<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>

<channel>
	<title>Bobcares</title>
	<atom:link href="http://bobcares.com/index.php/blog/?feed=rss2" rel="self" type="application/rss+xml" />
	<link>http://bobcares.com/index.php/blog</link>
	<description>Bobcares</description>
	<pubDate>Thu, 02 Sep 2010 00:19:20 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.5.1</generator>
	<language>en</language>
				<item>
		<title>Spam and Email Headers (II/II)</title>
		<link>http://bobcares.com/index.php/blog/?p=753</link>
		<comments>http://bobcares.com/index.php/blog/?p=753#comments</comments>
		<pubDate>Wed, 01 Sep 2010 10:00:47 +0000</pubDate>
		<dc:creator>Vicky Karmakar</dc:creator>
		
		<category><![CDATA[Email]]></category>

		<category><![CDATA[Mail server]]></category>

		<category><![CDATA[Uncategorized]]></category>

		<category><![CDATA[mail headers]]></category>

		<category><![CDATA[spam]]></category>

		<guid isPermaLink="false">http://bobcares.com/index.php/blog/?p=753</guid>
   		<description><![CDATA[Hey, welcome back! I knew you wanted to know more about deciphering email headers. If you haven&#8217;t done so already, please do go through the first part of this series. In this part we&#8217;ll be looking into email headers in detail and I&#8217;ll disclose what information they hold.

As discussed in the first part of the [...]]]></description>
		<content:encoded><![CDATA[Hey, welcome back! I knew you wanted to know more about deciphering email headers. If you haven't done so already, please do go through the first part [1] of this series. In this part we'll be looking into email headers in detail and I'll disclose what information they hold.

As discussed in the first part of the article:
How do I see the email headers ?
There are different ways to check email headers in email clients, here [2] is a list by spamcop.net. This list is quite comprehensive, but if your email client is not listed there, a quick search on the internet or your email clients documentation should get you what you need.
Here are the email headers from a spam mail I received. Let us start to dissect it and hopefully by the end of this post they wont seem Greek to you :)
------------------------------------------------------------------------
1. Delivered-To: examplemanforspam@gmail.com
Received: by xxx..222.22.22 with SMTP id l19cs98734wec;
Tue, 3 Aug 2010 14:01:22 -0700 (PDT)
Received: by 10.227.128.4 with SMTP id i4mr6900607wbs.106.1280869275233;
Tue, 03 Aug 2010 14:01:15 -0700 (PDT)
2. Return-Path: &#60;mailer@abt45ye.co.uk&#62;
3. Received: from exchange-in-49.abcdmail.co.uk (mail234.170.170.170.abcdmail.co.uk [xxx.170.170.170])
by mx.google.com with ESMTP id l4si10692605wba.10.2010.08.03.14.01.12;
Tue, 03 Aug 2010 14:01:15 -0700 (PDT)
4. Received: from exch-exch.exchange.internal (exch-exch.exchange.internal [10.15.15.15])
    by exchange-in-49.abcdmail.co.uk (Postfix) with ESMTP id 76F9268428B;
    Tue, 3 Aug 2010 22:01:10 +0100 (BST)
5. X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Winning number:PL/09788/60
Thread-Index: AcszTv6mcIdwDQt+QNiNHXTdKKg31g==
From: "WEB LINK" &#60;mailer@abt45ye.co.uk&#62;
X-OriginalArrivalTime: 03 Aug 2010 21:01:09.0684 (UTC) FILETIME=[FF79F740:01CB334E]
To: undisclosed-recipients:;
This is a multi-part message in MIME format.
Euro Lotto Promotion Company of Scotland.
Edinburgh, Scotland EH12 8LP,United Kingdom.
Ref: XYL /xxxxxxxxxxxxx
Batch: 24/xxxxxxxxxxxxx
Winning number:PL/09xxxxx
Congratulations winner.
.Blah Blah Blah...
------------------------------------------------------------------------
Deciphering the headers.
1. Delivered-To: The message was send to the email address examplemanforspam@gmail.com on 3 Aug 2010 at 14:01:22 PDT (which is 7 hours behind GMT). Mail servers do not use AM/PM clock time.
2. Return-Path: If we reply to this mail, it will reach the inbox of mail id mailer@abt45ye.co.uk. This may or may not be forged, depending on the intention of the spammer.
3. Received: This received header specifies mail was delivered from exchange-in-49.abcdmail.co.uk to mx.google.com. So abcdmail.co.uk can be the spammer. Lets note down their IP address as follows.
On Linux:
$host exchange-in-49.abcdmail.co.uk
exchange-in-49.livemail.co.uk has address xxx.171.171.171
On Windows:
Use nslookup, check my previous post for more information on how to use it.
mail234.170.170.170.abcdmail.co.uk is the actual machine name of the server from where the mail was sent. This facility is provided by many popular mail servers and the IP address beside it is mail234.170.170.170.abcdmail.co.uk's own IP address.
In email headers, any line can be forged. The most forged line is the "From" and least one is the "Received". Some mailservers are kind enough to state the actually machine name from where the mail was sent.
Let us check the Received line again:
Received: from exchange-in-49.abcdmail.co.uk (mail234.170.170.170.abcdmail.co.uk [xxx.170.170.170])
As you can see,  the mail is pretending to come from exchange-in-49.abcdmail.co.uk but actually coming from mail234.170.170.170.abcdmail.co.uk whose IP address is xxx.170.170.170. So now we have the name of the server from where the spam was sent, mail234.170.170.170.abcdmail.co.uk, use the host command as mentioned in my previous post to get its IP address. Then do the whois for the IP address, check the abuse mail part and complain to the concerned ISP. In many cases the host, in this case  mail234.170.170.170.abcdmail.co.uk, might be an open relay .
So, we have two IP address now in our note.
4. Received: From here we can see that the message was delivered from exch-exch.exchange.internal to exchange-in-49.abcdmail.co.uk. Since exch-exch.exchange.internal is pointing it to a local mail server, it is not much of a help. There is more here though, the mail server used to send the spam is Postfix and the mail ID is 76F9268428B. This unique identifier can be used by the mail server administrator to identify the sender of the e-mail.
5. Here we get general information of the mail. The noticeable part is the "From:" section which says mailer@abt45ye.co.uk. This is same as Return-Path: . Most of the time, the email address in the Return-Path: section is not forged, since a spammers wants to get replies (potential customers) for his spam. So we see the domain here is abt45ye.co.uk. Lets get its IP address now.
$host abt45ye.co.uk
abt45ye.co.uk has address xxx.88.88.88
abt45ye.co.uk mail is handled by 10 mailserver.abt45ye.co.uk.
$ host mailserver.abt45ye.co.uk.
mailserver.abt45ye.co.uk has address xxx.172.172.172
Thus we have 3 IP addresses of mail servers xxx.171.171.171, xxx.170.170.170 and xxx.172.172.172 . Since all of them are similar, we can do a whois on any one of them.
On Linux, we can use the command whois.
$whois xxx.171.171.171
On windows, we can check this [3] site for whois information.
There I found the line given below.
remarks: report abuse to abuse@abt45ye.co.uk
Now you can shoot an email to the email address above with all your heartfelt complaints! I hope this has been a knowledgeable journey for you, as it has been for me.
Note: All IP addresses and names in the article have been changed for obvious reasons and are completely imaginary.

