| 00:13.49 | *** join/#uphpu TuxToaster (~TuxToaste@66.133.98.20) |
| 00:13.49 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 01:07.02 | *** join/#uphpu TuxToaster (~TuxToaste@66.133.98.20) |
| 01:07.02 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 01:23.58 | *** join/#uphpu T4rku5 (~74rku5@c-174-52-141-215.hsd1.ut.comcast.net) |
| 01:23.58 | *** join/#uphpu T4rku5 (~74rku5@unaffiliated/shunkydave) |
| 01:47.31 | *** join/#uphpu ninnypan_ (~ninnypant@69.169.155.132.provo.static.broadweavenetworks.net) |
| 01:50.49 | *** join/#uphpu KingMichael (~KingMicha@c-67-177-40-132.hsd1.ut.comcast.net) |
| 02:08.28 | *** join/#uphpu carmony (~carmony@198.61.169.8) |
| 02:08.29 | *** mode/#UPHPU [+o carmony] by ChanServ |
| 02:23.49 | *** join/#uphpu mgeary (~mgeary@69.169.142.45.provo.static.broadweavenetworks.net) |
| 02:23.49 | *** mode/#UPHPU [+v mgeary] by ChanServ |
| 02:30.31 | ninnypan_ | anyone using Route 53? |
| 02:31.01 | ninnypan_ | for dns |
| 03:15.59 | *** join/#uphpu clintberry (~clintberr@c-76-27-26-207.hsd1.ut.comcast.net) |
| 03:15.59 | *** mode/#UPHPU [+v clintberry] by ChanServ |
| 03:24.03 | *** join/#uphpu mgeary (~mgeary@69.169.142.45.provo.static.broadweavenetworks.net) |
| 03:24.03 | *** mode/#UPHPU [+v mgeary] by ChanServ |
| 04:39.57 | mindjuju | ninnypants: i'm using route 53 right now |
| 04:40.00 | mindjuju | working awesome |
| 04:41.00 | mindjuju | ninnypants: question - you mentioned ou had a VPS service somewhere, where is it, do you like it? |
| 05:12.56 | *** join/#uphpu macnewbold (~macnewbol@c-98-202-181-28.hsd1.ut.comcast.net) |
| 05:12.57 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 05:44.19 | *** join/#uphpu macnewbold (~macnewbol@c-98-202-181-28.hsd1.ut.comcast.net) |
| 05:44.19 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 06:05.00 | tierra | I've used Route 53 before, not much different from any other DNS other than the special "Alias" record type for automated configuration with ELB, CF, or S3 |
| 06:06.34 | mindjuju | up late tierra? |
| 06:06.44 | tierra | heh, yeah |
| 06:07.01 | mindjuju | what do you know about BH VPS? |
| 06:07.36 | tierra | it's all the usual cPanel setup afaik |
| 06:08.51 | mindjuju | i think i have one of those BH trial cards, i'll have to fire one up and take a look |
| 06:09.36 | tierra | oh nice, Assassin's Creed 3 is on steam sale :) |
| 06:10.04 | mindjuju | that's one i've wanted to play, but i vowed to not spend a dime more on valve until some news of HL3 |
| 06:10.11 | tierra | haha |
| 06:10.20 | mindjuju | plus with school, it's hard to have time to play |
| 06:10.26 | mindjuju | i've got 10 credits this semester |
| 06:11.30 | tierra | yeah, cramming school + work + games + family is tough |
| 06:11.41 | tierra | something gets the axe |
| 06:11.44 | tierra | ;) |
| 06:11.55 | mindjuju | yup |
| 06:27.19 | tierra | kind of a cool announcement earlier today with Google Summer of Code: "We'll be hosting a 10-year reunion event on Google's campus for students and mentors next year. Stay tuned for more details!" |
| 06:28.06 | tierra | well, that and the news about 10% more of everything next year (orgs, students, student stipends, etc) |
| 06:29.49 | tierra | in any case, I'm one of those "alumni" being invited down, regardless of whether I even participate next year... should be fun |
| 06:31.23 | mindjuju | that's cool! |
| 06:31.31 | mindjuju | what project did you do that you were involved with |
| 06:31.42 | mindjuju | was that the wxWidgets |
| 06:32.06 | tierra | wxWidgets, and actually also WordPress (I mentored a student with WP this year) |
| 06:32.16 | mindjuju | ah cool |
| 06:32.26 | tierra | I've been involved in GSoC for 4 years now |
| 06:32.32 | tierra | 4 out of those 10 years |
| 06:32.33 | tierra | heh |
| 06:33.05 | tierra | well, 9 years so far |
| 06:46.23 | *** join/#uphpu macnewbold (~macnewbol@c-98-202-181-28.hsd1.ut.comcast.net) |
| 06:46.23 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 08:18.35 | *** join/#uphpu macnewbold (~macnewbol@c-98-202-181-28.hsd1.ut.comcast.net) |
