Thursday, January 28, 2010

Splitting a File into Smaller Pieces

On occasion, there will be a need to split a file up into smaller pieces for easier transportation. Be it email, FTP, CD's, or any other method. Here's how to do it with the split command.


$ split -b 1024m large_file.tbz chunk-



This will produce the following files:


-rwxr--r-- 1 owner group 1073741824 Jan 28 19:00 chunk-aa
-rwxr--r-- 1 owner group 134987776 Jan 28 19:00 chunk-ab


And to assemble them back into one piece, it's just as easy:


$ cat chunk-* >> large_file.tbz


--DRH

Wednesday, September 30, 2009

Putty + Vi + 10 Key = Trouble

So here's my situation. And don't lynch me for this one either. I just recently learned how to use VI. Shocking, isn't it? I never had time to learn it, as system administration was only a part of my job description. even though I'm the only sys admin on site. Nano was my choice of editing text files as I didn't need anything elegant for a quick modification of a conf file.

I chose to learn vi so I could develop websites on a terminal without firing up a VNC session - and wasting screen real estate in the process. Vi with syntax highlighting just can't be beat. A quick trip through vimtutor, a couple of Googles for setting up my .vimrc file, and I'm in business. But, I digress.

The Problem

When on a Windows computer, I use Putty to access my Linux computer. The number pad works just fine on the command line. It was only when I started using Vi that I noticed when you attempt to use the keypad, Vi interprets them as a different series of keystrokes. Not being able to use the 10-key is a big problem in my book.

The Solution

So, here's the solution. In Putty settings, go to Terminal - Features. Check the Disable application keypad mode and apply the setting. The 10-key in Vi now works as expected!

My .vimrc file

For those that are interested, these are my basic Vi settings.

~/.vimrc

hi Comment   ctermfg=darkcyan
set ruler
set showcmd
set tabstop=4
set linebreak


Enjoy!

-- DRH

Thursday, August 6, 2009

Use RSA Keypairs with SSH

Introduction

SSH is program that allows for secure remote access to another computer. All traffic through the SSH connection is encrypted. That's great! It's an excellent replacement for Telnet, which is insecure, and shouldn't be used anymore. But logging in is still susceptible to brute force attacks.

However if one uses RSA keypairs, an attacker would have to have the private key in order to login to your system, even if they had the right password. It is also possible to have keypairs for passwordless authentication; however that is better suited for automated tasks (bash scripts) that are executed via cron. And y0u really have to safegaurd those keys!

I'll show you how to use RSA keypairs with OpenSSH. I will assume that you already have OpenSSH Server installed, configured, and are able to login remotely with SSH using the standard authentication method. I'm doing this on OpenSUSE 11.1, so things may be different on your distro or version of SSH. So let's get going!

Generate Keypairs

On your Linux computer (server or client), enter this at the command prompt (as your user)
  • ssh-keygen -t rsa
The response

user@linux-ftim:~> ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa):

The default should be fine, so just press Enter

And now we're asked for a passphrase. Enter and confirm your password. You could choose not to enter a password, but again, unless you're running automated scripts or have a specific reason to, it's not a good idea to do that.

The response
user@linux-ftim:~> ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa):
Created directory '/home/user/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key fingerprint is:
7f:1b:12:15:15:7f:ce:f0:83:fa:87:a5:36:77:d8:76 user@linux-ftim
The key's randomart image is:
+--[ RSA 2048]----+
| ..o. |
| . . |
| . . o|
| . .=.|
| S . . .+|
| . .. ..|
| o.o +o |
| o.B.oE|
| o.+.o|
+-----------------+
user@linux-ftim:~>


Now we have a public key (~/.ssh/id_rsa.pub) and a private key (~/.ssh/id_rsa). The public key is what will be installed on the SSH server. The private key is the key that you take with you and use on the computer you will be loggin in from.

Configure the Client

Edit the /etc/ssh/ssh_config file. This controls how ssh is employed from the command line. Make sure the following lines exist, and are uncommented:

/etc/ssh/ssh_config
IdentityFile ~/.ssh/id_rsa
Protocol 2

Configuring the Server

This will control the SSH server daemon

/etc/ssh/sshd_config
Protocol 2
PubkeyAuthentication yes



Using the Keypair

Take the public key (id_rsa.pub) and copy it into the ~/.ssh directory on the server computer. You'll have to add the new key to a file called authorized_keys.
  • cat id_rsa.pub >> ~/.ssh/authorized_keys"
  • chmod 600 ~/.ssh/authorized_keys
Now take the private key file id_rsa and put that into ~/.ssh on the client computer. Also change the permissions to 600, just like the authorized_keys file. At this point, you should be able to ssh into your server, using the keypair. If everything went correctly, instead of being asked for a password, you should be asked for a passphrase. If you chose to not use a password for the keypair, you'll already be logged in!