 
About the Author


It has been over 6  months since Vicky Karmakar joined the Poornam family. A graduate in Information Technology, Vicky has always been interested in exploring the newer ventures of the Open source technology with an acute inclination towards network security. He also harbors a passion towards writing poetry and cooking culinary delicacies.

Co-Authored by Hamish O. Lawrence


[1] http://bobcares.com/index.php/blog/?p=751
[2] http://www.spamcop.net/fom-serve/cache/19.html
[3] http://tools.whois.net/whoisbyip/]]></content:encoded>
			<wfw:commentRss>http://bobcares.com/index.php/blog/?feed=rss2&amp;p=753</wfw:commentRss>
		</item>
			<item>
		<title>The .htaccess file - More than just redirects!</title>
		<link>http://bobcares.com/index.php/blog/?p=759</link>
		<comments>http://bobcares.com/index.php/blog/?p=759#comments</comments>
		<pubDate>Mon, 30 Aug 2010 10:00:46 +0000</pubDate>
		<dc:creator>Remya Vipin</dc:creator>
		
		<category><![CDATA[Website administration]]></category>

		<category><![CDATA[.htaccess]]></category>

		<guid isPermaLink="false">http://bobcares.com/index.php/blog/?p=759</guid>
   		<description><![CDATA[.htaccess is only a file in your home folder. But it can do wonders. It can change settings on the servers and allow you to do many different things. The .htaccess file isn&#8217;t difficult to use and is really just made up of a few simple instructions in a text file. Let me note down [...]]]></description>
		<content:encoded><![CDATA[.htaccess is only a file in your home folder. But it can do wonders. It can change settings on the servers and allow you to do many different things. The .htaccess file isn't difficult to use and is really just made up of a few simple instructions in a text file. Let me note down a few situations where the .htaccess file can be used. These are requests that I get frequently and hope this article will help you get it done, all by yourselves.

First and foremost, we need to see if .htaccess is enabled in our server. For those who have root access, check the Apache configuration file, and ensure that the following entry is set:
----------------------
&#60;Directory /&#62;
AllowOverride All
&#60;/Directory&#62;
----------------------
For those who have no root access, please check with your support team.
You can also change the name from .htaccess to anything else like .config. You just need to set the following in the Apache configuration file:
----------
AccessFileName .config
----------
Now lets get on with the various applications:
To set custom error pages
To point a certain error message to a custom file, put this in your .htaccess file:
---------
ErrorDocument 404 http://www.yourdomainname.com/filename.html
---------
Where 404 is the error message you are redirecting, and http://www.yourdomain.com/filename.html is the page you wish people to see when they receive the error.
  URLs will begin with a slash (/) for local URLs, or will be a full URL which the client can resolve.
Examples:
ErrorDocument 500 /cgi-bin/tester
ErrorDocument 404 /cgi-bin/bad_urls.pl
ErrorDocument 401 http://www2.foo.bar/subscription_info.html
ErrorDocument 403 "Sorry can't allow you access tod

Redirect a page using .htaccess
To redirect visitors to certain pages based on the directory or file they request, add this to your .htaccess file:
-------------
Redirect /directory http://www.domain.com/new.html
-------------
Where /directory is the URL of the directory or file that you wish to redirect, and http://www.domain.com/new.html is the URL you are redirecting to

Protecting a directory using .htaccess
If you want to set authentication, and prevent other users from entering certain area, here is the .htaccess code to
require passwords:
--------------
AuthType Basic
AuthUserFile /home/user/.htpasswd
AuthGroupFile /dev/null
AuthName "Members Area"
require valid-user
--------------

Deny users using .htacccess
Add the following to the .htaccess file:
--------------
&#60;Limit GET&#62;
order allow,deny
deny from 128.23.45.
deny from 122.2.2.2
allow from all
&#60;/Limit&#62;
--------------
This is an example of a .htaccess file that will block access to your site to anyone who is coming from any IP address beginning with 128.23.45 and from the specific IP address 122.2.2.2 . By specifying only part of an IP address, and ending the partial IP address with a period, all sub-addresses coming from the specified IP address block will be blocked. You must use the IP addresses to block access. Use of domain names is not supported.

