Básicamente, lanzando un sencillo apache enjaulado me topé con el siguiente error:

(116)Stale NFS file handle: Error retrieving pid file /var/run/apache2.pid

Muy bien, dije yo, vamos a que ver que punto de montaje está sobre NFS. Pero resulta que el punto de montaje de NFS era /var/apache/foobar y no en la ubicación que reclamaba el error.

Revisando los puntos de montaje, parecía que dicho path estuviese sobre el JFS, pero, ¿entonces, qué sentido tenía el error?

La solución, tras un buen rato, la encontré en esta lista de correos:
http://marc.info/?l=jfs-discussion&m=128707085832398&w=2

Básicamente, JFS puede arrojar este error en un sistema de archivos que no esté limpio (pudiendo darse incluso en sistemas que no hacen uso de NFS para nada). Para más INRI, fsck.jfs, si no se lanza con la opción -f, reporta el sistema de archivos como limpio.

Por tanto si llegas aquí buscando entender este error, la solución es tan sencilla como lanzar un fsck.jfs -f punto/de/montaje

Dejemos a un lado lo bizarro que pueda resultar que un sistema de archivos arroje mensajes de error sobre otro sistema de archivos que puede ni siquiera estar presente en la máquina…

The post Inflamable significa flamable first appeared on Javier Bahillo.

La verdad es que creo que este año ha colmado con creces las expectativas, dado que ha estado cargado de buenas noticias, tanto en lo personal, como en lo profesional.

Empezando por lo personal, como no, el nacimiento de mis dos peques lo dice todo. Han cambiado nuestra vida, y solo yo mi mi pareja sabemos cuán deseadas eran. Por otro lado también esta el compromiso con mi pareja. cómo no…

En lo laboral, por un lado el check de haber completado la adquisición de un título «oficial» a parte de las certificaciones que había adquirido ya el año anterior. Realmente ha sido duro por tener que compaginarlo con el trabajo, por un lado, y con la época del embarazo, por otro. Sólo agradecerle a mi futura mujer el esfuerzo que hizo para que yo pudiese dedicarle el tiempo suficiente.
Por otra parte, el «ascenso» pasando a ser definitivamente Administrador de sistemas de la empresa es una noticia que me llenó de sinsabores, puesto que el puesto era más que deseado, pero llegó a partir de la marcha de la empresa de un compañero con el que compartí muchos momentos tanto profesionales (esas migraciones nocturnas..) como personales.

En cualquier caso creo que solo podemos decir que este año ha sido más que completo y más que intenso… ¿qué nos deparará el año que viene…?

The post Fin de año first appeared on Javier Bahillo.

The post We’ve moved first appeared on Javier Bahillo.

I had begun doing it by hand using samba-tool ntacl set sddl-ACL patg, but I soon realized this was a nightmare . Thus I invested some time in creating a small script on python that at least did part of this for me:

import os
import sys
arg = sys.argv[1]
command = "samba-tool ntacl set "
wp = os.getcwd()
for dirname, dirnames, filenames in os.walk(wp):
 os.system(command + "\"" + arg + "\" " + "\"" + dirname + "\"")
 files = [f for f in os.listdir(dirname) if os.path.isfile(os.path.join(dirname,f))]
    for f in files:
 os.system(command + "\"" + arg + "\" " + "\"" + dirname + "/" + f + "\"")

With this at least I had to do it once per policy. Once done, I just created a bash script that got the path and the sddl from samba-tool ntacl sysvolcheck (and run the script above until this command were ok:

#!/bin/bash
until samba-tool ntacl sysvolcheck 2>/dev/null
do

DIR=$(samba-tool ntacl sysvolcheck 2>&1 | grep ERROR | cut -d" " -f12)
PERM=$(samba-tool ntacl sysvolcheck 2>&1 | grep ERROR | cut -d" " -f19)


cd "$DIR"

python script.py $PERM
done

Hope this is useful if you were looking for this.

P.S. You can find the code in my github under GPLv2 as ever

The post New script >set sysvol perm first appeared on Javier Bahillo.

Take a look here

Hope it may be interesting for all of you!

The post HTTPS Transparent proxy in Zentyal first appeared on Javier Bahillo.

It happened no more than few secons until I begun to though about the possible security implications this system may led to. As far as I could see here: http://forum.xda-developers.com/showthread.php?t=2720677 , the app just allows your mobile to perform a download and installation of lastest rom in case a particular formatted SMS were received.

Now let us think how we restrict this. Will it use mobile phone sender to restrict when this will be done? Well, it does not really matter, as long as SMS sender has been from some time ago easily faked.

Will it be using a particular keyword inside the specific format of this SMS. Well this shall be a password and all we know that passwords can be broken. The easiest case would be by brute-forcing, but we can not dismiss things like GSM-faking and even in the near future UMTS faking as I have recently read an article where it was stated that UMTS might be faked in a similar way that the GSM is, despite the network having to authenticate agains the device (http://www.hojaderouter.com/seguridad/redes-3g-seguridad-ataques/12437)

This being said, it seems this system is restricted to Cyanogen ROMS, so you cannot tell the mobile from where to download the ROM to install, you can just tell it, ‘hey download and install the lastest stable. This in a way relieves the impact this might have (somebody could build a hiacked ROM, and then send lots of sms to everywhere telling the mobile to apply that particular ROm, which- for instance- could be sending a summary of any of the rest of your passowrds (mail,bank accounts, whatever you can imagine)

Being discarded this (at first) we still are under the possibility of a DOS attack where an attacker could be once and over again sending formatted sms telling our mobile to download and install a ROM, so you could not even use your mobiles, as it would be continuously rebooting….

