Fedora Bootable USB

LiveUSB Creator, it's a wonderful thing. Connect a USB key, get the LiveUSB Creator on your PC (Windows or "Linux"), point it either to a local .iso file for a Fedora live CD or let it download the version you want for you, click go, and shazzam! (yes, "shazzam") You've now got a bootable Fedora USB key. And if you gave it a block of persistent storage, you've got, well, persistent storage to use in this OS for data files etc.

- Arch

Processing Deferred Messages in Postfix

For anyone who's had to cleanup some mail problems with Postfix configuration (or more often with other things, like anti-spam, tied in but not part of postfix), it may be common enough that a large spool of mail gets queued up and needs to be pushed out. The easy way to do this is to do either "postfix flush" or "postqueue -f" which basically force Postfix to re-process pending messages (actually "deferred" usually) and send them out.

However, if either the queue is huge, or you don't really know if you have your problems resolved and want to try a few messages before unleashing the masses, I found it was not clear how this can be done. There is a straight-forward way to do this which is to put everything on hold using "postsuper -h ALL deferred", and then un-hold whichever messages you do want processed with "postsuper -H ".

Tres handy

Let's FUSE him with this juice!

Back in the olden days, like a year or two ago, Filesystem in Userspace (FUSE) was a fancy feature that allows users to mount file systems. Using FUSE means that you can create a file system driven by an application rather than a driver (e.g. a kernel module). When I first tried it, it meant customizing your kernel to include this feature and building a bunch of utilities and drivers and generally it was awesome, but not something one does for a "quick fix".

Fast forward to a few months later (or aeons in OSS terms) and there's standard kernels and packages to operate FUSE. You can pull everything you need from your distro's stock repository.

In particular, there is sshfs which is hella tight. "sshfs" is, as you might guess, a file system over SSH, e.g. in FUSE. This means the security and features of SSH including SSH keys and all that good fun. Installing "sshfs" and FUSE is a simple three step process:

1. yum install sshfs (or aptitude install sshfs for Debian / Ubuntu users)


2. ?


3. Profit!

Similarly, once you've installed "sshfs", using it is a simple three step process:

1. sshfs myhost.example.com:/some/remote/path /some/local/path


2. ?


3. Profit!

What could be simpler? If you're finding your virtual file system access in Gnome or KDE produces odd behaviour sometimes, just FUSE your remote file system instead. You get fully functional and secure access to remote file systems.

Oh, and just one last note, you use a FUSE command to disconnect the mount:

fusermount -u /some/local/path

Thanks, Toddz for mentioning FUSE the other day and getting me to revisit it.

Ciao,
- Arch

(title for this post nicked from an Invader Zim quote)

Rolling dice in Bash

I often need short random numbers at work. For example, if I'm scheduling a whole bunch of servers to do the same automated tasks and I want them to not run at exactly the same time, I'll use a random number between 1 and 60 to have them run on different minutes. You can do this somewhat easily in bash using the $RANDOM variable and a mod operation like so:

echo $((RANDOM%60))

However, it's a bit long to type and sometimes I need batches of numbers. So I looked around at dice rolling programs but most were too fancy. So I wrote a simple simple script I called "roll" which returns sets of random numbers.

#!/bin/bash

# Roll
#   This script returns the values and sum of a set of dice rolls.  The first 
#   arg is optional and gives a number of dice.  The second arg is the number 
#   of sides on the dice.  For example "roll 2 6" will give two values from 1 
#   to 6 and also returns their sum.
#
# (c)2009 Dominic Lepiane 

sides=6
dice=1
total=0
c=0

if [ $# = 2 ] ; then
        dice=$1
        sides=$2
elif [ $# = 1 ] ; then
        sides=$1
else
        echo "Usage: $0 [# of dice] <# of sides>" >&2
        exit -1
fi

#echo "Rolling {$dice}d{$sides}"

while [ $c -lt $dice ] ; do
        c=$((c+1))
        roll=$((RANDOM%sides + 1))
        total=$((total+roll))
        echo -n "$roll "
done

if [ $dice -gt 1 ] ; then
        echo -n " = $total"
fi

echo ""

So if I want 12 numbers from 1 to 60, it looks like this:

./roll 12 60
21 32 30 38 56 36 27 19 25 34 25 48  = 391

Very handy!

VMware and Unity

I've been running Fedora 11 (x64) on my workstation at work and running Windows XP (32b) in a VMware virtual machine. It was a VM I'd created with server so all I needed to run it was the free VMware Player.