Redirect to a machine name
Add the following to the .htaccess file:
--------------
RewriteEngine On
Options +FollowSymlinks
RewriteBase /
# Rewrite Rule for machine.domain-name.net
RewriteCond %{HTTP_HOST} machine.domain-name.net $
RewriteCond %{REQUEST_URI} !machine/
RewriteRule ^(.*)$ machine/$1
--------------
This will redirect requests for the machine name machine.domain-name.net to the directory machine on the site
domain-name.net .

Prevent hot links: Preventing People from Linking to Your Images
Add the following to the .htaccess file:
--------------
# Rewrite Rule for images
RewriteCond %{HTTP_REFERER} &#60;URL of page accessing your domain&#62;
RewriteRule ^(.*)$ http://&#60;same as above URL&#62;
--------------
You would replace the &#60;URL of page accessing your domain&#62; above with the domain name and path of the page that is referring to your domain. For example: www.their-isp.net/users/mypage/
The RewriteCond directive states that if the {HTTP_REFERER} matches the URL that follows, then use the RewriteRule directive. The RewriteRule directive will redirect any reference back to the referring web page.
-------------------------------------------------------
Reference:
http://help.mindspring.com/webhelp/resources/powertips/accessindex.htm
http://www.javascriptkit.com/howto/htaccess.shtml
http://apache-server.com/tutorials/ATusing-htaccess.html
http://www.webdeveloper.com/servers/servers_htaccess_magic.html
http://baremetal.com/gadgets/htaccess/
-------------------------------------------------------




About the Author:
Remya Vipin has been with Bobcares for the last 6 years. She is an expert in cPanel-Linux servers and Linux server administration. She loves her work and aims to keep all her clients satisfied, but not as much as she loves spending time with her son.


]]></content:encoded>
			<wfw:commentRss>http://bobcares.com/index.php/blog/?feed=rss2&amp;p=759</wfw:commentRss>
		</item>
			<item>
		<title>Bobcares.com Refreshed!</title>
		<link>http://bobcares.com/index.php/blog/?p=769</link>
		<comments>http://bobcares.com/index.php/blog/?p=769#comments</comments>
		<pubDate>Sun, 29 Aug 2010 10:00:51 +0000</pubDate>
		<dc:creator>Hamish Oscar Lawrence</dc:creator>
		
		<category><![CDATA[Specials]]></category>

		<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://bobcares.com/index.php/blog/?p=769</guid>
   		<description><![CDATA[If you haven&#8217;t seen the changes yet, make sure you hit the refresh button a couple of times&#8230;Bobcares.com now has a new look! and so does our Blog! We&#8217;ve always felt like an open book&#8230;and now we look like one too! We are firm believers in change&#8230;and change is a good thing!

Completely designed in-house the [...]]]></description>
		<content:encoded><![CDATA[If you haven't seen the changes yet, make sure you hit the refresh button a couple of times...Bobcares.com [1] now has a new look! and so does our Blog! We've always felt like an open book...and now we look like one too! We are firm believers in change...and change is a good thing! [2]

Completely designed in-house the new site continues to uphoad our ideals of not taking ourselves too seriously, while still offering the best customer support services available today ;). Along with our tried and tested packages, we now offer "COMBO" packages, which combine the best of our support packages into one! Check out our latest Combo [3] offers if you haven't already.


About the Author:
 

Hamish works as a Senior Software Engineer in Bobcares. He joined Bobcares in July 2004, and is an expert in Control panels and Operating systems used in the Web Hosting industry. He is highly passionate about Linux and is a great evangelist of open-source. When he is not on his Xbox, he is an avid movie lover and critic.



[1] http://bobcares.com
[2] http://bobcares.com/blog/?p=645
[3] http://bobcares.com]]></content:encoded>
			<wfw:commentRss>http://bobcares.com/index.php/blog/?feed=rss2&amp;p=769</wfw:commentRss>
		</item>
			<item>
		<title>Bob goes traditional!</title>
		<link>http://bobcares.com/index.php/blog/?p=767</link>
		<comments>http://bobcares.com/index.php/blog/?p=767#comments</comments>
		<pubDate>Fri, 27 Aug 2010 11:09:27 +0000</pubDate>
		<dc:creator>Sankar H</dc:creator>
		
		<category><![CDATA[Fun Zone]]></category>

		<category><![CDATA[Word soup]]></category>

		<category><![CDATA[Bob]]></category>

		<category><![CDATA[Kerala]]></category>

		<category><![CDATA[Onam]]></category>

		<guid isPermaLink="false">http://bobcares.com/index.php/blog/?p=767</guid>
   		<description><![CDATA[For those looking forward to yet another technical blog, I have something even more attractive. This time, the article encompasses culture and tradition. The very Culture and tradition that gives Kerala the name ”God’s Own Country”. Kerala gets the name not just for it’s natural beauty, that rushes to the mind of each tourist who [...]]]></description>
		<content:encoded><![CDATA[For those looking forward to yet another technical blog, I have something even more attractive. This time, the article encompasses culture and tradition. The very Culture and tradition that gives Kerala the name ”God’s Own Country”. Kerala gets the name not just for it’s natural beauty, that rushes to the mind of each tourist who visits the state. Indeed Kerala is unique and special, as it has a blend of great natural beauty around its beaches, backwaters, forests, rivers and of course a mountainous belt of western ghats.
Kerala has a long tradition of religious harmony in spite of being a highly politicized region. The state where we have 100% literacy rates, where women enjoy the highest social status. Thanks to the coastline that brought in trade along with varied foreign influences in our tradition; helping in shaping our culture, and nurturing art forms like Kathakali, Kalaripayattu, Thaayambaka [1] and Vallamkali(snake-boat race). 
This week, Keralites celebrated “Onam” the spring festival commemorating the reign of mythical King Mahabali [2] during which people lived in plenty, prosperity and equality. 
The legend has it that the 'Asura [3]' King Mahabali was banished to the netherworld by Lord Vishnu, who took the incarnation of Vamana(the dwarf), under pressure from 'Devas', who were jealous of the King's popularity and success. 
It is said that before his banishment, the King got assurance from Lord Vamana that he would be allowed to revisit his people each year, on  'Thiruvonam' day of the Malayalam calendar. 
People of various caste, class and religion decorate their homes with floral carpets to welcome King Mahabali. 
As every other festival, we @Bobcares celebrated Onam with great enthusiasm, organizing cultural events,  comprising of some highly traditional Kerala's performing arts, and sports competitions that reflects rural sporting traditions.
'Onasadya'(a sumptuous feast) was another highlight of Onam day, as people assembled for lunch @Office.
 

