FHS hacks

This webpage contains various configurations, tweaks and hacks to improve my working experience at the Salzburg University of Applied Sciences.

Mail

Operators of mail infrastructure are in a constant battle against various threats like phishing mails. As in politics, sometimes measures are taken that have a broad impact on the user experience, freedom and privacy. As in politics, there companies that earn money by providing security solutions, which some describe as snake oil (here, here).

URL rewriting

One such measurement is URL rewriting through some Email Security Appliance (ESA) vendor, like Cisco. One can argue that an ESA is ineffective, impacts privacy¹, impairs usability and I personally do not like the idea that the mails I receive have been altered. But on the other hand, I do not² need to fight against cyber criminals.

Nonetheless, I now receive mails that contain URLs like

https://secure-web.cisco.com/1VqOjcxMgKL3XZfH1RVFk4flLLurhrVbZyjVabNjFFr
wcwvrjcKOq0YBEA_UeqrpX0yBPcmEGpNMmKGjUFJRPMyGPhHq61q7mepfDCD8F09vHfZp4tZ
4VLllvl6yAKJ3Am4p3mivuBeZQqmXQqrRmhfrfFQTgPrQPpB1uvzRTH6Z0eD61H3RAZmT6U0
e3iInSn8FFemTitFEVRT_VlrQh6CeiSE_1fEbpu81lEQoMSweguEckjoCEkG7J8LL0YKw5/h
ttps%3A%2F%2Fwww.example.org%2F

I wrote a script ciscoclean that undoes this transformation and nicely integrates with text-based mail clients like mutt.

Local DNS resolvers

Update 2020-03-09: DNS queries are not blocked anymore, but the general hint may still be useful for other networks.

There are a few good reasons to run a DNS resolver on localhost.³ Linux users often like to use dnsmasq, which is supported by NetworkManager as a configuration option. I personally use bind, which I also run as authoritative DNS servers for my domain.

However, sometimes network providers – such as FHS or the ÖBB federal railways – block outgoing DNS traffic and your local DNS resolver cannot resolve any requests anymore. One option is to resolve DNS queries via VPN.⁴ This would be a clean solution from security’s point of view but it slows DNS resolving down. In a foreseeable future, DNS over HTTPS partially changes the situation.

In case of the FHS, for me personally, the lesser evil would be to resort the FHS DNS resolvers if I am in their network, but otherwise I would like to use my local resolver. This can be done with NetworkManager by using the dispatcher simply by placing the following script 99-localhost-resolver in the directory /etc/NetworkManager/dispatcher.d:

#!/bin/sh

if [ "$2" == "up" ]; then
        # We got up in the FHS network
        if ip a | grep -q "inet 78.104.1[67]" ; then
                echo "# On FHS network" >> /etc/resolv.conf
        # Set resolver to localhost
        else
                echo "nameserver 127.0.0.1" > /etc/resolv.conf
        fi
fi