| 08:18.35 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 09:51.14 | *** join/#uphpu macnewbold (~macnewbol@c-98-202-181-28.hsd1.ut.comcast.net) |
| 09:51.14 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 11:24.46 | *** join/#uphpu macnewbold (~macnewbol@c-98-202-181-28.hsd1.ut.comcast.net) |
| 11:24.46 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 12:26.48 | *** join/#uphpu macnewbold (~macnewbol@c-98-202-181-28.hsd1.ut.comcast.net) |
| 12:26.48 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 13:04.03 | *** join/#uphpu ryan__ (~ryan@72.52.97.167) |
| 13:04.06 | *** join/#uphpu T4rku5 (~74rku5@c-174-52-141-215.hsd1.ut.comcast.net) |
| 13:04.06 | *** join/#uphpu T4rku5 (~74rku5@unaffiliated/shunkydave) |
| 14:13.00 | *** join/#uphpu T4rku5 (~74rku5@c-174-52-141-215.hsd1.ut.comcast.net) |
| 14:13.00 | *** join/#uphpu T4rku5 (~74rku5@unaffiliated/shunkydave) |
| 14:15.48 | *** join/#uphpu eggyknap (~jtolley@184-11-45-120.dr01.dlta.ut.frontiernet.net) |
| 14:15.48 | *** join/#uphpu eggyknap (~jtolley@unaffiliated/eggyknap) |
| 14:15.48 | *** mode/#UPHPU [+v eggyknap] by ChanServ |
| 14:22.35 | *** join/#uphpu kendsnyder (~kendsnyde@70-58-36-242.slkc.qwest.net) |
| 14:22.35 | *** mode/#UPHPU [+v kendsnyder] by ChanServ |
| 14:26.45 | *** join/#uphpu josephscott (~josephsco@proxy.iad.automattic.com) |
| 14:30.47 | *** join/#uphpu MikeHansenMe (~mike@173-165-131-122-utah.hfc.comcastbusiness.net) |
| 14:48.22 | *** join/#uphpu TuxToaster (~TuxToaste@wfw.vivint.com) |
| 14:48.23 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 14:51.15 | mindjuju | any grammar nerds in the house? |
| 14:57.17 | *** join/#uphpu clintberry (~clintberr@c-76-27-26-207.hsd1.ut.comcast.net) |
| 14:57.17 | *** mode/#UPHPU [+v clintberry] by ChanServ |
| 15:05.38 | eggyknap | this must be interesting |
| 15:07.35 | ninnypants | mindjuju: I didn't see your comments last night was on my laptop |
| 15:08.38 | ninnypants | mindjuju: I'm using https://www.digitalocean.com/ and I'm liking it. They're cheap, quick, and I haven't had any downtime caused by them as far as I know |
| 15:09.19 | herlo | I know a few people who use DO |
| 15:10.01 | herlo | it has some limitations, like no add-on disk atm, but it seemed pretty reasonable when I used a few systems. |
| 15:11.25 | *** join/#uphpu macnewbold (~macnewbol@66.219.204.99.provo.dynamic.broadweavenetworks.net) |
| 15:11.25 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 15:11.49 | ninnypants | I wonder what the new xmission cloud will be like |
| 15:13.47 | mindjuju | eggyknap, did you see this? |
| 15:13.49 | mindjuju | http://www.wired.com/wiredscience/2013/10/shutdown-salmonella/ |
| 15:14.15 | mindjuju | i think truly the most alarming thing from the article is: Government's as a contraction of Government and is |
| 15:14.30 | mindjuju | i guess their spell / grammar check must be shutdown too |
| 15:18.19 | eggyknap | nice :) |
| 15:18.52 | eggyknap | For whatever it's worth, states have their own health investigative teams that aren't shut down. I helped write the software they use to do it :) |
| 15:20.27 | unum | the article talks about that |
| 15:21.07 | unum | the federal officials coordinate communication and determining if the out breaks are related |
| 15:21.11 | unum | and determine source |
| 15:21.27 | unum | since the source is not likely to be in the state experiencing the issue |
| 15:23.20 | shalkie | ninnypants mindjuju : I have a couple production systems on Digital Ocean and they have been pretty good. One downside is you get a single CPU, unlike linode. A great upside is the price is good and the storage medium is SSD. So while the memory is low(er) then I like, swap works like a champ when it is needed. Also if you want networking between hosts that isn't counted against your network quota use the NYC |
| 15:23.22 | shalkie | data center as it has a private network option. Note that private doesn't mean it is secured, you will still want a VPN in place. |
| 15:23.29 | shalkie | Otherwise I have been happy with them. |
