wehuberconsultingllc.com » Linux

Adventures with iRedMail – Part III

Bill — Sun, 11 Jul 2010 14:10:46 +0000

Recently I installed iRedmail at work so that we could include DKIM signatures in our newsletters. Every week we send out a newsletter to 96,000 former customers. It takes about 13 hours to send the newsletter. Yahoo is probably our most important email domain and they want us to implement DKIM. A couple of weeks ago we started seeing Yahoo limit our sending rate. Obviously they had a problem with something in our newsletter. So we re-analyzed the error codes we were getting during the newsletter mailing and implemented DKIM. The problem is fixed. Here is how I implemented this version of iRedMail.

I implemented a VMware version of iRedMail to sign newsletter emails using DKIM. I used Ubuntu 9 server version(optimized for VMware version) to build appliance.

The server works as a mail proxy in front of the SMTP server we use exclusively for the newsletter. It signs and relays the email to the existing SMTP server. I kept the existing SMTP server so that I could continue to use my existing procedures for parsing the log files to identify old/obsolete mailboxes.
I created iRedMail users in LDAP to relay local users to mailboxes on Exchange.
My primary bottleneck is still my mail transmission to the Internet speed, 2 per second. I can create newsletter emails at about 8 per second.
On an old Proliant DL350 G4 iRedMail consumes about 40% of the dual CPU computer for four hours.

Since I had experience installing iRedMail it went quickly. The biggest bug I had to fix was the AWStats/permissions problem on the mail.log file.

Cleaning up an existing newsletter mailing list In December 2008 I was asked to clean up some...
Notes on Installing the Network Monitoring Appliance A couple of weeks ago I installed the Network Monitoring...
Updated Script for emailing ntbackup log files Jason left a comment on a previous post about wanting...

Related posts brought to you by Yet Another Related Posts Plugin.

Importing Self-signed CA Certificate into Windows 7

Bill — Sun, 18 Apr 2010 19:21:40 +0000

Yesterday I opted to create self-signed certificates for my local servers. Most of my local servers already had self-signed certificates with default names so it looked like a simple task. I found this document, Creating Certificate Authorities and self-signed SSL certificates, and in a few minutes I created a new Certificate Authority and replaced my existing server certificate. I checked the site via my web browser and it complained about needing the Certificate Authority certificate. So I copied the CA certificate to my PC and imported it into the Trusted Root Certification Authorities using IE8. Despite a message saying it succeeded, it really didn’t import the certificate. I re-started the browser and re-started the computer but the certificate refused to show up. I finally opted to login as the Administrator and install the certificate to the Trusted Root Certification Authorities of the computer account. I suspect that the key requirement is to import into the computer account. For those unfamiliar with the process you open a command window and run “mmc”. Next you click File-Add Snapin and add the Certificates Snap-in. When you add the plug-in it will prompt you to select which account you want to update. Select the computer account, the local system, and click to add the Snapin. Now navigate to Trusted Root Certification Authorities and import the CA certificate.

Event ID 7024 on SBS 2003 computer If you get “The Certificate Service terminated with service-specific error...

Related posts brought to you by Yet Another Related Posts Plugin.

Add a partition to Openfiler

Bill — Sat, 27 Mar 2010 15:49:23 +0000

I keep suffering from memory loss when it comes to using Openfiler. I use it so infrequently I keep forgetting how to add a partition to Openfiler. The user interface is not very intuitive so I keep recreating my steps. So I am posting this procedure as a reminder.

Click on the link, Volumes (https://filer:446/admin/volumes.html), in the navigation menu at the top of the page.
Click on the link, Block Devices (https://filer:446/admin/volumes_physical.html), in the navigation menu on the right side of the page.
To add a partition to the device, /dev/sda, click on the link, /dev/sda, under Edit Disk column.
At the bottom of the next page, Volumes : Block Devices : Edit Partitions, enter the data for the partition and click on the Create button.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

How To Set Up A Terminal Server In Linux Using Ubuntu 9.10 And FreeNX

Bill — Thu, 28 Jan 2010 13:16:23 +0000

This article was timely. I had just installed virtual version of Ubuntu on my ESXi server and set up VNC so I could access it. It was okay but FreeNX is a more elegant solution. The combination of FreeNX and Firehol to setup the firewall makes it a winner in my book.

