blog.aryps.com – Page 12 – Just another site

XRDP on SUSE12 issue – solved

I have installed XRDP on SLES12 but the systemd does not start this service as xrdp.service service file is missing. I know that it could be started by typing: /etc/xrdp/xrdp.sh start but I want it to be started after the reboot.

Create a systemd service file:

sles15:~ # vim /usr/lib/systemd/system/xrdp.service

[Unit] Description=xrdp daemon After=syslog.target network.target


[Service]

Type=forking

ExecStart=/etc/xrdp/xrdp.sh start

ExecStop=/etc/xrdp/xrdp.sh stop

[Install] WantedBy=multi-user.target

and then a symlink:

sles15:~ # ln -s /usr/lib/systemd/system/xrdp.service /etc/systemd/system/xrdp.service

now turn the XRDP service on, for start at next boot.

sles15:~ # systemctl enable xrdp sles15:~ # systemctl is-enabled xrdp

So, the XRDP will be started after the reboot 😉 And now another problem occurred, we connected to XRDP on SUSE12 and got a black screen 😛
To fix this issue you need to switch to icewm and at lest get a screen 😉 Just edit /etc/xrdp/startwm.sh and pretend the list of Session with “icewm”.

sles15:~ # vim /etc/xrdp/startwm.sh --cut #SESSIONS="gnome-session blackbox fluxbox startxfce4 startkde xterm" SESSIONS="icewm" --cut

I am a bit surprised that a package like XRDP made it into SLES in such a broken state. Well, have to wait for SP1.

Address masquerading in Postfix.

Address masquerading refers to the idea that you can hide the names of internal hosts, and make all addresses appear as if they originated from the gateway system itself. You may have internal systems that use your Postfix server as a gateway. When mail is sent from these systems and the sender addresses include the fully qualified hostname, you may want addresses to appear with the domain name only. The masquerade_domains parameter strips hostnames down to their simpler domain names.

The parameter takes a list of domains. Any address whose fully qualified hostname matches the domain portion is stripped down to just the domain name:

root# vim /etc/postfix/main.cf

masquerade_domains = domain.com

Addresses that look like user1@srv1.domain.com and user2@srv2.domain.com are converted to user1@domain.com and user2@example.com.

You can list multiple domains and subdomains. Postfix processes addresses against masquerade domain names in the order you list them. Consider a network that includes the two subdomains, acct.example.com and hr.example.com. You want addresses from these domains to show the subdomain, but you want addresses from any other domain or host in the network to show the parent domain. Set masquerade_domains as follows:

masquerade_domains = srv.domain.com srv1.domain.com domian.com

With this setting, the address user1@hades.srv.domain.com matches srv.domain.com, so that it becomes user1@srv.domain.com.
The address user2@prod.srv1.domain.com matches srv1.domain.com, and becomes user2@srv1.domain.com. Finally, user3@srv1.domain.com matches the last value, domain.com, to become user3@domain.com.

If you want to preserve a domain name that would otherwise be stripped down, you can preface the domain with an exclamation point:

masquerade_domains = !srv2.domain.com, domain.com

In this case, the domain srv2.domain.com will not be rewritten, so the address user10@srv2.domain.com stays as it is.

You can exclude specific account names from masquerading. For example, if you want an address like root@srv10_prod.example.com to stay intact, add the account to the masquerade_exceptions parameter:

masquerade_exceptions = admin, root

And then:

root# /etc/init.d/./postfix restart

Rewriting Addresses – Postfix canonical maps.

Postfix canonical maps can be defined in 3 ways.

1. canonical_maps – rewrites the sender and recipient address
2. sender_canonical_maps – rewrites the sender address
3. recipient_canonical_maps – rewrites the recipient address

In main.cf, point the canonical_maps parameter to the canonical file and then add addresses that you would like to rewrite.
For Example:

root# vim /etc/postfix/main.cf # Add the following to your configuration file. canonical_maps = hash:/etc/postfix/canonical

root# vim /etc/postfix/canonical # address that would like to rewrite new address user1 greg user2@domain.com greg@otherdomian.com

root# postmap canonical && postfix reload

OpenVPN in OpenVZ/VServer

# Allow OpenVPN iptables -A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT iptables -A FORWARD -s 192.168.88.0/24 -j ACCEPT iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT # iptables -t nat -A POSTROUTING -s 192.168.88.0/24 -o venet0:0 -j MASQUERADE # in OpenVZ/VServers you may need the following instead the lane above iptables -t nat -A POSTROUTING -s 192.168.88.0/24 -j SNAT --to-source 198.50.149.196

Exporting and NSS Volumes for NFS Access – OES11 to Linux.