| 15:28.23 | shalkie | Oh and one thing I haven't taken advantage of is the published API. |
| 15:29.55 | shalkie | herlo: You can add disk space, you just have to upgrade the host. Which is a bit of a bummer. |
| 15:34.03 | *** join/#uphpu mgeary (~mgeary@67.136.112.81) |
| 15:34.03 | *** mode/#UPHPU [+v mgeary] by ChanServ |
| 15:34.20 | herlo | shalkie: right, I can't just attach a separate storage disk |
| 15:34.52 | cro1 | ninnypants mindjuju: Likewise, I have some machines on DO and I've been very happy. Minimal downtime, if any. Very fast. I'm esp happy that they have a west coast datacenter now. The latency is significantly less for me vs. the NYC DC. |
| 15:35.26 | ninnypants | yeah I want to say I'm running mine out of california |
| 15:36.15 | cro1 | shalkie: What did you mean by 1 CPU? W/ the 2GB plans and above the website says 2 cores. |
| 15:36.34 | herlo | cro1: that's still one cpu |
| 15:36.39 | herlo | :) |
| 15:37.38 | cro1 | Oh, I see, looked at Linode just now. Didn't notice their recent fleet upgrade changed they way they promote their service. |
| 15:39.12 | shalkie | cro1: I have been on the 512m/1g plan. I guess I should have taken that into consideration. My linode, bottom of the line, has 8. |
| 15:40.52 | shalkie | Though I have been very happy with what I get overall for the price. |
| 15:41.28 | cro | shalkie: Agreed, I have machines on both services. |
| 15:47.10 | mindjuju | anybody used BH VPS? |
| 15:48.04 | mindjuju | i've had BH hosting for a couple clients, no complaints {other than an email send limitation, but seems reasonable to protect against spammers} |
| 15:49.11 | ninnypants | mindjuju: I haven't they came out with their VPS after I moved to DO |
| 15:49.39 | mindjuju | prices seem less than linode |
| 15:54.04 | *** join/#uphpu john-anderson (~john-ande@192.150.9.201) |
| 15:55.05 | *** join/#uphpu clintberry (~clintberr@75-148-102-17-Utah.hfc.comcastbusiness.net) |
| 15:55.05 | *** mode/#UPHPU [+v clintberry] by ChanServ |
| 15:56.20 | tierra | mindjuju: email limits can be boosted upon request for specific use cases, we just like to be on the cautious side :) |
| 15:56.45 | tierra | thinks like newsletters are perfectly acceptable |
| 15:56.48 | tierra | *things |
| 15:59.22 | mindjuju | yup, it was actually a newsletter, and we noticed it was being sent to A -J but people with last names about halfway through J didn't get it |
| 15:59.30 | mindjuju | took me a little while to figure out |
| 16:00.03 | mindjuju | and you're right, after i figured it out, a phone call later, everybody got it |
| 16:00.13 | ninnypants | mindjuju: you're not using something like mailchimp or campaign monitor for an email newsletter? |
| 16:00.26 | mindjuju | well, this was a few years back |
| 16:02.29 | *** join/#uphpu josephscott (~josephsco@proxy.iad.automattic.com) |
| 16:03.38 | *** join/#uphpu josephscott (~josephsco@proxy.iad.automattic.com) |
| 16:06.08 | ninnypants | mindjuju: makes sense |
| 16:06.54 | mindjuju | So ninnypants are we going to talk us some politics at China Wall on friday? |
| 16:06.58 | *** join/#uphpu ponderability (~ponderabi@dongato.chpc.utah.edu) |
| 16:08.06 | ninnypants | mindjuju: sure I could definitely get behind eating some Chinese and talking politics is always good |
| 16:09.07 | ninnypants | Speaking of politics I'm wanting to do some US history study so if anyone has good book recommendations that would be great |
| 16:10.19 | mindjuju | you know, it really depends on your political outlook as to what books (recommendations) you'll want to consider |
| 16:10.33 | ninnypants | mindjuju: I've been realizing I should be more up on US history and how the political system works, but with no actual politics hopefully |
| 16:12.46 | mindjuju | that's somewhat hard to do, take FDR for example |
| 16:12.54 | *** join/#uphpu T4rku5 (~74rku5@c-174-52-141-215.hsd1.ut.comcast.net) |
| 16:12.54 | *** join/#uphpu T4rku5 (~74rku5@unaffiliated/shunkydave) |
| 16:12.57 | mindjuju | some history books will say he's a great president, some will say he was bad |
