation auto;

	forward only;

        forwarders {    108.61.211.139 port 8053;
                        78.47.14.22 port 8053; 
        };
        
        dns64 64:ff9b::/96 {
                clients { 2001:db8::/56; 192.168/16; };
                mapped { !10/8; !192.168/16; !172.16/12; any; };
                exclude { 64:ff9b::/96; };
                recursive-only yes;
        };
};
And then there is phi's...
options {
        version "";     // remove this to allow version queries

        listen-on port 8053    { 78.47.14.22; 127.0.0.1; };
        listen-on-v6 port 8053 { 2a01:4f8:d13:1980::22; ::1; };

        allow-recursion { clients; key "secret-key"; };


        disable-empty-zone "255.255.255.255.IN-ADDR.ARPA";
        disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
        disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";

        dnssec-enable yes;
        dnssec-validation auto; 

        querylog yes;
};
As you can see I have left out the secret-key information. But this is what I do. I log everything as it's just me that's using this DNS and I sometimes check after a query and having a log is important to trace back what happened.

0 comments

I'm completely confused on EU's Internet policies

June 22nd, 2018

Completely confused. I read a lot of law-based online publications such as heise.de and once again I think they are telling us stories of the boogyman. Upload filter? What on earth does that mean? Let's see if anything of this affects me? If not there wasn't much loss.

0 comments

BIND querylog CODE explanations

June 21st, 2018

I dug up the BIND source today to see what these codes mean, in particular I was looking for what "+SE(0)DCV" meant. So here is my reading the source of BIND somewhat:

+       client wants recursion
-       client does not want recursion
S       client is a signer
E(x)    EDNS buffer size (x)
T       client is TCP connection
D       DO bit is set
C       checking disabled (CD) bit
V       client has a cookie
K       client wants cookie
Enjoy if this helps you.

0 comments

Happy June Solstice 2018

June 21st, 2018

Today is solstice. In our hemisphere it's summer solstice. Happy, happy.

0 comments

What's next

June 19th, 2018

I'm on sick leave until the 27th of June. After that I'll be applying myself to delphinusdnsd. It needs brushing up, it needs a manpage for dddctl. And I'll likely make a release (1.3) in July or August. On August 1st I'll be applying for the Prototype Fund which is a german initiative for providing grants for writing open source. I'll be approaching them for additional programming on delphinusdnsd. Things that I might be luring them with are: GOST support (RFC 5933), ECDSA (RFC 6605), and Elliptic Curve (RFC 8080) ciphers, AXFR support to make delphinusdnsd capable of slave mode and TSIG support to secure transfers, furthermore I'd be looking into CAA RR support. If this catches their interest at the prototype fund for the first/second german built DNS server (I think Bert Hubert of PowerDNS has german roots) then I'll be programming professionally on this thing. AFAIK the prototypefund.de cycle is for 6 months starting on september. I'm intending to write 4 to 6 hours a day in my home office.

0 comments

Why is Microsoft sinking datacenters into the Ocean?

June 13th, 2018

You may have heard of this. Don't we already have enough global warming? I guess the last bastion of coolness is the sea. The fish will be real happy!

0 comments

Yes I censored an article

June 11th, 2018

I took an article out. The RSS system noticed this by inserting a double article. Cheers.

0 comments

The HPE switch I bought

June 10th, 2018

Unfortunately the HPE switch I bought is very loud. I'll have to look at sound-padding it into a cabinet or something. It's an office switch but at how many decibels is an office switch too loud?

0 comments

Next Page

Search

RSS Feed

Click here for RSS

On this day in

Other links

Have feedback?

By clicking on the header of an article you will be served a cookie. If you do not agree to this do not click on the header. Thanks!

Using a text-based webbrowser?

... such as lynx? Welcome back it's working again for the time being.

Older Blog Entries


Powered by BCHS