Note the security section which disables some paranoid protection IIS has switched on by default. If your server doesn’t allow double escaping of request strings, the YOURLS links with a + in them don’t work. This breaks the admin interface and the stats reporting pages.

The rest of the web.config is standard stuff to fix a non-canonical hostname, and make sure the IDs are rewritten to the right pages:

<system.webServer>
	<security>
		<requestFiltering allowDoubleEscaping="true" />
	</security>
	<rewrite>
	<rules>
		<rule name="Canonical Host Name" stopProcessing="true">
			<match url="(.*)" />
			<conditions>
				<add input="{HTTP_HOST}" negate="true" pattern="^domain\.com$" />
			</conditions>
			<action type="Redirect" url="http://domain.com/{R:1}" redirectType="Permanent" />
		</rule>
		<rule name="YOURLS 1" stopProcessing="true">
			<match url="^([0-9A-Za-z]+)/?$" ignoreCase="false" />
			<conditions logicalGrouping="MatchAll">
				<add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
				<add input="{REQUEST_FILENAME}" matchType="IsDirectory" ignoreCase="false" negate="true" />
			</conditions>
			<action type="Rewrite" url="/yourls-go.php?id={R:1}" appendQueryString="false" />
		</rule>
		<rule name="YOURLS 2" stopProcessing="true">
			<match url="^([0-9A-Za-z]+)\+/?$" ignoreCase="false" />
			<action type="Rewrite" url="/yourls-infos.php?id={R:1}" appendQueryString="false" />
		</rule>
		<rule name="YOURLS 3" stopProcessing="true">
			<match url="^([0-9A-Za-z]+)\+all/?$" ignoreCase="false" />
			<action type="Rewrite" url="/yourls-infos.php?id={R:1}&amp;all=1" appendQueryString="false" />
		</rule>
	</rules>
	</rewrite>
</system.webServer>

1) I run my own Exchange Server.  It provides ActiveSync, Outlook Web Access, and Outlook Anywhere for my company’s email domains and my personal durdle.com domain.

2) I provide email addresses at durdle.com for family members (and a few people who just happen to share the family name).

Historically all those family emails have been maintained by Gradwell without going near my Exchange Server.  The durdle.com MX records in DNS pointed to Gradwell’s servers for mail delivery and I had a forwarder at Gradwell that would redirect my – and only my – messages to the Exchange Server.  For a number of reasons I needed to change this so that all email is delivered via my Exchange Server.  I made this change yesterday, discovering one problem in the process.

Email Suffixes

Gradwell’s mail server supports email suffix matching.  If you have a GMail account you may be familiar with the approach.  Say you have an email john@gmail.com.  Gmail will actually deliver mail to john+anything@gmail.com; you can add any suffix you like after the + and GMail will still deliver it to your inbox.  Gradwell support this by allowing you to place a period after the local part so you can use john.anything@example.com.  You don’t have to create these email addresses anywhere – you can just start using it and the mail server will make sure it gets to you.

This is fantastically useful because it means that when a website asks for your email address you can give out a custom throwaway email just for that site.  So when you sign up at DodgyCo.com, you give them the email john.dodgyco@example.com.  If you ever receive spam because DodgyCo sold your email address you’ll know a) who sold you out, and b) which email address to add to your spam filter.

Exchange Server

Enter Microsoft Exchange Server.  I’m currently running the 2010 edition, but the problem I’m about to describe (and solve!) exists in every recent version.  Exchange Server doesn’t support email suffixes.  Every recipient has to have an alias created on the server.  If you want to deliver to john.suffix@example.com you’d better remember to create an alias for that user, otherwise the Exchange Recipient Filter will reject the message since – as far as it is concerned – the user does not exist on the server.

Worse, Exchange doesn’t even implement any generic CatchAll functionality.  CatchAll would allow the server to redirect messages for non-existing recipients to a specific address. Smart people have created solutions to the CatchAll problem but all that does is allow you to define one mailbox for ALL non-deliverable messages to be delivered to.  Since I need to provide suffix matching to multiple users this doesn’t work for me.

Time to extend Exchange’s functionality!

Transport Agents

Transport Agents were introduced in Exchange 2007 to replace Exchange 2003’s SMTP Event Sinks and have been retained largely unchanged in Exchange 2010.  Broadly speaking when a message arrives at an Exchange Server it is moved through the transport pipeline as each SMTP event occurs.  Each SMTP event (Connect, MAIL FROM, RCPT TO, etc) can trigger an interested Transport Agent to perform some actions on the message.
The complete list of SMTP events and their sequence is described on this Exchange Server TechCenter page.

Transport Agents are simply DLLs written in managed code that fire on SMTP events.  Back when I contracted for the MOD I wrote a Transport Agent for Exchange 2007 which demonstrated that Exchange was capable of performing Dominance Checking on outgoing emails so I knew that it wouldn’t take to long to write a Transport Agent to filter incoming messages.  I was able to reuse some of that code and also made use of some of Wilbert De Graaf’s CatchAll Agent code which made the handling of a configuration file very quick to implement.  Thank you Wilbert!