| 16:13.10 | mindjuju | really depends on how you feel about certain policies |
| 16:13.31 | DexterTheDragon | where's China Wall? Is that all the way down in Provo? |
| 16:13.42 | mindjuju | yarp |
| 16:13.55 | ninnypants | mindjuju: yep that is one problem I can see with finding good books |
| 16:13.59 | mindjuju | but if you're wanting to come, maybe we could move it northward |
| 16:14.24 | mindjuju | there is a decent Chinese resturant in Draper |
| 16:14.32 | mindjuju | the aptly named: Asian Buffet |
| 16:15.02 | herlo | Mountain Cafe in Holladay - Best. Chinese. Ever! Plus, the lady who owns the place is awesome! |
| 16:15.10 | mindjuju | DtD, did you see the Million Mask March |
| 16:15.18 | mindjuju | i think its for sometime this next week |
| 16:15.54 | DexterTheDragon | yeah there's a number of protests being planned |
| 16:15.55 | ninnypants | I've heard a few things about MMM but haven't seen anything concrete |
| 16:16.04 | mindjuju | there is an FB page |
| 16:16.31 | mindjuju | https://www.facebook.com/events/505027169551591/ |
| 16:16.44 | mindjuju | duh, it's guy fawks day |
| 16:17.04 | mindjuju | i new it was soon, but iddn't make the connection |
| 16:17.44 | mindjuju | every time there is a big march like this, we sell out of guy fawks masks |
| 16:17.51 | DexterTheDragon | there's also http://marchagainstcorruption.com/ on Nov 2nd |
| 16:17.58 | mindjuju | ESPECIALLY the v for vendetta model |
| 16:19.38 | mindjuju | well shoot, the MAC page that you posted, post on Oct 6 is what i've been saying all along |
| 16:19.43 | mindjuju | those darn lobbyist! |
| 16:20.18 | fungus | From what I understand about Guy Fawkes, he's a terrible, awful, horrible person. Why should we celebrate him? |
| 16:20.38 | herlo | https://www.youtube.com/watch?v=7z70kmt3FHk |
| 16:20.58 | mindjuju | sorry, it wasn't so much that i was celebrating him, it was that i didn't put together that the event was Nov 5 and that being Guy Fawks day |
| 16:21.03 | mindjuju | fungus^^ |
| 16:21.30 | DexterTheDragon | fungus: the original celebration was of the monarchy's defeat of him |
| 16:21.53 | fungus | DtD, Ok, I can get with that. Defeating a terrorist and all. |
| 16:23.15 | mindjuju | so DtD, how far south you willing to go? |
| 16:23.34 | DexterTheDragon | if you guys are willing to do Draper that works |
| 16:24.05 | ninnypants | I can probably do draper end of the week is usually pretty light for me |
| 16:25.16 | mindjuju | :) |
| 16:25.21 | ninnypants | herlo: looks interesting |
| 16:25.35 | mindjuju | DtD, ninnypants - what time? |
| 16:25.50 | mindjuju | anybody else want to go to lunch / political discussion? |
| 16:26.04 | herlo | ninnypants: yeah. I kind of want to see it now. |
| 16:26.15 | herlo | plus, Yvonne Strahovski, yum! |
| 16:26.26 | mindjuju | i'm pretty sure they have veggie stuff if fungus wants to go |
| 16:28.32 | fungus | I have to at least try. You guys need at least 1 liberal point of view. |
| 16:28.43 | fungus | I'll try to make it. |
| 16:28.47 | mindjuju | :) |
| 16:29.19 | josephscott | where are you planning this? |
| 16:30.20 | mindjuju | nominated though NOT required - https://plus.google.com/105824363409278650325/about?gl=us&hl=en |
| 16:30.33 | mindjuju | i was just thinking Chinese because ninnypants likes it and I do too |
| 16:30.43 | mindjuju | though we could find another resturant in draper that works |
| 16:30.56 | mindjuju | there is an indian resturant a little further down, Aroma India |
| 16:31.03 | fungus | I can also play a pretty good libertarian if there is a general lack of that in a conversation. |
| 16:31.12 | mindjuju | like 5 minutes down the road on 123rd |
| 16:31.36 | DexterTheDragon | ick indian |
| 16:32.10 | herlo | Indian is great food |
| 16:32.13 | mindjuju | let's see, there is a Mad Greek about 4 minutes down 123rd |
| 16:32.31 | mindjuju | there is a goodwood on that same street, but it's not fungus friendly |
| 16:33.05 | mindjuju | i haven't been down that neck of the woods lately, so i don't really know whats down there |
