Jeroen's blog

the final move

2012-12-14T15:40:00.003+01:00

ok people, if you want to check out my latest stuff (and of my friends), go to:

http://actualadmins.com/

see you there! :)

To boldly move...

2011-07-14T15:06:00.000+02:00

Hi All,

Haven't been updating for a while, the reason being that I'm starting a website for admins, together with two friends, to replace our old blogs. We should have some results in the next few months. When the new site is up, I'll do a last post on this blog. Till then, enjoy my old articles, the new site is going to be something totally different as per writing style, layout, dedicated server and such. Hope to be blogging for you soon again!

gr,

Jeroen

Add-ons management speed up IE9

2011-04-01T11:48:00.000+02:00

Just wanted to share I noticed something today about Internet Explorer 9. One of the things I quite like is they have really thought about addons. As every browser nowadays supports a gazillion plugins, it might be handy to see what kind of an impact those addons or plugins have on your browsing experience. As someone who used to have 10 to 15+ plugins in my Firefox days, this is a good thing.

Anyway, I open up IE9 today to check something, and I see this bar on the downside of the window:

Pleasantly surprised by this new feature I clicked the 'Choose add-ons' button, which led to the following window:

As you can see this keeps track of how much delay you get in your browsing by your addons. I think the window speaks for itself. Even though I don't have that much plugins running at the moment, at least now I have to ability to see if any are misbehaving, and disable those. All in all a handy addition to IE9 which I applaud.

Video editing in Ubuntu

2011-03-30T17:46:00.004+02:00

A student asked me earlier today if I knew how to install the program Cinelerra, which seems to be a very nice open source video editing software. He had apparently tried installing it some time ago, but had failed to get it working, ending up in your usual hours of typing commands from sites and wondering what the heck they do.
As I was intrigued to see if this program would be so complicated to install, 10 minutes later I had it installed on our student library Ubuntu machine (especially for those support FOSS and/or Ubuntu), and afterwards explained how I'd done that. I'll do the same thing here, after the break.

note: I'm a noob at video editing, and it's not really my thing, so don't ask me how the program itself works ;)

The entire procedure of installing is quite simple, as you can get it from (manually added) repositories. Of course these are not maintained by Canonical (the company behind Ubuntu), so it could be that this way stops working tomorrow, or might not patch a security bug very fast. But if your just interested in getting Cinelerra working fast, this is a very easy way:

In a terminal, become root on your machine: (i hate constantly typing sudo ;)
   su root

Now get, install and remove the debian install package which will add the Cinelerra repositories
   wget -q http://akirad.cinelerra.org/pool/addakirad.deb
   dpkg -i addakirad.deb
   rm addakirad.deb

Update the list of software we can get from the repositories (the qq is to suppress useless output except errors)
   apt-get -qq update

As there are two different versions, depending if your cpu supports a certain cpu instruction ("ssse3"), which would make the program faster. So if your CPU supports this, it is advised to get the faster version.

Let's find out if we support this:
   grep ssse3 /proc/cpuinfo

If that command gives output, run the following to get the speedy version:
   apt-get -qq install cinelerra-xt

However, if that command didn't give output, or you are unsure, then use this version that will run everywhere:
   apt-get -qq install cinelerra

Done! You can find it under your sound & video part of the 'start' menu.
Also, as it's in the repositories now, it will also automatically be updated with the rest of your software!
Another thing is you can use these same instructions for getting cinecutie which seems to be a bit different from cinelerra. The only thing you should change is the final 'apt-get install cinelerra(-xt)' line, and change it to 'apt-get install cinecutie(-xt)'. As I don't know the differences of the versions I won't go into that.

For completeness, I tested this on a lucid 10.04.2 installation and it worked fine.

Cinelerra screenshot, grabbed from google images

Tasksel remove might break your system

2011-03-10T16:38:00.003+01:00

I wrote in one of my last articles that it's handy to use the 'tasksel' command to install complete packages (called tasks in Ubuntu/Debian) like samba server or a virtual machine host. These are comparable with server roles & features as Microsoft calls that. I've been doing some more reading into this, but at the moment it is NOT advised to remove tasks with tasksel, as it might remove more then you'd like. Which in turn could render your system more or less unusable.

For those of you who'd like to read more info on this issue, or follow it in the bug tracker, here are the Ubuntu and Debian links for this issue:

https://bugs.launchpad.net/ubuntu/+source/tasksel/+bug/574287
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=587046

One half baked workaround would be to list the tasks (possibly using grep to speed it up):

tasksel --list-tasks | grep samba
i samba-server Samba file server

the 'i' in front means this task is installed, a 'u' would mean it isnt.

So now we now that the samba task is called 'samba-server', which we can use to find out which packages are used in installing this task:

tasksel --task-packages samba-server

libavahi-common3

libfile-copy-recursive-perl

libavahi-client3

libtalloc2

cifs-utils

smbfs

libcups2

winbind

samba-common-bin

libavahi-common-data

smbclient

samba-common

libwbclient0

samba-doc

libpam-smbpass

update-inetd

samba

Another way of doing this is by 'test' removing the task (so a test run that wont do anything):

tasksel -t remove samba-server

debconf-apt-progress -- apt-get -q -y install libfile-copy-recursive-perl- libavahi-common3- libavahi-client3- cifs-utils- libtalloc2- smbfs- libcups2- winbind- samba-common-bin- libavahi-common-data- smbclient- samba-common- libwbclient0- samba-doc- libpam-smbpass- update-inetd- samba-

After this we could make a well educated guess that 'samba' is the main package and just remove that with an:

sudo apt-get remove samba

or if you really want to get rid of the configuration files as well:

sudo apt-get purge samba

Finding out which package to remove might be a bit tricky (especially in larger tasks then something as simple as samba), so let's just hope they solve this issue soon by fixing the bug, or removing the remove option from tasksel.

