UNIX and Linux

Downloading from the Red Hat online store

Devin L. Ganger — Fri, 02 Mar 2007 01:16:00 GMT

Downloading Red Hat Enterprise Linux 4 provides Devin a couple of unexpected pain points.

Anti-spam with Exchange 2003

Devin L. Ganger — Sun, 02 Apr 2006 01:23:00 GMT

My debut article for Windows IT Pro Magazine, Fight Spam for Free, is now online in the April 2006 issue. If you're a subscriber to Windows IT Pro, you can access the article now or wait for it to show up in your mailbox. This article isn't anything new or revolutionary, but it is a concise overview of the native anti-spam capabilities you get in Exchange 2003, including the updates included in SP2. Leave me a comment if this article was helpful or you want to argue about something I said.

One interesting behind-the-scenes note: I originally wrote and submitted this article over a year ago. This kind of lead time is not uncommon in the magazine industry, especially in the tech industry where current developments can require the rapid inclusion of content that bumps an article that had been previously planned. It was an interesting experience and I'm eager to get more articles written -- in fact, I've got a couple of ideas I'm working on.

Another peek behind the curtain: one of the tech reviewers was dubious about the whole premise of the article. For a long time, mail admins in the know refused to allow Exchange to be the edge server in their organization; they'd use an SMTP proxy or some other SMTP MTA (like my favorite Postfix) to handle all inbound connections. Even today, it isn't a trivial task to harden an Exchange 2003 server to accept incoming connections from the Internet, and you still want to spend some time with your network and firewall design before you do it. (In particular, my favored design is to place ISA Server 2004 in the DMZ and use that to publish SMTP to the Exchange bridgeheads in the protected network.) However, Exchange 2003 -- especially with SP2 -- has finally matured enough and gained enough useful anti-spam features to make it worth the effort. The tech reviewer in question argued that no major companies would use this configuration; I happen to know of one or two. In fact, it was this very discussion -- and my defense of Exchange 2003 as the edge mail server, especially in small-to-midsize companies (which are more likely to be in the Windows IT Pro target audience) -- that prompted me to update my own home network. For years, I'd been using Postfix as an edge mail router to my Exchange org. I've since retired both Postfix (and the Solaris box it ran on). Postfix has a lot of nice features (like greylisting) that Exchange doesn't have, but I wasn't using any of them -- and the resulting reduction in time to configure and maintain my network (plus the ability to completely track all message flow in and out of my network from Exchange) more than makes up for it.

Not that I think Postfix is a bad MTA, mind you; in fact, there are many circumstances in which I'd still encourage clients to use it (or another MTA) in front of their Exchange organization. However, it's no longer the only sane option; Exchange is more than capable of taking care of itself now, as long as you have a sane network and firewall configuration. And I very much appreciate not having to take my Solaris box down to single-user mode to apply the latest security patch clusters anymore; WSUS is the cat's meow and helps me keep my network safer than ever.

Two steps forward, one step back

Devin L. Ganger — Wed, 22 Jun 2005 16:27:00 GMT

A while back, Microsoft acquired anti-virus vendor Sybari. Sybari had an interesting product line with support for Exchange, SharePoint, Live Communication Server, Lotus Domino, generic SMTP gateways, Windows, and UNIX/LINUX. Now that the acquisition is complete, guess what disappeared from the product lineup?

If you guessed "UNIX/Linux" support, you'd be right.

On the one hand, I'm not really surprised. Sybari may continue to run as a separate company for now (albeit with a little "A Microsoft Subsidiary" addition to their logo), but sooner or later, they are likely to get merged into the general body of Microsoft products and development, and you don't see too many other Microsoft products for UNIX platforms these days (the last one I can remember was Internet Explorer for Solaris, back in the day). They just don't have the corporate expertise to write UNIX apps.

