DNS

呵呵，什么东西都可以是DNS。如果说这话的人不是讲冷笑话的话，我不知道您是觉得别人都是白痴，还是什么意思。

若想人不知，除非己莫为。

算了，不说了。

对于所有进入的连接：

• 必须发送EHLO或HELO
• 拒绝无效EHLO
• 允许经过身份认证的用户绕过余下的测试
• 禁止特定EHLO名字
• 拒绝EHLO机器名非FQDN的情形
• 拒绝不可解析的EHLO名字
• 除上述禁止情况之外，进入下一流程。

http://www.dnsreport.com/ 提供了一项检查服务，帮助你查找自己域名DNS配置中存在的问题。过去曾经以为自己很明白如何配置Internet域及其服务，查了才知道差很多，然后才加以改正。

A decision was made to enable SPF on beastie. SPF is a technology that mitigates forged spam (while it itself is not totally spam proof, as spammers can set up their own SPF record :-)

This article has suggested a way of hiding version.bind string. From a security perceive, this is an overkill and can usually be harmful:

• While it’s true that you can hide version.bind, the fact that version.bind is can be queried reveals that you are running BIND. It makes little sense to fake a version.
• The need of hiding information, which is unnecessarily hidden like this, means that the system administrator is neglecting security.
• Therefore, FOREACH(version.bind is queriable and is hidden) HACKEM :-)

Security can NOT be built on what others are not aware of.

As title. We *need* to struggle to make the upcoming 6.0-RELEASE a good release . I hope we can show the great improvements taken place in 6-CURRENT and hopefully we can cut 6-STABLE this June.

Highlights on recent 6-CURRENT that was not merged (and may never be merged):

• MPSAFE VFS
• Integrated VFS hashing (generallized, traditionally it’s different on ufs, msdosfs, etc)
• 64bit-ize of several utilities, to ensure better usage of large storage.

I’ve finally decided to move out from cnftp as I can’t figure out when, what and why its configuration that can influence my site keeps changed from time to time. Everything pulled out, and the httpd configuration has been removed to reflect this without misleading people who has decent DNS records cached in their DNS mirrors.

Still don’t know why a simple upgrade will cause GB2312 to represent in UTF8 errornously. Maybe when I have time, but not now.

Today FreeBSD will have its 5.3-RC1 if there is no other problem occours. I have sent a private mail to Doug Barton about a strange issue I have in BIND9, however, it does seem to be serious enough nor it is clear to determine the impact. I may post it later on a public list.

5.3-RC1 is also the point that I can suggest you to install 5-STABLE instead of 4-STABLE because most of the show-stopping issues are addressed and being corrected.

I finally got beastie.frontfree.net running bind 9.3 (as FreeBSD 5.3-BETA7 does, which is chroot’ed by default). While this is accomplished primarily with help of src/UPDATING’s instructions and Doug Barton’s excellent mergemaster(8). BIND stands for “Berkeley Internet Name Daemon” and is the de-facto standard of DNS implementation.

For those who is interested, I have deployed the stuff after 3 months’ test.

The major difference between traditional Frontfree Mail System and this is: