Please note. The following content is new on this website:

• status.html — See the current server status here. Known problems will be listed here.
• higs/ — An idea for a long-term hosting project.
• rab/ — A concept presentation for a relational address book.
• ip.php — Get your IP-address quickly and plainly, well suited for integration in scripts or applets.
• dymoprint/ — A small python program to print labels on the DYMO LabelManager PnP under Linux.

Liebe Nutzer von sbronner.com:

Nach einem bösartigen Angriff auf sbronner.com kam es zu Komplikationen. In deren Folge musste der Server vollständig neu eingerichtet werden. Zur Zeit werden die verschiedenen Dienste, die dieser Server zur Verfügung stellt neu eingerichtet.

Ich bitte euch um etwas Geduld bis der Server wieder steht.

Details über den Angriff und geplante Maßnahmen um sowohl solche Angriffe in Zukunft zu vermeiden als auch eine Ausweichmöglichkeit im Falle von einem etwaigen künftigen Einbruch des Servers zu schaffen werden nach Beendigung der Wiederherstellung des Servers hier erläutert.

Mit freundlichen Grüßen,

Plan zur Wiederherstellung des Servers

Dieser Teil des Dokuments ist für technisch interessierte Leser gedacht. Hier werden die einzelnen Schritte aufgeführt, die nötig sind den Server wiederherzustellen, und zu jedem Schritt wird der aktuelle Bearbeitungsstatus aufgeführt.

Diese Liste wird auf englisch geführt, da das meine Arbeit erleichtert.

1. ✔ put the server in a stable software state (debian/lenny(testing)): debian squeeze = testing
2. ✔ put up a website describing what is happening
3. ✘ put up a firewall: the vServer architecture/kernel combination prevents this
4. ✔ add user waschtl
5. ✔ copy pertinent user data to local store
6. ✔ give waschtl sudo priviledges
7. ✔ change root-login to key-based only
8. ✔ put up the SMTP-Server (exim vs postfix) in testing mode: exim won out (previously used postfix), see http://shearer.org/MTA_Comparison
9. ✔ move sbronner.com and bronner.name to new registrar
10. ✔ configure primary and virtual mail domains
    • sbronner.com
    • bronner.name
11. ✔ add the remaining users
12. ✔ switch the SMTP server live
13. ✔ put up the IMAP/POP3-Server (dovecot vs courier): dovecot seems to be the way to go — configuration and first tests were exciting (from a sysadmin's point of view)
14. ✔ enable authentication for sending with the SMTP-server
15. ✔ check with the owners of the remaining domains for further procedures
    • kr-architects.de
    • babelee.de
    • gabrielundsarah.de
    • rescigno.org
16. ✔ put back any virtual e-mail folders
17. ✔ change slave DNS servers
18. ✔ look into vexim for user-based mail account management; are there alternatives?: At the moment no such interface will be installed — vexim requires a very specific configuration style for exim, which does not suit my needs, the best alternative, phamm, relies on an LDAP-configuration, which appeals to me, but must wait until this server receives a general LDAP infrastructure for all users.
19. ✏ check with all system users the following: users have been contacted
    • do they want their mail forwarded, if so, where?
    • family shall be offered an account at bronner.name
    • inactive users shall be asked if they still want to keep their account
20. enable phased auto-replies for discontinued addresses using http://wiki.exim.org/EximAutoReply as a guide
    progress check: at this point, the e-mail service will be fully operational again
21. put back the virtual websites
22. put back the served files
23. put back SmART
    progress check: at this point, the web-service will be fully operational again
24. put up a page explaining in detail what happened to this server include plans for backup/contingency in the future.
25. configure openVPN on ports 1194 and 443
26. configure monitoring with automated SMS alerts, if possible
27. look into the open DNS-Ring
28. ✏ put up the DNS server: zones required for mail are configured, check remaining zones
    progress check: at this point, all services hosted on this server will be fully operational again
29. configure regular backups to be made of all pertinent data, either the HKN FTP-Server, locally, or a combination of both
30. consider the best combination between HKN, Server-Ware, IN-ULM, and a backup server at home
31. set up a backup server, if possible with the open DNS-Ring
    progress check: at this point, the services hosted on this server will be protected against future service outages