Bobs dressed as Maveli for a competition.
 

Bobs testing strength in the tug of war referred as “vadam vali”.
 

The floral carpet that forms part of the tradition of welcoming Mahabali.
 

Bobs participating in Thiruvathira, a traditional dance form of Kerala.
 


About the Author :
Sankar works as a Senior Software Engineer in  Bobcares. He joined Bobcares back in April 2006. He loves grooming/mentoring people. During his free time, he listens to music, and enjoys singing..



[1] http://en.wikipedia.org/wiki/Culture_of_Kerala
[2] http://www.onamfestival.org/king-mahabali-onam.html
[3] http://en.wikipedia.org/wiki/Asura]]></content:encoded>
			<wfw:commentRss>http://bobcares.com/index.php/blog/?feed=rss2&amp;p=767</wfw:commentRss>
		</item>
			<item>
		<title>Spam and Email Headers (I/II)</title>
		<link>http://bobcares.com/index.php/blog/?p=751</link>
		<comments>http://bobcares.com/index.php/blog/?p=751#comments</comments>
		<pubDate>Wed, 25 Aug 2010 10:00:54 +0000</pubDate>
		<dc:creator>Vicky Karmakar</dc:creator>
		
		<category><![CDATA[Email]]></category>

		<category><![CDATA[Mail server]]></category>

		<category><![CDATA[mail headers]]></category>

		<category><![CDATA[spam]]></category>

		<guid isPermaLink="false">http://bobcares.com/index.php/blog/?p=751</guid>
   		<description><![CDATA[Hey, is spam bogging you down? Is it clogging your Inbox? Has it become a nuisance in your day to day life? Deleting them is an easy way out, but if you want to really fight spam then read on&#8230;
Wouldn&#8217;t be great if you could stop spam? To do that, it is always best to [...]]]></description>
		<content:encoded><![CDATA[Hey, is spam bogging you down? Is it clogging your Inbox? Has it become a nuisance in your day to day life? Deleting them is an easy way out, but if you want to really fight spam then read on...
Wouldn't be great if you could stop spam? To do that, it is always best to get to the root cause of a problem. In this case, spam can be stopped if you shoot a complaint to the Internet Service Provider (ISP) or the DataCentre from where this spam originated. Nowadays, most ISP's have a "zero tolerance" policy against spammers. As per their policy, they can delete the spammers account, make them pay hefty fine or even send them to jail! Yet, we are to blame to, a majority of this spam goes unreported. Spamcop does this service for free, all they need is for you to report these spam mails to them and they will send a complaint to the abuse department of the spammer's ISP. Are you curious as to how that happens? How do people like Spamcop know which ISPs are responsible? The answer lies in the "email headers". When a email is sent by you to someone or vice-versa, it travels through the internet, stopping and turning at many points to reach the destination. At each point some information is added to the email, which is mostly invisible to the untrained eye. These bits of information are invaluable in finding the source of an email. These bits of information added at each "turn", are called "Email Headers".
The short way to identify spammers:
1. Check the email headers.
2. Find the spammers IP address.
3. Find the (Internet service provider) ISP or the DataCentre associated with IP address.
4. Send a complaint to the abuse department of the ISP or DataCentre.
I'm sure you've got a hundred questions running through your mind right now. You may already have seen these "email headers", but not quite sure what to make of them. Don't sweat! I'm dedicating a couple of posts just to help clear the mystery behind these fabled "email headers". In the rest of this post I'll talk about how you can get the email headers of a mail, the procedure for reporting an IP address that appears to be the source spam, and just for good measure, some tips on how to safely use your email address on the internet.
How do I see the email headers?
There are different ways to check email headers in email clients, here [1] is a list by spamcop.net. This list is quite comprehensive, but if your email client is not listed there, a quick search on the internet or your email clients documentation should get you what you need.
How do I find the spammers IP address?
Ah, this is what this article is all about, but I'll be delving into the details of that in my next post. For now, just know that after analyzing the email headers, we will get either the hostname or IP address of the server from where the mail was sent. To convert a hostname to an IP address, we use the “host” command on Linux and “nslookup” on Windows.
For example:
On Linux:
$  host bogus123.com
google.com has address xx.104.7.99
google.com has address xx.104.7.104
On Windows:
C:Documents and Settingsvickykarmakar>nslookup bogus123.com
Server: ed-002-sfo.abc.com
Address: 192.168.1.9
Non-authoritative answer:
Name: google.com
Addresses: xx.104.7.99, xx.104.7.104

Now we have found the IP address from the corresponding hostname. With this IP address, we will search for the ISP or DC to whom this IP address belongs.
How do I find the concerned ISP or the DC?
Have you heard about the term “whois”? It is a protocol by which we can determine the registrar of the domain name or IP address.
On linux, you can try the “whois” command as follows.
$whois xxx.110.110.110
Unfortunately there is no such utility present on windows. You can use this [2] site to get the whois information about the IP address. Then check for the word “abuse” in their. There will be a email address to which abuse complains concerning the  IP address can be sent.
It will look something like this.
----------------------------
remarks:        * For abuse/spam related to this IP address block,
remarks:        * please send email to: abuse@link.abc.in
----------------------------
Voila! now that you have these deails, just shoot a complaint over to them. If everybody is vigilant enough against spamming, we can surely fight this menace.