Requirements

I had a couple of requirements for my Transport Agent:

1) It should allow redirection of multiple suffixes to different recipients.

2) It should allow me to ban delivery to any previously used suffixes and ensure that the sender receives a non-deliverable report.

I ended up meeting these requirements by using C# to write a Transport Agent that accepts its configuration from an XML file.  The config.xml defines multiple regular expressions to match against along with associated redirect addresses.  It also lists banned email addresses which the Transport Agent should reject.

To mimic the Gradwell behaviour which we were already making use of I needed to match firstname then a dot and then any word before the domain.  This is a fairly simple regular expression in C#, and looks like this:

^firstname+\.[a-z]+@example.com$

The config.xml takes the form:

<config>
    <redirect pattern="^john+\.[a-z]+@domain.com$" address="john@domain.com" />
    <redirect pattern="^jane+\.[a-z]+@domain.com$" address="jane.doe@gmail.com" />
    <banned address="john.spam@domain.com" />
    <banned address="jane.newsletter@domain.com" />
</config>

Here we define two patterns for redirect, one to an internal recipient and one redirect to an external SMTP address.  We also ban two known “bad” recipient addresses.

You’ll need to provide at least one redirect entry, but you’re not required to ban any addresses if you don’t want to.  Also, while redirects specifiy regular expressions to match, banned addresses are just strings which are simply compared. I leave it as an exercise for the reader to add regular expressions to the banned list!

The Code

Whenever the config.xml file is changed, the agent reloads it and parses the XML.  It puts the banned emails into a List and the regular expression patterns and redirect addresses into a Dictionary.  If any of the emails in the config appear invalid the new configuration is rejected and the agent continues to use the running config.

The agent defines a RCPT TO: handler.  This event is fired as soon as the sending MTA starts to transmit the recipient addresses. rcptArgs contains the argument we need: RecipientAddress, which we store as a lowercase string for comparison. Although the spec (RFC2821) actually requires email addresses to be case sensitive, I’ve never met an MTA that adheres to that part of the spec. So for our purposes email addresses are case insensitive and we can do all comparisons in lowercase.

public void RcptToHandler(ReceiveCommandEventSource source, RcptCommandEventArgs rcptArgs)
{
// Get the recipient address as a lowercase string.
string strRecipientAddress = rcptArgs.RecipientAddress.ToString().ToLower();

It performs two checks. First – is the recipient address in the ban list?

// Search the banned email List for the recipient.
bool exists = catchAllConfig.Banned.Exists(element => element == strRecipientAddress);
if (exists)
{
	// If found respond to the sending MTA with the reject response.
	source.RejectCommand(CatchAllAgent.rejectResponse);
 
	// No further processing.
	return;
}

And second, does the recipient address match any of the regular expressions?

// For each pair of regexps to email addresses
foreach (var pair in catchAllConfig.AddressMap)
{
	// Create the regular expression and the routing address from the dictionary.
	Regex emailPattern = new Regex(pair.Key);
	RoutingAddress emailAddress = pair.Value;
 
	// If the recipient address matches the regular expression.
	if (emailPattern.IsMatch(strRecipientAddress))
	{
		// And if the recipient is NOT in the address book.
		if ((this.addressBook != null) &&
			(this.addressBook.Find(rcptArgs.RecipientAddress) == null))
		{
			// Redirect the recipient to the other address.
			rcptArgs.RecipientAddress = emailAddress;
 
			// No further processing.
			return;
		}
	}
}

Note that in both cases as soon as we’ve got a positive result we stop further processing. If an address is in the ban list we immediately reject it, and if we find a matching regular expression we use its paired address to redirect the message and stop looking for further matches.

I’ve given enough information here that a C# developer with some spare time could create this Transport Agent themselves. However I know that it is really useful to have a package you can just download and install without having to worry about compiling it yourself. So I’ve packaged the DLL together with installation scripts and the install and configuration guide.

Please visit the product page for more information and to purchase the Transport Agent. Payment is via PayPal, you will receive the download link within minutes of payment.

First, list the orphan users to make sure this is the problem:

EXEC sp_change_users_login 'Report'

Usually I already have the login and password set up on the server, this being the case you can fix the orphan by doing:

EXEC sp_change_users_login 'Auto_Fix', 'user'

If not, and you want/need to create the login and password, you’ll need to do this instead:

EXEC sp_change_users_login 'Auto_Fix', 'user', 'login', 'password'

For example, I want a canonical host name (so visitors always see workavoidance.net with no www prefix in the address bar) and to ensure that the Wordpress permalinks work properly. While I was at it I took the opportunity to disable hot-linking of our images, since for some reason a Russian website had taken a shine to some of our Armory graphics.

Below is the web.config I created. It redirects users to the canonical host name, enables Wordpress permalinks and disables hot-linking of our images. The redirect proved something of a problem to begin with. Our iPhone App “Monkey Shaker” has an online high score system. Scores are submitted from the app via an encrypted HTTP POST to a PHP page which decrypts the information and updates the database. I discovered that when you issue a server side redirect most clients won’t re-POST their data to the new page – they will issue a GET for the new page and the original POST data is lost. This meant that highscore submissions were failing.