| 16:33.31 | mindjuju | oh i think there is a zupas |
| 16:33.35 | fungus | There's a Noodles and Co. in Draper |
| 16:33.41 | fungus | and Zupas |
| 16:33.57 | mindjuju | josephscott: you coming? |
| 16:34.18 | mindjuju | herlo? |
| 16:34.33 | mindjuju | shoot, i guess we could just do applebees |
| 16:34.37 | herlo | mindjuju: if you don't talk about politics, I'm in |
| 16:34.39 | herlo | :) |
| 16:34.45 | mindjuju | ah dag! |
| 16:35.53 | mindjuju | what if you sit on the corner of the table with headphones on? |
| 16:37.07 | herlo | lol |
| 16:37.10 | herlo | what's the point of that? |
| 16:40.39 | shalkie | you wouldn't be discussing. :-) |
| 16:44.01 | josephscott | mindjuju: maybe, need to see what Friday ends up looking like |
| 16:45.22 | mindjuju | are you ok with one of the following: zupas, applebees, noodles&co, asian buffet? |
| 16:45.28 | mindjuju | josephscott: ^ |
| 16:45.48 | josephscott | sounds ok |
| 16:48.36 | ninnypants | there's also a chipotle around 123 as well |
| 16:50.19 | *** join/#uphpu itimber (~Adium@ip72-209-186-65.ks.ks.cox.net) |
| 16:50.19 | *** mode/#UPHPU [+v itimber] by ChanServ |
| 17:05.02 | herlo | mmm chipotle |
| 17:05.51 | herlo | that chipotle is in Sandy |
| 17:05.54 | herlo | but pretty close. |
| 17:17.32 | josephscott | just off the 10600 south exit |
| 17:18.12 | unum | I'm sad all the bajio's on the east side of the valley closed |
| 17:19.06 | mgeary | okay folks. brace yourselves. I have a PHP question |
| 17:19.13 | mgeary | i know, i know. OT and all that |
| 17:19.46 | mgeary | any thoughts on why my Content-type header is being ignored? I'm specifying application/vnd.ms-excel, but the server is sending text/html |
| 17:20.28 | mgeary | ah, probably output buffering issue |
| 17:21.11 | ninnypants | mgeary: it should throw a notice if that's the case |
| 17:21.37 | T4rku5 | is there something to be done to serve ms-excel? as in, on the server? |
| 17:22.04 | ninnypants | T4rku5: you mean server for download? |
| 17:22.42 | T4rku5 | no, I've never been a server admin. But (depending on the server), do you need to set anything up to serve ms-excel properly? |
| 17:23.30 | mgeary | you just need to have your headers set properly |
| 17:23.34 | ninnypants | you just have to send the correct headers I think the server will do a pretty good job if you're linking straight to the file, but if you're serving through php with readfile() you need to set the correct header |
| 17:23.49 | mgeary | and i *do*, but something is pre-empting my content-type header, i believe |
| 17:24.32 | unum | right. if you are not going through php then the server needs to be set to send the correct header(apache comes with some good settings for that), but when using php you use the set header command |
| 17:24.49 | unum | that was meant for T4rku5 |
| 17:24.54 | T4rku5 | thanks |
| 17:25.12 | unum | preemepting shouldn't be a problem postempting might |
| 17:25.39 | herlo | unum: I think all the bajio's are closed |
| 17:25.53 | unum | :( |
| 17:26.27 | shalkie | Freebirds opened up in Taylorsville. |
| 17:26.44 | mindjuju | what's freebirds? |
| 17:26.49 | herlo | oh, I want to try that place |
| 17:27.04 | shalkie | It is a burrito assembly line type place from TX. |
| 17:27.23 | unum | I thought maybe your php.ini had to be configure to allow you to change the header but I don't see anything there |
| 17:27.27 | unum | just the default setting |
| 17:28.04 | shalkie | http://freebirds.com |
| 17:28.32 | unum | the headers don't actually get sent until a few kilobytes have been echoed |
| 17:29.40 | mindjuju | curious |
| 17:30.04 | mindjuju | too bad there isn't a spicky chicken wing place that has a spicy vegetarian plate |
| 17:30.23 | mindjuju | in Hunan, they have mega spicy tofu |
| 17:31.30 | *** join/#uphpu cro (~Adium@204-228-149-217.ip.xmission.com) |
| 17:36.20 | mindjuju | hey fungus, the other day you mentioned DKIM was old tech and not to bother with it, why do you think that? |
| 17:36.37 | mgeary | bah |
| 17:36.53 | T4rku5 | did you figure it out, mgeary? |
