Raw TCP proxy using socat (Ubuntu)

On ubuntu you can just

# apt-get install socat

and then

# socat TCP-LISTEN:80,fork TCP:192.168.0.200:80

DKIM + SPF + Sendmail for multiple domains (Ubuntu)

First things first,

DKIM is DomainKeys Identified Mail and is used in mail servers, such as Postfix or Sendmail to sign e-mails and thus authenticating the sender so that a forgery can be detected. It also reduces the possibility of an e-mail being flagged as spam, but it's not a definite prevention.

A much simpler method is using SPF (Sender Policy Framework) which, in a nutshell, verifies the sender IP address.

According to the internet, using both should result to ????, PROFIT !!!.

SPF does not need a specific configuration. Whitelisted servers are listed in a DNS record, TXT or SPF, and an example record is:

example.com. IN TXT "v=spf1 a mx ~all"

And that's preety much it, for the simplest case there is. This record specifies the policy (v=spf1), whitelisted servers (a and mx records), and ~all states that every other IP address should be tagged as SOFTFAIL.
It can get much more complicated than this, so RTFM.

Okay, so, DKIM.

DKIM includes a cryptographic hash in the e-mail header which is calculated with the private key (on the server) and verified with the public key (in the DNS record).

DKIM-Signature: v=1; a=rsa-sha256; d=example.net; s=brisbane;
     c=relaxed/simple; q=dns/txt; l=1234; t=1117574938; x=1118006938;
     h=from:to:subject:date:keywords:keywords;
     bh=MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI=;
     b=dzdVyOfAKCdLXdJOc9G2q8LoXSlEniSbav+yuU4zGeeruD00lszZ
              VoG4ZHRNiYzR

First, install opendkim.

apt-get install opendkim

Edit the configuration file of opendkim.conf, located in /etc/opendkim.conf.

AutoRestart             Yes
UMask                   002
Syslog                  yes
AutoRestartRate         10/1h
Canonicalization        relaxed/simple
ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
KeyTable                refile:/etc/opendkim/KeyTable
LogWhy                  Yes
Mode                    sv
PidFile                 /var/run/opendkim/opendkim.pid
SignatureAlgorithm      rsa-sha256
SigningTable            refile:/etc/opendkim/SigningTable
Socket                  inet:8891@localhost
SyslogSuccess           Yes
TemporaryDirectory      /var/tmp
UserID                  opendkim:opendkim

As you can see, there are three more files to be added, TrustedHosts (whitelisted IPs that can sign e-mails), KeyTable (multiple domain configuration for public and private keys) and SigningTable (whitelisted users that can sign e-mail).

/etc/opendkim/TrustedHosts:

127.0.0.1
example.com
192.168.0.1/24

You get the idea.

/etc/opendkim/SigningTable:

*@example.com default._domainkey.example.com

All users from @example.com can sign. You can specifiy usernames and domains, instead of the wildcard, for additional security.

/etc/opendkim/KeyTable:

default._domainkey.example.com example.com:default:/etc/opendkim/keys/example.com.pvt

Location of the private key and name of the DNS record for each domain. The "default" before _domainkey.example.com and :default: is a selector. This can be changed to something else.

Next, we need to generate the public and private key for each domain.

Shouldn't be too difficult.

If some folders don't exist, just create them.

root@ubuntu:/etc/opendkim/keys# opendkim-genkey -D /etc/opendkim/keys/example.com -d example.com -s default

Again -s flag is for the selector. If you changed it, you need to enter it here.

The command generates a private key (default) and public key (default.txt). You will probably rename them, to match the configuration.
An important note here is that the files are owned by user opendkim, or you will get permission denied errors in /var/log/mail.err. Default permissions on those files are -rw------.

Move the private key to where you specified it should be in the KeyTable.
Insert the public key in your DNS as a TXT record.

Next up, telling sendmail to talk to opendkim.

Edit /etc/mail/sendmail.mc and add this line at the end. DO NOT EDIT sendmail.cf.