EDIT: later I found you can actually just type 'aptitude' and that will ALSO list the tasks, but apparently in this way it's safe to remove... I didn't test this myself, so be careful.

Simple samba file server setup

2011-02-27T14:45:00.004+01:00

As it's nice and simple to do pc to pc file activities through a samba file server, let's set this up.

If at any time after installing Ubuntu you want to change 'server roles', you can just run
  tasksel
which will give you a menu with a lot of options. From these options select 'Samba file server' with arrow keys and space, and enter to confirm.
After this tasksel will setup samba for you and when it's done return you to the command line.

Now edit /etc/samba/smb.conf with
  pico /etc/samba/smb.conf

From this point onward it depends a bit on how you'd like to setup samba, which has a lot of options.
In my case i want to make sure only users who have an account on my system can logon through samba, so i uncomment:
security = user

Further, I only want to share my root partition, so I add
[root]
comment = root directory
path = /
guest ok = no
valid users = root
writeable = yes

Note: sharing your root directory will widely be regarded as a stupid move because of security implications, it's just that as I'm the only real user of my system, it would be a bit annoying having to jump through hoops whenever i want to get root access. For normal everyday use you could just uncomment the part on [homes] which goes on for a couple of lines explaining each line) instead of sharing your entire root directory.

All the other stuff should be ok, but this really depends on how safe your server is (who could have network access to it). You might want to comment out the parts on printers, but it should be fine as is.

We'll also need to make a samba user which we can access the samba server with. So as root run the following:
  smbpasswd -a root
and give it a password, use this username and password to access your samba share.
You could of course also create samba accounts for other users

Now always before rerunning samba, run the samba configuration test command
  testparm

This will probably give you a warning alike:

rlimit_max: rlimit_max (1024) below minimum Windows limit (16384)

This can be ignored, as it's just a reminder Ubuntu has fixed an issue (just doesnt report that too clearly). This will probably be fixed in a samba to come.

To effectuate the new configuraton:

reload smdb

or for older Ubuntu's

/etc/init.d/samba reload

Now on another machine, browse to the IP address (or DNS name if you've got that correctly setup) and you should see your root or homes share. In my case this was a windows 7 machine which promptly came with the question with which name & password I'd like to login.

Note: This actual access did go wrong once, as it made my name into clientpc\username instead of serverpc\username, so you might want to write your username as servername\username.

Smart monitoring of harddiscs

2011-02-27T12:21:00.001+01:00

Now we have exim4 email setup on our server, it would be nice to get alerts of impending doom for our harddiscs. So let's setup smart monitoring with smartmontools.

First install smartmontools
  apt-get install smartmontools

Next configure the daemon so it may start
  pico /etc/default/smartmontools
and change the following line so it says YES like here:
start_smartd=yes

Now we edit /etc/smartd.conf for the configuration
  pico /etc/smartd.conf

comment out the line (or any lines in your config that are not commented out)

DEVICESCAN -d removable -n standby -m root -M exec /usr/share/smartmontools/smartd-runner

and add this line:

DEVICESCAN -m root -d sat -M test -s (S/../.././02|L/../../6/03)

That line means:

-m root = mail root in case of issues (root should have an email alias in /etc/aliases!)

-d sat = we have sata devices (you might want to change this if you're still using IDE discs)

-M test = mail us when things go wrong, subject TEST

-s (S/../.././02|L/../../6/03) = do a short selftest every night at 2, and a long test on saturday at 3

having that explained, let's start our smart daemon

/etc/init.d/smartmontools start

after a few second the test email should arrive, which it will for every harddisc, on every restart of smartmontools (so also on server reboot). So now we instantly know when our hard discs will fail, and our server reboots :)

For more info on how to configure smartd.conf, type:

man smartd.conf

Exim4 to Gmail with ubuntu

2011-02-27T11:57:00.000+01:00

It's handy if your server can mail you alerts (think smartmon and the likes), and as gmail completely allows this and most people have a gmail account anyway, let's do a quick setup of the exim4 email server.

Just create a new email address at gmail, so we dont run into trouble with exim4 accidently sending so much messages your gmail account becomes blocked for suspected spamming and such.

In my current Ubuntu 10.10 there's a dependency problem with Exim4, so till that's fixed, first you have to install the normal packages, then the meta package :
   apt-get install exim4-base exim4-config
   apt-get install exim4-daemon-light

for testing to send an email, let's also install mailutils
   apt-get install mailutils

Then we configure Exim4:
   dpkg-reconfigure exim4-config

Here are the answers to the questions it asks (these differ a bit with version differences)

General type of mail configuration: mail sent by smarthost; received via SMTP or fetchmail
System mail name: leave as is, "zz9" in my case
IP-addresses to listen on for incoming SMTP connections: leave as is, "127.0.0.1 ; ::1" in my case
Other destinations for which mail is accepted: leave as is, "zz9" in my case
Machines to relay mail for: leave as is blank
IP address or host name of the outgoing smarthost: smtp.gmail.com::587
Hide local mail name in outgoing mail? No
Keep number of DNS-queries minimal (dial-on-demand)? No
Delivery method for local mail: mbox format in /var/mail/
Split configuration into small files: No

Now open the file /etc/exim4/exim4.conf.template (possibly copy first so you have a backup)

Find the line .ifdef DCconfig_smarthost DCconfig_satellite and add the following in that section

send_via_gmail:

driver = manualroute

domains = ! +local_domains

transport = gmail_smtp

route_list = * smtp.gmail.com

If you have any other smarthost defined with “domains = ! +local_domains” remove that smarthost.