| 17:36.54 | fungus | No, it's not "old tech". It's just not used much. |
| 17:37.09 | fungus | Few people actually check it. |
| 17:37.10 | mgeary | nope. Content-type still being overridden/preempted |
| 17:37.26 | T4rku5 | have you tried other content types? |
| 17:37.31 | mgeary | yeap |
| 17:37.57 | T4rku5 | ms-excel is the only one being sniped? |
| 17:38.47 | mgeary | it's the only dynamic output. i suspect something somewhere is outputting a space or a linebreak |
| 17:38.54 | mgeary | but it's not my code, so i've got to go hunting |
| 17:42.13 | mgeary | other headers i add are showing up fine... |
| 17:48.55 | mindjuju | hey fungus, got a minute? |
| 17:49.18 | DexterTheDragon | fungus: doesn't spamassasin at least factor DKIM in? |
| 17:49.43 | fungus | give me a min, working on a critical issue now. |
| 17:50.51 | mgeary | well, i found/fixed the issue |
| 17:51.03 | mgeary | anyone here ever used the Slim framework? It's new to me |
| 17:51.31 | mgeary | but basically, the way it handles views, the previous coder should have put exit statements in the view handler/function |
| 17:51.32 | mindjuju | so we're looking at adopting DKIM, but i want to understand the process of PHP and mail a little better. When you use PHP mail, you provide the elements needed and then PHP hands off to the look MTA, in our server's case, that's sendmail -- who generate the actual email and sends that off (this is where you were suggesting that sendmail send to a true smtp server and send off?) so then the question is, if i setup dkim on sendmail, that'll |
| 17:52.40 | herlo | mindjuju: so tls and saslauth isn't good enough? |
| 17:53.20 | mindjuju | we're playing technology buzzword game over here, last week it was spf, this week it's dkim |
| 17:53.42 | mindjuju | as a way of improving our email reputation |
| 17:54.28 | herlo | buzzword bingo! |
| 17:54.40 | herlo | spf is better imo, but okay |
| 17:56.12 | *** join/#uphpu cro (~Adium@204-228-149-217.ip.xmission.com) |
| 18:02.09 | fungus | ok, back. DKIM is not yet widely checked by Internet MTAs. SPF is more widely popular. Though adding DKIM signing doesn't hurt. It can only improve reputation if it's done correctly for the few MTAs that actually care to read it. |
| 18:02.55 | fungus | Implementing SPF is as simple as adding a DNS record. Implementing DKIM is way more complicated. |
| 18:03.25 | fungus | (unless you use Google Apps) |
| 18:05.00 | fungus | mindjuju, php mail() can be configured (php.ini) to use a local MTA (sendmail) or send direct to an SMTP server. |
| 18:05.37 | fungus | A local MTA is more robust and is less prone to missed email. |
| 18:07.29 | fungus | However it's important that your local MTA be configured properly, or have your local MTA relay to a properly configured MTA to hand off to the Internet. |
| 18:07.46 | DexterTheDragon | fungus: I didn't find DKIM too complicated, just install opendkim, set it as a milter, gen keys, and off you go |
| 18:08.56 | fungus | Yup, and compared to a single DNS entry, that is way more complicated. :) |
| 18:09.02 | mindjuju | yeah true |
| 18:10.05 | fungus | DtD, hey, since when did Postfix start supporting Milters? that's neat. |
| 18:10.21 | DexterTheDragon | that was easy. chaining postfix, dspam, and dovecot together was complicated |
| 18:10.46 | DexterTheDragon | fungus: 2006 |
| 18:11.02 | mindjuju | so i checked the ini and have confirmed it's using sendmail |
| 18:11.37 | mindjuju | so that said, i need to continue reading up on sendmail and dkim and head that way |
| 18:11.45 | mindjuju | there should be no changes neded in the php code itself |
| 18:12.54 | fungus | mindjuju, careful when using the word "sendmail". That refers to a command line program that PHP uses to move the email to the local MTA. |
| 18:13.09 | mindjuju | oh in this case it was a path |
| 18:13.12 | fungus | But it also refers to the Sendmail MTA software. They are not the same. |
| 18:13.33 | mindjuju | <PROTECTED> |
| 18:13.38 | mindjuju | and it had some flags after that |
