Subject: pgsql-committers list is misconfigured

From: Alvaro Herrera <[email-masked]>
Date: Thu, 20 Mar 2008 16:25:22 -0300

Hi,

Again a message to pgsql-committers went unsent.  Bruce committed
changes to several README files, and I didn't get the email and it's not
on the archives either:
http://archives.postgresql.org/pgsql-committers/2008-03/
(I guess it's somewhere on Maia's queue.)  For example see rev 1.5 here:
http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/backend/access/gin/README

Also, I sent an email with a fake @pgfoundry.org address this morning,
and it passed without requiring moderator approval.  Also, I added a
X-No-Archive header to avoid having the test message appearing on the
archives, but to no effect -- the message is there all right:
http://archives.postgresql.org/pgsql-committers/2008-03/msg00393.php

I think the idea here is that any pgfoundry.org address passes through
unmolested to allow the pgfoundry projects to publish their changes to
pgsql-committers.  I think this is a mistake, and others have vouched
against this idea too (most notably Peter Eisentraut.)

Finally, and what prompted this test message, was the fact that Heikki
committed a patch this morning and his message got stuck in the
moderation queue.  I wonder how smart it is to be letting @pgfoundry.org
mails unchecked, but have @postgresql.org addresses filtered ... ??

-- 
Alvaro Herrera                                http://www.CommandPrompt.com/
PostgreSQL Replication, Consulting, Custom Development, 24x7 support

---

From: "Dave Page" <[email-masked]>
Date: Thu, 20 Mar 2008 21:21:43 +0000

>  http://archives.postgresql.org/pgsql-committers/2008-03/msg00393.php

I'm not sure that we actually honour that header.

>  against this idea too (most notably Peter Eisentraut.)

No, this is entirely intentional.

>  mails unchecked, but have @postgresql.org addresses filtered ... ??

We only add postgresql.org addresses very occasionally, but pgFoundry
committers may be added much more frequently and without our
knowledge.

-- 
Dave Page
EnterpriseDB UK Ltd: http://www.enterprisedb.com
PostgreSQL UK 2008 Conference: http://www.postgresql.org.uk

---

From: Magnus Hagander <[email-masked]>
Date: Thu, 20 Mar 2008 22:33:25 +0100

> http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/backend/access/gin/README

It has come through here, I think. But the list server has had major 
issues today, so commit mails have been backing up for a *long* time on 
the cvs server.

> http://archives.postgresql.org/pgsql-committers/2008-03/msg00393.php

Not sure if majordomo is supposed to listen to that header. Are we sure 
it is?

> against this idea too (most notably Peter Eisentraut.)

Yes, I believe that's the idea.

> mails unchecked, but have @postgresql.org addresses filtered ... ??

Generally, the first mail from a new committer is approved and at that 
time it's whitelisted as well, IIRC. Which could certainly be applied to 
pgfoundry commits as well, as long as the moderators don't mind dealing 
with it.

//Magnus

---

From: "Marc G. Fournier" <[email-masked]>
Date: Thu, 20 Mar 2008 20:44:39 -0300

- --On Thursday, March 20, 2008 22:33:25 +0100 Magnus Hagander 
<[email-masked]> wrote:

> It has come through here, I think. But the list server has had major issues
> today, so commit mails have been backing up for a *long* time on the cvs
> server.

had an issue with an IP being DOS'd ... took a bit to isolate and have the 
upstream block it ...

Does anyone know of anything that can be run on an interface that would show 
'unusual traffic' to a specific IP?  I was able to easily login to all the 
servers remotely, so running such would be a piece of cake, just need some sort 
of tool that I can start up to listen generate a report, similar to top maybe, 
on 'most busy' IP?

- -- 
Marc G. Fournier        Hub.Org Hosting Solutions S.A. (http://www.hub.org)
Email . [email-masked]                              MSN . [email-masked]
Yahoo . yscrappy               Skype: hub.org        ICQ . 7615664

---

From: "Joshua D. Drake" <[email-masked]>
Date: Thu, 20 Mar 2008 17:03:39 -0700

On Thu, 20 Mar 2008 20:44:39 -0300
"Marc G. Fournier" <[email-masked]> wrote:

> 
> Does anyone know of anything that can be run on an interface that
> would show 'unusual traffic' to a specific IP? 

tcpdump?