Find the “begin authenticators”. In that section add the following

gmail_login:

driver = plaintext

public_name = LOGIN

client_send = : yourname@gmail.com : YourGmailPassword

Make sure you have no other authenticators with the same public_name (LOGIN). Comment them out if needed.

Find the comment “transport/30_exim4-config_remote_smtp_smarthost”. In that section add

gmail_smtp:

driver = smtp

port = 587

hosts_require_auth = $host_address

hosts_require_tls = $host_address

Now to effectuate:

update-exim4.conf

/etc/init.d/exim4 reload

In case you want all your root messages to go to that or another account, edit /etc/aliases, and add/replace:
root: accountname@gmail.com
adding that for each account you want to redirect to that email address... so if my user is jeroen just add
jeroen: accountname@gmail.com
or just say jeroen: root

now let's send a message:
echo blabla | mail -s "test" accountname@gmail.com

A few seconds later you should have mail in your inbox. Enjoy your new mailserver :)

Setting up a permanent ubuntu SSH tunnel

2011-02-27T10:28:00.001+01:00

My home system is behind a router I do not control (yet :). This means port forwarding so I can remotely reach my machine might seem impossible. Or not....
All you really need is a good (trustworthy) friend with his own server, and a little ssh tunneling magic.

Today I'll make a permanent password less (auto)ssh tunnel that binds local port 22 (ssh) to 11122 on a remote machine, so that when i login to the remote machine from anywhere, all i have to do is ssh to port 11122 and voila, i'm on my own supposedly unreachable server.

First of all you need to make sure to be able to do a password less login to machine B (the friends server).
For this you'll need to generate public keyfiles and tell machine B to trust them.

So on your own machine generate the files (while logged in under the user you want to connect to machine B):
  ssh-keygen
When it asks for a passphrase, just hit enter for both times it asks.

This will generate ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub. If it doesn't your probably running an older version of openssh which still generates id_dsa which is the old form, use ssh-keygen -t rsa in that case.

Now we have to copy the ~/.ssh/id_rsa.pub file to the remote machine, which for this exercise is on port 443.
  scp -P 443 ~/.ssh/id_rsa.pub jeroen@machineb.com:~/

Now login to the remote server, create the .ssh directory (in case it doesn't exist) and make that file trusted, and then delete the transferred public key we'll no longer need.
  ssh -p 443 jeroen@machineb.com
  mkdir ~/.ssh
  cat ~/id_rsa.pub >> ~/.ssh/authorized_keys2
  rm ~/id_rsa.pub

Now logout from the remote machine, and try to login to it again, this time without password.
After this is working we can setup our permanent tunnel.

Back on your local machine, let's start installing & configuring the permanent tunnel.
  apt-get install autossh
  pico /etc/init.d/ssh_tunnel

and put the following in /etc/init.d/ssh_tunnel:

#!/bin/sh
# Example script to start up tunnel with autossh.
# This script will tunnel 22 from the local host
# to 11122 on the remote host.
ID=jeroen
HOST=machineb.com
AUTOSSH_POLL=600
AUTOSSH_PORT=20000
AUTOSSH_GATETIME=30
AUTOSSH_DEBUG=yes
AUTOSSH_PATH=/usr/bin/ssh
export AUTOSSH_POLL AUTOSSH_DEBUG AUTOSSH_PATH AUTOSSH_GATETIME AUTOSSH_PORT
autossh -p 443 -2 -fN -M 20000 -R 11122:localhost:22 ${ID}@${HOST}

Then save and exit this file (ctrl-o/x), and make it executable.

chmod +x /etc/init.d/ssh_tunnel

Then all we need to this is let it start up when your network starts up, and we're done.

pico /etc/network/interfaces

Depending on through what interface you make your tunnel, add the following to an eth0 or wlan0 or such:

post-up /etc/init.d/ssh_tunnel

For clarity I'll post my own setup here:

my home setup, where autossh activates on post-up of the wireless

We should now have a permanent tunnel we will activate and test:

/etc/init.d/ssh_tunnel

ssh -p 443 jeroen@machineb.com

ssh -p 11122 jeroen@localhost

Now you should be tunneling back to your local machine through our port forwarded autossh tunnel. Done!

For debug purposes I'd like to add that I didn't change the default autossh logging path, which means all logging goes to the normal system log at /var/log/syslog.

Of course you can tunnel much more through setup's like these. Play around with it, just make sure your not using ports that might actually be in use. To check which ports are already used on a server, run:

netstat -plntu

Simple spicing up the ubuntu server motd

2011-02-26T18:19:00.002+01:00

On the lighter side of servers, those of us who like a little information when they login might like the following. An overview of cpu load, memory usage, disc space free for example. Or a warning that says you still have some updates to install.
Luckily there's a package that easily does this.
Just install landscape-common (which takes several python and other packages along) as:
apt-get install landscape-common

This package is part of the new cloud services from Ubuntu, which if your just starting with ubuntu is probably not all that interesting so I'll leave it at that. Next (logout and) login to your server for the new login

putty display of a login on my new 10.10 server

The above 'helpful message' part welcoming you to Ubuntu, and where you can find the documentation can be removed with:

rm /etc/update-motd.d/10-help-text

or of course you can put your own text or 'ascii art' into it so it shows up on login.