How To Set Up A Terminal Server In Linux Using Ubuntu 9.10 And FreeNX

FreeNX is an open source implementation of NoMachine’s NX Server. It is a bit more akin to Microsoft’s RDP protocol that the usual VNC, so while keeping bandwidth to a minimum, it maintains good visual quality and responsiveness.

How To Set Up A Terminal Server In Linux Using Ubuntu 9.10 And FreeNX
(author unknown)
Mon, 25 Jan 2010 16:42:09 GMT

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Notes on Installing the Network Monitoring Appliance

Bill — Sun, 29 Nov 2009 16:08:53 +0000

A couple of weeks ago I installed the Network Monitoring Appliance using the tutorial on HowToForge.com. Prior to installing the Network Monitoring Appliance I was planning to give the latest community version of GroundWork Monitor, http://www.groundworkopensource.com/products/community-edition/index.html another trial. My network monitoring objectives were to have the Network Monitoring appliance notify me of problems on a remote web server and on my local network. Although these network monitoring objectives can be accomplished by a ping or a “HTTP ping”, I wanted to see a some network throughput graphs and I expected to eventually need a slightly more sophisticated data base monitoring in the near future. Nagios was at the core of the best solution for me since accomplished most of my needs and I was already familiar with Nagios from a previous trial of Groundwork Monitor. The primary attraction of the Network Monitoring Appliance over Groundwork was its much smaller resource requirements. In my environment it would be sharing a VMware ESXi server. I was also pleased to see that the Network Appliance used Jeos. For those unfamiliar with Jeos it is:

Ubuntu Server Edition JeOS (pronounced "Juice") is an efficient variant of our server operating system, configured specifically for virtual appliances.

Users deploying virtual appliances built on top of JeOS will benefit from:

better performance on the same hardware compared to a full non-optimized OS
smaller footprint of the virtual appliance on their valuable disk space
fewer updates and therefore less maintenance than a full server installation

For my installation I decided to use VMware’s 32-bit Ubuntu template to create the virtual machine. The only modification to the template was to adjust the disk drive size down from 8 GB to 1 GB. As described in HowToForge tutorial I installed the following programs.

Ubuntu 8.04.3 JeOS as OS
Nagios 2.11 for monitoring and alarming
Smokeping 2.3 to observe latencies and packet loss
MRTG 2.14.7 to observe network traffic’s tendencies
RRDTool 1.2.19 as the Round-Robin Database for storing all measurement data
Lighttpd 1.4.19 as a fast, lightweight web server frontend
Weathermap4rrd for illustrating the network weather
sSMTP as extremely lightweight MTA for mail delivery

The installation was quick. Almost all of my challenges was in configuring the programs. Fortunately I had previous experience configuring the most difficult to configure programs, Nagios and MRTG. It helps if you have a basic knowledge of PERL since most of programs use it. Here are my installation notes.