First, installing VMware Player was a bit of a problem. The install from RPM didn't work, it hosed initially. Then the install from the bundle also failed... Much like it does for many users Online it turned out so there was a community-created patch which worked just fine.

Then there was running the VM. Initially, it seemed great. I was running Windows XP full-screen on my right-screen and had my Fedora desktop / apps on my left screen. But it was pretty wonky about mouse control so I got to the point where I was firing up the Windows VM only when I needed it and then not in full-screen mode.

But I discovered that VMware's Unity mode helps bridge the gap. It pulls you out of console mode and launches any apps from the guest VM in their own windows in your desktop environment. This is especially useful for say, running MSIE or MS Outlook. It's still a little weird because the apps *look* like they should be running natively yet the responsiveness is clearly far behind local apps, but the only real gap is that I can't Shift+Right-Click -> Run As... on tools like Active Directory Users and Computers (which I need). I tried switch back to the console, doing the Run As... and then switching back to Unity, but the escalated app doesn't show up.

Well, it's great and closes the gap some, but for now I'll just keep updating Player and Tools and see if eventually that full-screen mode just gets fixed and works transparently.

- Arch

SpamAssassin

On previous mail server setups, I've tried to pass all mail coming into the server through SpamAssassin (The Fight Against Spam) and it's a bit of a struggle to get it working sometimes so I've had nothing setup for a while other than some SMTP restrictions and a couple of the RBLs. So since SpamAssassin is generally geared to being run / configured per-user, I figured, what the hell, I'll try that. And it is way easier. All I did was plop this in my .procmailrc:

# SpamAssassin
:0fw: spamassassin.lock
| /usr/bin/spamassassin

:0:
* ^X-Spam-Status: Yes
Junk

So now, SA happily tags all my possibly spammy mail and then for actual spam, it dumps it in the Junk folder and it actually strips the content replacing it with all the reasons why the message was identified as spam (the original message is attached).

So far so good!

- Arch

Using proc to force a reboot

So we just had this little discussion on IRC and I figured I'd save it for posterity here:

[11:37:36]  to force a 'hard' reboot (if reboot is not working) - equivalent to pulling the power cable:
[11:37:44]  echo 1 > /proc/sys/kernel/sysrq; echo b > /proc/sysrq-trigger
[11:40:45]  come on dom, you know you want to try it.
[11:41:21]  heh
[11:42:29]  what's this do?  what's this do?  what's it do???
[11:43:13]  you tell us
[11:47:09]  yeah, that's awesome
[11:47:24]  it just tells BIOS to reboot
[11:47:35]  (or something like that anyhow)
[11:47:58]  so, immediate reboot in other words?
[11:47:58]  system just goes *blip* and starts posting

So there you go. Want to reboot without waiting for all those nasty processes to finish or phyiscally pressing the power button? That's your way out.

Thanks, toddz :D

- Arch

Apache and LDAP users

Requisites:

Apache 2.2
mod_authnz_ldap (and enabled with a2enmod authnz_ldap under Debian+Ubuntu)

In your httpd.conf or your htaccess file, add the following:

    # Access control for this directory
    AuthBasicProvider ldap
    AuthType Basic
    AuthName "Password Required"

    AuthLDAPURL "ldap://localhost:389/OU=Users,DC=example,DC=com?sAMAccountName?sub?(objectClass=*)" NONE

    AuthLDAPBindDN readonly@example.com
    AuthLDAPBindPassword plaintextpassword

    Require ldap-group CN=somegroup,OU=someou,OU=Groups,DC=example,DC=com

This example is for connecting to an MS Active Directory server. For an OpenLDAP server, you may find that you don't need the BindDN/Pass options and you need uid instead of sAMAccountName (or possibly just "ldap://localhost/DC=domain,DC=tld").

If you look at other sites online, you'll find that a lot of users say they have to fiddle the config to get it working. Some of the common things I saw were:

1. Setting "AuthzLDAPAuthoritative off"


2. Specifying at least one container under the base DN (as in my example)


3. Tweaking the GroupAttribute and GroupIsDN options


4. Using a DN for the AuthLDAPBindDN (UPN used in my example)


5. Enabling SSL or TLS


6. Multiple domain controllers (simply specify them separated by spaces in your URL)


7. Filters with "Require ldap-filter"

... As you can see there can be a lot of tweaking for specific sites. But all-in-all, the basic configuration is quite simple. If your LDAP server allows anonymous searches, you really only need the AuthLDAPURL line and it can be as simple as "ldap://localhost/DC=example,DC=com".