The post ROM SMS installer…really? first appeared on Javier Bahillo.

1. (Server A) The server on which the CA existed previously, and from which the files for the CA will be taken.
2. (Server B). The secondary server to which we want to export the CA which exists on Server A.

In order to better understand the procedure we must keep in mind that:
Zentyal CA files are stored on /var/lib/zentyal/CA
This folder has these permissions:

drwx r-x --x 9 ebox ebox

ebox user has as his home the folder /var/lib/zentyal/

• With this information, we’ll proceed to follow these steps:Check that rsync is installed in server B, and if not install it.

 sudo apt-get install rsync

• Check if root has a rsa key in server B. If it did not have, create if with ssh-keygen

 if [ ! -f /root/.ssh/id_rsa.pub ] ; then /usr/bin/ssh-keygen" ; else echo "Key Already exists" ; fi

• Create folder /var/lib/zentyal/.ssh/ and create file authorized_keys

sudo mkdir -p /var/lib/zentyal/.ssh/
sudo touch /var/lib/zentyal/.ssh/authorized_keys

• Chown both to ebox.ebox:

sudo chown -R ebox.ebox /var/lib/zentyal/.ssh/

• Copy the root public key to /var/lib/zentyal/.ssh/authorized_keys of server A. Given ebox user has no password you will have to do it by hand, as long as you won’t be able to do it with ssh-copy-id . Thus, open /root/.ssh/id_rsa.pub and paste its contents into /var/lib/zentyal/.ssh/authorized_keys of server A.

• Test that you can ssh without using password from root as ebox user:

sudo ssh ebox@SERVER-A-IP

• Now you can:

1. Limit connections from IP:

To do so edit in SERVER A /var/lib/zentyal/.ssh/authorized_keys, and add prior to the ssh-rsa this:

from="SERVER-B-IP" ssh-rsa dasghgdgh+RqUVx5wzgnaMxH2Km5KRx0Wzvsa5YvxjwERVVXs2mUEes5mDpoDMX9pUAwKqPCS5C
LyDwI+t0xNmVzPzeZjhypIfvBmgaG7pBNx7Zted7C+fha1X3SUmT4TguLzy7pfWbG7CKr2XkkFUYUOdUniYc99NsIxY1/51+/jjhfg
jhfg/Pr5jqH+jhfjfgj/jhfgjh+9kErROS1z root@hostname

2.  Ensuring that only rsync is used for this ssh connection:
To do so edit in SERVER A /var/lib/zentyal/.ssh/authorized_keys, and add prior to the ssh-rsa this:

command="/usr/share/bin/check_command.sh” ssh-rsa fdasghgdgh+RqUVx5wzgnaMxH2Km5KRx0Wzvsa5YvxjwERV
VXs2mUEes5mDpoDMX9pUAwKqPCS5CLyDwI+t0xNmVzPzeZjhypIfvBmgaG7pBNx7Zted7C+fha1X3SUmT4TguLzy7pfWbG7CKr
2XkkFUYUOdUniYc99NsIxY1/51+/jjhfgjhfg/Pr5jqH+jhfjfgj/jhfgjh+9kErROS1z root@hostname

Now, you must add the script it mentions this line (script taken from http://troy.jdmz.net/rsync/index.html)

#!/bin/sh

case "$SSH_ORIGINAL_COMMAND" in
*\&*)
echo "Rejected"
;;
*\(*)
echo "Rejected"
;;
*\{*)
echo "Rejected"
;;
*\;*)
echo "Rejected"
;;
*\<*)
echo "Rejected"
;;
*\`*)
echo "Rejected"
;;
*\|*)
echo "Rejected"
;;
rsync\ --server*)
$SSH_ORIGINAL_COMMAND
;;
*)
echo "Rejected"
;;
esac

If you use both, separate them with a “,”:

from="SERVER-B-IP",command="/usr/share/bin/check_command.sh” ssh-rsa fdasghgdgh+RqUVx5wzgnaMxH2Km5KRx0Wzvsa5Y
vxjwERVVXs2mUEes5mDpoDMX9pUAwKqPCS5CLyDwI+t0xNmVzPzeZjhypIfvBmgaG7pBNx7Zted7C+fha1X3SUmT4TguLzy7pfWbG7CKr2Xkk
FUYUOdUniYc99NsIxY1/51+/jjhfgjhfg/Pr5jqH+jhfjfgj/jhfgjh+9kErROS1z root@hostname

• Create the folder where you’re going to store the script that will do the sync and give it appropriate permissions:

mkdir /var/local/rsync-ca
chmod 754 /var/local/rsync-ca

• Create the script file and give it proper permissions:

 chmod 740 /var/local/sync-ca/rsync-ca

• Place the following content on the script (change variables as needed)