(NB: this isn’t as big a disaster as it sounds since we built a very robust mechanism to retry score submission into the app.)

So, you’ll note an extra entry in the web.config to exclude that page from a redirect:

<add input="{URL}" negate="true" pattern="scoresubmit\.php$" />

“Why not just change the URL in the app to be canonical?!” You may well ask. Yes, we probably will, but that relies on issuing an update and getting over a quarter of a million users to download it. This way we don’t have to rely on that.

Still to come – how I implemented caching in Wordpress and in our high score system to improve performance.

Here’s the rewrite rules section of the completed web.config:

<rule name="Canonical Host Name" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTP_HOST}" negate="true" pattern="^workavoidance\.net$" />
<add input="{URL}" negate="true" pattern="scoresubmit\.php$" />
</conditions>
<action type="Redirect" url="http://workavoidance.net/{R:1}" redirectType="Permanent" />
</rule>
 
<rule name="Prevent image hotlinking">
<match url=".*\.(gif|jpg|png)$"/>
<conditions>
<add input="{HTTP_REFERER}" pattern="^$" negate="true" />
<add input="{HTTP_REFERER}" pattern="^http://workavoidance\.net/.*$" negate="true" />
</conditions>
<action type="Rewrite" url="/no.png" />
</rule>
 
<rule name="wordpress" patternSyntax="Wildcard">
<match url="*" />
<conditions>
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
</conditions>
<action type="Rewrite" url="index.php" />
</rule>

If you install Java 6 Update 13 and then try and log into Cisco SDM 2.5 it will fail. The SDM console will not load.

I found I had to go back to Java 6 Update 6 (available at the Java archive page, or direct download.).

With that the Cisco SDM started working again. I’ve not found anything about this on the Cisco site.

bindSid = "LDAP://<sid =" & SID & ">"
set oVal = GetObject(bindSid)
Result = oVal.Get("cn")
set oVal = Nothing

So if you have a list of SIDs and want to translate them into meaningful account names, this will do it without relying on using WMI – which on a lot of secure networks is locked down (or at least should be!).

Why do I need this? It’s a part of a larger script I’m writing that will archive specific Group Policy Objects from the \SYSVOL\<domainname>\Policies\ folder of a PDCe. One of the files in a GPO is the GptTmpl.inf file which gives a list of the User Rights Assignments (SeBackupPrivilege, SeShutdownPrivileg etc) along with the SIDs of the accounts that have been given those privileges (e.g. S-1-5-19). I wrote a script that reads the SIDs and queries the DC for the account names. This code fragment works more reliably (and I think faster) than the WMI calls I was previously using.

He used a custom compiled “rcon” binary to talk directly to the game server’s Remote Console port. This is the port that allows an administrator to configure the game, kick players, change maps and generally do all the useful stuff that a game admin needs to do. It’s the protocol used by the hlstats live stats page to determine what is happening right now on the game server. Unfortunately, as far as my Googling shows, such a binary doesn’t exist for win32. There is a perl module (kkrcon.pm) which does the work inside hlstats, but the command line wrapper for kkrcon.pm – kkrcon.pl – doesn’t seem to have been updated since 2001 and so doesn’t work for Source titles.

A little Perl hacking later and I’ve created a version of the kkrcon.pl wrapper that is capable of using the Source rcon protocol. You can download both the module and the wrapper here: source server rcon perl script. This was tested on Windows Server 2003 running ActiveState Perl.

With that done, we can use MRTG to run another Perl script which will run the new kkrcon.pl with the right parameters, request some data from the game server and then parse it into a format that MRTG can understand. The two scripts I used are much the same as I found on the Zokahn site, but tweaked to use my new kkrcon.pl instead of the binary and to pass the parameters in a slightly different way. You can grab the scripts here: MRTG Counter-Strike: Source perl data source scripts.

The last step is the MRTG config file itself, here’s what the CSS Users part of mine looks like:

Target[server.CS-Users]:`.\m_cs-s_users.pl <server_ip> <port> <rcon_password>`
Title[server.CS-Users]: Active Counter-Strike:Source users
PageTop[server.CS-Users]: <H1>Counter-Strike:Source Users</H1>
MaxBytes[server.CS-Users]: 16
ShortLegend[server.CS-Users]: #
YLegend[server.CS-Users]: Active Users
Legend1[server.CS-Users]: Current active CS:Source users
LegendI[server.CS-Users]: Users
LegendO[server.CS-Users]:
Options[server.CS-Users]: growright,nopercent,gauge,integer
Unscaled[server.CS-Users]: ymwd

It’s very important to note that those are back ticks (`) on the first line – NOT apostrophes (‘). This caught me out and stopped MRTG generating data until I’d fixed it.

You can see my graphs here, although there isn’t a lot of data yet – just waiting for the clan to wake up and start playing!