Prevention is better than cure.
Here are some tips, to help stop your email address from getting bombarded with spam:
1. Never reply to mails which you consider as spam. If you reply, the spammer will be assured that your mail account is an active one and will send you more mails(read: spam).
2. Never click any link or download any attachment from a spam email. These can be malicious objects to infect your system.
3. Have your antivirus, web browser and OS always updated. They are often patched up for known security vulnerabilities.
4. Always have more than one email id's, use one of them only to register on public websites such as social networking sites, forums, newsletters and other for professional use.
5. Do not use your email id as john@example.com instead use john_@_example_dot_com. This way the crawlers on internet would not be able to scan and store your email id.
6. Be informed about spam. Do not accept it. Complain to the concerned authorities. Laws are getting stricter, it is time we fight back this menace.
Though the procedure lined above to identify the spammer can be done using tolls on a  website like spamcop.net, isn't it always better to know what happens under the hood ? That's what I'll be covering in the next part of my post, analyzing email headers. Check back next week!

 
About the Author


It has been over 6  months since Vicky Karmakar joined the Poornam family. A graduate in Information Technology, Vicky has always been interested in exploring the newer ventures of the Open source technology with an acute inclination towards network security. He also harbors a passion towards writing poetry and cooking culinary delicacies.

Co-Authored by Hamish O. Lawrence


[1] http://www.spamcop.net/fom-serve/cache/19.html
[2] http://tools.whois.net/whoisbyip/]]></content:encoded>
			<wfw:commentRss>http://bobcares.com/index.php/blog/?feed=rss2&amp;p=751</wfw:commentRss>
		</item>
			<item>
		<title>Installing the LiteSpeed Load Balancer</title>
		<link>http://bobcares.com/index.php/blog/?p=749</link>
		<comments>http://bobcares.com/index.php/blog/?p=749#comments</comments>
		<pubDate>Mon, 23 Aug 2010 10:00:40 +0000</pubDate>
		<dc:creator>Remya Vipin</dc:creator>
		
		<category><![CDATA[Web Server]]></category>

		<category><![CDATA[LiteSpeed]]></category>

		<category><![CDATA[Load Balancing]]></category>

		<category><![CDATA[LSLB]]></category>

		<guid isPermaLink="false">http://bobcares.com/index.php/blog/?p=749</guid>
   		<description><![CDATA[We are constantly on the lookout for ways to improve the response times of our servers. We already have various software available in the market today that can help us achieve that goal, like Nginx, LightHttpd, Litespeed etc. In my article today we will discuss on one of them in particular - LiteSpeed, and its [...]]]></description>
		<content:encoded><![CDATA[We are constantly on the lookout for ways to improve the response times of our servers. We already have various software available in the market today that can help us achieve that goal, like Nginx, LightHttpd, Litespeed etc. In my article today we will discuss on one of them in particular - LiteSpeed, and its ability to act as a Load Balancer.

Litespeed can be used in 3 different ways. You can:

Install Litespeed Load Balancer and distribute the requests based on the server loadInstall Litespeed to serve dynamic pages on one port and Apache to serve static pages on another.Install Litespeed alone to serve all pages on port 80
All options are equally good. But now let me share with you, how I installed the LiteSpeed Load Balancer and certain issues I faced after that.
LiteSpeed Load Balancer(LSLB) is a high-performance, content-aware, session-aware HTTP application load balancer. It can forward requests based on request content as well as session stickiness preference. LiteSpeed Load Balancer can help scale your application beyond one server deployment, as well as improve the reliability of your service in case of hardware failures.
Lets say we have 3 servers, I will be explaining with reference to a domain name mytestdomain.com. First and foremost, you need to make sure that the domain name is pointing to the IP of the load-balancer server. Hence, do make the required changes in the DNS for mytestdomain.com.
To install Litespeed Load Balancer in the server with IP address 1.1.1.1:

1. Login to the server as root and disable port 80, as Litespeed Load balancer will be listening on port 802. cd /root3. Download the load balance, based on your server version, from http://www.litespeedtech.com/litespeed-load-balancer-downloads.html4. tar -zxf /root/lslb-xx.tar.gx5. cd lslb-*6. Download the trial license from http://www.litespeedtech.com/trial/license/ and the trial key that is sent to your email account. Save it in /root/lslb-* folder7. ./install.sh You just need to accept the default values and continue with the installation. Just make sure that you enable port 80 for HTTP port.8. Enable the desired ports (80 for http and 7090 for admin interface) in the server firewall
We have now finished installing the Load Balancer.

As for the other servers in the group, for now, you can install Apache on them, but you could also move to lone instances of LiteSpeed on those servers too. Now lets start configuring the load balancer:

1. Access the admin interface using the link  http://1.1.1.1:7090 and the login credentials provided in Step 72. Click on Configuration -> Virtual Hosts -> Add. You will see a Virtual Hosts Page3. Click Add
   Enter the Virtual Host Name : eg: mytestdomain.com
   Default Cluster : clusterHTTP
   Configure File : $SERVER_ROOT/conf/mytestdomain.com.xml
   Click SAVE4. You will see a message "Input error detected. Please resolve the error(s)"
   Click the link "CLICK TO CREATE"
   Click SAVE5. Click SAVE, again, to finish. Now your Virtual Host has been added.6. Next click the link "Apply Changes".