- Arch

Hardening a RHEL5 Box and the NSA

Hardening a server takes two general activities: Reducing the number of services that can be attacked and protecting any services that are still required.

There are a lot of discussions on how to do this for various operating systems including RedHat Linux. RedHat's Deployement Guide is a good resource.

The NSA also has documents on securing your operating system. However, they're a little hard to get. I tried searching for RHEL5 on their site and had some difficulty access the documents in the search results:



Now it's a little hard to access the documents on the NSA's E drive, but I was able to eventually find them by getting in another way ;) ;) ... Okay, I didn't breakin to the NSA to get on their E drive, I found the page that actually good links: NSA/CSS Operating Systems.

There's a longer document (about 170 pages) and also a short reference (2 pages) which gives lots of good things to secure.

There are a lot of other good resources Online as well, so I won't ramble further. Just turn off anything you don't need, update what you do need frequently, and secure your system with a firewall, and other security tools (PortSentry, fail2ban, DenyHosts, anti-virus software, rootkit detection, etc, etc, etc).

- Arch

Virtual Host Debugging

I just came across this obscure feature of apache2ctl / httpd:

# apache2ctl -S
VirtualHost configuration:
wildcard NameVirtualHosts and _default_ servers:
*:443                  webmail.nibble.bz (/etc/apache2/sites-enabled/webmail.nibble.bz:3)
*:80                   is a NameVirtualHost
         default server alia.dl.nibble.bz (/etc/apache2/sites-enabled/000-default:2)
         port 80 namevhost alia.dl.nibble.bz (/etc/apache2/sites-enabled/000-default:2)
         port 80 namevhost blog.nibble.bz (/etc/apache2/sites-enabled/blog.nibble.bz:3)
         port 80 namevhost www.nibble.bz (/etc/apache2/sites-enabled/blog.nibble.bz:17)
         port 80 namevhost forums.thenibble.org (/etc/apache2/sites-enabled/forums.thenibble.org:2)
         port 80 namevhost lists.thenibble.org (/etc/apache2/sites-enabled/lists.thenibble.org:10)
         port 80 namevhost siona.nibble.bz (/etc/apache2/sites-enabled/siona.nibble.bz:1)
         port 80 namevhost uro.mine.nu (/etc/apache2/sites-enabled/uro.mine.nu:2)
         port 80 namevhost webmail.nibble.bz (/etc/apache2/sites-enabled/webmail.nibble.bz:51)
         port 80 namevhost www.thenibble.org (/etc/apache2/sites-enabled/www.thenibble.org:3)
         port 80 namevhost thenibble.org (/etc/apache2/sites-enabled/www.thenibble.org:15)
Syntax OK

"man apache2ctl" doesn't give the switch parameters but merely alludes to the presence of them:

SYNOPSIS
When acting in pass-through mode, apachectl can take all the arguments available for the httpd binary.

apachectl [ httpd-argument ]

And on my system (Ubuntu 8.04), "man httpd" doesn't report diddly. It is in a manpage *somewhere* so I found it Online:

http://www.manpagez.com/man/8/httpd/

And what it says is:

-S Show the settings as parsed from the config file (currently only
shows the virtualhost settings).

So there you go. Hidden away in the documentation "somewhere" is possibly the most useful virtual host diagnostic tool.

- Arch

Renaming Wordpress Blogs

Under Debian (Ubuntu), there's a helper script which does a lot of the work for adding a new blog. You need to create a hostname, add it as an alias in your apache config, and a database. Then use this helper script to setup the database and config:

/usr/share/doc/wordpress/examples/setup-mysql

Now if you want rename your blog say from "inaction.example.com" to "takeaction.example.com", it's pretty simple.

1. Create the new hostname in DNS,


2. Add it as an alias to your apache config,
<

3. Create a soft-link to the current config using the new name,


4. Edit the settings for your blog and give the new URL.

Edit: You can easily change the settings (from the last step) in the the db. If something goes terribly wrong, just poke around in there and update anything with the wrong URL.

- Arch

Using Procmail to Notify Senders of a Change of Address

Here is a procmail recipe that auto-responds to email messages addressed to an email address that is going to be removed. It's totally simple, it just avoids looping and auto-responding to mail daemons. This can just go at the end of your .procmailrc file (in your home directory).

Basically, the lines starting with * are the conditions so it reads do not match FROM_DAEMON, FROM_MAILER or our X-Loop headers, and only take messages addressed To: (including CC:) . Then the line starting with | is the action which is to use formail to send a reply, insert our X-Loop header then use a file (or two in this case) for the message body.