Joshua D. Drake

- -- 
The PostgreSQL Company since 1997: http://www.commandprompt.com/ 
PostgreSQL Community Conference: http://www.postgresqlconference.org/
United States PostgreSQL Association: http://www.postgresql.us/
Donate to the PostgreSQL Project: http://www.postgresql.org/about/donate

---

From: "Marc G. Fournier" <[email-masked]>
Date: Thu, 20 Mar 2008 21:09:26 -0300

- --On Thursday, March 20, 2008 17:03:39 -0700 "Joshua D. Drake" 
<[email-masked]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>

Is there a top-like switch for that that I haven't found?

- --

---

From: "Joshua D. Drake" <[email-masked]>
Date: Thu, 20 Mar 2008 17:13:09 -0700

On Thu, 20 Mar 2008 21:09:26 -0300

> Is there a top-like switch for that that I haven't found?

Hmmm I don't think so, you would probably have to pipe and grep.

Joshua D. Drake

- --

---

From: "Marc G. Fournier" <[email-masked]>
Date: Thu, 20 Mar 2008 21:19:51 -0300

I'm using ipaudit right now, which does a reasonable job of dumping the data, 
but its at least a half hour out before I really know if a change I've made is 
having the desired effect ... would really like to find something more 'real 
time' for dealing with identifying a DOS recipient ...

Is there anything I can do with a Cisco switch for this, maybe?  Something more 
granular then mrtg?

- --On Thursday, March 20, 2008 17:13:09 -0700 "Joshua D. Drake" 
<[email-masked]> wrote:

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
>
> iD8DBQFH4v2VATb/zqfZUUQRAgDwAJ9S8deJvyw0+8Xgk5Q5PC3PE51P4wCfVx7d
> TNKdUtcM5dfat5cBxvDdfVw=
> =ykrG
> -----END PGP SIGNATURE-----

- --

---

From: Alvaro Herrera <[email-masked]>
Date: Thu, 20 Mar 2008 21:35:35 -0300

> of tool that I can start up to listen generate a report, similar to top maybe, 

ntop perhaps?

-- 
Alvaro Herrera                                http://www.CommandPrompt.com/
The PostgreSQL Company - Command Prompt, Inc.

---

From: "Joshua D. Drake" <[email-masked]>
Date: Fri, 21 Mar 2008 00:33:27 -0700

On Thu, 20 Mar 2008 21:19:51 -0300
"Marc G. Fournier" <[email-masked]> wrote:

> I'm using ipaudit right now, which does a reasonable job of dumping
> the data, but its at least a half hour out before I really know if a
> change I've made is having the desired effect ... would really like
> to find something more 'real time' for dealing with identifying a DOS
> recipient ...
> 
> Is there anything I can do with a Cisco switch for this, maybe?
> Something more granular then mrtg?

Hmmm Cisco is a long time from my memory. I know with Linux you can
tell iptables to say, "If X IP initiates Y packets within Z time,
block!" Which is essentially what a DOS is.

I am sure Cisco can do the same thing but it would be out of my
expertise to tell you how.

Sincerely,

Joshua D. Drake

- --

---

From: Magnus Hagander <[email-masked]>
Date: Fri, 21 Mar 2008 09:52:31 +0100

> Is there anything I can do with a Cisco switch for this, maybe?  Something more 

If you have a "decent size" cisco switch, you can use netflow. But you 
still need a piece of software to analyze it.

There are a lot of other trafic control "appliances" out there, but 
they're pretty expensive... It's not all unusual that this service is 
provided datacenter-wide by the ISP - but I assume you've checked with them?

//Magnus

---

From: hubert depesz lubaczewski <[email-masked]>
Date: Fri, 21 Mar 2008 10:19:49 +0100

> of tool that I can start up to listen generate a report, similar to top maybe, 

iptraf.

depesz

-- 
quicksil1er: "postgres is excellent, but like any DB it requires a
highly paid DBA.  here's my CV!" :)
http://www.depesz.com/ - blog dla ciebie (i moje CV)

---

From: "Marc G. Fournier" <[email-masked]>
Date: Fri, 21 Mar 2008 10:07:08 -0300

- --On Friday, March 21, 2008 09:52:31 +0100 Magnus Hagander 
<[email-masked]> wrote:

> There are a lot of other trafic control "appliances" out there, but they're
> pretty expensive... It's not all unusual that this service is provided
> datacenter-wide by the ISP - but I assume you've checked with them?

I have a good relationship with the VP of Tech, but he's on holidays until 
April 1st ... will
broach this with him when he gets back ...

I don't know near enough about Cisco, but assuming they have a Cisco router, is 
there software like iptables (that JD referred to) that can be run on / beside 
it to do the auto-blockage as he described?  URLs / pointers appreciated ...

- --