Spammers love the xmlrpc.php  - I just checked one server, and it has ~60K over the last month, and it is only that small because I block 100% of the hits to them and then my firewall blocks the IP addresses if people try multiple times.  And basically all of those requests are trying to hack into wordpress sites by testing usernames and passwords.

But, the reason for this post is that today I had an actual customer who wanted to use it for a legitimate purpose - he has a 3rd party site that he wants to allow backend access into his site through automated means.

I've done some interesting things in the past with the config file for the ssh client, but ChatGPT pointed out a neat way to manage an ssh server for which you have two ssh keys and want to be able to login easily to each one at different times.

In my case, I'm using Subversion, and use the svn+ssh method of connecting.  And I have two users (one for the main LifeType source code and one for my customizations.

By using aliases in the config file for the Host, then I can direct it to use different ssh keys for each host and then all of the regular subversion commands just work without further thought.

Host svn.limedaley.com
  User svn

Host lifetype.limedaley
  HostName svn.limedaley.com
  User svn
  IdentityFile ~/.ssh/id_rsa_lifetype

svn.limedaley.com is the actual hostname of my Subversion server, and lifetype.limedaley is an unresolvable alias, but I can then checkout:

svn+ssh://lifetype.limedaley/

and 

svn+ssh://svn.limedaley.com/

and they point to a completely different subversion repo!

(Obviously, the .ssh/authorized_keys needs to be setup appropriately on the server, using a different tunnel user and/or repo depending on what you are trying to do)

As a side-note, I hadn't thought about how trivial it is to put the User svn entry, so then that can be left off the svn checkout command as well.

I just recently discovered Cloudflare's Turnstile app, which is their answer to stopping spam, and it looks to work quite well, and was easy to code, so I added it to my contact plugin for LifeType.  Commenting on LifeType has generally worked pretty well, and we rarely get any spam, but the spammers have recently figured out my hidden input plugin, which was created just over 20 years ago, so it has lived a good life, stopping almost 100% of the spam.  I assume it is being bypassed by Agentic AI or something.

I'll have to see how well it works, but it looks good so far.  Note that you don't have to host your site on their CDN to be able to use it, though you do need a free cloudflare login.

I came across a "new" feature in SPF records today called macros.  It is an interesting idea that hasn't gained widespread adoption, but something I need to think about if it is useful for any of my customers.  It is one way around the 10 lookup limit that is easy to hit if you use a bunch of 3rd party mailing services, each which require their own SPF record (and sometimes have quite extensive include statements within each record).

One problem with them is that the typical SPF checkers (even those that accept an IP address as well) don't actually lookup the macro, but are basically just testing for syntax, and ignore the macros entirely, so testing the macro can be more difficult.

I have a customer that complained they have an email from a particular vendor that ends up in their spam folder due to a misconfiguration on the sender's end.  We added a whitewlecomelist (I hadn't ever thought about it, but kind of crazy that white and black lists existed for so long...) rule for this sender, so SpamAssassin won't filter out this sender any more, and I wrote up a technical email for them to forward to the vendor, and I thought I should include it here, since some of the information about SPF macro records isn't great.

One of my old physical servers finally died and I had to move the Subversion server to a new machine.  This resulted in the ssh host key changing, so if you get this error:

svn: E170013: Commit failed (details follow)
svn: E170013: Unable to connect to a repository at URL 'svn+ssh://svn@svn.limedaley.com/...'
svn: E210002: To better debug SSH connection problems, remove the -q option from 'ssh' in the [tunnels] section of your Subversion configuration file.
svn: E210002: Network connection closed unexpectedly

You'll need to run these commands to fix it:

ssh svn@svn.limedaley.com

Which will output "Warning: Possible DNS spoofing detected", and that is okay (note, that this error protects you from getting spied on so normally if you see this error, it means someone has hacked your network and/or DNS server, and so you normally don't want to follow these instructions, but in this case, it is expected.

In the long warning message, it should say something like:

ssh-keygen -f "/home/jondaley/.ssh/known_hosts" -R "svn.limedaley.com"

And you can manually run that command, or edit out the line that has the host key for svn.limedaley.com.

Then you can run your svn command like normal.  It should warn you that you are connecting to an unknown host and ask you to verify the fingerprint, which is:

The authenticity of host 'svn.limedaley.com (74.118.138.75)' can't be established.
ECDSA key fingerprint is SHA256:YyG0ezKHFS61i8JC0AyK5HXXZAFyGEyLgrZh29kqDeY.

And as long as that matches, you are all set!

