Well, the main darquecathedral.org server is back up and almost completely operational. There were a few things that took more than a little while to try and get figured out, but all in all, the server is working again. The old server had a P-II 350 CPU, an old iWill motherboard with some kind of Intel chipset, and 384 MB RAM. In its place, I put in an Athlon XP 2000+ CPU, an Asus motherboard with a nVIDIA nForce chipset, and 1 GB of RAM. Of course, seeing as it had a UDMA 66 controller, an ethernet adapter, and a video adapter all on the motherboard, I was left scrambling for three slot covers to cover the holes left by unused cards.

Then, once I got the hardware installed, it was time to install the software. I went ahead and reformatted the OS hard drive and installed Slackware Linux 10.2 onto the machine. Actually, it took me two tries, as I quickly found out that the server’s CD-ROM drive doesn’t like to work when it’s on its side. Then, once that was done, it took me a while to get all of the software I generally use installed. I also had to remember some of the tweaks I put in here and there to actually get the software working nicely with one another.

In the end, I only had a couple of problem children. One was this website itself, as WordPress couldn’t connect to the MySQL database. I FINALLY was able to find out that PHP 4.4.1 (which I was using) doesn’t exactly like the new authentication that came about as of MySQL 4.1. (The old server used MySQL 3.23.58.) I got a fix in place, and everything should be good to go. The other was the Amanda backup system, but I narrowed that issue down to file permissions, a brief mail issue, and human stupidity (I forgot to actually enable the scheduled backup). That’s good to go now too.

Anyway, to summarize the whole long and boring post, the server’s back up and I have it back where I like it. More to the point, I’ve already been told by Mom and Dad (who I provide mail services for) that the server is a LOT faster than it used to be and they’re very happy with it. As for now, I’m just going to keep an eye on the server and make sure it’s working properly. That is, after lunch… heh.

Okay, I damn near had a panic attack this afternoon because I thought someone was attacking the main darquecathedral.org server.

Earlier today Slashdot had posted a story about Lupper.Worm making its way around the net. I wasn’t worried, as my webserver’s installs of Apache and PHP are relatively up-to-date. One of its features was that it copied a program to the /tmp folder and ran it under the username Apache runs under. Anyway, I was talking to CCShadow about it and happened to do a check on /tmp. To my shock, there was a whole shitload of files starting with “sess_” in the /tmp directory owned by the Apache user.

“What the hell???” I thought.

So, what I did was go to the access log, and checked. Sure enough, throughout today there had been a few attempts to make the server download and run a file that started with sess_ in the logs. Problem was… it showed that the requests were for files that didn’t exist on my server. So, I deleted the files. They reappeared… with no trace in the logs.

Curious, I downloaded the sess_ file shown in the logs. Sure enough, it was a Perl script that acted as a zombie IRC bot used for attacking computers. However… I couldn’t see how the files were being run. Every time I deleted the files they reappeared (albeit at zero size). I even rebooted the machine to no avail.

I even went as far as to install a new module into Apache called mod_security. No go. The files kept appearing, with no trace in the audit logs. I tried replicating the command from Safari on my Powerbook, and it got blocked (and appeared in the audit logs). I was stumped.

Then something worried me even more. One of the sess_ files that had appeared wasn’t a script file. It was private mailbox information for someone who uses the webmail on my server. At this point I was even more into a WTF mode.

Finally, I was talking to Sinc and Kanan about it on #Vampire, and Kanan pointed out the obvious: the sess_ files I had been seeing were normal cache files used by PHP. There was no compromise on my system. I tested, and he was right.

Gods, I felt like a fucking dumbass.

On the bright side, I did get mod_security tested and in place on the darquecathedral.org server, and I’ll end up implementing it on the MK Online server as soon as we get it nice and tested. Still… tonight was not one of my shining moments. *sigh*

Those few of you who keep up with my site via RSS might have briefly noticed some weird garbage posts. I apologize for that, as I was testing posting via the Blackberry. I think I straightened out the whole getting it to recognize that it’s me part, but unfortunately the script that actually converts the body of the email to the post doesn’t like anything other than plain text, and despite what I thought earlier, Blackberry devices don’t send in plain text. *sigh*

I just downloaded a plugin for WordPress called “Postie” that should alleviate that problem. I’ll probably end up testing it tomorrow, however; I’ll be leaving for dinner and poker in about ten minutes.

