Back in 1999, when many of us still got a new IP address every time we dialed into the internet, I set up ipid as an easy way to figure out my public IP. It caught on, and was eventually added into several dynamic DNS clients and various other projects with a need to determine the user's IP. I took the service down in 2013, given the myriad other options available; you can just Google "IP address" to get it, now.

Recently I was debugging a DNS issue and was surprised to see how many queries were still coming in for the ipid name. I decided to spin the site back up on a spare VPS and see what sort of traffic it would get. I wasn't quite expecting this:

Server uptime: 14 hours 17 minutes 12 seconds
Server load: 0.01 0.02 0.00
Total accesses: 8149452 - Total Traffic: 101.4 MB
158 requests/sec - 2067 B/second - 13 B/request

~160 hits per second to a site that's been down (and NXDOMAIN) for 4 years! There's obvio...

Yesterday, Scott Arciszewski from ParagonIE published The 2018 Guide to Building Secure PHP Software. If you develop for (or attack) the web in any language, this is an excellent reference that addresses a number of common web application pitfalls.

In the section devoted to security headers, I saw a reference to one that's flown under my radar until now: Expect-CT. Scott Helme has a nice write-up of Expect-CT, and I went off to read the specification for myself. As it happens, the HTTP Working Group just posted an updated draft today, but the changes aren't substantive.

The executive summary of Expect-CT is that Chrome can no...

Today I spotted an entry in the firewall log that's sent me down a bit of a rabbit hole. I default-deny traffic between my different network segments, and I filter most of the mundane stuff before it's logged, so this caught my eye:

    Deny UDP 169.254.5.108:17784 255.255.255.255:17784 in via dc1

Apparently port 17784 is the default port for the Universal Discovery & Access Protocol, or UDAP, a network protocol so obscure it doesn't even have a Wikipedia page. UDAP seems to be spoken mostly by LG smart TVs (UDAP originated at LG, as far as I can tell) and by a now-defunct home audio streaming product called a SqueezeBox. I don't own any of this equipment, so naturally I was curious what device the packet came from.

After running tcpdump for a couple of minutes, I came up with enough multicast packets from 169.254.5.108 to at least figu...

This week, the Plugin Vulnerabilities site posted about a local file inclusion exploit in MailChimp's WordPress plugin for WooCommerce. My thoughts about WordPress are generally unenthusiastic, so I don't spend much time looking at its vulnerabilities, but from the standpoint of a mail server operator I was interested in the MailChimp angle. As it turns out, there's nothing of impact to mail admins, though I was a little intrigued by MailChimp's fix.

The exploit, in a nutshell, is that one of the plugin's scripts accepted a template name via the query string and then called include() on a filename built from that variable:

<?php if(isset($_GET['error_notice']) 
  && file_exists(__DIR__.'/errors/'.$_GET['error_notice'].'.php')): ?>
    <?php include(__DIR__.'/errors/'.$_GET['error_notice'].'.php'); ?>
<?php endif; ?>

Direct us...

On a relatively old Mac that I was inspecting recently, I saw a load of entries in the system.log generated by a process named dashboardadvisoryd. The errors follow this pattern:

    dashboardadvisoryd[4326]: fetch: advisory list is not the correct format, could not obtain being marker
    dashboardadvisoryd[4326]: fetch: unable to get sql from net
    dashboardadvisoryd[4326]: fetch-parsers: unable to fetch data from read stream

As is common with Mac errors, a quick search turned up only one result, an unanswered 10-year-old post on the Apple forums.

Not being familiar with dashboardadvisoryd, I poked around a bit to see if I could track down what's throwing the error. The binary itself is part of the Dock, and lives at:

    /System/Library/CoreServices/Dock.app/Contents/Reso...

Reddit has been tweaking their site layout, and they've added a big yellow block at the top of the page for logged-out visitors. In addition, even after opting out of the garish new redesign, a bright red "try the redesign" banner appears in the upper left corner of the page.

While I was in the Stylish editor adding some new rules, I figured I'd post my ad-blocking recipe here. This should suppress much of the advertising and promoted content on Reddit's web interface, as well as the yellow signup promo and the "try the redesign" banner.