You can also edit the files in /etc/update-motd.d/ so they show other things as well.. it's a lot of fun to play around with tbh :)

note: if you just want something simple displayed, it might be wisest do put that in /etc/motd.tail

Ubuntu 10.10 with RaLink RT2561/RT61 pci wifi

2011-02-26T17:11:00.006+01:00

I installed a new installation of Ubuntu server 10.10 today, and had to spend two hours getting my wireless card to work. As I had to scour half the internet for tips before I finally had a working configuration, I'll share my findings here to prevent head-aches for other people.

Card: RaLink RT2561/RT61 pci wifi (802.11g) card (D-link DWL-G510)
Ubuntu 10.10 server x86 running 2.6.35-25-generic-pae kernel
Connection will be setup through WPA2 to a normal access point (with DHCP)

For the rest of this guide: text marked in bold red are commands, blue text is output.

First of all, make sure you're system is updated, the issue you're now reading *could* already be fixed:
   apt-get update
  apt-get dist-upgrade
(upgrading is not supposed to break your system, but it might.. be forewarned)
note: of course you already need a working internet connection for this and the next step. I did this temporarily by setting up my windows machine with wired Internet Connection sharing.

Next you need to install support for wireless devices, and the wpasupplicant package.
  apt-get install wireless-tools wpasupplicant

Reboot computer to effectuate new drivers.

Just for checking, running 'lspci' or 'iwconfig' should show you your wireless:
  lspci | grep RT
  05:04.0 Network controller: RaLink RT2561/RT61 rev B 802.11g

  iwconfig
  lo no wireless extensions.
  eth0 no wireless extensions.
  wlan0 IEEE 802.11bg ESSID:off/any
   Mode:Managed Frequency:2.462 GHz Access Point: Not-Associated
   Tx-Power=9 dBm
   Retry long limit:7 RTS thr:off Fragment thr:off
   Encryption key:off
   Power Management:off

Now we need to tell the wireless where you want to connect to, so we need to edit the network configuration.
   pico /etc/network/interfaces
locate the wlan0 part, and make sure it looks like this afterwards:
auto wlan0
iface wlan0 inet dhcp
   wireless-ssid Breestraat collective
   pre-up wpa_supplicant -B -Dwext -iwlan0 -c/etc/wpa_supplicant.conf
   post-down killall -q wpa_supplicant

The 'Breestraat collective' is the network ssid I connect to, you should change that to your own network's name/ssid what you are trying to connect to.

(save in pico with ctrl-o, exit when done with ctrl-x)

Now we create the configuration for wpasupplicant which handles our wpa encryption.
   pico /etc/wpa_supplicant.conf
make sure it looks like the following when you save and exit:
network={
   ssid="Breestraat collective"
   proto=RSN
   key_mgmt=WPA-PSK
   pairwise=CCMP TKIP
   group=CCMP TKIP
   psk="52eb377246ac2114"
}
Be sure to again change the ssid, and enter your network key at the PSK line.

Now to test our configuration:
    if-up wlan0
if it was already on or such, you can completely reinitialize networking with:
   /etc/init.d/networking restart

Cross your fingers, and you should see your adapter coming up now.
Signal strength still seems very low in my case (lots more then windows) and there seem to have been more people using this adapter with the same issue. Regrettably with low signal you usually are just aimlessly trying to beg for a dhcp package to arrive....

Last tip: in some cases your default route will be to your internal network card (usually eth0). Testing wireless connections works a lot better if you disable your internal nic so you know for sure your trying to reach through the correct network. Then later you can reconfigure your routing to correct this.
To disable eth0
   if-down eth0
And to reenable
   if-up eth0

Trying out the AppInventor: FingerPaddle

2011-01-30T16:41:00.006+01:00

I've been toying around with programming something with the new (ßeta) Google AppInventor, which allows you to create simple applications for android with almost no code. For this I decided to make a sort of paddle game, a bit alike Arkanoid (only without the bricks for now ;)
This little gadget does utilize a bit of a hack with arrangements to use multiple screens (as you can see)
Attached is the full source code (including gfx & sound), and the .apk which if you open it up, will install the 'game'.

Now remember, this was only a tryout and is missing a lot of options which would actually make it a viable game. Things like better graphics & sound effects and of course the addition of a high score table (on device, possibly on the web with TinyDB), etc..
But it will give you a nice intro into how AppInventor works, just play around with it! :)

To view another screen: make one visible and the other 2 invisible: VerticalArrangementMain, VerticalArrangementHistory or Canvas1.

apk link 1.1 MiB apk file v0.3ß (what you can install on phone)
source code link 45 KiB zip file v0.3ß (what you load into the AppInventor)

Have fun!
J.

ps. yes, I know I used a lot of horizontal/vertical arrangements... went a bit overboard on those trying to position everything a bit more normal

Some screenshots (from the emulator & AppInventor suite)

version history

mainmenu

actual gamescreen

AppInventor (click to enlarge)

Blocks editor (click to enlarge)

hard disc monitoring using zabbix

2010-12-21T16:54:00.002+01:00

Just a quickie on monitoring SMART data from a hard disc, or temperature in this case.

