[Solved] Fixing Broken DomainKeys and DKIM Signatures Sent via PHP mail()

When sending emails through PHP's native mail() function on a server configured with SPF, DomainKeys, and DKIM (such as Plesk), desktop mail clients (Outlook, Thunderbird) may sign outbound emails correctly, but emails dispatched from web scripts fail DKIM verification with invalid domain signatures.

The Trap: Setting a raw From: string inside $additional_headers causes the sendmail wrapper to misidentify the originating signing domain d=$DOMAIN.

The Problematic Call

// This breaks DKIM signatures by overriding the sender envelope incorrectly:
mail($to, $subject, $message, "From: Name <user@domain.com>");

The Solution

Explicitly pass the envelope sender using the -f flag in the 5th parameter ($additional_parameters):

// Correct invocation with verified envelope sender:
mail($to, $subject, $message, "", "-f user@domain.com");

Verification Tip: Send a test email to check-auth@verifier.port25.com. The automated robot will reply within seconds with a detailed SPF, DKIM, DomainKeys, and SpamAssassin diagnostic report.

[Solved] Postfix SASL Authentication Failure: realm changed: authentication aborted in Plesk

When enabling STARTTLS on a Plesk server running Postfix, mail clients like Mozilla Thunderbird may connect normally, while Microsoft Outlook clients repeatedly fail with authentication popups and the following mail log errors:

Environment: Plesk • Postfix with STARTTLS • Cyrus SASL Authentication

postfix/smtpd[1929]: warning: SASL authentication failure: realm changed: authentication aborted
postfix/smtpd[1929]: warning: SASL DIGEST-MD5 authentication failed: authentication failure

Root Cause & Solution

Outlook struggles with DIGEST-MD5 SASL negotiation over TLS on certain Cyrus SASL configurations. Restricting the SASL mechanism list to CRAM-MD5, PLAIN, and LOGIN resolves the negotiation conflict:

1. Edit /usr/lib64/sasl2/smtpd.conf and update mech_list:

   mech_list: CRAM-MD5 PLAIN LOGIN

2. Edit /etc/postfix/main.cf and confirm security options:

   smtpd_sasl_security_options = noanonymous

3. Restart services:

   service postfix restart
   service saslauthd restart

Setting Up Vim with Python 2/3 Support and Code Completion on Ubuntu 16.04

Configuring Vim as a fast, keyboard-driven Python IDE significantly boosts developer productivity. When following standard Vim Python configuration guides on Ubuntu 16.04 (Xenial Xerus), several key adjustments are required to achieve clean PEP 8 indentation, accurate syntax highlighting, and YouCompleteMe code autocompletion.

Stack: Ubuntu 16.04 LTS • Vim 7.4 / 8.0 • Python PEP 8 indentation rules

1. Enforcing Clean PEP 8 Indentation

Add the following configuration to your ~/.vimrc to ensure 4-space indentations, soft tabs, and trailing whitespace highlighting:

" PEP 8 standard formatting for Python buffers
augroup python_indent
    autocmd!
    autocmd FileType python setlocal tabstop=4
    autocmd FileType python setlocal softtabstop=4
    autocmd FileType python setlocal shiftwidth=4
    autocmd FileType python setlocal textwidth=79
    autocmd FileType python setlocal expandtab
    autocmd FileType python setlocal autoindent
    autocmd FileType python setlocal fileformat=unix
augroup END

2. Installing YouCompleteMe on Ubuntu 16.04

Install prerequisite development libraries before compiling the YCM C-extension:

sudo apt-get install build-essential cmake python-dev python3-dev -y
cd ~/.vim/bundle/YouCompleteMe
./install.py --clang-completer

How to Fix VMware ESXi 6.0 Root Account Lockout and Brute-Force Restrictions

Starting with version 6.0, VMware ESXi introduced an automated security lockout feature that locks the root account after consecutive failed login attempts. On hypervisors exposed to public networks, malicious automated SSH bots frequently trigger this threshold, inadvertently locking legitimate administrators out of the vSphere Client and Web UI.

Security Best Practices: Enforce SSH key-based authentication • Restrict ESXi management firewall to designated administrative IPs.