Using Putty on Windows

You can also generate RSA keypairs using Putty on Windows. However, I'm imagining that using Putty on Windows will be an afterthought after several servers and/or client computers will already be configured with existing keypairs. That's how we're going to proceed here.

Getting Putty

Go to either http://www.putty.org, or directly to the download page. The version I'm using is 0.60, which is the lastest as of this writing. Install it per the installation guidelines. I used putty-0.60-installer.exe, but you can also download individual components. You'll need putty.exe, and puttygen.exe.

Copy your private key, id_rsa, to the Windows computer.


Open PuTTYgen. Select "Conversions" from the menubar, and click on "Import key".


Select your id_rsa key and click open.


Enter your passphrase for the key, and click OK



Now we're ready to work with the key. Putty stores keys in its own format, for whatever reason. But hey, we can work with that!


Now click on "Save private key", and give your key a name. Now you can close the key generator.


Now, open PuTTY. Enter the hostname or IP address of the computer you want to connect to.


On the left side, under Connection, expand SSH and click on Auth. Under Private key file for authentication, enter the path to the PPK file, or click on Browse and select it. If you c,lick Open, you'll continue to connect. Or if you go back to Session, you can save the configuration and use it later. This is particularly handy if you manage several servers with different keys, different SSH ports, etc.


You will get the security alert, saying that you haven't connected to this computer befire. Click on yes to contine.


Enter your username. You should get a prompt telling you that you're using a public to to authenticate, and asking for a passphrase, not a password. Enter your passphrase, and you're in!!

-- DRH

Wednesday, July 29, 2009

The Perfect CentOS 5 and Zimbra 5 Server

Introduction

This guide will show you how to install a Linux email server. After completion, you'll have the following capabilities:
  • Retrieve email from a remote POP account and deliver it to a local user
  • Access your email locally, through webmail or an email client
  • Access your email remotely, through webmail, while on the road (if you choose to)
The environment that this server will integrate into is as follows:
  • Website hosted by an outside service
  • POP email accounts hosted by the same outside service
  • High-speed Internet connection
  • An Internet router/firewall device
Please note that Zimbra does not support installing on CentOS. It does however provide binaries for RHEL, which is what we will be using. CentOS is 100% binary compatible to RHEL. Provided that you do not activate and use anything in the CentOS Plus repository, which potentially breaks the 100% compatiblily claim. This is because the CentOS Plus repo upgrades several components in the Base repo.

Because this server is geared towards a small (and possibly medium) sized business, I do not want that business to host the website and the email. Why? The website for a business has to be up 24/7/365 with 99.99% uptime. A small business (in my opinion) can neither afford the infrastructure to maintain such a system, nor can they afford to hire talented personnel to maintain it. And even with all that hardware and expertise, all it takes is a power failure to last longer than your battery backups, and you're down.

For this tutorial, we're going on the assumption that your company is called Example. Your website is called Example.com. And, one of your email addresses is sales@example.com. All this is hosted by XYZ company, whose website is xyz.com.

Here's the software we're going to install.
  • CentOS 5 Linux distribution
  • Zimbra Collaboration Suite - Open Source Edition
I've chosen this configuration for two reasons. One, they are both available free of charge. Second, they can both be upgraded to a paid-for version for the purpose of support.

CentOS is a clone of Red Hat Enterprise Linux. Upgrading from CentOS to RHEL is rather smooth, and would be done for the purpose of having paid support. Zimbra offers the Open Source Edition free of charge.

So you can start off by not shelling out one dime to get a working setup for testing and deployment. And, you can upgrade to paid-for support at any time. Now that's sweet!!

Caveat

There is one thing to be aware of with this installation. We have to disable sendmail in order to install Zimbra, as Zimbra has its own MTA. You can remove sendmail, provided that you are not using software RAID. For reason, mdadm is dependant on sendmail.

What You'll Need

The following system requirements were taken from the System Requirements link found on the Zimbra Documentation page.
  • A late model computer (2+ Gigahertz)
  • At least 2 Gigabytes of RAM
  • 10 Gigs of hard drive space for software and install logs
  • Ample storage space for mailboxes and other user data
  • CentOS installation media, downloadable from here
The exact partitioning scheme is up to you. I cannot cover that here. I'm going to use the default partition scheme the CentOS installer uses. So, let's get going!