In your /etc/zabbix/zabbix-agentd.conf add a UserParameter at the end. (add one p/hard disc you would like to monitor)

UserParameter=linux.smart, smartctl -A /dev/sda | grep Celsius | cut -d'-' -f2 | sed 's/ //g'

the part after linux.smart (which is your template and keyname), is the commandline. To explain it:

This shows (only) vendor specific SMART attributes of the first hard disc (or whatever is /dev/sda)
smartctl -A /dev/sda
Only get/display/echo the line with Celsius in it
grep Celsius
Cut away everything but the second field, using - as delimiter. This will leave you with some empty space and a number.
cut -d'-' -f2
Delete empty space (actually substitute by nothing), so we only have the number left.
sed 's/ //g'

Now in zabbix you can use my previous article on how to expand your (for example) linux template in zabbix and create an item called smart in there... piece of cake :)

Last thoughts;

Of course you can grab more info from the smartctl command, just run: (notice the lowercase a this time)

smartctl -a /dev/sda | less

to have a bit of a look at what it all tracks... it's a lot.

I can also advise everybody just to have a look at the smartmontools/smartctl pages and setup frequent hard disc self testing. Smartmon tools can automatically mail you in case things start looking bad.

See you in the next article...

Getting statistical values from Exim4 in Zabbix

2010-12-16T16:51:00.017+01:00

I made a quick few modifications to our Zabbix installation to monitor mail coming in and spam counts/day and such...
This could still use a lot of improvements, but for now at least I am happy :)
Do notice the Exim queue count is the only data that's always on spot. The other values like spam and such are dependant on how log rotation is setup for exim4. With us that was daily, so I gave all the items a description like 'today's rejected spam' which basically sums up exactly what it is :)
Also, I place my values in /tmp which probably has some security issues, but tbh, it seems safe enough to me.. and as the values are so small, I wont have any space issues (besides... I monitor /tmp afaik ;)

put the following in a crontab: (make sure user has enough rights, and do crontab -e)

*/2 * * * * /usr/sbin/exim -bpc > /tmp/eximcount.txt
*/5 * * * * grep -c "Message rejected as spam" /var/log/exim4/rejectlog > /tmp/exim_spamcount.txt
*/5 * * * * grep -c "Unrouteable address" /var/log/exim4/rejectlog > /tmp/exim_unrouteable.txt
*/5 * * * * grep -c "This message contains malware" /var/log/exim4/rejectlog > /tmp/exim_malware.txt
*/5 * * * * grep -c "relay not permitted" /var/log/exim4/rejectlog > /tmp/exim_relay.txt
*/5 * * * * grep "<=" /var/log/exim4/mainlog | grep webster.nl | wc -l > /tmp/exim_incoming_internal.txt
*/5 * * * * grep "<=" /var/log/exim4/mainlog | grep webster.nl | grep exchange.webster.nl | wc -l > /tmp/exim_incoming_exchange.txt
*/5 * * * * grep "<=" /var/log/exim4/mainlog | grep webster.nl | grep -v exchange.webster.nl | wc -l > /tmp/exim_incoming_nonexchange.txt
*/5 * * * * grep "<=" /var/log/exim4/mainlog | grep -v webster.nl | wc -l > /tmp/exim_incoming_external.txt
*/5 * * * * grep -c Completed /var/log/exim4/mainlog > /tmp/exim_completed.txt

(note: some of these values, especially where i grep our company name are kinda specific to my situation)

Part of the above text falls off the article, no worries, you can still copy/paste all the info :)

then add the following to your zabbix_agentd.conf (located at /etc/zabbix-agent), and afterwards restart zabbix-agent (/etc/init.d/zabbix-agent restart):

UserParameter=exim4.mailq,cat /tmp/eximcount.txt
UserParameter=exim4.spamq,cat /tmp/exim_spamcount.txt
UserParameter=exim4.unrouteq,cat /tmp/exim_unrouteable.txt
UserParameter=exim4.malwareq,cat /tmp/exim_malware.txt
UserParameter=exim4.relayq,cat /tmp/exim_relay.txt
UserParameter=exim4.incintq,cat /tmp/exim_incoming_internal.txt
UserParameter=exim4.incexchangeq,cat /tmp/exim_incoming_exchange.txt
UserParameter=exim4.incnonexchangeq,cat /tmp/exim_incoming_nonexchange.txt
UserParameter=exim4.incexternalq,cat /tmp/exim_incoming_external.txt
UserParameter=exim4.completedq,cat /tmp/exim_completed.txt

Then go to Zabbix, create a template exim4:

Go to Configuration
Go to Hosts (left above)
Change Hosts into Templates (right above, the pulldown box)
Create template:

Name: exim4
save

onward to create your first item (I do only one, the rest should be child's play to add in the same way!)

Now on the topright corner, set Group to templates (host should default to All)
Locate Template_Exim4 and click Items on the rightside.
Now topright you have the option Create Item, click it.

Host: Template_Exim4 (automatically filled in, i check this to make sure i'm actually editing the template, not directly a host)
Description: Exim4: Today's messages rejected as spam
Type: Zabbix agent
key: exim4.spamq
Type of information: Numeric (unsigned)
Data type: Decimal
Update interval (in sec): 300

Leave other values as they are...or whatever you want... and Save

If you have done all this correctly, and added your template to a host; Within +-5 to 10 minutes you should have data slowly going to zabbix, check by going to Monitoring/Latest Data, and select a server to which you applied the exim4 template.