One of the first things I needed to install to make this installation go smoother was an editor other than VIM so I could cut-and-paste from the tutorial to my SSH session. In my case I installed nano.
The first application I configured was smokeping. The configuraton file is pretty easy to figure out and can be found at /etc/smokeping/config. If everything works you will see a nice graph of the the ping statistics at http://yourip/cgi-bin/smokeping.cgi.
Configuring Nagios is a bit more complicated. Since this is version 2 of Nagios, the configuration files are located at /etc/nagios2/conf.d. The main Nagios web page is at http://yourip/nagios2/. The Nagios QuickStart Document, http://nagios.sourceforge.net/docs/3_0/quickstart.html, is a good primer for the folks not familiar with Nagios.
The Debian logo did not appear in Nagios next to the localhost. It showed a missing image. After a little research I figured out that I needed to install nagios-images using apt-get install nagios-images.
For some reason I did not seem to have cron installed and running. This is easily solved by apt-get install cron.
MRTG is useful if you have a SNMP router to poll. I used my pfSense Firewall as the SNMP source. MRTG provides some nice graphs of network traffic and its page is located at http://yourip/cgi-bin/mrtg-rrd.cgi/
Configuring Weathermap4rrd is a little challenging since the documentation is sparse. Weathermap4rrd provides a clever network status graph once you figure how to configure it. It uses the same data as MRTG to create its graph. The network status page for weathermap4rrd is located at http://yourip/weathermap4rrd/weathermap.png
I installed apticron to nag me via email about installing security updates and Logwatch to find any problems posted in the log file by the installed programs.
If you plan on getting emails from Nagios when a host is down, you should test it. Duh! The easiest way to test it is to deliberately mistype the host name. If you do not get the email, you should check your Nagios configuration, sSMTP configuration, and the SMTP log file.
sSMTP is easy to configure and use. In the simplest configuration you point it at the SMTP server you are sending your emails to. If you are sending emails to more than one domain, you need to connect to a SMTP server that will relay emails for you.
I installed PHP version 5 to see how hard it would be to install under Lighttpd. I followed the instructions on the Lighttpd wiki and PHP appears to be running without problems. Most of these network monitoring programs have newer versions in PHP. Some day in the future I plan to migrate to the PHP versions of Nagios and weathermap but it is not necessary for this small network.
I created a simple navigational menu on the main page with links to the various network management status pages. It is much easier to use this menu then remembering the addresses of the different status pages.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Adventures with iRedMail – Part II

Bill — Mon, 25 May 2009 01:16:36 +0000

In the first installment of Adventures with iRedMail I got it to send emails but I left the MS Exchange integration for another day. Since then I have updated my DNS zone with the DKIM information, set up local DNS information, decided on naming standards, and reconfigured Postfix several times before I got it right.

Updating the DNS with DKIM information

This task was relatively easy. I copied the DKIM information in the iRedMail.tips into a trouble ticket with my web provider. About 24 hours later it was ready to test. I sent an emails to my Yahoo account, sa-test@sendmail.net, and autorespond+dkim@dk.elandsys.com. Although the email from dk.elandsys.com was the first to respond, it said it did not work. When I checked my Yahoo account the headers said the email was signed correctly with DKIM. Ironically the return email from sendmail.net ended up in my Junk Mail folder. It said that everything worked correctly. For one more test I created a Gmail account and sent an email to it, too. It said the email was signed correctly.

Local DNS, naming standards, and more Postfix problems

The next challenge was to configure Postfix to accept both local email addresses and email addresses for the exchange server under the same domain. I used PostFixAdmin to create Aliases that pointed to the Exchange server emails(e. g. myemail@mybusiness.com points to myemail@mybusiness.local). PostFix complained about the DNS records for my Exchange server so I added mybusiness.local as a relay_domain and set up a psuedo DNS so that PostFix can find the IP address for my Exchange server. In my case I decided to let my pfSense firewall act as a local DNS server to serve up the local IP addresses. At this point I can email to everyone from a local iRedMail account but I cannot get replies until I set up iRedMail as the SMTP gateway and the Exchange server as a relay domain.

PostFix domain checks get me again!

It took me a long time to figure this out. When I changed the firewall to redirect SMTP traffic to the PostFix gateway I could not get any mail. I thought I had messed up the firewall settings so I kept trying different settings. I was pretty limited with my testing tools. If I could Telnet into port 25 I could see what is happening but I could not make the connection work as long as I was located on this side of the firewall. Fortunately I found a solution on the Internet. The dnsqueries.com site provides a page, http://www.dnsqueries.com/en/smtp_test_check.php, that allows me to check my local SMTP connection using their server. Within minutes I figured out that my email server did not like my sender’s domain. In fact it did not like anyone’s domain. This was the same type of problem I had with the Postfix recipient domain check, so I removed the sender domain check and the emails starting flowing.