Installing CentOS

Insert installation media in the CD/DVD drive and boot the computer. Press 'Enter' to boot the system


This screen presents you with the option to test your media. Typically, one should test the ISO image downloaded before you burn it to disk to insure the download didn't get mangled. This check eliminates the possibility of a bad burn. It's highly recommended you do this test, and not skip it.


This screen presents you with the option to test your media. Typically, one should test the ISO image downloaded before you burn it to disk to insure the download didn't get mangled. This check eliminates the possibility of a bad burn. It's highly recommended you do this test, and not skip it.


I love it when this happens! Press OK, and on the next screen press Continue.


This is self-explanatory. Click Next


Select your language.


Select your keyboard


This warning only shows up if you are using a new disk, or a disk without a partition table. Click on Yes.


For this tutorial, I'm going with the default layout. This will give you an LVM setup, with everything thrown in one partition. Click Next. Another window will open warning that all data will be destroyed. Click Yes. (If you choose something different, help yourself!)


Now it's time to configure the network.
  1. Click on Edit under Network Devices.
  2. Click on Manual configuration under Enable IPv4 support
  3. Enter your IP address (192.168.1.2)
  4. Enter your Netmask (255.255.255.0)
  5. Uncheck IPv6 support.
  6. Click OK
  7. Enter server.local.zzz in the hostname area (next to manually)
  8. Enter your Gateway address (probably 192.168.1.1)
  9. Enter your Primary DNS server (probably 192.168.1.1)

Item 7 matches the host.domain.tld convention
Items 8 and 9 should be the address of your router

Click Next


Select your timezone. And select whether your hardware clock uses UTC. If the time on your hardware clock is set to local time, uncheck it.


Select a password for the root account. This is equivalent to Administrator for that 'other' operating system.


Here you can select additional packages. Let's just go with the default of Desktop - Gnome. Click Next.


OK, let her rip! Click Next to install.


OK, now we're done. Let's reboot!


Welcome to the first time boot screen. Just click next


Let's turn off the firewall. Why? Because our router has a firewall on it. And, if we are going to configure a firewall, we'll just use iptables to do it. So change Enabled to Disabled and click Forward. The installer will give you a warning. Just tell it Yes.


SELinux, or Security Enabled Linux adds to the security of Linux. It also adds complexity, and makes debugging your installation more difficult. Should you decide to use it, don't turn it on until after you have a working setup. Set it to Disabled and click Forward. It will warn you that you'll have to reboot. That's OK. It's one of the few times you'll have to do it!


Configure your time.

Add a user. Our username for the tutorial is user.


You can test your sound card, if one is detected. I don't have one, so I'll move past this.


If you have additional CD's with software packages on them, you can install them here. Since we don't, let's click Finish and continue with a reboot (because we changed SELinux).


Let's login.


Yep, it's Gnome. Right click on the desktop, and select Terminal. First off, we need to update the system. Even though the GUI is telling us that there are updates for the system, we'll use the command line to do the update. In the terminal, do the following.
  • su - root
  • Enter your root password
  • yum upgrade -y
If the kernel got updated, you'll need to reboot. If not, just continue.

Install DNS

Now that the updates are done (however long that took), it's time to install the DNS server that Scalix needs. In the same terminal window (login in as root), do
  • yum install -y bind caching-nameserver
Now, we need to do some configuring. Modify the following configuration files, using your favorite text editor.

/etc/hosts -- Edit this file

# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
192.168.1.2 server.local.zzz server


The last line should use your IP address, and your FQDN and hostname.

/etc/resolv.conf -- Edit this file

search local.zzz
nameserver 192.168.1.2


/etc/named.conf -- Create this file

include "/etc/rndc.key";
zone "local.zzz" {
type master;
file "/etc/named.zzz.fwd";
allow-update { key "rndckey"; };
notify yes;
};

zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/named.zzz.rev";
allow-update { key "rndckey"; };
notify yes;
};

options {
forwarders { 192.168.1.1; } ;
};


/etc/named.zzz.fwd -- Create this file

$TTL 14400;
@ 14400 IN SOA zimbra.localhost. root@zimbra. (
2009073001 ; Serial in YYYYMMDDXX - tab indented
28800 ; Refresh
3600 ; Retry
604800 ; Expire
14400 ; Default TTL
)