The one thing to point out is that if you want to setup this reply for many email addresses at once just put a | between them. This is a "regex" pattern so you can do fancier matching criteria if you want.

# bounce messages addressed to archangel@uro.mine.nu
:0
* !^FROM_DAEMON
* !^FROM_MAILER
* !^X-Loop: email-dsn
* ^TO_(archangel@uro.mine.nu)
| (formail -rt -A"Precendence: junk (autoreply)"\
-A"X-Loop: email-dsn" ; \
cat $HOME/.procmail/change-of-address.txt $HOME/.signature) | $SENDMAIL -t


Processing Arguments in BASH

There are many ways to skin a cat, but in a bash script, this is probably the "most right" way to processes command line arguments:

#!/bin/bash

while getopts vf: opt ; do
        case "$opt" in
          v) echo "verbose set" ;;
          f) echo "f: $OPTARG" ;;
         \\?) echo "Error: unknown flag" >&2 ;;
        esac
done

shift `expr $OPTIND - 1`

Basically, you run "getopts" giving it a "parameter string" and a variable name. The parameter string is a list of letters you want to pull arguments from and each one that takes an argument itself is followed by a colon (:).

Loop through the arguments as above, and then use "shift" and the "OPTIND" to shift off all the arguments that were processed, leaving only the "regular" arguments, e.g. take out all the "-v" and such but leave the list of file names.

Props: SHELLdorado

Configuring Postfix to Relay to a Server with SMTP AUTH

If your system has a mail server installed and is not an actual mail server, it is preferable that your system relays through a host that is a regular mail server. In this example, we are configuring Postfix to relay to a host that requires SMTP and TLS.

Make these changes to your Postfix configuration, either by editing /etc/postfix/main.cf or using "postconf -e":
relayhost = [smtp.dl.nibble.bz]
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_use_tls = yes

The given password map file will need to be created and it is in the format of:
mailserver.example.com username:password

The name of the mail server must match your "relayhost" above, and the username and password are the credentials of some user with permission to relay mail. You can use your own credentials or create an account on the server to specifically allow mail relaying.

Once you have created the password map file, run:
postmap /etc/postfix/sasl_passwd

This should create a corresponding "sasl_passwd.db" file. Since both these files contain the above password in plaintext, you should protect them as much as possible:
chmod 600 /etc/postfix/sasl_passwd
chmod 640 /etc/postfix/sasl_passwd.db
chgrp mail /etc/postfix/sasl_passwd.db

Once you have edited your Postfix configuration and created the password map, just restart or reload postfix (just run "postfix reload") and you're done!

Optionally, you can enable SSMTP (on port 465) in addition to TLS on the standard SMTP port (25) which is useful for users who are connecting from sites which block outbound SMTP. It's trivial, un-comment these lines in master.conf and do "postfix reload" again:

smtps inet n - - - - smtpd
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject


Props to the following resources:
http://www.postfix.org/postconf.5.html#smtp_use_tls
http://wiki.zimbra.com/index.php?title=Outgoing_SMTP_Authentication
http://ben.franske.com/blogs/bensbits.php/2005/09/06/postfix_smtp_auth_support_for_relayhost
http://dl.nibble.bz/~archangel/archive.php?news=219

Connect to Nibble Jabber with iChat on a Mac

Connecting to Nibble Jabber with iChat on a Mac requires OS X 10.4 or above and it is super easy to setup. The screenshots below are for OS X 10.4 (Tiger). Note: If you are already using iChat for other types of instant messaging, scroll down to the end to see how to enable Jabber.

When iChat is first run, it will come up and tell you how great it is:


Then it will ask you for your name, just check that it is correct, and your .Mac account info which is optional:


Then you can enable a Jabber account. Just check the box as show, and provide your Jabber ID:


Basically you're done at this point. You will get a couple screens asking you about enabling Bonjour (optional) and configuring your web-camera (if you have one), and then you're done:


When iChat connects, you will probably get this warning about security, choose "continue":


And then you will be logged in and you should see your buddy list:



On the other hand, if you are already using iChat, you just need to go in to "Preferences" to enable Jabber. Open the "Preferences" for iChat, and go to the "Accounts" tab as shown:


Now just choose "Jabber" from the drop-down box and provide your Jabber ID:


That's it! You should get the security warning and buddy list as shown above.

Connect to Nibble Jabber with Pidgin

To connect to Nibble Jabber with Pidgin, just add a new "XMPP" account. Give your Nibble login name as the "Screen name", and "dl.nibble.bz" as the "Domain". That's it! Just click "Save".

For example, in Windows, it looks like this: