- Never post to mailing lists with your real name when you’re not sure that you explicitely WANT the messages to be shown when you’re googled. Keep in mind that when you write something today, you may have opposite opionions in a few years, but the Google results in a few years may just show the message of today!
- Don’t support mailing lists, use Web-based forums whenever you can. These have a database storage where you can easily delete messages with one command and the messages won’t be distributed over many different archive servers, too. Web-based forums have other advantages, too (more useable, attachments, community features, you can login from everywhere …).
- If you absolutely have to use mailing lists, use a fake real name. Nobody will notice that and your postings can’t be assigned to you that easily.
Fujitsu Siemens Computers recommends Windows Vista® Business for Business Computing
Fujitsu Siemens Computers recommends Windows Vista® Home Premium for Personal Computing
But what if you need Linux running on your Laptop because you are a computer professional and want a robust base for your daily work?
The good news is: In opposite to many other laptops I’ve tried, Ubuntu 8.10 works “out of the box” (including LAN, WLAN, Web cam) with the Fujitsu-Siemens Amilo Pi 3540 which is quite a good all-round notebook. I can fully recommend it for Linux users.
Many people use AMaViS or amavisd-new to combine Postfix with ClamAV and SpamAssassin. However, Amavis takes huge amounts of CPU time and memory. Also, it’s quite slow and difficult to configure, so another solution without Amavis would be interesting.
In this article, I will only discuss server-wide solutions without procmail because it can’t be used with virtual domain mailboxes.
It’s possible to use a shell script that calls ClamAV and SpamAssassin as a Postfix content filter:
/opt/mail-scanner
#!/bin/sh
EX_OK=0
EX_BOUNCE=69
EX_DEFER=75
SENDMAIL="/usr/sbin/sendmail -G -i"
SPAM_DIR=/home/mailscan/spam
VIRUS_DIR=/home/mailscan/viruses
function cleanup {
for fname in ${tmpfile[@]}
do
rm -f $fname
done
}
for ((i=0;i<2;i++))
do
fname=`mktemp -p /tmp mail-scanner.XXXXXXXX`
if [ "$?" != 0 ]; then
logger -s -p mail.warning -t scanner "Unable to create temporary file."
exit $EX_DEFER
fi
tmpfile[$i]=$fname
trap cleanup EXIT TERM
done
cat >${tmpfile[0]}
# check for viruses
clamdscan - <${tmpfile[0]} >${tmpfile[1]}
return="$?"
if [ "$return" = 1 ]; then
virus=`grep FOUND ${tmpfile[1]}`
logger -p mail.info "Message rejected by ClamAV: $virus"
mv ${tmpfile[0]} `mktemp -p $VIRUS_DIR virus.XXXXXXXX`
exit $EX_OK # discard (exit without re-injecting)
elif [ "$return" != 0 ]; then
logger -s -p mail.warning -t scanner "Temporary ClamAV failure (clamdscan returned $return)"
exit $EX_DEFER
fi
# check for spam
spamc -x <${tmpfile[0]} >${tmpfile[1]}
return="$?"
if [ "$return" = 1 ]; then
logger -p mail.info "Message rejected by SpamAssassin"
mv ${tmpfile[0]} `mktemp -p $SPAM_DIR spam.XXXXXXXX`
exit $EX_OK # discard (exit without re-injecting)
elif [ "$return" != 0 ]; then
logger -s -p mail.warning -t scanner "Temporary SpamAssassin failure (spamc returned $return)"
exit $EX_DEFER
fi
# deliver
$SENDMAIL "$@" <${tmpfile[1]}
exit $?
All you need is to copy this script to a location, let’s say /opt or /usr/local/bin and then edit the master.conf file of your Postfix so that:
A quick scan of sites made with Typo3 told me that 99 of 330 pages are still vulnerable to the last Typo3 security bug that allows to read all .php files, including localconf.php (where the database password and other things ard stored) at the moment.
That means that about 30 % of all Typo3 pages show their database passwords (and other things) in clear text 5 days after the security bulletin has been sent out.
To send pingbacks from your site to other blogs/communities/etc., you can use the PHP CURL module:
<?
function send_pingback
($sourceURI, $targetURI)
{
$target = file_get_contents($targetURI);
// HTTP headers are now in $http_response_header, see docs of HTTP wrapper
foreach ($http_response_header as $header)
if (preg_match("/^X-Pingback:\s*([^\s]+)\s*$/", $header, $matches))
$serverURI = $matches[1];
if (!$serverURI) {
$target = html_entity_decode($target);
if (preg_match("/<link rel=\"pingback\" href=\"([^\"]+)\" ?\/?>/", $target, $matches))
$serverURI = $matches[1];
}
if (!$serverURI)
return;
$xml = ‘<?xml version="1.0"?><methodCall><methodName>pingback.ping</methodName><params>’.
‘<param><value><string>’.$sourceURI.‘</string></value></param>’.
‘<param><value><string>’.$targetURI.‘</string></value></param>’.
‘</params></methodCall>’;
$rq = curl_init();
curl_setopt($rq, CURLOPT_URL
, $serverURI);
curl_setopt($rq, CURLOPT_POST
, 1);
curl_setopt($rq, CURLOPT_POSTFIELDS
, $xml);
curl_exec($rq);
curl_close($rq);
}
send_pingback
("… source uri …", "… target uri …");
If you want to enable a Web site (for instance, a blog or community project) to receive pingbacks, you can use the PHP XML-RPC module.
All you need to do is to
- create an XML-RPC server
- register a function for pingback.ping
- call the server
- implement the function
The function itself, let’s call it do_pingback, only needs to process the pingback: verify its validity and register the ping somewhere, for instance in the database.
Sample code:
<?
/* /pingback-server.php */
require_once("include/config.php");
function do_pingback
($method, $params, $extra)
{
global $db;
list ($sourceURI, $targetURI) = $params;
// fetch the source URI to verify that the source does indeed link to the target
$source = file_get_contents($sourceURI);
if ($source == false)
return 16; // "The source URI does not exist."
$source = html_entity_decode($source);
if (strpos($source, $targetURI) === false)
return 17; // "The source URI does not contain a link to the target URI, and so cannot be used as a source."
// TODO: check own data to ensure that the target exists and is a valid entry
// register pingback (if not done already)
$status = $db->exec("INSERT INTO pingbacks (source, target) VALUES (".$db->quote($sourceURI).", ".$db->quote($targetURI).")");
if (PEAR
::isError($status))
return 48;
return "Ping registered, thanks";
}
$server = xmlrpc_server_create();
xmlrpc_server_register_method($server, "pingback.ping", "do_pingback");
if ($response = xmlrpc_server_call_method($server, $HTTP_RAW_POST_DATA, null)) {
header("Content-Type: text/xml");
print $response;
}
?> Of course, you have to announce the pingback server on your Web site. I prefer the HTTP header solution, so I added
header("X-Pingback: http://".GU_DOMAIN
."/pingback-server.php"); to a global include.
I use this code for the pingback implementation on gimpusers.com / gimpusers.de.
Network Services | rfc2822 | 
February 26, 2009 14:32 | 
Comments (0) 
Subscribe