1. Unlocking the Root Account via Local Console (DCUI)

Log in via the physical or out-of-band Direct Console User Interface (DCUI), navigate to Troubleshooting Options, enable the ESXi Shell, and reset the lockout counter:

# Check failed login attempt count
pam_tally2 --user root

# Reset failed attempt counter and unlock account
pam_tally2 --user root --reset

2. Permanent Hardening: Restrict Management Access

To eliminate unauthorized brute-force attempts permanently:

1. Disable SSH password logins in /etc/ssh/sshd_config:

   PasswordAuthentication no

2. Restrict the ESXi management firewall rule for the vSphere Client (port 443 / 902) to your office or VPN gateway IPs:

   esxcli network firewall ruleset set --ruleset-id vSphereClient --allowed-all false
   esxcli network firewall ruleset allowedip add --ruleset-id vSphereClient --ip-address 203.0.113.10

Essential Techniques to Block Browser Fingerprinting, Canvas Tracking, and Audio APIs

Standard "Private Browsing" or "Incognito" modes prevent local history from saving to disk, but they do little to protect your identity from sophisticated web trackers. Modern tracking networks rely on device fingerprinting—measuring system fonts, GPU rendering quirks via HTML5 Canvas, WebGL parameters, audio latency, and installed plugins to create a persistent hardware signature across sessions.

Auditing Tools: Test your browser uniqueness at EFF Panopticlick (Cover Your Tracks) and BrowserLeaks.

Key Tracking Vectors and Countermeasures

• HTML5 Canvas Fingerprinting: Trackers draw invisible shapes and text behind the scenes; minute GPU driver rendering variations produce a unique hash.

  Defense: Install privacy tools like Canvas Defender or Firefox's native privacy.resistFingerprinting = true in about:config.

• AudioContext API Tracking: Variations in audio buffer processing across system sound cards provide another identifiable vector.

  Defense: Block non-consensual Web Audio processing through extension policies.

• System Font Enumeration: Tracking scripts measure font rendering metrics across hundreds of installed fonts.

  Defense: Restrict font queries to standard platform fonts (layout.css.font-visibility.standard = 1 in modern Firefox).

• WebRTC IP Leakage: WebRTC STUN requests can expose real public and private LAN IPs even when connected behind a VPN proxy.

  Defense: Set media.peerconnection.enabled = false.

How to Configure Docker with the Btrfs Storage Driver on CentOS 7

On CentOS 7, Docker initially defaulted to the devicemapper storage driver in loop-lvm mode, which suffered from high I/O latency, severe disk fragmentation, and occasional filesystem deadlocks. Configuring Docker to use the Btrfs storage driver provides native copy-on-write subvolumes, instant snapshots, and superior performance for virtualized hosts.

Prerequisites: Dedicated block device or partition formatted as Btrfs (e.g. /dev/sdb1).

1. Create and Mount the Btrfs Filesystem

# Format partition as Btrfs
mkfs.btrfs -f /dev/sdb1

# Mount at Docker root directory
mkdir -p /var/lib/docker
mount -t btrfs /dev/sdb1 /var/lib/docker

Add the mount to /etc/fstab for persistence across reboots:

/dev/sdb1  /var/lib/docker  btrfs  defaults,compress=lzo  0 0

2. Configure Docker Daemon

Specify the Btrfs driver in /etc/docker/daemon.json:

{
  "storage-driver": "btrfs"
}

Start Docker and verify the active storage engine:

systemctl start docker
docker info | grep "Storage Driver"

How to Use Persian and Eastern Arabic Numerals for Zotero Citations in Microsoft Word

When writing academic papers and theses in Persian or Arabic using Microsoft Word, the Zotero plugin often renders citation reference numbers (e.g. [1], [2]) using Western Arabic numerals (1, 2, 3), even when Word's numeral display setting is configured to Context under File → Options → Advanced.

Goal: Automatically convert Zotero bibliography and in-text citation numbers into Persian / Eastern Arabic digits (۱, ۲, ۳).

The Solution: Modifying the CSL Locale Style

Zotero determines numeral localization through its Citation Style Language (CSL) locale definition. You can enforce native localized digits across your document:

1. In Zotero, navigate to Preferences → Advanced → Config Editor.
2. Search for extensions.zotero.export.bibliographyLocale and set it to fa-IR (or your target RTL language code).
3. Alternatively, edit the CSL style file (.csl) by adding the xml:lang="fa-IR" attribute to the root <style> element:

   <style xmlns="http://purl.org/net/xbiblio/csl" version="1.0" xml:lang="fa-IR">

4. Return to Word and click Zotero Refresh. All bracketed citations will update to Eastern Arabic / Persian numerals smoothly.