Now we need to configure clusters:

7. Click on the Clusters tab.8. Click ClusteHTTP9. Click on the Worker Group tab10. Click on nodeHTTP/LI>11. Click Edit, to continue12. Enter the loadbalancer server address and the address of the servers that are being load-balanced. Please replace with your respective ip address:
(mytestdomain) = node name
1.1.1.1 = load balancer ip address
1.1.1.2 and 1.1.1.3 = 2 web servers

This will make sure that if someone tries to access mytestdomain.com, the request will be reach the load balancer first and then will be routed to the server with the least load.

13. Click SAVE14. Click on Listeners tab.15. Click View/Edit16. You need to click "Add" to add our virtual host mytestdomain.com, into Listener17. Click Add18. Choose your Virtual Host : eg: mytestdomain.com
Input your Domains : mytestdomain.com, www.mytestdomain.com19. Click SAVE20. Click on "Apply Changes" in the message: "Configuration has been modified. To apply changes, perform Graceful restart Apply Changes"21. Click Apply Changes / Graceful Restart
And thats it! You have now installed the LiteSpeed Load Balancer.

Here are a few issues I faced with the LiteSpeed Load Balancer:

If you see 503 messages in your browser, you need to increase "Initial Request Timeout (secs)" in clusterHTTP worker.In case of DOS attack, you need to set "Connection Soft Limit"  and "Connection Hard Limit" to block aggressive IP.If you want to split the work load among the servers, you just need to assign different values for "Max connections" to the different serverslike "100" connections to server1, "50" connections to "server2". LiteSpeed Load Balancer will use this as "weight" for different backend.

I hope this tutorial will help you achieve faster response times for your sites.



About the Author:
Remya Vipin has been with Bobcares for the last 6 years. She is an expert in cPanel-Linux servers and Linux server administration. She loves her work and aims to keep all her clients satisfied, but not as much as she loves spending time with her son.


]]></content:encoded>
			<wfw:commentRss>http://bobcares.com/index.php/blog/?feed=rss2&amp;p=749</wfw:commentRss>
		</item>
			<item>
		<title>Release Management of Infrastructure/Service</title>
		<link>http://bobcares.com/index.php/blog/?p=761</link>
		<comments>http://bobcares.com/index.php/blog/?p=761#comments</comments>
		<pubDate>Fri, 20 Aug 2010 14:15:54 +0000</pubDate>
		<dc:creator>Sankar H</dc:creator>
		
		<category><![CDATA[Development and Testing]]></category>

		<category><![CDATA[Uncategorized]]></category>

		<category><![CDATA[Virtualization]]></category>

		<category><![CDATA[Release Management]]></category>

		<category><![CDATA[vCenter Stage Manager]]></category>

		<category><![CDATA[VMware Infrastructure]]></category>

		<guid isPermaLink="false">http://bobcares.com/index.php/blog/?p=761</guid>
   		<description><![CDATA[To roll out an IT service or business application into production, companies customize standard application packages, or go ahead and develop the entire application inhouse. In either case, applications go through a rigorous release management cycle, before it is put in to production. This is pretty much similar to the process applied to production systems, [...]]]></description>
		<content:encoded><![CDATA[To roll out an IT service or business application into production, companies customize standard application packages, or go ahead and develop the entire application inhouse. In either case, applications go through a rigorous release management cycle, before it is put in to production. This is pretty much similar to the process applied to production systems, that need to be patched or updated.

In today's challenging times,  companies need to respond very quickly to software requirements, and roll out new services or feature requests to meet these requirements. The process is mostly simplified or rather eased by creating an image template of instances at each stage of application development. This makes the process seamless and also helps greatly in managing versions. Simultaneous testing and deployment of projects can be done by adopting such a methodology.
Even though this method is widely adopted, where test instances are created to implement integrations and patch management, it adds to the complexity of overall integration.  Often the results won't be the same in a production environment, unlike the testing or staging environment. The whole process of migrating the applications to production in itself is time consuming, and it often leaves you with the additional burden of further testing the app in the production environment.
In the highly competitive market, the time to hit the market and time to deploy services are very important. Companies cannot afford to spend months in production cycles or days in deployment stages.
VMware Infrastructure and vCenter Stage Manager
VMware Infrastructure can provide a definitive edge to automate release management in the datacenter and reduce the issues of configuration drift and release management. It allows creation of  standardized software containers, wherein components can be standardized across different stages of release management. The ease of management that VMware Infra provides, can easily make infrastructure management pretty easy.
VMware vCenter Stage Manager, organizes systems in the enterprise software lifecycle into services. These services represent the deliverables of IT and are broken into stages that span development and testing to production. vCenter Stage Manager increases IT service availability, accelerates response to configuration changes, promotes compliance with regulatory or workflow processes, and promotes efficient use of storage
Together with VMware Infrastructure, vCenter Stage Manager automates release management and allows IT operations and application owners, to roll out applications into production and meet change requests to production systems more dynamically, in response to business requirements. vCenter Stage Manager provides a global view of all applications and IT services under management and simplifies service operations through an intuitive user interface.
To know more about Stage Manager, visit http://www.vmware.com/support/pubs/stagemanager_pubs.html [1]
 


About the Author :
Sankar works as a Senior Software Engineer in  Bobcares. He joined Bobcares back in April 2006. He loves grooming/mentoring people. During his free time, he listens to music, and enjoys singing..