@ IN NS zimbra.localhost. ;
@ IN A 192.168.1.2
@ IN MX 10 zimbra

zimbra IN A 192.168.1.2



/etc/named.zzz.rev -- Create this file

$TTL 14400;
@ IN SOA zimbra.localhost. root.localhost. (
20090731001 ; Serial
28800 ; Refresh
3600 ; Retry
604800 ; Expire
38400 ; Default TTL
)

IN NS zimbra.localhost. ; tab intented

2 IN PTR zimbra.localhost. ;
2 IN PTR zimbra ;cd /


And, now for security, in a terminal as root, enter
  • chmod 640 /etc/named.zzz*
  • chmod 644 /etc/named.conf
And let's start everything up
  • service named start
  • chkconfig --level 2345 named on
This starts the service, and tells the computer to run named when the computer boots. Specifically, in run levels 2, 3, 4, and 5.

A few things to remember. Be sure to enter your own info in the config files. This is just a sample you can modify for yourself. And, if you modify the forward or reverse zone files, you need to index the serial number. I chose a serial number of year, month, day, version. 2008011501. You can index numbers starting from 1. But with my format, it's easier to tell if you've actually changed the serial number.

Install Zimbra


Now, it's on to install Zimbra. First, we need to install a few packages before we do that. Once again, in a terminal, as root, enter:
  • yum install -y compat-libstdc++-296 compat-libstdc++-33
  • service sendmail stop
  • chkconfig --level 12345 sendmail off
We're ready to install Zimbra. In your terminal window, go to the location where you downloaded Zimbra. If you used Firefox, it should be on the desktop of the user you created during the install (assuming you haven't changed anything). As root, enter:
  • cd /home/user/Desktop
  • tar xvfz zcs-5.0.18_GA_3011.RHEL5.20090707164432.tgz
  • cd zcs-5.0.18_GA_3011.RHEL5.20090707164432
  • ./install.sh --platform-override
The --platform-override switch allows Zimbra to install on CentOS.

The installer will check to see what's installed. Being a fresh install, you'll have a series of NOT FOUND. At the end, press Return to continue

The installer checks for needed packages. If it finds everything it needs, it will then search for what's available to install (ie, what's in the extracted archive). Now it will ask you what to install, item by item.


Install zimbra-ldap [Y]                   --  Press Enter
Install zimbra-logger [Y] -- Press Enter
Install zimbra-mta [Y] -- Press Enter
Install zimbra-snmp [Y] -- Press Enter
Install zimbra-store [Y] -- Press Enter
Install zimbra-apache [Y] -- Press Enter
Install zimbra-spell [Y] -- Press Enter
Install zimbra-proxy [N] -- Press Enter

Checking required space for zimbra-core
checking space for zimbra-store

Installing:
zimbra-core
zimbra-ldap
zimbra-logger
zimbra-mta
zimbra-snmp
zimbra-store
zimbra-apache
zimbra-spell

Install anyway? [N] -- Enter Y and press enter. This answers the warning about CentOS

The system will be modified. Continue? [N] -- Enter Y and press Enter


Note:
I get a DNS warning message. You'll be asked if you want to reconfigure your domain name. Enter NO. Even though the installer warns of an incorrect MX record, it will not prevent mail retreival via POP or IMAP. If this were to be a 'real' mail exchanger, it would be an issue. I'm working on an alternative DNS config, and will post it when completed. This will, however, depend heavily on the configuration of DynDNS.



Several packages will now be installed. The next screen come up to configure Zimbra. The only thing that needs to be configured is the Administrator password. Enter 3, and 4. Enter the password. Enter R to return to the previous menu. Enter A to apply the settings. And Enter again to save the configuration data to a file. The default config file should suffice. Rename it if you like, or press Enter. Enter Yes to modify the system and finalize the install.

You'll be asked whether you want to notify Zimbra of your installation. Enter your desired response and press Enter.

A few more items will be setup. After it's finished, press return to exit.

Configuration

To access the configuration web page, go to https://[server]:7071. Login with admin@fqdn, and the password you setup.

Getting Your Email

Each user has the option of configuring external accounts. This is done through the Preferences, Accounts tab in the webmail interface. More information can be found in Zimbra's docs.



That's it! Enjoy your Zimbra email server!



Monday, July 20, 2009

The Perfect Ubuntu 9.04 Desktop

Introduction

OK, I have to say that OpenSUSE lived on my desktop for 1 week. The reasons for its death are twofold. One, it was slow on my hardware. Two, I had an issue with converting RAW images from my digital camera. That was a showstopper for me. I could handle the speed issues, but I honestly didn't feel like mucking around with Image Magick and UFRAW to get things to work.