What have I achieved?

I have a gateway that checks all incoming mail for spam and viruses. Postini offers a similar service for about $1 per user per month. We use MXLogic at work.
I have an alternate email server that allows me to send email that passes the SPF and DKIM checks. One of the reasons I investigated iRedMail was to use it for sending out a newsletter at work. Like many Internet retailers we get a chunk of our business as a result of our biweekly newsletter. In our case DKIM is another piece of the puzzle to improve our sender reputation. Since both Yahoo and Gmail require DKIM signing in order to set up feedback loops, DKIM is probably essential if you have ambitions of having a pristine email list. For those folks looking at ways to cut the umbilical cord to Microsoft this is one of several low cost, low maintenance migration alternatives to a local Exchange server.

Cleaning up an existing newsletter mailing list In December 2008 I was asked to clean up some...
Importing Self-signed CA Certificate into Windows 7 Yesterday I opted to create self-signed certificates for my local...
Notes on Installing the Network Monitoring Appliance A couple of weeks ago I installed the Network Monitoring...

Related posts brought to you by Yet Another Related Posts Plugin.

Adventures with iRedMail

Bill — Sun, 17 May 2009 21:51:13 +0000

I read this article on HowtoForge and decided to give it a try. I was not as successful as the author.

iRedMail: Full-Featured Mail Server With LDAP, Postfix, RoundCube, Dovecot, ClamAV, DKIM, SPF On CentOS 5.x Debian (Lenny) 5.0.1

iRedMail is a shell script that lets you quickly deploy a full-featured mail solution in less than 2 minutes on CentOS 5.x and Debian (Lenny) 5.0.1 (it supports both i386 and x86_64).

iRedMail: Build A Full-Featured Mail Server With LDAP, Postfix, RoundCube, Dovecot, ClamAV,SpamAssassin, DKIM, SPF On CentOS 5.x | HowtoForge – Linux Howtos and Tutorials

My first try was to use the script to update a Centos 5.3 workstation installation. It went smoothly until I tried to update look at the keys used by DKIM. I ran into trouble with the LDAP option. OpenLDAP would not install do to a missing file. So I took the Mysql option. That was when I found a series or problems. Most of the problems were minor. My initial mail userid used Chinese. Since I was particularly interested in DKIM I was disappointed to find out that Amavisd was running at a version that did not support DKIM. I quickly realized that this was taking too much time and a better solution was to install a virtual machine using the iRedOS. This is a Centos 5 installation with all of the prerequisites already installed.

Creating a virtual machine mail server went pretty smoothly. The only problem I found with the installation was that I was unable to send mail. I quickly realized that I needed to install Webmin so I could perform normal system maintenance and troubleshoot. After I installed Webmin I found my problem. Postfix thought Yahoo was an unknown domain. Although I am not familiar with intricacies of Postfix I found that if I removed the configuration parameter “reject_unknown_recipient_domain” I could send emails successfully. This is a not a fix but it will work for me until I figure out the problem between the DNS and Postfix.

My next trick is to set up the mail server as a mail relay to my Exchange server. Technically this could be a first step in migrating off of Exchange to a non-Microsoft cloud computing environment. There are a lot of good things to be said about Exchange but there are even more good things to say about cloud-based email. Making the transition to a low cost, highly dependable, feature rich email environment with the least amount of pain is the challenge for both the Microsoft and open source communities.

Cleaning up an existing newsletter mailing list In December 2008 I was asked to clean up some...
Notes on Installing the Network Monitoring Appliance A couple of weeks ago I installed the Network Monitoring...

Related posts brought to you by Yet Another Related Posts Plugin.

