OIT SysCore

The new Sun Studio 10 compilers are installed for for Solaris Sparc > 8, and Solaris x86 10, in /afs/umbc.edu/@sys/usr/opt. These are linked from /opt on sys-core administered machines.

Today, MATLAB + SIMULINK was upgraded from R14 Service Pack 1 to R14 Service Pack 2 (R14.2).

Many modules were upgraded in the process and license access to a few more were added.

You may run the new MATLAB but executing /usr/local/bin/matlab from any GL machine or Linux workstation in the OIT labs. MATLAB users elsewhere on campus will also benefit from the new license.

Updated our maildir driver code to the latest and greatest that fixes some file descriptor leaks that I'm totally shocked we have never seen here. This patch also logs the target of maildir_open calls, which may help in debugging.

New versions of sudo (for Solaris Sparc 8 and above) and Linux were released, that aren't reliant on the afsutil library. This is to clear up some problems with Solaris 10.

Also, a slight update was made to the openssh daemon deployed on our systems to deal with "*NOLOGIN*" users, an oversight that became visible last week.
(the build tree for the openssh *daemon* is in /afs/umbc.edu/src/afsapps/ssh)

I've built an openssh for OSX that has Kerberos5/GSSAPI enabled for use here @umbc, or logging into UMBC systems with kerberos pre-authentication. It's a tar file, meant to unpack in your Tiger system's root directory -- the ssh stuff will go in /usr/local, and a krb5.conf gets put in /etc.

It's here: openssh-4.1-osx-krb.tar.gz.

After you install it, you should be able to kinit on your mac, and ssh into core-managed systems that have had kerb. host keys assigned to them.

(remember to make sure you're running the /usr/local/bin/ssh, not Apple's ssh. I usually move theirs aside and symlink to the one in /usr/local...)

zlib 1.2.3 was released into beta and gamma for solaris 8 sparc, intel linux 2.4, and solaris 10 intel.

Fixes some apparent security issues, as well as fixes some brokenness in the 1.2.1 zlib build for solaris 10 intel.

Blackboard production was upgraded this morning 8/19 and is now running 6.2.3.6-hf3

The Firefox web browser and Thunderbird e-mail, USENET, and RSS client are now available in /usr/local/bin of all UMBC Linux systems which use AFS depot space (this means all GL servers and Linux lab workstations.)

These were put in place in advance of the deployment of the new UMBC Linux lab workstation build which is based on RHEL 3 Workstation.

One may run into issues executing these two apps on the current GL servers and Linux workstations due to some GTK library incompatibilities, but since these will all end up with RHEL 3 builds soon, it will not be a issue for long.

Firefox and Thunderbird are to be the default web browser and GUI-based e-mail client on the workstations, but Mozilla will still be available for those who prefer that.

Updated pine on linux with a new version of the maildir driver that deals better with interrupted system calls; the previous version had a problem on RHEL3, which caused it to crash periodically if there was a signal interrupting the read() system call that read in message contents.

Will probably update it every where else later, this is just where we were seeing the problem.

Mathematica has been upgraded to version 5.2 on Solaris Sparc/x86, Irix, and Linux.

spice3, the circuit simulation application has been deprecated due to the existing binaries for it (circa 1999) being no longer compatible with the new RHEL3 build the GL servers use. Unfortunately, this is a incompatibility which we cannot rectify directly.

A replacement has been found in the form a of ngspice. If you are a user of spice3, please consult the ngspice website on how to use it and convert your spice3 programs to ngspice.

GNU GCC 3.4.4 has relplaced version 3.2.1 as the standard C, C++ and FORTRAN compiler on all Linux and Solaris servers which use AFS depot for /usr/local contents.

No problems should be encountered with this upgrade, but if you do run into one, be sure to file a ticket with the Helpdesk or email systems@umbc.edu.

bbss or "booboo" is now running SP1 for blackboard 6.3

Miltermonkey on the milter machines has been upgraded.

In my development, it was found that there were some mistakes made in shared variable locking when running it under a new version of perl (5.8.7) that weren't caught by warnings under 5.8.0. Since we now have a standard perl distribution
with threading enabled (5.8.6), fixes had to be made to the miltermonkey code to use it. Miltermonkey is now running on the standard /usr/local/bin/perl5.8.6 with the threading fixes that were found under 5.8.7.

