Category: Life: Work and Techy

I’ve just got off the phone with a company where I had to spell my surname: I’ve got quite a difficult to correctly spell surname so I often have to spell it out phonetically (the “a for alpha” business), but three-quarters through I realised I couldn’t remember what ‘W’ was for (it’s for whisky). Oops. Anyway, as an aid to my memory more than anything, here’s the phonetic alphabet that dates from around 1995 (and has been approved by the International Civil Aviation Organisation, International Telecommunications Union and the FAA – so it’s “quite official”):

Alpha Bravo Charlie Delta Echo Foxtrot Golf Hotel India Juliet Kilo Lima Mike November Oscar Papa Quebec Romeo Sierra Tango Uniform Victor Whisky Xray Yankee Zulu

The UK police sometimes use “Indigo” instead of “India” and the actual spellings of some of the words may vary – but since they are made to be said rather the spelt themselves, it shouldn’t be much of a problem.

In aviation, they also use the following phonetic digits mainly to avoid “conflicts” with other words and digits (“five” may be mistaken for “fire”, but fife won’t be):
zero one two tree fower fife six seven eight niner

Well today was an interesting day at work. First hour or so was quite quiet (mainly responding to any technical helpdesk enquiries that were logged over the weekend and just following up on a few things), but then things started to get just a little bit busier… Then one of our main servers failed 🙁 It’s the one we’ve been having a few problems with. We hoped that the RAM swap-out would have sorted the issue, but it died big time again today and we were without it for an hour or so. Proactive action is being taken though – we (more technically, me) are moving the critical files off that server on to one of our spares (the helpdesk and client system) and I’m planning on getting some really severe logging systems running on the server. By really severe, I mean regular system snapshots to let us know exactly what is happening, monitors running in case pre-determined levels are exceeded yadda yadda yadda. I was hoping it wouldn’t be necessary, but we do need to find the cause of this fault ASAP. Yes, our customers don’t pay a lot to be hosted on the server (it’s one of the cheapest hosting plans available to my knowledge) and we don’t offer a SLA (Service Level Agreement) so technically we can just let the box “die” and be done with it – but that’s not good for our customers and since our major form of advertising is “word of mouth” – downtime ain’t good for us!

After the server came back up (and we got full email capabilities back) I had loads of work come in. I had sent out emails on Thursday, Friday and this morning saying “I need approval on this/I need these details” for a number of our search engine optimisation customers and they all decided to get back to me in the same time frame. Grrr. Combine that with ‘standard’ customer side of things I’m involved with (I seem to be getting “respond to this potential customer with your standard marketing gumff” style emails from my boss) and I was overloaded!

Sorry if you were visiting my blog between 7:45pm and 8:05pm today – I was performing a small server upgrade (to be specific, applying a patch to the Apache webserver) when something went wrong. It took me around 10 minutes to notice that Apache hadn’t properly restarted (I was doing some other maintenance tasks at the time so I hadn’t got round to checking it had came back alive correctly), than around another ten minutes to find out why it wouldn’t restart.

The problem I was getting was [crit] (98)Address already in use: make_sock: could not bind to port 80 whenever I tried to restart Apache. I disabled the Tomcat Jakarta server (as that was what I was patching as the previous version I was running had a security hole) as I don’t do anything important with Java on my server at the moment and attempted to restart Apache. Still no joy and the same error message. I do a netstat -lpn to try and find out which process is running on port 80 so I can kill it…. Nothing is. Aaargh! I then have a brain wave and think that perhaps when Apache was restarted it failed to shutdown properly. So I go into the Apache config file and change the “Port” number from 80 to 81. Start the server and success! (this also proves there was nothing wrong with the Apache configuration file). Change the port number back to “80”, restart the server and the flibblepenguin is alive!

As you may have already heard, over the weekend the Internet was hit by one of the fastest spreading worms since the original Morris worm. The name of this nasty piece of code? “MS-SQL Slammer”- so called because it uses a 6-month old exploit in unpatched Microsoft SQL servers as its method of spreading- but spreads so quickly that it caused major problems across the ‘net.

Actually, to call it a nasty piece of work is doing a disservice to the author (who is, at this moment of time, still unknown). It’s a lovely piece of optimised assembly code which does “it’s job” in just 376 bytes in length (to put that in perspective – that is exactly the length, in letters, spaces and punctuation, of the first paragraph of this entry).

When the code infects an unpatched Microsoft SQL Server 2000 or Microsoft Desktop Engine (MSDE – which is included in Visual Studio.net, Asp.net Web Matrix Tool, Office XP Developer Edition, MSDN Universal and Enterprise, Microsoft Access and Microsoft Applicaiton 2000), it first loads the “modules” Kernel32.dll and WS2_32.dll. It then calls the routine “GetTickCount” to generate random IP (internet protocol) address which it then targets for propagation and exploitation over the UDP (User Datagram Protocol) protocol port 1434. It repeats the exploit code (using a method called a stack buffer overflow) until either the SQL server is shut down or the machine is rebooted.

Well, that’s been fun! It’s been a strange 72 hours in the techy land of Richy – and to enable me to look back and go what the f—k (WTF), here’s just one of the incidents I’ve had to deal with…

Last week we had a customer report that he was having problems sending email – basically the mail server was rejecting his mail. This is our most frequently asked question (and it’s now had a step by step guide published on our FAQ/Knowledge base about it) and the situation is always the same – the customer has put our mail server in the SMTP (outgoing mail) settings. They need to have their ISPs mail server in this field as our servers don’t permit remote relaying of mail (also known as ‘open relays’). So I sent this customer an email saying that he needs to change his outgoing mail server to be that of his ISPs and heresponds with details of which email package he is using and which ISP dialup/ADSL/ISDN or broadband connection he is using then we’ll provide a step by step walk thru. This was sent within 6 hours of his initial query.