[1] http://www.vmware.com/support/pubs/stagemanager_pubs.html]]></content:encoded>
			<wfw:commentRss>http://bobcares.com/index.php/blog/?feed=rss2&amp;p=761</wfw:commentRss>
		</item>
			<item>
		<title>Windows Server 2008R2 SP1 Beta - 2 new features added!</title>
		<link>http://bobcares.com/index.php/blog/?p=747</link>
		<comments>http://bobcares.com/index.php/blog/?p=747#comments</comments>
		<pubDate>Thu, 19 Aug 2010 10:00:27 +0000</pubDate>
		<dc:creator>Hamish Oscar Lawrence</dc:creator>
		
		<category><![CDATA[Virtualization]]></category>

		<category><![CDATA[R2 SP1 Beta]]></category>

		<category><![CDATA[Windows Server 2008]]></category>

		<guid isPermaLink="false">http://bobcares.com/index.php/blog/?p=747</guid>
   		<description><![CDATA[Microsoft recently released the Service Pack 1 Beta for Windows Server 2008 R2. In its war with VMWare in the Virtualization sector, Microsoft has decided to showcase its own developments in the Windows Server virtualization platform via two key features:  Dynamic Memory and RemoteFX. Both of which are now available via the SP1 Beta [...]]]></description>
		<content:encoded><![CDATA[Microsoft recently released the Service Pack 1 Beta for Windows Server 2008 R2 [1]. In its war with VMWare in the Virtualization sector, Microsoft has decided to showcase its own developments in the Windows Server virtualization platform via two key features:  Dynamic Memory and RemoteFX. Both of which are now available via the SP1 Beta update.

Lets take a look at what Microsoft has to say about these two new features:
Dynamic Memory
Dynamic Memory allows customers to achieve increased density when they’re consolidating physical servers into a virtual realm, providing them with predictable performance and linear scalability.  With Dynamic Memory, IT administrators are able to pool available memory on a physical host and then dynamically dole that memory out to virtual machines running on the host, based on current workload needs.For a technical overview of the new Dynamic Memory feature, download the Dynamic Memory Technical Overview whitepaper [2].

RemoteFX
RemoteFX, a key feature of Remote Desktop Services (RDS) lets IT administrators deliver a rich graphics experience to end-users through virtualized desktops.  Using new protocol enhancements between Windows Server 2008 R2 and Windows 7, end users can now access virtual machines on a wide variety of target devices and still get a rich graphics experience with server-side graphics processing. Learn more about RemoteFX and download the Remote Desktop Services Datasheet [3].
With Service Packs now starting to offer exciting new features like this, we all have something more to look forward to than just a couple of bug fixes ;)


About the Author:
 

Hamish works as a Senior Software Engineer in Bobcares. He joined Bobcares in July 2004, and is an expert in Control panels and Operating systems used in the Web Hosting industry. He is highly passionate about Linux and is a great evangelist of open-source. When he is not on his Xbox, he is an avid movie lover and critic.



[1] http://www.microsoft.com/windowsserver2008/en/us/sp1.aspx
[2] http://download.microsoft.com/download/E/0/5/E05DF049-8220-4AEE-818B-786ADD9B434E/Implementing_and_Configuring_Dynamic_Memory.docx
[3] http://download.microsoft.com/download/5/6/9/5698CD2F-D22B-4466-AF6F-3FC8524B626A/Datasheet%20WS08R2_RDS_SP1beta.docx]]></content:encoded>
			<wfw:commentRss>http://bobcares.com/index.php/blog/?feed=rss2&amp;p=747</wfw:commentRss>
		</item>
			<item>
		<title>Security Testing of Web Applications (III/III)</title>
		<link>http://bobcares.com/index.php/blog/?p=735</link>
		<comments>http://bobcares.com/index.php/blog/?p=735#comments</comments>
		<pubDate>Tue, 17 Aug 2010 10:00:44 +0000</pubDate>
		<dc:creator>Dhanya P.B.</dc:creator>
		
		<category><![CDATA[Development and Testing]]></category>

		<category><![CDATA[Cross-Site Scripting]]></category>

		<category><![CDATA[Security Testing]]></category>

		<category><![CDATA[SQL Injection]]></category>

		<guid isPermaLink="false">http://bobcares.com/index.php/blog/?p=735</guid>
   		<description><![CDATA[Last week I spoke about SQL injection attacks used to try and gain access to the Administrative Interface on an application sever. This week I will be talking about three other methods used to try and do the same.

Parameter Tampering:
 

Parameter tampering is a form of hacking that creates a change in the url associated [...]]]></description>
		<content:encoded><![CDATA[Last week [1] I spoke about SQL injection attacks used to try and gain access to the Administrative Interface on an application sever. This week I will be talking about three other methods used to try and do the same.

Parameter Tampering:
 

Parameter tampering is a form of hacking that creates a change in the url associated with a web page. The web parameter tampering attack is based on the manipulation of parameters exchanged between client and server. This parameter tampering is used to modify application data, such as user credentials and permissions, price and quantity of products, etc. Usually, this information is stored in cookies, hidden form fields, or url query strings.
One of the most common tools used to minimize the potential of parameter tampering is firewall. As part of the operation of a firewall, each parameter or identifying data that defines a web page must be verified in order to allow full access to the page. If any single parameter does not meet with the standards established during the implementation of the firewall, access is blocked and cannot be secured by a hacker.
Various other settings can be put in place to limit the ability of a hacker to make use of parameter tampering. Like a firewall, these settings verify the status of all parameters and make sure nothing is wrong. This verification process will look at the numeric range that was set for the web page as well as the minimum and maximum lengths of the entered strings that are applied to the page. If any parameter does not match the original configuration, then access is denied.
Both whitelisting and blacklisting are employed as tools to limit parameter tampering. Whitelisting essentially works to accept only input that is allowable by the current security settings. Blacklisting focuses more on refusing to allow access, using any input that is not specifically included in the security protocols. Depending on the degree and type of security protection desired, one or both of these tools may be employed simultaneously.