As part of this, the sendmail binary on the mxout machines (smtp.umbc.edu) was upgraded to 8.13.1. It seems that the wire-level milter protocol was incompatible with the newer version of the Sendmail:Milter perl module -- which was done against the 8.13.1 milter library. No big deal, it had already been tested awhile back and was ready to roll out anyhow.

With the miltermonkey codebase upgraded, we'll be installing and running the open source virus scanner ClamAV to see how it performs up against our current (commercial) scanning solution -- which is slow, and never gets a signature until the worm has been around for days ;)

Blackboard is now undisputedly at 6.2.3.23 It was
rather nebulas as to just how much of the SP3 update
had taken place so the patch was applied again last night. (10/14)
Started backup stuff at 12:30 AM, slept part of the night, then applied the upgrade around 6:30 AM

We've added ClamAV to our production mail filters.

After running it for a few days on one of our filters, it didn't miss *one* email that our current virus scanner (McAffee) picked up. That, and it's faster. And free. And releases signatures faster then the commercial vendors. Here here!

Our beloved blackboard test server is now running BB Version 7.0
This is mostly a backend upgrade to prepare the way for some really nice features to be release in 7.1 (~Decemeber release)

From the little time I've had to work with it, it still seems really nice. Security is improved. File sharing is set to really work allowing us load balance.

I think I got the collabaration tools working again
on our test BB 7.0 instance. Seems blackboard deleted
all of our custom auth files and cleaned out its libraries also.

The imap server software has been upgraded (slightly!) to log logins that were made via TLS or SSL as such. UW-IMAP would log SSL-initiated connections, but wouldn't log connections that were TLS-negotiated.

Messages look like this, for an encrypted login attempt (either TLS or SSL)


Dec 6 09:39:37 mr4 imapd[16487]: Login (SSL) user=travel host=accounting-3.finsrv.umbc.edu [130.85.165.232]

or


Dec 6 09:48:00 mr4 imapd[16983]: Login (CTX) user=banz host=kyle.ucs.umbc.edu [130.85.70.249]

for a clear-text authentication.

We've removed the SMTP Message Size limit from our mailservers. Now you can send your friends 120MB files. "yay"

For linux machines, the version of GNU Binutils in AFS (/usr/local) has been upgraded to 2.16.

For Solaris 10/x86, Solaris 8,9,10/sparc, and Linux, the MySQL clients and client libs have been upgraded to 5.0.18. Note that our MySQL server currently runs version 4.1.18, and we want to move that to 5.0.x in the future as well, but the clients must be upgraded first before we can move ahead with that. In case you're wondering, connecting to a 4.1.x server with a 5.0.x client will work fine.

Weblock is now running blackboard 7.1 There are issues with the way our custom auth is interfacing with this version. But that is for another day...

Sendmail has been upgraded on the mx machines from 8.13.5 to 8.13.6 in response to http://www.securityfocus.com/bid/17192/info.

This morning (3/24/06)I upgraded our blackboard production system from 6.3.1.505 to 6.3.1.574 (SP2 for
app pak3)
I also installed the recompiled and repackaged custom auth binaries.

-Shutdown blackboard services
-Shutdown all IIS
-Shutdown database
-Broke the mirror sets for the database logs and the database data files.
-Broke the app data mirror.
-Removed the custom auth and references to it.
-Pushed out the updates.
-Restarted BB and tested.

-Ran the updater.
-Installed the new custom auth binaries.
-Reenabled the custom auth.
-Added the links and references to the custom auth.
-Pushed out the updates.
-Tested basic functions.
Total downtime was ~1:20

-*Now that we have been up for a while with much more testing it's time to remirror the disks.

• Fixed a problem with the milter, where perl wasn't freeing up memory causing it to get bigger and bigger.


• Upgraded to SpamAssassin 3.1.1


• Tweaked some of the spam assassin configs to give it a lower timeout, and allow more spamd processes to fork


• Configured the the bogusmx blacklist

I updated Blackboard's custom auth module to move the
custom auth log file to a subdirectory. This is nessesary to keep the log rotator process from crashing.

After replacing the jar files, I restarted the blackboard services. The server still needs a complete restart as the log file is now being written to both the new location and the old.

Our webmail service has been moved from it's old home (a Dell 2650) to a Sun V20z running Solaris x86 for various reasons -- primarily becuase the PHP accellerator that we were using under Linux just "stopped" working for some odd reason.