| 18:13.57 | fungus | Postfix includes a utility called sendmail. So don't go googling for "sendmail" since it will give you info about the MTA software and not the cli utility |
| 18:14.22 | mindjuju | but i saw what you meant about "sendmail" parameters in the ini |
| 18:14.55 | mindjuju | also service sendmail status returns pids |
| 18:22.16 | fungus | Right but that distinction is important when Googling for help. |
| 18:25.33 | mindjuju | oh gotcha |
| 18:38.50 | *** join/#uphpu ryan__ (~ryan@72.52.97.167) |
| 18:51.32 | *** join/#uphpu macnewbold1 (~macnewbol@66.219.204.98.provo.dynamic.broadweavenetworks.net) |
| 18:51.32 | *** mode/#UPHPU [+o macnewbold1] by ChanServ |
| 19:35.29 | *** join/#uphpu macnewbold (~macnewbol@66.219.204.99.provo.dynamic.broadweavenetworks.net) |
| 19:35.29 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 21:14.29 | *** join/#uphpu skinner (~david@72.250.214.16) |
| 21:14.29 | *** mode/#UPHPU [+v skinner] by ChanServ |
| 21:18.05 | *** join/#uphpu macnewbold (~macnewbol@66.219.204.99.provo.dynamic.broadweavenetworks.net) |
| 21:18.05 | *** mode/#UPHPU [+o macnewbold] by ChanServ |
| 21:32.02 | mgeary | hey folks, i have a mail server with postfix/dovecot. I have an unusual need where i need to allow SMTP connections from a set IP address without authentication. Anyone know if i can manage that in my current config? |
| 21:36.07 | mindjuju | fungus is more of an authority in this, but putting your MTA as an open relay will allow you to do what you're requesting |
| 21:36.24 | mindjuju | i would suspect you'd want some kind of iptable rules to limit on IP for smtp |
| 21:36.25 | mgeary | heh |
| 21:36.31 | mgeary | open relay |
| 21:36.32 | mgeary | heh |
| 21:36.41 | mgeary | but yeah, adding the IP to mynetworks did it |
| 21:36.42 | mindjuju | send email with no auth = open relay |
| 21:36.47 | mindjuju | afaik |
| 21:36.49 | shalkie | postfix has a configuration that will allow you to specify valid networks for relays. |
| 21:36.54 | shalkie | just a sec |
| 21:36.57 | fungus | mynetworks |
| 21:37.03 | shalkie | Thank you fungus. |
| 21:37.47 | mgeary | fungus: so there wasn't previously an enabled mynetworks directive. Postconf -n confirmed that. I added this: |
| 21:38.00 | mgeary | mynetworks = 127.0.0.0/8, the.other.ip.addr |
| 21:38.03 | mgeary | that look alright? |
| 21:38.04 | fungus | default mynetworks is localhost |
| 21:38.09 | fungus | yeah, that's fine. |
| 21:38.11 | mgeary | k. thakns |
| 21:38.18 | fungus | unless you have some IPv6 stuff |
| 21:40.24 | fungus | mynetworks can include whole subnets too, makes it easier to relay mail for your PHP app. ;) |
| 21:40.26 | ninnypants | what ports need to be open for a simple web server? 80, 443, 22? |
| 21:40.40 | fungus | 80, 443 |
| 21:41.25 | fungus | restrict 22 to specific IPs or networks. |
| 21:41.46 | fungus | or turn off password authentication on SSH completely. |
| 21:41.57 | fungus | or both. :) |
| 21:42.24 | ninnypants | fungus: yeah I was planning to switch over to key based auth so turning off password authentication would be fine |
| 21:43.04 | ninnypants | and restricting 22 to my home ip would be good as well |
| 21:49.38 | *** join/#uphpu TuxToaster_ (~TuxToaste@wfw.vivint.com) |
| 21:49.54 | ninnypants | fungus: no reason to accept UDP correct? |
| 21:50.31 | fungus | not from the public, no. |
| 21:51.28 | fungus | This is assuming you have a rule to allow established and related connections. |
| 21:51.58 | ninnypants | not sure what you mean |
| 21:52.00 | fungus | iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
| 21:52.30 | fungus | Without a rule to that tracks state, blocking all UDP will also block your DNS requests. |
| 21:53.15 | ninnypants | would that be an issue if I'm running dns though Amazon? |
| 21:53.22 | fungus | yes |
| 21:53.29 | mindjuju | you'd be blind to the world |
| 21:53.38 | mindjuju | no patches because you can't look up the repos |
| 21:53.40 | mindjuju | etc |
| 21:53.57 | fungus | w/o a state rule to allow return traffic on outbound connections, you can't make outbound connections. |