Cross-Site Scripting:
Cross-site scripting attacks occur when the attacker takes advantage of a web application and creates a request with malicious data (such as a script) that is later presented to the user requesting it. The malicious content is usually embedded into a hyperlink. If the user then follows the link, the malicious data is sent to the web application, which in turn creates an output page for the user. The user, however, is normally unaware of the attack, and assumes the data originates from the web server itself, leading the user to believe this is valid content from the Web site. Many popular guestbook and forum programs allow users to submit posts with html and javascript embedded in them.
For example, an attacker might place a hyperlink with an embedded malicious script into an online discussion forum. The purpose of the malicious script is to attack other forum users who happen to select the hyperlink. It could copy user cookies and then send those cookies to the attacker.
The following are the general approaches to prevent cross-site scripting attacks:

Encode output based on input parameters.Filter input parameters for special characters.Filter output based on input parameters for special characters.

Buffer Overflow:
A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information can overflow into adjacent buffers. This may corrupt or overwrite the valid data held in them. Although it may occur accidentally through programming error. Buffer overflow is an increasingly common type of security attack on  data integrity. This may damage the user's files, change data, or disclose confidential information. Code security is the best possible solution to avoid buffer overflow. Avoid standard unsafe functions in coding to prevent buffer overflow.

Incomplete development processes leave the web application at risk. Well, to achieve greater level of application security, mature development practices that will not leave any loop holes to attackers need to be implemented. I hope these posts will help you on your way there.

 


About the Author :
Dhanya P.B. joined Bobcares in October 2006. Initially working in the Technical Support department, she later moved to our Software Development department where her talents truly shined. She has been working as a dedicated software tester for the past two and a half years and is passionate about learning the rhythms of various Software Testing Techniques. In her free time she listens to soft music and enjoys cooking.



[1] http://bobcares.com/index.php/blog/?p=733]]></content:encoded>
			<wfw:commentRss>http://bobcares.com/index.php/blog/?feed=rss2&amp;p=735</wfw:commentRss>
		</item>
			<item>
		<title>Firewall: Guard on surveillance</title>
		<link>http://bobcares.com/index.php/blog/?p=745</link>
		<comments>http://bobcares.com/index.php/blog/?p=745#comments</comments>
		<pubDate>Sat, 14 Aug 2010 02:40:35 +0000</pubDate>
		<dc:creator>Sankar H</dc:creator>
		
		<category><![CDATA[Security]]></category>

		<category><![CDATA[Firewall]]></category>

		<category><![CDATA[hardware firewall]]></category>

		<category><![CDATA[software firewall]]></category>

		<guid isPermaLink="false">http://bobcares.com/index.php/blog/?p=745</guid>
   		<description><![CDATA[To define a firewall in simple terms, one can put it to words as a - protective system that functions between your host/network and the sometimes &#8220;deadly&#8221; Internet. An effective firewall policy, prevents unauthorized use and access to your network/server. 
The role of a firewall is to analyse information entering and leaving the network/server, based [...]]]></description>
		<content:encoded><![CDATA[To define a firewall in simple terms, one can put it to words as a - protective system that functions between your host/network and the sometimes "deadly" Internet. An effective firewall policy, prevents unauthorized use and access to your network/server. 
The role of a firewall is to analyse information entering and leaving the network/server, based on an existing firewall configuration. It usually acts as a barrier for many form of attacks.
Ideally, a security strategy puts to use both hardware, and software firewalls. That said, understanding them based on a comparative approach definitely helps framing sound firewall policies.

Hardware Firewalls
Hardware firewalls are stand alone hardware devices, specially designed to filter traffic based on configured rules. They have the distinct advantage of ease of configuration and simpler operation. They are easily deploy-able and fit in for all O/S’es and networks.  The device usually has incoming and outgoing ports, and effectively fits into various network topologies.
Hardware firewalls work on the concept of packet filtering. It reads the header of each packet, to determine the source and destination of a packet(including ports). Based on pre-configured rules in the firewall, it either lets the packets through, or drops them.
Even though the configuration of the device is more or less user friendly, setting up a sound firewall policy warrants some expertise in server/network security and design.
Software Firewalls
The popularity of software firewalls are much higher, when compared to hardware firewalls. The reasons of such a choice, is probably the cost and additional features that ship with it. There is also a misconception that a hardware firewall is needed only for large and medium scale enterprises. 
A key advantage of software firewall is that it allows a greater degree of flexibility in its configuration. Many a times the firewall is OS specific and hence gives more features using the inherent features of the installed OS. Feature rich firewalls usually incorporate vulnerability checks and anti-virus extensions, that makes it even more attractive.
While we discuss the merits, it is worth mentioning that the use of a software firewall is almost always limited to protect a specific host/computer. Configuration of such firewalls to provide protection for a network is possible, and is practised by many. Remember that such firewalls depend on the resource of the host machine for functioning.  The ability to pick a firewall - that is lean on resource usage, aggressive in terms of security, timely updates and enhancements, is what makes Software Firewalls the popular choice!
Using a high end hardware firewall, or a feature rich software firewall does not always stop potential risks at the doorsteps. It is more about how one uses these, to build a strong security strategy that stands the “test of time and attacks”.
 


About the Author :
Sankar works as a Senior Software Engineer in  Bobcares. He joined Bobcares back in April 2006. He loves grooming/mentoring people. During his free time, he listens to music, and enjoys singing..
.
]]></content:encoded>
			<wfw:commentRss>http://bobcares.com/index.php/blog/?feed=rss2&amp;p=745</wfw:commentRss>
		</item>
	</channel>
</rss>