We've sorry for any of the webmail wonkiness you may have seen this morning/afternoon as a result. It seems to be rather well settled in now -- the ldap address book should be functional again, as well as the multi-byte character stuff.

Procrustes is now running blackboard 7.1 beta 2. It is ready for use as a pilot server for the summer. SSL is not working due to a problem with some of our custom auth code.

@ndms.umbc.edu has been restricted to the only addresses it needs.
@afs.umbc.edu has been removed as a valid mail-to address.
@umbc8.umbc.edu & @umbc9.umbc.edu are being rejected now as they should have been for awhile...

Friday night/Saturday morning I updated blackboard from
build .576 to build .593 (6.3 app pak 3 service pak 2 hot fix3)

Due to the extent of our customization, this was not as easy as seemed it world be. First the test system failed to update properly but this was easily corrected.
Then the production update failed in an entirly different way. The update completed but our custom
auth module would not install properly. Somehow, one of the configuration files got corrupted. The corruption was a single space which made it very hard to find.

All in all this part of the bb updates took ~4 hours to complete.

Other work completed:

All servers flashed to latest RAC firmware, latest ESM,
latest internal RAID drivers and firmware.
SQL SP4 patches
Log rotator work.

This was a long time in coming...

Squirrelmail, the software which runs UMBC's Webmail email interface was sorely out of date and a recent upgrade (by necessity) of PHP brought to light some stinging incompatibilities between the old Squirrelmail version 1.4.3 and the new version of PHP, so the time was right to put an update in. We're now running Squrrelmail 1.4.6.

Among the problems, the major one users have been complaining about were the corrupted attachment downloads. The attachments on the email servers were always fine, but Squirrelmail parsed them wrong when serving a request from a user to download/view them, and junk always got added to the end of the file. Depending on the file format of the attachement, it was either inconsequential (eg: for images) or it made them unusable (PDF and MS Word documents). This is fixed with tonight's update.

Our bb 7.1 pilot server is now running the latest
version of blackboard... 7.1.324.14

I updated it 6/13 just after midnight.

Hotfix1 for Application Pack 1 fixes the following critical issues:

An HTTP 404 error appears when a user attempts to open a file that includes accented characters in the file name. This issue appears when a Course Builder adds a content item to a Course and creates a link to a file.
Users report problems with adding an image to a course and displaying it to users. The issue is the result of an authorization problem when accessing the image file.
Accented characters, such as umlauts or acute accents, do not appear properly in assessments if ugpraded or imported from Release 6.x.
The Exact Course Copy feature does not include the Gradebook or Assessments in the copy operation.
Users experience problems viewing multimedia files with multibyte characters in the file name from within the Discussion Board. This issue is resolved when using an Internet Explorer Web browser. Firefox users will still experience difficulty adding files, however, they may view files added through Internet Explorer without problems.

NOTE: Hotfix 1 does not repair reported issues with calculating weighted grades and standard deviations within the Gradebook. Blackboard is urgently working to address these issues in an upcoming patch release.

After removing some unused building block compontents
the log rotator started working (really working) again.
Yet another example of a third parties building block
messing up blackboard.

Weblock, our blackboard development/general hack server is now running Blackboard 7.1.324.14
Java 1.5.0_06
MSSQL SP4

BooBoo, BBSS, or our Blackboard special session server is now running Blackboard 6.3.1.593
Java 1.5.0_06
MSSQL SP4

BBSS is mostly used for winter session but it would be crazy to add another alias like BBWS (Winter Session)
and BBMM (MiniMester) to DNS.

Weblock, our blackboard development server is now running Blackboard 7.1.324.28 The lastest 7.1 hot fix.

David Freeman
UMBC

And for google search purposes "creek brother"
If you're out there, send me an email.

Last night I applied hot fix 2 to our Blackboard 7.1
"pilot" server. Procrustes.umbc.edu, is not running
Blackboard release 7.1.324.28

Our Blackboard 7 servers (weblock and procrustes) have been updated to release 7.1.391.0 This is service pak
1 for release 7.1

Ran a bunch of database checks to see if I could find a possible inconsistancy within the blackboard database.Found nothing... Well, at least nothing interesting.

As per OpenAFS Security Advisory 2007-01, setuid status has been disabled on all of the core managed servers and workstations. This has been done via a cfengine change, and the introduction of an init script which will disable setuid status on bootup.