Have fun! (i plan to do more Zabbix related articles at a later point :)

ps. this worked on our in production Ubuntu 10.04 server, running exim4 4.71-31ubuntu1 & zabbix-agent and zabbix-server-mysql 1:1.8.1-1ubuntu1

screenshot of this all at work: (to show I'm not completely talking out my ass :)

Windows 7 DVD can install any version

2010-02-21T14:52:00.001+01:00

I recently noticed you can install any version of windows 7 with the same DVD. All this requires is modifying or deleting one file on the iso and your done. Let's get to it then shall we;

First off, you can choose if you're going to copy the entire contents of the DVD to hard disk, or get sneaky and edit the actual ISO to take the file out. For now I'll stick with proof of concept and just copy it to hard disk. After copying, locate the file ei.conf in the sources directory. Open it in your favorite editor, it will look something like:

[EditionID] Ultimate [Channel] Retail [VL] 0

The Ultimate here is what decides the version is, possibilities are:

Ultimate
Professional
HomePremium
HomeBasic
Starter

Or just delete it :)
If this file actually does not exist, windows will ask for the version, which is what we want.
If your successfull, it should look something like the following:

ps. Of course you still need a valid key to install...

How to upgrade your Windows 7 RC to Enterprise

2010-02-21T14:27:00.003+01:00

Windows 7 doesn't allow you to do an upgrade over the release candidate version. There is however a quite simple way to fool the installer into doing just that.

Be carefull with registry editing, you can break your system.. anywayz, dont hold me responsible ;)

Go to regedit (start->run->regedit)
Head over to the following key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version
Change Ultimate with Enterprise in ProductName and EditionID

Note: the ultimate to enterprise trick actually just fakes that your under a corporate license, or not. You probably don't need to do that step if your not specifically upgrading to an Enterprise version of Win 7.

Now all we need to do is edit one file on the Windows 7 ISO. Do this either by copying it to harddisc and installing from there, or reburning it with our modified file.

Open up the following file in your favorite text editor: \sources\cversion.ini
Locate the minclient line, and change the version number behind that to 7100. (7100=rc 7000=beta)

Happy installs :)

sidenotes:

you can't go from 32 to 64 bit this way (or reverse)

For all you people having fun with the upgrades, here's a little mood lifter out of Vista days, courtesy of ctrl-alt-del:

Ubuntu disk i/o analysis

2010-02-21T13:41:00.002+01:00

Very quick rundown of some commands can tell you things about your disk IO. If I feel like it in the future, I'll expand this to a more documented post.

What processes have files open
lsof
Use this as "lsof /srv" to show all open files under /srv (else you'll get loads of output).

Which processes are using which disk IO
iotop

note: might need to install package sysstat

Which processes are using a partition
btrace -s /dev/sda1
Just quit the btrace with a CTRL-C. This will give you a (rather large) report on which processes are using disc and what for (reads/writes/etc..)
note: might need to install package blocktrace

Quick realtime overview of generic disc I/O info

watch --interval 1 iostat

Will show you cpu usage, and also the amount of transfers p/second, blocks read & written p/sec, etc..
The watch command is just so the output is refreshed every second, you can also just run iostat.

Longer overview of generic system info
Other good tools that let you check real time generic system info that also includes I/O wait is vmstat, just run it as the following, the 1 being the refresh time. The BO and BI headers are for blocks in/out. Also might be usefull to check if processes are being blocked or how much the cpu is waiting (could be on disk io).

vmstat 1

Another way of looking at the generic system info, but now also for the past is sar. You have to install this first (apt-get install sysstat), and enable the daemon in /etc/default/sysstat. And possibly restart the daemon to effectuate. This will then start collection system data that can be viewed by the sar command, keeping 12 hours worth of data.

Organizing Windows desktop icons with Fences

2010-02-21T12:42:00.003+01:00

I frequently get annoyed by apps changing the way I've organized my desktop icons. Only recently I found an excellent program to deal with this once and for all. It's called Fences (by Stardock). It let's you create little boxes or 'fences' where you can drag icons into. Once in a fence you can move the fence or resize it, but all the icons will nicely stay in it.

In contrary to their usual software, this one isn't annoying and it's free for personal usage.
Get it at the Stardocks website.

I'll add one of the screenshots so you've got a bit of an idea how it looks:

Youtube faster with Feather ßeta

2010-01-23T15:30:00.004+01:00

Youtube is testing a new system called Feather, which would deliver their content much faster. Lower latency and reducing the stream from 391 KB to 52 KB are amongst things to watch for.
Though it doesn't yet work for all video's, you can join here.

This doesn't seem to work with Opera or Firefox at the moment because of interpreting issues of the HTML 5 code using ogg or H264 (youtube using the later). Internet Explorer can't handle it at all, so use Chrome or Safari if you want to test.

Edit: Here's an article of Firefox defending why they only play ogg and no H264

Installing Ubuntu 9.10 as home server

2009-12-30T12:14:00.004+01:00

In this article I'm going to be installing Ubuntu Server 9.10 on my home server with some specific requirements. I'm doing the installation on a similar built VM as well to get screencap's.

The server contains 2 SATA drives of 1 TB in it. It also has one internal gigabit nic, and a wifi USB stick.

Requirements
For this system some requirements spring to mind:
-Full install from USB stick, just for the added speed & to test if and how that works.
-Full raid mirror array set for vital data, partially using logical volume management
-Minimal networking setup during installation, as I'll do that later, bridging my wireless internet to wired.

After initial setup is done, I'll write follow-up articles on for example:
-I want an Apache2 server running
-I want a scheduled Dirvish backup
-Monitoring & alerting, undecided with what nagios or cacti or something else
-Networking setup
-DHCP/DNS for internal network/domain
-Wifi internet sharing to my internal wired network (my landlord has wireless internet)

As I can only cover so much in 1 article, we'll mostly handle the installation today.