INPUT_MAIL_FILTER(`opendkim', `S=inet:8891@localhost')

Rebuild sendmail configuration and restart, start opendkim if it's not running yet

root@ubuntu:~# sendmailconfig; service sendmail restart; service opendkim start

Test it out.

That's it, you're done!

Apache :: Could not determine fully qualified domain name

Error message:

apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName


Is preety much self-explanatory

Add this
ServerName localhost

In your server configuration file.

Apache :: VirtualHost overlap on port

Errors like


[warn] _default_ VirtualHost overlap on port 443, the first has precedence

are caused because the virtualhosts are not named.

(The same applies for any other port, for example 80)

Add this in your apache configuration file

NameVirtualHost *:443

In Ubuntu server, Linux, that configuration is actually located in the ports.conf file in /etc/apache2.


NameVirtualHost *:80
NameVirtualHost *:443


Listen 80

MySQL not starting when restoring files in /var/lib/mysql

If you get errors like:


120226  1:54:14 [Note] Plugin 'FEDERATED' is disabled.
120226  1:54:14  InnoDB: Initializing buffer pool, size = 8.0M
120226  1:54:14  InnoDB: Completed initialization of buffer pool
120226  1:54:15  InnoDB: Started; log sequence number 0 44233
120226  1:54:15 [ERROR] Event Scheduler: Failed to open table mysql.event
120226  1:54:15 [ERROR] Event Scheduler: Error while loading from disk.
120226  1:54:15 [Note] Event Scheduler: Purging the queue. 0 events
120226  1:54:15 [ERROR] Aborting


120226  1:54:15  InnoDB: Starting shutdown...
120226  1:54:20  InnoDB: Shutdown completed; log sequence number 0 44233
120226  1:54:20 [Note] mysqld: Shutdown complete

or

120226  1:59:18 [Note] Plugin 'FEDERATED' is disabled.

mysqld: Can't find file: './mysql/plugin.frm' (errno: 13)

120226  1:59:18 [ERROR] Can't open the mysql.plugin table. Please run mysql_upgrade to create it.

120226  1:59:18  InnoDB: Initializing buffer pool, size = 8.0M

120226  1:59:18  InnoDB: Completed initialization of buffer pool

120226  1:59:18  InnoDB: Started; log sequence number 0 44233

120226  1:59:18 [ERROR] mysqld: Can't find file: './mysql/host.frm' (errno: 13)

120226  1:59:18 [ERROR] Fatal error: Can't open and lock privilege tables: Can't find file: './mysql/host.frm' (errno: 13)

You need to check the file permissions.

The user and group is mysql:mysql

File permissions are rw for user and group (660)

Solution

chown mysql:mysql -R /var/lib/mysql

chmod 660 -R /var/lib/mysql

Linux/Ubuntu :: pure-ftpd does not allow login to user with /usr/sbin/nologin shell

Expectations:
You have created a user with /usr/sbin/nologin shell (ftp-only user) in Linux/Ubuntu.
If you SSH to the box with this username and password it should not work.
If you FTP to the box with this username and password it should.

Symptoms:
Pure-ftpd does not permit login if the shell is set to /bin/false or /usr/sbin/nologin.
If you change the shell to /bin/bash it works.


Connected to localhost.
220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
220-You are user number 2 of 50 allowed.
220-Local time is now 17:53. Server port: 21.
220-This is a private system - No anonymous login
220-IPv6 connections are also welcome on this server.
220 You will be disconnected after 15 minutes of inactivity.
Name (localhost:root): ftponly
331 User ftponly OK. Password required
Password:
530 Login authentication failed
Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.

