When downloading and compiling software, it's always a good idea to verify the integrity of the source files you obtain. Package handlers like yum and apt handle this automatically, but it must be done manually when you download software yourself.

ISC, the publisher of the BIND DNS server, provides cryptographic signatures with each release. If you have gpg installed, you can use the signature to validate your downloaded BIND tarball. ISC's download URLs follow a consistent naming pattern; simply change the version number in the URLs below to match the version you need.

Download the BIND source

[root@host /home/files]# wget https://ftp.isc.org/isc/bind9/9.11.12/bind-9.11.12.tar.gz
  `bind-9.11.12.tar.gz' saved [8180761/8180761]

Download the associated signature file

[root@host /home/files]# wget https://ftp.isc.org/isc/bind9/9.11.12/bind-9.11.12.tar.gz.sha256.asc
  `bind-9.11.12.tar.gz.sha256.asc' saved [833/833]
`...

Here's how to get stunnel up and running on a CentOS 6 server, and configure your local stunnel client to work with it.

Server-side installation and configuration

First, install stunnel itself on the server:

[root@host ~]# yum -y install stunnel

Next, create a key and a self-signed certificate for stunnel to use:

[root@host ~]# cd /etc/pki/tls/certs/ && make stunnel.pem

Now, generate a set of Diffie-Hellman parameters using a 2048-bit group instead of the default 1024-bit size. A 2048-bit group is recommended by the discoverers of the Logjam attack.

    [root@host certs]# dd if=/dev/urandom count=64 | openssl dhparam -rand - 2048

    0 semi-random bytes loaded
    Generating DH parameters, 2048 bit long safe prime, generator 2
    This is going to take a long time
    64+0 records in
    64+0 records out
    32768 bytes (33 kB) copied, 0.00312777 s, 10.5 MB/s
    ....................+..[snip lots of outp...

This article outlines the deployment of a recursive, caching, authoritative DNS server running BIND 9.11.12 on CentOS 6.10. Why this combination? The BIND name server is the most feature-rich open source resolver, with decades of development behind it. And despite closing in on its nominal end-of-life, CentOS 6 remains a popular server OS due to its proven stability and the absence of systemd.

Preparing your environment

In order to set up your DNS server, you're going to need:

• A server running CentOS 6.10 (bare metal, VM, or VPS will all work)
• root ssh access to your server
• At least 64MB of available RAM for the named process
• wget or some other utility to download a file

There are also some software dependencies:

• The gcc compiler (yum -y install gcc)
• The file utility (yum -y install file)
• OpenSSL header files (yum -y install openssl-devel)

You don't necessarily ...

When working with PHP's filetype() function, you may encounter the following error:

Warning: filetype(): Lstat failed for [filename]

This warning means that the argument to filetype() doesn't exist. Consider the following code, which is intended to get the contents of the system's /tmp directory while ignoring any subdirectories:

<?php
function get_file_list($directory) {
    $files = [];
    if (is_dir($directory) && $handle = opendir($directory)) {
        while (($file = readdir($handle)) !== false) {
            if (filetype($directory . $file) === 'file') {
                $files[] = $directory . $file;
            }
        }
        closedir($handle);
    }
    return $files;
}

var_dump(get_file_list('/tmp'));

This code will generate one Warning: filetype(): Lstat failed... for every file in the /tmp directory, and the returned $files array will be empty. Can you spot the error? The value of the $directory variab...

In an age where SSL/TLS certificates are free via Let's Encrypt, if you're running a Postfix mail server, you should make sure it's capable of speaking TLS.

Here's the output from postconf -n | grep tls on my machine, which lists all of the TLS options in main.cf that I've changed from their defaults:

    smtp_tls_CAfile = /etc/pki/tls/cert.pem
    smtp_tls_ciphers = medium
    smtp_tls_loglevel = 1
    smtp_tls_mandatory_protocols = !TLSv1, !SSLv2, !SSLv3
    smtp_tls_note_starttls_offer = yes
    smtp_tls_protocols = !SSLv2, !SSLv3
    smtp_tls_security_level = may
    smtpd_tls_CAfile = /etc/pki/tls/cert.pem
    smtpd_tls_auth_only = no
    smtpd_tls_cert_file = /etc/letsencrypt/live/my.example.com/fullchain.pem
    smtpd_tls_ciphers = medium
    smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
    smtpd_tls_dh512_param_file = /etc/postfix/ssl/dh_512.pem
    smtpd_tls_eecdh_grade = strong
    smtpd_tls_exclude_ciphers = aNULL, eNULL, EX...

From a Linux terminal, if you need to find out what time it is in a different time zone or another country, you can use the date command. Just override the TZ environment variable when you run date:

[user@host ~]$ date
Mon Dec 14 22:10:59 CST 2015

[user@host ~]$ TZ=Poland date
Tue Dec 15 05:11:03 CET 2015

[user@host ~]$ TZ=Japan date
Tue Dec 15 13:11:07 JST 2015

[user@host ~]$ TZ=Australia/Melbourne date
Tue Dec 15 15:12:36 AEDT 2015

[user@host ~]$ TZ=Australia/Perth date
Tue Dec 15 12:12:41 AWST 2015

The full list of supported time zones will be somewhere on your filesystem; on many distributions, they're located at /usr/share/zoneinfo/. If you aren't sure where to find them, Wikipedia has a tz database that's mostly accurate.

Because some of the time zone names are cumbersome to remember and type, consider using aliases if you need to reference international times frequently. You can add commands ...

Years ago it was possible to do a packet capture on a Linux machine by redirecting the output of tcpdump to a file, and Ethereal (ah, memories) would open it up. Somewhere along the way, Wireshark started choking on these files. Every now and then I still forget and try to do something like this:

    tcpdump -nn -vv -S -X -s0 -i eth0 port 53 > /tmp/dns.cap

That captures a bunch of packets in human-readable form, but Wireshark refuses to open the file. It gives an error along the lines of:

    The capture file appears to be damaged or corrupt.
    (stanag4607: File has 976238138d-byte packet, bigger than maximum of 262144)

If you find yourself looking at this error, make sure to use the -w flag to tcpdump instead of redirecting stdout:

    tcpdump -nn -vv -S -X -s0 -i eth0 port 53 -w /tmp/dns.cap

This generates a binary pcap file that Wireshark happily opens up.

Given an error from chronyd that looks like this:

Sep 17 10:31:12 kitch chronyd[1355]: Could not write to temporary driftfile /var/lib/chrony/drift.tmp

The likely cause is that the filesystem where the driftfile lives (in this case /var) is full. Inspect the filesystem and free up some space.

I discovered by accident that PHP allows you to format the iterator in a for loop with sprintf(), as long as the result of sprintf() can evaluate to the same numeric type as your step value. As a contrived example, consider the following loop used to build out the options in a "months of the year" select list:

$month = '<select name="month">';
for ($i = 1; $i < 13; $i++) {
    $month .= '<option value="' . sprintf('%02d', $i) . '">' . sprintf('%02d', $i);
}
$month .= '</select>';

The same loop can be written this way:

$month = '<select name="month">';
for ($i = sprintf('%02d', 1); $i < sprintf('%02d', 13); $i = sprintf('%02d', ++$i)) {
    $month .= '<option value="' . $i . '">' . $i;
}
$month .= '</select>';

That is, the formatting of $i into a two-digit zero-padded integer is being done inside of the control block itself, instead of as a separate instruction inside the loop.

In this specific example, there's no benefit (and in fact there is some detri...