Getting Ubuntu Server
This should be the least of your worries, in my case I downloaded the ISO, and used UNetbootin to create the USB stick. The later to install from USB for added install speed.
Just make sure your UNetbootin screen looks similar to this:

That's all nice for desktop live cd's, but doesn't work when you just want to install the server version.
Open syslinux.cfg on the root of your usb stick and add the following section (under timeout):

label ubuntuserver

menu label ^Server installer
kernel /install/vmlinuz
append initrd=/install/initrd.gz ramdisk_size=10000 cdrom-detect/try-usb=true root=/dev/rd/0 devfs=mount,dall rw

Note: the 'append' line is 1 line till 'rw' !
I tried about 10 different USB creators and loads of manuals, but in the end I doctored this approach together.

The install
Insert the Ubuntu USB stick or live CD and boot from it. You'll get an UNetbootin menu, where you just select 'Install'. After accepting English as your language for the installer, we come to the main menu.
Select 'Install Ubuntu Server' (you'll skip this step if your working from the USB stick..this is cd only)

We then get to choose the language for the installation process, where I select 'English'

Next up is choosing your country, territory or area.
Here I first select 'Other', then 'Europe' and then 'Netherlands'.

Keyboard setup is next, just select 'No'. On the next 2 screens then say 'USA' and again 'USA'.
You might want to pick whats more appropriate for your system, but most keyboards are USA. USA International is also one that's picked a lot by people in Europe and other native non-english countries.

Now it starts detecting and loading components, this takes a few seconds.

If like me you don't have DHCP server running, you'll get a DHCP autoconfiguration error as thus:

Most people will never get this message as they'll have DHCP auto-configuration from their modem/router. Just press 'Continue' if this happens.

Note: If you don't get the DHCP fail, then your server's TCP/IP settings will be set by your DHCP provider, which should be OK for most systems, though it might be handy to make sure your server will keep the DHCP lease so as to keep a static IP. You can read the manual of the device which provides your DHCP on how to configure it to keep a device on the same IP. (this is definitely outside my scope)

Network Configuration
Will be mostly empty as I plan to setup most networking after installation.

In my specific case I want to manually configure my server's networking to be sure it remains on the same internal IP. Select 'Configure network manually'. Servers like a static IP :)

Next up is entering your IP address. The internal wired will be on the 192.168.66 network, so I set my servers IP to 192.168.66.1. Just make sure you keep it in an allowed private range.

Next question is the netmask, this is usually 255.255.255.0.

Gateway is up next; As I'll be configuring internet later for this machine, I'll make this blank for now.
This usually is your router or modem's IP.

Name server, which I also won't be using for now. So same as last time, blank.
Normally this is either your modem/router, or your internet providers DNS.

Enter a hostname, think of this wisely, you'll be stuck with it for a while, and chances are you're going to be typing it a lot (so something easy & small is handy). In my case bender was the last, but I'm going for 'hactar' this time. In case your stuck for a name you might want to browse wikipedia's list of finctional computers.
(Hactar: the computer that designed the cricket-ball-shaped doomsday bomb (that would destroy the universe) for the people of Krikkit, in Douglas Adams's Life, the Universe and Everything (1982))

Next is your domain name. Unless your running (or building) a domain controller, leave this empty.

Disk Partitioning
The next part is important as your going to be stuck with it for a while. Paritioning in linux can be done very simple, by just letting the partitioner auto configure. But I want a slightly more advanced configuration. As my server contains a lot of files I don't want to lose, I configure my 2 drives as a mirror. And I set most of that up as a volume group for easier dynamic resizing.

I'll give a short list partition wise, then I'll give the screenshots:

/dev/sda1 & /dev/sdb1 = raid 1 mirror as /boot, each 500 MB.
/dev/sda2 & /dev/sdb2 = raid 1 mirror in a volume group VG01, each 999.5 GB

Volume group VG01 setup:

/dev/VG01-swap = mounted as swap, 4 GB
/dev/VG01-root = mounted as /, 15 GB
/dev/VG01-home = mounted as /home, 15 GB
/dev/VG01-share = mounted as /srv, 500GB

Now to continue where we left of. I choose 'Manual' here.

Ignore the sizes a bit from here on, this is my VM's installation and I didn't have enough terabytes to do all this exactly as on my server ;)
As you can see on the next picture, i do have drives, but no free space, which means we haven't got partition tables yet. Just click the 2 harddiscs and the installer will ask if you want a new partition table there.

After getting our partitions fixed, we get a lot more options...

Now select the first piece of freespace (the "pri/log 5.2 gb free space" line), and select "Create a new partition".

As the boot partition should be first on the drive we'll start with that. Set partition size to "500 MB"

Select Primary

Select beginning of space

Next your given the choise of what type of partition we're creating. Change use as into 'Physical volume for RAID', and turn the bootable flag on.

Now do the same for the second harddisc till they both have a raid partition. Go to "Configure software RAID"

In case the installer asks if you want to keep your current partition layout and configure RAID, say Yes.

You should come to the RAID configuration menu, select "Create MD device".

To skip a few screenshots: Select RAID1. Select 2 active devices. Select 0 spare devices.

When asked which are the active partitions of the device, select our two 500MB raid partitions:

After clicking Continue, and then selecting Finish from the main RAID menu, we come back to the main partitioning screen, which by now should look like the following. Highlight (as shown) the 500 MB raid device, and press enter.

By default it will say the partition is unused, change this to ext4 (or whatever you want your partition in, I'm going for ext4), and change the mount point to /boot.

Now that we're done setting up our first raid partition, it's time for the next one. Setup the two remaining free space as logical partitions of all the leftover space. Configure it as a Physical volume for RAID again, only this time leave the bootable flag set to off. After checking things are similar to the image, proceed to the RAID configuration again.