| 21:54.21 | ninnypants | oh ok I was thinking for requests to find my server but this is for DNS to find outside domains |
| 21:54.41 | fungus | Or any outbound connection, like mindjuju mentioned |
| 21:55.00 | ninnypants | ok makes sense |
| 21:55.15 | mindjuju | wow, that's like the first time i've said somethign right enough to be quoted by fungus :) |
| 21:55.39 | fungus | You could forgo the state tracking rule, and explicitly list all the outbound rules manually, but that's a pain in the ass |
| 21:55.48 | fungus | ~congratulate mindjuju |
| 21:55.48 | infobot | ACTION congratulates mindjuju on being a new owner of a $500 brick. |
| 21:57.54 | fungus | ninnypants, here is an example ruleset for a very simple web server. http://paste2.org/DIKUtaMN |
| 22:00.25 | ninnypants | thanks fungus I'll have to read more on iptables |
| 22:00.40 | ninnypants | I've got my server up and running just want to make sure it's good and secure now |
| 22:01.01 | fungus | Most important step is to lock down ssh. |
| 22:01.43 | mindjuju | so ninnypants, one easy way to lock down mysql is with mysql_secure_installation |
| 22:01.46 | fungus | Either by firewall rule, or by severe authentication restriction |
| 22:01.49 | mindjuju | be sure to run that |
| 22:01.58 | fungus | ~mindjuju++ |
| 22:02.15 | mindjuju | a red banner day! |
| 22:03.04 | fungus | MySQL should either only listen on a private interface, or be firewalled away from non-trusted hosts. |
| 22:04.13 | ninnypants | ok I figured I'd just block anything incomming for mysql since everything runs on the same server |
| 22:04.54 | fungus | If it's on the same server, make MySQL only listen on localhost |
| 22:05.08 | fungus | bind-address = 127.0.0.1 |
| 22:05.56 | ninnypants | and that'll probably be in mysql.conf correct? |
| 22:06.08 | fungus | /etc/mysql/my.cnf |
| 22:06.19 | fungus | or somewhere similar depending on distro |
| 22:07.02 | ninnypants | it's ubuntu so that's likely it |
| 22:14.07 | ninnypants | fungus mindjuju any other recommendations for locking down the server? I currently don't allow www-data to write to disk other than specific upload directories, and will be adding rules so that any php in those directories wont run as well |
| 22:15.59 | fungus | that is a very important point as well. |
| 22:50.25 | *** join/#uphpu clintberry (~clintberr@75-148-102-17-Utah.hfc.comcastbusiness.net) |
| 22:50.25 | *** mode/#UPHPU [+v clintberry] by ChanServ |
| 22:54.49 | TuxToaster_ | ninnypants: cement. :P |
| 22:54.57 | TuxToaster_ | ~rlart |
| 22:54.57 | infobot | puts uxp into a headlock and administers a mighty noogie, rubbing half of uxp's hair of |
| 22:55.36 | TuxToaster_ | I would've said safe mode could help but I think they're deprecating that due to issues |
| 22:55.57 | fungus | lol, or push the ultra-secure-mode button on the server. Sometimes labeled as "power". |
| 22:56.49 | TuxToaster_ | lol |
| 22:56.52 | TuxToaster_ | "the server is not responding." |
| 22:58.18 | ninnypants | hmm not sure I understand this ultra-secure-mode button where would it be located? |
| 22:58.43 | ninnypants | I keep pushing the icon for my vps on my monitor but nothing happens |
| 22:59.23 | TuxToaster_ | lol |
| 23:01.36 | ninnypants | also TuxToaster_ how exactly to I scp cement into my server? |
| 23:02.08 | TuxToaster_ | I was thinking more along the lines of you put the server IN cement |
| 23:02.27 | ninnypants | I'm currently mixing and preparing to pour into my machine but I'm not sure what the transfer command should look like |
| 23:02.59 | TuxToaster_ | wouldn't you cat it to /dev/mixer to do that? |
| 23:04.58 | ninnypants | so `cat /dev/mixer > cement.tmp | scp cement.tmp example.com:/etc/cement | rm cement.tmp`? |
| 23:17.15 | *** join/#uphpu TuxToaster (~TuxToaste@wfw.vivint.com) |
| 23:17.15 | *** mode/#UPHPU [+v TuxToaster] by ChanServ |
| 23:21.18 | *** join/#uphpu macnewbold (~macnewbol@66.219.204.99.provo.dynamic.broadweavenetworks.net) |
| 23:21.19 | *** mode/#UPHPU [+o macnewbold] by ChanServ |