#!/bin/bash
RSYNC=/usr/bin/rsync
SSH=/usr/bin/ssh
KEY=/root/.ssh/id_rsa
RUSER=ebox
RHOST=SERVER-A-IP
RPATH=/var/lib/zentyal/CA
LPATH=/var/lib/zentyal/
$RSYNC -az -e "$SSH -i $KEY" $RUSER@$RHOST:$RPATH $LPATH

• Test the script and confirm that it works as expected

• Create the cron job for the script we have just created. For instance, to run this daily write under /etc/cron.d/rsync-ca :

 # /etc/cron.d/rsync-ca - Runs the script that syncs CA with SERVERA daily

SHELL=/bin/sh
PATH=/usr/bin:/bin

# Log data for report hourly
@daily root /var/local/rsync-ca/rsync-ca

The post Syncing Zentyal CA between two Zentyal servers first appeared on Javier Bahillo.

Selecting Comptia, has been moreover a really good choice as it has provided me with 5 certifications in a shot:

COMPTIA Linux +

LPIC 1

Novell Certified Linux Admininstrator

Data Center Technical Specialist

SUSE 11 Technical Specialist

I cannot finish this without thanking my employer, Zentyal for providing the time and economic support in reaching this certification!

The post First Certification step done first appeared on Javier Bahillo.

#!/bin/bash
for i in {1..50}
do
sleep 90
echo "Reboot $i "
ssh root@192.168.1.57 init 6
done

The post Testing reboots first appeared on Javier Bahillo.

Zentyal provides mail functionality through Zentyal Mail module. It uses Postfix as the daemon to provide smtp functionality, and Dovecot as the daemon for POP3(s) and IMAP(s) functionalities. Where are mails stored? It stores mail files in /var/vmail/. You can enable which services (POP/IMAP) you want to have enabled in the Zentyal GUI:

Zentyal Groupware (zarafa)provides as well mail functionality. Zarafa will store mail on its database (Zarafa MySQL database when using Zentyal 3.0),and provides Webaccess as the interface for webmail. So What’s the difference with them?

• Zarafa provides you an address book with your LDAP users, so they don’t need to include their collegues by hand.
• Zarafa allows you to use (collaborative) calendar where you can write and share your day-by-day events.
• And the main one: Zarafa provides you with the possibility of allowing your users to use Exchange accounts for your domain (using the so-called Outlook Connectors) and to use their mobiles for Exchange accounts (using z-push).

So far so easy isn’t it? But many people get confused when configuring these. In order to clarify these, we’ll try to make clearer how Zarafa works, so configuration should be easier.
We’ll take for this a simple environment, with no Mailfilter module involved (as it will be transparent for this), and Zentyal Mail, Webmail, Zentyal Zarafa and Zentyal Webaccess (which is installed when installed zentyal-zarafa module)

For the first step, let’s take an environment with Zentyal Mail with POP3, Secure POP3, IMAP, and IMAPS configured and Zentyal Webmail modules. In this environment we have a single domain, say zentyal-domain.loc, and three users:

• john@zentyal-domain.loc
• doe@zentyal-domain.loc
• foo@zentyal-domain.loc

User john retrieves his mail through a Thunderbird/Outlook client with IMAP  and when he’s abroad, he checks it using it IMAPS on its mobile)

User doe retrieves his mail through POP3, and when he is abroad he checks it using IMAPS on its mobile)

User foo check his mail using webmail.

So, in this state-of-things any user can check his email using any method he might prefer (POP3, POP3S, IMAP, IMAPS or Webmail). But now we install the Zarafa module, and a new user bar@zentyal-domain.loc , and we define this user as a Zarafa user:

So, our user goes straight away to its Thunderbird mail client, and configures it but…gets nothing. We know that the should at least have received the welcome to the company email, so… what might have happened? He also checks webmail… and he finds the same result.

As we had told standard mail stores mail in /var/vmail while Zarafa does in MySQL. When a user is marked as non-Zarafa user its mail is sent to the filesystem, and if it is a Zarafa user mail is sent to MySQL. Now let us have a look to the first screenshot of this article. Yes, we still have enabled POP3, POP3S, IMAP and IMAPS. So meanwhile  we keep this configuration, no client can be used to check a zarafa account (unless using a Exchange account with an Outlook connector) as every method is still reserved for standard mail.  About the webmail, well you might have guessed, you user should point his browser to /webaccess (or /webapp, if webapp has been installed)  in order to check Zarafa mail, as Webmail module only checks standard mail.

So, in order for our user bar to be able to use Thunderbird, we have to disable in mail configuration some service. For our example we’ll leave the secure protocols for mail.

After saving changes, you’ll be able to enable the POP3 and IMAP gateways for Zarafa, and our user will be able to check Zarafa mail using these protocols. Don’t try enabling any gateway without disabling first on mail module config, as it will logically complain, as  the same port cannot be bind by two services:

The post Mail server in Zentyal – Understanding differences between Mail and Groupware modules first appeared on Javier Bahillo.