Category computers

Upon sitting down at my desk just now it appeared that I had email from an eBay user named ‘yuki668’ asking simply “Hello,do you accept PayPal?”. This seemed a bit fishy, so I decided to dig into it a little bit.

Come to find out, it’s the best made phishing scheme that I’d not yet seen. It appears to look like valid email from eBay, takes you to a look-alike login page, allows one to compose a reply, and even appears to send the message, then offering to redirect the user to My eBay and various other pages.

Here are some screenshots of this message and the hosted false pages:

· Original email from ‘yuki668’ asking a ‘question’.
· Fake eBay login page.
· Fake message composition page.
· Fake sent message confirmation.

I have to say, with my actively selling something on eBay, this almost fooled me. The way I knew it not to be right, is the original email message was sent, it didn’t say that it was a question about a particular item…

Anyway, here is the full header if the email, if you are curious: Continue reading: Clicky Clicky →Continue reading: Clicky Clicky

Note to self:

My mom’s computer was unable to check her email with Mail.app. IMAP worked fine. When logging in by telnetting to port 110, the following error about being unable to read the home directory was received, yet the proper permissions was there:

-ERR this user has no $HOME/Maildir

My mom also reported that occasionally she was able to check her email just fine.

The problem ended up being that Mail.app was set to leave all mail on the server. By the time there were around 1400 messages in her inbox (stacked up over the past eight months or so) it seems that these messages were simply too much for qmail-pop3d to parse upon login, and the error was received.

It should be noted that the log for qmail-pop3d showed a successful login with an unsuccessful one immediately following.

The solution was to ensure that she had all her mail, then clear out the POP3 server. Now everything works fine.

rez.nuxx.net (on the right) in the colo facility.

Just FYI, rez.nuxx.net is back up. Everything was done as of just before noon…

I just had the problem which normally happens when I visit the Waveform offices. That is, I get to talking with Bill there, and next thing I know a few hours have passed.

Well, I’m back home, the server is back up, and everything seems good.

To everyone who I host things for on my server, rez.nuxx.net. It seems that /dev/ad10 (one of the 120GB disks in the RAID 0+1 array which holds all the web and email data, databases, logs, aggregated backups, etc) actually has gone south. It’s still spinning and all, but when I tried to run a SMART extended offline test, there was a read error:

SMART Self-test log structure revision number 1
Num  Test_Description    Status                  Remaining  LifeTime(hours)  LBA_of_first_error
# 1  Extended offline    Completed: read failure       20%      5330         208317256

So, I’m looking at replacing the drive sometime around 11am tomorrow, which means that the server and such will be unavailable. It’ll be back up ASAP, hopefully by noon.

Well, this is just what I wanted to see when I read my webserver’s log files this morning.

rez.nuxx.net kernel log messages:
> ad10: TIMEOUT - READ_DMA retrying (2 retries left) LBA=208317255
> ad10: TIMEOUT - READ_DMA retrying (1 retry left) LBA=208317255
> ad10: FAILURE - READ_DMA timed out
> GEOM_MIRROR: Request failed (error=5). stripe/stripe1[READ(offset=213316869632,length=4096)]
> GEOM_MIRROR: Device mirror1: provider stripe/stripe1 disconnected.

And the output from a script I wrote to check the RAID status daily:

GEOM mirror status:
Name Status Components
mirror/mirror0 COMPLETE ad0
ad2
mirror/mirror1 DEGRADED stripe/stripe0

GEOM stripe status:
Name Status Components
stripe/stripe0 UP ad4
ad6
stripe/stripe1 UP ad8
ad10

< sigh > At least I’ve got some spare disks… And I just happened to run a backup last night.

(Just FYI, there’s no data loss. One of the stripes which makes up half of the 0+1 array I use for data has gone offline due to a disk faililng.)