Let say that you have OES11 machine with NSS volume and you would like to export this volume to Linux machine for sharing data.
To exporting and NSS Volume from an OES11 machine to a Linux machine, add the following to /etc/export on OES11 machine:

root# cat /etc/export /media/nss/DATA/Shared/XXHR/BNMDEV1 Linux(fsid=1,rw,no_root_squash,sync,anonuid=1000,all_squash) root#

To mount NSS volume from an OES11 machine into a Linux machine, add the following to /etc/fstab on Linux machine:

root# cat /etc/fstab oes11:/media/nss/DATA/Shared/XXHR/BNMDEV1 /share/Shared/XXHR/BNMDEV1 nfs defaults 0 0 root#

to verity that everything is okay type mount command on a Linux machine, and you should see something like this:

root# mount OES11:/media/nss/DATA/Shared/XXHR/BNMDEV1 on /share/Shared/XXHR/BNMDEV1 type nfs (rw,addr=172.16.12.12)

What is the maximum length of a valid email address?

That limit is a maximum of 64 characters (octets) in the “local part” (before the “@”) and a maximum of 255 characters (octets) in the domain part (after the “@”) for a total length of 320 characters. Systems that handle email should be prepared to process addresses which are that long, even though they are rarely encountered.

For more information see: https://www.rfc-editor.org/rfc/rfc3696.txt

authz_core:error – client denied by server configuration: /var/lib/roundcube/

From logs:

[Tue May 05 10:01:46.317409 2015] [authz_core:error] [pid 5837] [client 109.70.215.137:32407] AH01630: client denied by server configuration: /var/lib/roundcube/

From browser:

Forbidden
You don’t have permission to access / on this server.

To enable roundcube on Debian 8 after an upgrade add the following “Require all granted” to a virtual host configuration file:

<Directory /var/lib/roundcube/> Options +FollowSymLinks AllowOverride All Order allow,deny Allow from all Require all granted </Directory>

Continue reading “authz_core:error – client denied by server configuration: /var/lib/roundcube/”

Starting NFS client services: sm-notify idmapd – hangs on SUSE and OES11.

The system is responding to a keyboard, but the booting process does not go forward.
Only ctrl+alt+del is working fine. To make it work I had to reboot with runlevel 1 and delete this one:
/etc/init.d/rc5.d/S04nfs.
After that system is booting without problem.

OpenVPN and OpenVZ tun issue.

After the upgrade Debian 7 to Debian 8 on OpenVZ platform on OVH the OpenVPN service stopped working. The problem was that the “TUN” device was missing, so the command below will temporary fix this problem.

root# mkdir -p /dev/net root# mknod /dev/net/tun c 10 200 root# chmod 600 /dev/net/tun

Also you can add this to a script at start up.

Troubleshooting and debugging syslog-ng.

Sometimes, syslog-ng seems to be working wrong, it does not send logs, or it does not start or in an extreme case it crashes.
Is it a real syslog-ng bug or not?

First of all, syslog-ng has a lot of parameters for debugging:

root# syslog-ng –help-all

-F, –foreground Do not go into the background after initialization -v, –verbose Be a bit more verbose -d, –debug Enable debug messages -t, –trace Enable trace messages -e, –stderr Log messages to stderr -s, --syntax-only Only read and parse config file

For example:

root# syslog-ng -F WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please update your configuration; Error resolving reference; content='source', name='_src', location='/etc/syslog-ng/conf.d/iptables.conf:3:7' root#

cat /etc/syslog-ng/conf.d/iptables.conf destination iptables { file("/var/log/iptables.log" owner("user") group("adm") perm(0644)); }; filter iptables { facility(kern) and match("IN=") and match("OUT="); }; log { source(_src); filter(iptables); destination(iptables); };

So what is missing? ‘s’ in name=’_src’ The syntax should look like this:

cat /etc/syslog-ng/conf.d/iptables.conf destination iptables { file("/var/log/iptables.log" owner("aryps") group("adm") perm(0644)); }; filter iptables { facility(kern) and match("IN=") and match("OUT="); }; log { source(s_src); filter(iptables); destination(iptables); };

Worth to add the following and not filter(iptables) to filter f_kern and filter f_messages so the filters will look like this:

cat /etc/syslog-ng/syslog-ng.conf ... filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news) and not filter(iptables); }; filter f_kern { facility(kern) and not filter(f_debug) and not filter(iptables); }; ...