Tech – Page 3 – Ryan Schulze

Odroid HC1

January 24, 2019April 1, 2022Ryan

I finally got my new Odroid SBC and have migrated all the services from my Odriud XU4 over to the new HC1. The HC1 is based on the XU4 but drops multimedia interfaces like the HDMI port and instead adds a SATA connector and the black aluminium case fits a 2.5″ hard drive. The case is stackable and acts as a passive cooling heat sink. Since the HC1 is based on the XU4, software that runs on a XU4 will run on a HC1 without any fiddling.

It doesn’t have an eMMC connector, but you can assign the / partition to the hard drive/SSD, only the /boot partition needs to be on the SD Card.

Selfhosting email, and sending email to Microsoft.

September 25, 2018October 19, 2018Ryanemail, microsoft, MTA, SMTP

About once a year one of my outgoing email servers will magically pop up on Microsofts blacklist of email servers. The exact status in SNDS is “Blocked due to user complaints or other evidence of spamming“, which is a bit ironic since the weekly volume of emails that go to Microsoft controlled domains seldom is higher than 5 and they are all personal emails.
The error message the MTA recieves is “550 5.7.1 Unfortunately, messages from [xxx.xxx.xxx.xxx] weren’t sent. Please contact your Internet service provider since part of their network is on our block list (S3140). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.” in case anyone ends up here via google.

I’m not going to bitch and moan or attempt to guess why the server ends up on the list since it isn’t something I can influence
(just submit a support request and wait), instead I’ll post some tips and pointers to useful tools you should be using:

SPF – Sender Policy Framework
Specify which IPs are allowed too send mail for your domains, also determine what should happen with mail that is recieved from unauthorized IPs.

DKIM – DomainKeys Identified Mail
Outgoing mail servers for a domain can sign the emails and thereby allow recipients to verify that the email really came from a valid mail server and is not from a spoofed sender.

DMARC – Domain-based Message Authentication, Reporting & Conformance
DMARC allows you to specify policies for domains or subdomains in regards to “what should happen if an email fails DKIM or SPF” and where/if to send reports for Emails recieved by other mail servers.

SNDS – Smart Network Data Service
Allows you to monitor the IPs of your mailservers as viewed by the Outlook.com system.

JMRP – Junk Email Reporting Program
Forwards the full message with headers of any email marked as “junk” or “phishing” by Outlook.com users

MX Toolbox
MXtoolbox is a great website for testing your mail server settings, they also have a free_monitoring service for one IP, so you can get alerted if your IP shows up on a Blacklist.

Last but not least I use the following small script to monitor the status of my servers according to Microsoft. I call the script via a daily cronjob, and if a server is blacklisted, it sends an alert. Go to Automated Data Access first to generate an API key.

#!/usr/bin/env bash

sdns_key="&lt;&lt;insert API key here&gt;&gt;"
recipient="&lt;&lt;email to send alerts to&gt;&gt;"

if [[ "${sdns_key}" == '' ]]; then
        exit 0
fi

_URL_ip="https://sendersupport.olc.protection.outlook.com/snds/ipStatus.aspx?key=${sdns_key}"
_URL_data="https://sendersupport.olc.protection.outlook.com/snds/data.aspx?key=${sdns_key}"

content="$(curl -s "${_URL_ip}")"

if [[ ${#content} -gt 0 ]]; then
        {
        echo "${content}"
        echo
        curl -s "${_URL_data}"
    } | mailx -s "Microsoft SNDS status" ${recipient}
    exit 1
fi

#!/usr/bin/env bash

sdns_key="<<insert API key here>>"

recipient="<<email to send alerts to>>"

if [[ "${sdns_key}" == '' ]]; then

exit 0

_URL_ip="https://sendersupport.olc.protection.outlook.com/snds/ipStatus.aspx?key=${sdns_key}"

_URL_data="https://sendersupport.olc.protection.outlook.com/snds/data.aspx?key=${sdns_key}"

content="$(curl -s "${_URL_ip}")"

if [[ ${#content} -gt 0 ]]; then

{

echo "${content}"

echo

curl -s "${_URL_data}"

} | mailx -s "Microsoft SNDS status" ${recipient}

exit 1

And if all else fails and your IP does end up blacklisted in SNDS, you can go here to submit a ticket to get back off (although I’d suggest checking your mail server logs and the status of the IP on other RBLs first, just to make sure).

http://go.microsoft.com/fwlink/?LinkID=614866

Odroid XU4 case

September 11, 2018April 1, 2022Ryanodroid

It’s been quiet here lately. I moved back to Germany and have taken on new responsibilities at work. We are slowly getting settled in, although i still have to get the network at the new apartment up and running the way I want it. I expect to post here more often once I have more time for side projects.

One thing I recently acquired and really like, is a new case for my Odroid XU4.
The small 5v Noctua fan fits very nicely in it and is virtually silent, together with the large heatsink it stays cool enough and seldom has to throttle the CPU.
I prefer the odroid over a raspberry pi for “small server” tasks since it has a Gbit interface (that isn’t shared on the USB bus) and supports eMMC modules (no one enjoys waiting on I/O).

A short list of cheap but useful network devices to have handy.

March 20, 2018March 20, 2018Ryango bag, hardware, network

Here is a snort list of useful, off the shelf, network devices that sell for around $50. Not necessarily stuff that you would want use long-term in production, but more for the one-off projects or for troubleshooting.

First off is a 5-Port Gigabit switch from Netgear (the GS105Ev2).
It is interesting because it supports port mirroring and only costs about $35. That’s a really good price. It obviously isn’t going to replace a real network tap and you will lose traffic if the upstream plus downstream you are copying are together more than 1Gbit of traffic (but that’s a problem you always have when mirroring ports 1:1). It is dirt cheap, fanless and small enough to throw in a bag, can’t go wrong with this one. Need a temporary tap to monitor traffic? Just pop it inline and you are good to go.

If you are more of a DIY kind of person, I’d suggest the ESPRESSObin.
It sells for about $50 and is a single board computer with Gigabit network interfaces and a SATA interface. It is based on ARM architecture and runs Linux.
Since it has multiple Gbit interfaces and you can hook a HDD up to it you have a wide array of possibilities you could use it for. A lot of network traffic monitoring situations come to mind, where you would want to keep copies of the traffic in question for later analysis.

Another little useful device is the EdgeRouter X from Ubiquiti.
As the name suggests it’s a router and sells for about $55 The nice thing about this device is that it runs Linux (or more specifically a fork of Vyatta), so you can dig into it to get it to do things not available on the GUI.
5 Gbit ports, RIP and OSPF routing protocols, usual SOHO features like Firewall, VPN, QoS. Behaves a lot like a switch with some routing functionality. Unfortunately I couldn’t get port mirroring to work reliably but aside from that it’s still an impressive little router.

Strict-Transport-Security

March 18, 2018April 3, 2018Ryan

I finally got around to setting the Strict-Transport-Security header on all my HTTPS websites. The current age is set to 1 month and I’ll gradually up that to 6 months if no problems pop up.

In case anyone is curious, I terminate SSL on a haproxy, which then sends requests to various backends (containers on the same physical server). This makes it really easy to deal with Let’s Encrypt (just need one agent/script installed on the haproxy host that deals with all incoming /.well-known/acme-challenge/ requests), and I can keep all HTTPS settings central and don’t have to worry about configuration creep or any settings falling through the cracks for oddball subdomains.