Nimble Method: Garbage Collection is Why Ruby on Rails is Slow: Patches to Improve Performance 5x; Memory Profiling

Bill — Sat, 02 Feb 2008 14:09:43 +0000

The News: Ruby on Rails performance is dominated by garbage collection. We present a set of patches to greatly improve Rails performance and show how to profile memory usage to get further performance gains.

What’s at Stake: Rails is slow for many uses and did not lend itself well to optimization. Significant performance gains could only be achieved at application level at large development cost.

The Upside:

5x potential performance gains;

easy way to identify whether GC is a bottleneck;

deterministic process to fix memory bottlenecks;

set of canned patches to solve the biggest problems;

you can help

Nimble Method: Garbage Collection is Why Ruby on Rails is Slow: Patches to Improve Performance 5x; Memory Profiling
arunthampi
Sat, 02 Feb 2008 05:30:00 GMT

Okay, a couple of weeks ago I installed Ruby so that I could run Metasploit. Installing Ruby was a challenge since I needed to install several dependencies so that I could install RubyGems. Fortunately Simon had the answer. When I cranked up the GUI version of Metasploit, the GUI seemed slow and the console messages showed Ruby to be busier than I thought it should be. I hadn’t asked it do anything yet. Maybe this will help! Then again maybe if I upgrade to the latest version of Metasploit(3.1) will help.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

KeePassX – The Official KeePassX Homepage

Bill — Sat, 02 Feb 2008 13:47:44 +0000

KeePassX – The Official KeePassX Homepage

KeePassX saves many different information e.g. user names, passwords, urls, attachmets and comments in one single database.

Yesterday I got around to installing KeePassX on my Centos server. The rpm version worked fine but I had to manually create a menu item. For fun I downloaded the new versions of the KeePassX icon. For a very brief time I thought about compiling KeePassX from source code but it looks like I will have to do a lot of work. It uses the QT library and Qmake. I would prefer if I could set it up in Eclipse but that looks complicated.

KeePassX is a port of KeePass and it read the KeePass database on my USB stick without a problem. It maintains the same look and feel as the original program so that is a big advantage on the learning curve for me. KeePassX has everything I use except for the global auto-type hot key and the plugins.

Quick Takes: python(x,y) – Python for Scientists Python(x,y) is a free scientific and engineering development software...

Related posts brought to you by Yet Another Related Posts Plugin.

Linux Tip: Replacing GKSUDO for CENTOS users

Bill — Sun, 20 Jan 2008 15:26:11 +0000

One of the annoying things about maintaining CENTOS installations is performing system maintenance as the super user from the command line. Don’t get me wrong but I was programming before graphical interfaces(BGI). The command line is a good and trusty way to perform maintenance. As long as everything works you can get by with a minimum of memorization. Since most of us live in an after graphical interfaces(AGI) world and we do not practice our Linux command line knowledge on a daily basis, we quickly get rusty on the tricks of the trade and yearn for an easier way. Something with a fast learning curve. This is precisely why we have graphical interfaces.

For reasons I did not understand until today CENTOS does not make it easy to run graphical programs as the super user, such as nautilius and gedit. Ubuntu offers a fairly simple way to create menu items to start graphical programs as a super user, gksudo. CENTOS does not offer this utility in either Version 4 or 5. A similar utility, kdesu, was offered in CENTOS Version 4 but is not offered in CENTOS 5. Opening a terminal window and running SUDO is an pretty clumsy option so I was pretty sure that there probably was a better way! I wanted a menu item like the other system maintenance menu items that would authenticate me before running an application as a super user.

Today I found the answer. Matt Hansen wrote a tip how to “How to run a program from GNOME menu with root privileges ” back in 2004. The tip uses a utility called consolehelper. You have to create a couple of configuration files but the whole process can be completed in about five minutes. It is interesting that today was the first time I found a reference that claims consolehelper is the “proper” way to solve the “missing” gksudo problem.

Quick Takes: python(x,y) – Python for Scientists Python(x,y) is a free scientific and engineering development software...

Related posts brought to you by Yet Another Related Posts Plugin.