@namespace url(http://www.w3.org/1999/xhtml);
@-moz-document domain("reddit.com") {
    div#siteTable_organic {
        display: none !important;
    }
    span#sponsored-indicator {
        display: none;
    }
    div#sponsorship {
        display: none;
    }
    div#sponsorshipbox {
        display: none;
    }
    iframe#ad_main {
        display: none;
    }
    iframe#ad_sponsorship {
        disp...

When downloading and compiling software, it's always a good idea to verify the integrity of the source files you obtain. Package handlers like yum and apt handle this automatically, but it must be done manually when you download software yourself.

ISC, the publisher of the BIND DNS server, provides cryptographic signatures with each release. If you have gpg installed, you can use the signature to validate your downloaded BIND tarball. ISC's download URLs follow a consistent naming pattern; simply change the version number in the URLs below to match the version you need.

Download the BIND source

[root@host /home/files]# wget https://ftp.isc.org/isc/bind9/9.11.4-P2/bind-9.11.4-P2.tar.gz
  `bind-9.11.4-P2.tar.gz' saved [9617963/9617963]

Download the associated signature file

[root@host /home/files]# wget https://ftp.isc.org/isc/bind9/9.11.4-P2/bind-9.11.4-P2.tar.gz.sha256.asc
  `bind-9.11.4-P2.tar.gz.sha256.asc' saved ...

Here's how to get stunnel up and running on a CentOS 6 server, and configure your local stunnel client to work with it.

Server-side installation and configuration

First, install stunnel itself on the server:

[root@host ~]# yum -y install stunnel

Next, create a key and a self-signed certificate for stunnel to use:

[root@host ~]# cd /etc/pki/tls/certs/ && make stunnel.pem

Now, generate a set of Diffie-Hellman parameters using a 2048-bit group instead of the default 1024-bit size. A 2048-bit group is recommended by the discoverers of the Logjam attack.

    [root@host certs]# dd if=/dev/urandom count=64 | openssl dhparam -rand - 2048

    0 semi-random bytes loaded
    Generating DH parameters, 2048 bit long safe prime, generator 2
    This is going to take a long time
    64+0 records in
    64+0 records out
    32768 bytes (33 kB) copied, 0.00312777 s, 10.5 MB/s
    ....................+..[snip lots of outp...

This article outlines the deployment of a recursive, caching, authoritative DNS server running BIND 9.11.x on CentOS 6.10. Why this combination? The BIND name server is the most feature-rich open source resolver, with decades of development behind it. And despite closing in on its nominal end-of-life, CentOS 6 remains a popular server OS due to its proven stability and the absence of systemd.

Preparing your environment

In order to set up your DNS server, you're going to need:

• A server running CentOS 6.10 (bare metal, VM, or VPS will all work)
• root ssh access to your server
• At least 64MB of available RAM for the named process
• wget or some other utility to download a file

There are also some software dependencies:

• The gcc compiler (yum -y install gcc)
• The file utility (yum -y install file)
• OpenSSL header files (yum -y install openssl-devel)

You don't necessarily n...

In an age where SSL/TLS certificates are free via Let's Encrypt, if you're running a Postfix mail server, you should make sure it's capable of speaking TLS.

Here's the output from postconf -n | grep tls on my machine, which lists all of the TLS options in main.cf that I've changed from their defaults:

    smtp_tls_CAfile = /etc/pki/tls/cert.pem
    smtp_tls_ciphers = medium
    smtp_tls_loglevel = 1
    smtp_tls_mandatory_protocols = !TLSv1, !SSLv2, !SSLv3
    smtp_tls_note_starttls_offer = yes
    smtp_tls_protocols = !SSLv2, !SSLv3
    smtp_tls_security_level = may
    smtpd_tls_CAfile = /etc/pki/tls/cert.pem
    smtpd_tls_auth_only = no
    smtpd_tls_cert_file = /etc/letsencrypt/live/my.example.com/fullchain.pem
    smtpd_tls_ciphers = medium
    smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
    smtpd_tls_dh512_param_file = /etc/postfix/ssl/dh_512.pem
    smtpd_tls_eecdh_grade = strong
    smtpd_tls_exclude_ciphers = aNULL, eNULL, EX...