If the RAID configurator asks if you first want to write partition changes, say Yes.
Create a second MD device, also RAID 1 of 2 devices and 0 spares of the remaining two partitions.
After finishing the RAID configurator, enter the new raid device that's created and setup it up for LVM:

Select 'done setting up the partition', and enter the logical volume manager configuration menu.

As it has no volume groups setup yet, this will be the first thing we do: Create volume group

Name it VG01, and as devices select /dev/md1 (our big 999.5 GB mirror). You should come back to the same LVM menu. Now it will no longer show 1 free physical volume, but 1 used, and 1 volume group.

Select Create logical volume, select VG01, name it VG01swap, and make it 4 GB.

We do the same for VG01home (15GB), VG01root (15GB), and VG01share (500GB).

Finish the LVM configurator.

Set VG01home as EXT4, mounted as /home

Set VG01root as EXT4, mounted as /root

Set VG01share as EXT4, mounted as /srv

Set VG01swap as swap.

Now your screen should look like: (ignore that the VG01 partitions are all in MB...;)

Go down and select 'Finish partioning and write changes to disk'. The next question depends a bit on your configuration, but I choose that I don't want my system to boot if my raid mirror breaks.

After this your asked to OK all the partition changes.. say YES if you did all the previous steps correctly.

Further questions are username, full name, password, if you have a proxyserver and if you want to encrypt your homedirectory. Proxyserver was left blank and no encryption of home dir.

Next item of interest was the scheduled updates question. As I like to be present during updates, I have cron-apt handle this on download-only mode, but that's for later. For now answer 'no automatic updates'.

Next question will be the Software selection. This is a handy feature to quickly install various software. As I like to do things manually (read: the hard way ;) I only opt for OpenSSH, which I'll be using to remotely access my ubuntu server.

Install should really get on the way now (feel good moment!).

At some point I was asked by grub if I wanted grub2 (which I did), and what my boot partition was, which I set to '/dev/sda /dev/sdb'.

After this my VM crashed (running M$ virtual pc..go figure :), and on my server I ran into an error that was a known bug on launchpad for intel 915 videocards, which my server has builtin. Luckily the Intel error did not affect system performance especially since I don't do anything graphical on my server.

Next time we continue with first configurations of our new server, in part 2.

Booting multiple OS's from USB stick

2009-12-19T16:45:00.000+01:00

Pendrivelinux.com has an excellent article on this, can't really add more to it :)
Check it out at: http://www.pendrivelinux.com/boot-multiple-iso-from-usb-multiboot-usb/

Windows 7 as Wifi AP ?

2009-12-19T13:15:00.007+01:00

Just came across a really interesting article which claims the full version (non beta/RC or starter versions) of Windows 7 can turn your wifi adapter into a wireless AP!

As I'm currently running the ßeta at home (sorry for being lazy ;) I can't test this at the moment.
But you are welcome to report your own findings as comment. As soon as I install Windows 7 I'll do a follow up article.
Source: gizmodo.

EDIT: Apparently you have to activate this through commandline (i highly doubt this), but the Jan/Feb issue of C'T magazine mentions you can use Connectify from Nomadio for this. Also edited that vwifi doesn't work in the started edition of Windows 7.

EDIT: Found another article which explains how this works through the commandline: http://erratasec.blogspot.com/2009/11/windows-7-includes-soft-ap.html
Also edited in a little wifi graphic, I plan to add at least 1 image to each article :)

Securing a USB stick

2009-12-19T11:58:00.005+01:00

USB sticks, we all put our vital information on it as they're extremely handy to take with you. Downside is that because they're so small, there's a tendency to lose them. Making sure others can't read your private information in case you lose it is a must for most people (like me). Therefor I had a look into encryption techniques:

Truecrypt
Truecrypt is a well known free encryption program, that features a portable mode for USB sticks. This will autorun the truecrypt program and after supplying the password will mount your USB stick on a driveletter of your choosing. Regrettably you have to be an administrator on the machine for this too work.

Omziff
Another program which almost does the same is Omziff. This is also a free portable program that can encrypt files, and can also split files or secure erase them. Download link to the latest version: Omziff 3.3 download. For Omziff you don't need to be an administrator, so you can take your stick anywhere and it will work (as long as it's a windows machine, and your company security isn't done by a paranoid IT guy).

BitlockerToGo
Since Windows Vista, Microsoft has introduced the Bitlocker technology by which you can encrypt drives. New in Windows 7 is BitlockerToGo which, like Truecrypt, can encrypt your drive and include a mounting tool in the unencrypted part of the drive. This will then automatically ask for a password upon insertion of the stick in any PC with Windows 7. As the guys from www.windowssecurity.com made an excellent video on how to set this up, i don't have to reinvent the wheel: Videolink.

Of course there will be many other tools to do the same as the aforementioned programs. But the ones I discussed in the article should give you a good head start on how to make sure nobody sees what's on your usb stick.

EDIT: various typo's fixed
EDIT: added picture

first writeup

2009-12-18T00:36:00.005+01:00

Hi,
This is the first post on this blog.
Still testing how blogger works, but other then that (and having to think about 30 min before coming up with this name...sigh) i've started :)

I hope to publish a lot of interesting articles here in the coming months about anything that I get in touch with IT-wise.

soon to follow up with something less blabby, and more pc related.

till then,
J.

ps. hmm, interesting how it says i've got 2 posts....first bug? :P
EDIT: later i noticed i DID have 2 articles, but the second was saved as a draft...sigh..! Added gfx.