Oh, well… hopefully this new plugin will work out much better for me. :-)

Well, the replacement hard drives arrived yesterday while I was at lunch. When I got home from work, the first thing I did was go into the office and try to get the hard drives into the case. (One of them didn’t like going into the slot previously occupied by the Zip drive, but it got in there eventually.) As soon as the drives were in, I hooked the machine up to the KVM switch my servers use for testing. Sure enough, both hard drives were detected properly. So, with that, I took the machine into my room, hooked up all the peripherals, and started the real work. I got the two drives into a RAID 0 configuration (making it appear as a gigantic 640 GB drive), and began installing Windows XP Professional on it.

By the time I was ready to go to bed, the system was fully up and running and ready to go. About the only three applications I have left to install on it are the GIMP, Winamp, and OpenOffice.org. The only real hiccups I encountered were that the nVIDIA Firewall was corrupting downloads (so I had to disable it and switch back to Windows Firewall) and MS’s IntelliPoint software no longer supports the Intellimouse Explorer I use. I’m pondering getting a new mouse anyway, so the mouse issue is really a non-issue. As for the firewall… apparently in the week since I copied the nVIDIA nForce drivers to my USB flash drive, nVIDIA updated the drivers. I might give it another try tonight.

In any event, the main PC is back up and running, and is actually faster than it was before. I should be a happy camper. :-) Tonight will be spent installing Vampire: The Masquerade – Bloodlines and Quake 4, and seeing how well they run on the new hardware.

And now, I have work stuff to deal with. Fun fun…

Well, now that I know my main PC requires a new hard drive, I went ahead and did a bit of shopping on Newegg and at Fry’s for new hard drives. Unfortunately, for what Fry’s wanted for a 200 GB Serial ATA drive, I could have gotten a 320 GB one from Newegg. So, I ended up ordering two 320 GB Serial ATA drives from Newegg this evening. My new motherboard has a RAID 0/1/0+1 controller on it, so what I’ll end up doing is putting the two drives into a RAID 0 configuration, making them into a single 640 GB megadrive. :-)

Before you ask… no, I don’t need redundancy. All of the critical data is either on my server which is backed up nightly, or on another machine (as is the case with my music collection). So, losing the array won’t bother me too much. Besides, with improved performance with the two drives working in tandem… it should be win-win for me.

The only downside is that I don’t believe the drives will get here before Friday, so I’ll be stuck on the Powerbook until then, and likely through the weekend as well. I really do with Apple had made official docking stations for the Powerbook line, but for now I can make do with this.

I also picked up two games while at Fry’s: Quake 4 and Vampire: The Masquerade – Bloodlines. Of course, with no hard drives I can’t install them yet, but I wanted to take advantage of Quake 4 being $15 off today. Oh, well…

In any event, I should be heading to bed. More later…

Gah. It seems I’ll be without the main PC for a couple of more days.

Over the weekend my main PC bluescreened twice. Neither time was I near the machine or paying attention (the first time I was sleeping, the second was while I was in the shower). I tried flashing the BIOS and also ran memtest86+ on it. The BIOS update took and memtest86+ didn’t slow any errors. So, I went with it and prayed all Sunday night that the BIOS update was all that the machine needed.

Well, after breakfast this morning, I decided to do some work on slipstreaming Service Pack 2 into my Windows XP Professional install CD, thus making a new CD that I could use to install WinXP with without needing a separate SP2 install. While the system was downloading SP2, it froze for about a minute, briefly bluescreened, and rebooted. When it came time to start loading Windows, I got an error message:

Disk read error
Press Ctrl+Alt+Del to restart

Fuck.

I went ahead and disconnected the PC from the cables behind my desk and took it into the office where I could hook it up to the servers’ KVM switch (so I could have the machine out and free and use the servers’ monitor and keyboard). I ran Western Digital’s Lifeguard Tools diagnostics to get official confirmation whether or not the drive was bad. The quick test came back fine, incredibly enough. However, when it started the full media test… the clicking coming from the drive alone was enough to tell me the drive was toast.

In a way, this is actually a relief, seeing as a number of things I noticed before now make a bit more sense. I had gotten errors when wiping the drive with DBAN, but hadn’t thought much of it. I had heard the clicking before, but had thought it was the IDE Zip drive which I rarely use anymore. Finally, this does explain a few of the mystery lockups the machine had before the video card crapped out. Still, though, this does mean I’m going to have to replace the drive. I’ll probably end up getting two Serial ATA drives and put them in a RAID 0 configuration (thus combining the two drives into one), and put the replacement 120 GB drive from Western Digital in a server.

Oh, well, in the meantime I’m stuck on the Powerbook again. Fun.