Solution:

You need to add the nologin or false shell to the file /etc/shells.

root@box:/# cat /etc/shells

# /etc/shells: valid login shells

/bin/csh

/bin/sh

/usr/bin/es

/usr/bin/ksh

/bin/ksh

/usr/bin/rc

/usr/bin/tcsh

/bin/tcsh

/usr/bin/esh

/bin/dash

/bin/bash

/bin/rbash

/usr/bin/screen

/bin/false

/usr/sbin/nologin

Configuring repcached service on Debian/Ubuntu

Repcached is a slightly modified version of memcached, that supports replication of data between two repcached nodes.

Let's say you've read all about these two and you know the benefits of replication and why this article could be useful to you.

One example of why replicated memcache could be useful are replicated PHP sessions between servers.

If you want to configure that PHP sessions are stored in memcache's memory, you need to edit these settings in /etc/php5/apache2/php.ini:

session.save_handler = memcache
session.save_path = "tcp://IP_OF_REPCACHE_1:11311, tcp://IP_OF_REPCACHE_2:11311"

and these optional settings in /etc/php5/apache2/conf.d /memcache.ini:

memcache.maxratio=0
memcache.allow_failover=1

memcache.allow_failover setting is used if one of the servers becomes unreachable, so there is an automatic failover.
Read more about configuring PHP sessions in memcached here.

Now, let's set up repcached to start on boot and System V init scripts, so you can easly start and stop the daemon with the service command.

Steps described here imitate memcached's default configuration in great detail, so you shoud set up memcached before repcached.

sudo apt-get install memcached

Obtain, configure, compile and install repcached. There is a dependancy with libevent-dev for repcached.

sudo apt-get install libevent-dev
tar xvf memcached-1.2.8-repcached-2.2.tar 
cd memcached-1.2.8-repcached-2.2/
./configure --enable-replication
make
make install

(Read this if it won't compile)

At this point you have two installations of memcached. Default memcached that came from apt packages, which is installed in /usr/bin/memcached and repcached, that installed itself in /usr/local/bin/memcached, leaving the original memcached intact.

Now that we have both versions installed, we can copy memcached's default settings and init script and modify them to use repcached. This way you can quickly switch between versions. I would even recommend using default ports (just remember to firewall them!) Arguments are saved in /etc/memcached.conf, so we will create /etc/repcached.conf

See example here.

Note that the only differences with memcached.conf is the name (repcached) and two extra arguments: -x for the server IP and -X for replication port.

Memcached has an enable/disable config in /etc/default so you can quickly switch between daemons or disable them. We will copy this as well.

cp /etc/default/memcached /etc/default/repcached
vi /etc/default/repcached

Change the line to: ENABLE_REPCACHED=yes, and then edit /etc/default/memcached

vi /etc/default/memcached

and disable it, by changing the line to ENABLE_MEMCACHED=no.

Now let's move on to init scripts.

cd /etc/init.d
cp memcached repcached

Edit the file /etc/init.d/repcached.

Here is my example.

Again, we didn't change much, mostly changed from memcached to repcached, but note that the actual start-up of the service happens in this file: /usr/share/memcached/scripts/start-repcached which doesn't exist yet, so we will copy and edit it.

cp /usr/share/memcached/scripts/start-memcached /usr/share/memcached/scripts/start-repcached

File contents or /usr/share/memcached/scripts/start-repcached

Setting up repcached to start at boot

We need to be sure that /etc/init.d/repcached is executable. If you copied it from memcached, everything should be OK, but if init's not recognising the repcached service, you need to chmod +x /etc/init.d/repcached

After you've run update-rc.d command in the terminal it will create shortcuts in rc?.d files which are read at boot.

update-rc.d repcached defaults

For more information on update-rc.d, click here.

You have successfully configured repcached as a service and to start on boot.

To start/stop repcached use

service repcached start
service repcached stop

Try to run repcached by hand at first with the configuration you provided in /etc/repcached.conf.
In my example it's this:
/usr/local/bin/memcached -m 64 -p 11211 -u memcache -X 11212 -x 22.163.130.33

After installing repcached on another machine I've found out that the default user for memcached is nobody, not memcache, so please always check the differences from the default memcache config with the repcached config you've modified or copied from here.