I recently noticed that unblocked spams had gone up and that our mail server was getting error reports from a spam checking service konwn as "validity". Which is yet another list that tries to promote good internet behavior by listing good and bad actors.  However, reportedly, they have changed their free service layer from a reasonable number of hits down to 13 per hour.  This causes three rules to be hit in the default configuration of SpamAssassin to be hit: RCVD_IN_VALIDITY_CERTIFIED,RCVD_IN_VALIDITY_RPBL, and RCVD_IN_VALIDITY_SAFE, two of which are negative rules (negative means a good email), and thus emails that would have otherwise been tagged as spam were now being marked good.

We haven't had many announcements for quite a while, and that is because everything has been running smoothly.  A few new customers here and there, some small website changes, etc.

But...  Today our mail server got listed on the dreaded SBL (which is a great service, and I use it to block incoming email), not because any of our servers were hacked, but because our ISP had a "fraudulent customer" who setup a bunch of servers to send out spam, and we got caught up in the sweep of the "bad neighborhood".

The ISP knows about the problem and is shutting down servers and will submit a de-listing request shortly.

For now, the mail server is holding all outgoing messages, since they likely won't be delivered anyway, and we'll send the whole queue once the block has been removed.

Sorry for the inconvenience, and we'll hopefully go back to not making any announcements...

After much procrastination, Lime Daley has a new mail server, thus finally bringing it up to date with the latest standards, etc.

Due to the way the hostnames work, as long as you have your configuration setup correctly, you shouldn't have noticed any problems.

If you are now getting login problems, check your configuration according to the link above, and then give us a call to help you figure out what you need to change.

We now have the problem of deciding what to do with "orange", our very first server, purchased in 2005, and which has served us very well all these years.  It might become a backup server, or maybe it is time to retire it entirely - it's always hard to get rid of old hardware that is still working...

Flowroute has served Lime Daley for the last 15 years and they have done well for the most part, but every once in a while they make really bad policy decisions.  Last time they almost made me switch to a new provider was a silly decision to charge all customers a monthly fee for 911 access even if they couldn't actually call 911 due it being an incoming-only line or not even registered.  They insisted that they couldn't change that policy, so I cancelled a bunch of numbers that I had been holding onto because they had a good area and region code.  A month after I did that, they must have gotten yelled by lots of customers, because they reversed their position.

Last week, they made another change, disabling all outgoing SMS messages for all non-commercial customers, stating that all of their DIDs are commercial.  And since many of my customers are not commercial, they can't register for the 10DLC system that Flowroute is subjecting all of their customers to (including the increased fees).  So, I'm now in the market for a new SIP provider.

Until I can switch, all outgoing SMS messages won't be able to be sent.  I'm sort of hopeful that Flowroute might change their mind because it will be a lot of work to switch, and I've mostly been happy with their service (though we do have occasional issues in Hillsboro, NH when they switchover to cheaper routes, so hopefully that will go away with a new provider.  I'll be interviewing providers over the coming week or so. 

I was faced with an interesting problem yesterday of trying to calculate the optimal salary for someone who wants to contribute all of their income to their 401K.  And "optimal" is defined as "near as possible to the deductible maximum and not have any half penny or rounding issues per month or for the quarterly social security and medicare reports".  In previous years (especially last year) it was trivial to get the right number, and I didn't have to think too much.  I poked around guessing some numbers but kept getting fractional payments when multiplying the tax rates, so ended up writing a script to do it, and got an excuse to do it in Python, since I've been trying to learn it, but often don't have reasons to use it. (not that this script is all that interesting from a Python perspective).  As my first Java instructor said, "it looks like you took a C program and then renamed it .java and modified it until the compiler didn't complain."  And I had to admit that he was right...

#!/bin/python3
MAX_401K=23000
SOCIAL_SECURITY_RATE=0.062
MEDICARE_RATE=0.0145
TEST_RANGE=200
MONTHLY_NET=int(MAX_401K/12)
MONTHLY_GROSS = int(MONTHLY_NET / (1 - SOCIAL_SECURITY_RATE - MEDICARE_RATE))

for gross in range(MONTHLY_GROSS,MONTHLY_GROSS-TEST_RANGE, -1):
  social=gross*SOCIAL_SECURITY_RATE
  if(social*100 == int(social*100)):
    medicare=gross*MEDICARE_RATE
    if(medicare*100 == int(medicare*100)):
      net=gross-medicare-social
      print("gross:",gross,"net:",net," social:",social,"  medicare:",medicare)
      break

Hope this helps someone else, and maybe I'll even remember I wrote this next year and not calculate it manually...