On the other hand, presumably the Sybari acquisition brings with it an existing UNIX development infrastructure, as well as a pool of developers who know how to write for UNIX. It's a long way from anti-virus products to, say, Office, but it's a start. A lot of people are finding the Linux desktop story more compelling, but office software continues to be one of the sticking points of that story; Office file compatibility is a major de facto requirement in today's world and it would be hard to beat Office's compatibility with a UNIX version of itself (granted, Mac/Windows compatibility occasionally has a few warts). Add to that the new Office Communicator -- now there's a product that should have a UNIX version sooner rather than later -- and surely Entourage to at least provide some UNIX-based competition to Novell's Evolution (which they added to their product lineup with the acquisition of Ximian).

On the gripping hand (if you don't get this phrase, you obviously haven't read The Gripping Hand, the sequel to the classic Niven and Pournelle sf novel The Mote in God's Eye), The Register makes a very painful point, which is that the vast majority of viruses in the wild are targetted at the Windows platform. UNIX-based virus scanners aren't so much about protecting UNIX machines from viruses as they are a convenient platform from which to scrub data intended to be used on Windows workstations.

Microsoft has been doing a lot of good work on trying to show that they've gotten serious about security. Unfortunately, this move is going to become a rallying point for the people who want to show otherwise, and it's going to be very hard to disagree with them. Granted, I'm not in the big office up at the Microsoft campus, but from my view here I have a hard time seeing how nuking the existing Sybari UNIX anti-virus solution ties into the strategic goals of Trustworthy Computing -- or in fact how it is anything other than a decision made in a reflexive anti-UNIX reaction. A lot of companies used the Sybari engine in conjunction with a nice UNIX-based MTA like Postfix to provide a high-performance, highly secure message hygiene gateway between the Internet and their Exchange organization. Now they've got one less option -- and I can pretty well guarantee they're not going to sit on their hands idly waiting for Exchange 12 to come out so they can deploy an Exchange edge server to fill the gap.

I wish somebody at the high executive level would realize that sometimes it is better to have your finger in every pie rather than try to make sure you have the only pie.

The demise of SunSolve as we know it

Devin L. Ganger — Fri, 25 Mar 2005 05:37:00 GMT

Sun has long had an impressive amount of documentation and support material on their website, in the form of SunSolve. That appears to be changing in the near future. From the Sunsolve website:

Sun is streamlining online support, and access to information on SunSolve and in the Sun System Handbook will change.

SunSolve and the Handbook provide information to two different audiences:

(1) the general Sun Community
(2) Sun Service Plan or Contract customers

The type of information available to these two audiences will be changing starting on April 5, 2005.

At least this doesn't appear to be affecting their online documentation.

This is, in my opinion, not the smartest move for Sun to be making. It really makes me wonder why they are bothering to open source Solaris, if they're going to shut off a lot of the support content that is currently available to the Sun community and instead make it dependent on having purchased a support contract. The open source operating systems have most of this information publicly accessible; heck, even Microsoft makes it available.

Sun enthusiasts need to contact Sun and urge them to rethink this. I'm not sure who to talk to, but someone at Sun must know. I'll try linking to Jonathan Schwartz's blog and hope he sees the trackback. It doesn't look like the software they're using supports trackbacks, though.

I'm posting this entry to the Sun Rescue mailing list, run by Bill Bradford of sunhelp.org and invite folks to blog about this. Feel free to trackback to this entry; it will be interesting to see how far this can go.

[Edit: I forgot to check Bill Bradford's sunhelp.org blog before I posted this, or I would have seen his post about this and linked to it originally. Sorry, Bill.

Looking forward to Exchange Connections

Devin L. Ganger — Wed, 23 Feb 2005 19:07:00 GMT

Since this seems to be the year where I meet one professional goal after another, I took the next step in my plan of world domination and submitted proposals to speak at the Fall 2005 Exchange Connections conference in San Diego. Here are the sessions I proposed:

Preventing Sender Domain Spoofing with Sender ID
Using AD/AM for Edge Mail Sanitation
Maintaining a Custom DNS Blocklist
Solution Accelerator for Consolidation and Migration: One Year Later
Using UNIX solutions with Exchange
Workshop on UNIX solutions with Exchange

It will be interesting to see which ones are accepted (if any); they won't accept me as a speaker unless they take at least three of my sessions. I am looking foward to seeing how this plays out.