After a short vacation, Ubuntu has found its way home again. I can say that there's definite speed improvments with 9.04, than there were with 8.04 LTS. Despite the fact that I'm a fan of the LTS versions, I still chose 9.04. There's just a better feel of coherence, and better speed than the recent LTS version. This has restored my faith in Ubuntu. It took 30 seconds to boot, after POST, to get to the sleek login screen. For reference, my box is a P4 HT, 3GHz (dual cores @ 1.5GHz, not 1 core at 3GHz.), with 1.5 Gigs of RAM, and I use software RAID 1 on the boot disks, which are SATAII.

UPDATE
I have now figured out the problem with Image Magick and UFRAW. I am now putting OpenSUSE back on my system. It feels more solid that Ubuntu 9.04. Wine+Firefox works so I can upload photos to online stores in bulk with third-party add-ons that only work with the Windows version of Firefox. Sorry Ubuntu. The last 3 years have been great. But it's now off to OpenSUSE.
But nevermind my specific reasons for choosing it. Let's get to installing it, and doing a few tweaks.

Get the Install Media

Go to the Ubuntu website and download the ISO. The ISO I used is ubuntu-9.04-desktop.i386.iso.

Install Ubuntu


Select Your Language


Select Try Ubuntu without any change to your computer


Here's the desktop. Double Click on Install.


Click on Next


Select your location



Select your keyboard layout


Partition your drive. Note that if you want to install to a RAID array, you'll need to use the "Alternate" install disk.


Enter your name and login credintials


Double check settings, and Install. This is the point of no return.


We're done! Click on Restart Now



Log in. This is one slick looking GDM theme. It's about time!



After a few moments the update manager will let you know there's updates. Click Install Updates to install them.


Since we're modifying the core system, you'll need to enter your password


And away we go.


Reboot, and log back in

Customizing

Gnome Control Center


Let's turn on the Gnome Control Center. Go to System -> Preferences -> Main Menu. Click on System, and turn on the Control Center and click Close.


Now you can go to Syste -> Control Center, and get a panel that resembles OpenSUSE's YaST. I rather like it, but the rest of the tutorial will not use this.

Static IP Address


Go to System -> Preferences -> Network Connection. Edit eth0. You'll have to supply your password. Go to the IPv4 tab. Change Method to Manual. Enter you IP address, subnet mask, and gateway. Click apply, and close. You'll have to ifup eth0 and /etc/init.d/network restart for the settings to take hold. You may alternatively reboot.

Media Codecs

You'll probably want to be able to play any media file you come across. Let's load the codecs.
  • sudo wget http://www.medibuntu.org/sources.list.d/jaunty.list --output-document=/etc/apt/sources.list.d/medibuntu.list
  • sudo apt-get update && sudo apt-get install medibuntu-keyring && sudo apt-get update
That adds the repositories. Now let's add the codecs and additional goodies
  • sudo apt-get install non-free-codecs w32codecs mencoder libdvdcss2 gxine libxine1-ffmpeg vlc
Now we're ready to rock!

Email

If you prefer Thunderbird to Evolution, install it.
  • sudo apt-get install thunderbird thunderbird-gnome-support
  • sudo apt-get purge evolution evolution-common evolution-exchange evolution-plugins evolution-webcal
Compiz Settings Manager

If you're using the restricted drivers for your graphics card, you can add the Compiz settings manager to fine-tune your eye-candy.
  • sudo apt-get install compiz-config-settings-manager

Startup Manager

Install this if you would like to adjust the boot process.
  • sudo apt-get install startupmanager
AmaroK

I prefer Amarok to any other music player. Let's add it.
  • sudo apt-get install amarok
  • sudo apt-get purge rythmbox
Note: If this is the first time you're installing a KDE app, you'll need to logout and login so that new environment variables can take effect.

DigiKam

This is my preference over F-Spot
  • sudo apt-get install digikam
  • sudo apt-get purge f-spot
Tomboy

Maybe it's just me, but I don't find much use for Tomboy. Eradicate it.
  • sudo apt-get purge tomboy
And since I've pulled both F-Spot and Tomboy, I can pull their dependencies also
  • sudo apt-get purge libmono0 mono-common
A few other goodies
  • apt-get install bluefish inkscape scribus blender
And there you have it! A computer that's the perfect blend of speed and usability.

-- DRH