blog.chessgriffin.com

blog.chessgriffin.com http://blog.chessgriffin.com/ en-us Copyright 2001-2011, Chess Griffin chess@chessgriffin.com chess@chessgriffin.com Tarsnap http://blog.chessgriffin.com/2011/06/Tarsnap I've been testing out <a href="http://www.tarsnap.com/">Tarsnap</a> to do some backups and I really like this service. The creator and maintainer of Tarsnap is Colin Percival, FreeBSD Security Officer. Essentially, Tarsnap is a secure online backup service that uses a simple command-line interface based on tar and other standard UNIX utilities. The data is <a href="http://www.tarsnap.com/security.html">encrypted using keyfiles</a> and is then stored on Amazon's S3 servers. It's very inexpensive (costs less than $5 to get set up, and the ongoing fees are quite minimal). There is great documentation on <a href="http://www.tarsnap.com/gettingstarted.html">how to get started</a> and <a href="http://www.tarsnap.com/usage.html">general usage</a>. Colin has also created several excellent <a href="http://www.tarsnap.com/man.html">man pages</a> to assist with configuring and using the service, and the website provides some great information on the overall <a href="http://www.tarsnap.com/design.html">design</a> of the service. One issue I ran into when trying out Tarsnap was how to do rotating backups. I asked Colin about this and he pointed me to several third-party scripts, which make this easy. One is <a href="https://bitbucket.org/madssj/tarsnap-sparsify">tarsnap-sparsify</a> which looks great but I have not yet tried. Another way to go is outlined by Jonathan Street on his <a href="http://jonathanstreet.com/blog/setting-up-backups-with-tarsnap/">blog</a>. I have used Jonathan's scripts as a starting point and it all seems to work well. There are lots of online backup services out there, like Crashplan and Jungledisk (although read Colin's <a href="http://www.daemonology.net/blog/2011-06-03-insecurity-in-the-jungle.html">blog post</a> about a security problem he discovered in JungleDisk) but Tarsnap is neat in that it fits the UNIX mindset (i.e. simple and scriptable), is inexpensive, and easy to set up on a server or desktop. I highly recommend folks check it out. chess backup http://blog.chessgriffin.com/2011/06/Tarsnap#comments Sat, 18 Jun 2011 03:22:27 UTC OpenBSD 4.9 Server Setup http://blog.chessgriffin.com/2011/05/OpenBSD-4.9-server-setup I recently set up a new <a href="http://www.openbsd.org">OpenBSD</a> 4.9 server to run this site and decided to tackle a few other things along the way. I ended up with a server running <a href="http://httpd.apache.org/">Apache</a> for web sites, <a href="http://www.dovecot.org/">Dovecot</a> for IMAP, <a href="http://www.postfix.org/">Postfix</a> as a mail transfer agent (MTA), <a href="http://roundcube.net/">Roundcube</a> for webmail, and <a href="http://www.openbsd.org/spamd/">spamd</a> for spam control. Here's an incomplete summary (not a step-by-step cut-and-paste howto) of what I've done and how I got some things to work. What works for me may not work for you, YMMV, and all the standard disclaimers apply. Essentially, I am not an expert sysadmin and I am still learning OpenBSD, so if you apply any of the following to your system and it breaks, you get to keep both pieces. Links to config files and diffs are at the end of this post.  The primary reference for me in all of this was the excellent OpenBSD documentation: the OpenBSD <a href="http://www.openbsd.org/faq/index.html">FAQ</a>, the OpenBSD <a href="http://www.openbsd.org/cgi-bin/man.cgi">man pages</a>, and the instructions displayed in the terminal after installing a package. If you ever need to redisplay the package messages in OpenBSD, just do 'pkg_info -M <packagename>' and the install messages will be displayed. A little bit of Googling or searching the OpenBSD mailing lists was occasionally needed as well. On to the good stuff. <h2>HTTP</h2> After installing OpenBSD, I configured Apache. OpenBSD includes a <a href="http://openbsd.org/faq/faq10.html#httpdchroot">patched and chrooted</a> 1.3 Apache in the base install. The chroot can cause some issues with certain programs, but in the end, I was able to accomodate the chroot without any major problems. The default Apache configuration file in OpenBSD resides at /var/www/conf/httpd.conf and this file sources any files in /var/www/conf/modules. I like to use Apache's <a href="http://httpd.apache.org/docs/1.3/vhosts/">name-based virtual host</a> directives, so I created /var/www/conf/modules/vhosts.conf in which all my websites' <VirtualHost> directives reside. I won't go into detail on how to create and set up Apache per se, as there are zillions of websites that do that already. After creating each websites' directory structure and populating them with the right files for each website, I restarted Apache to make sure all were working. To make restarting Apache easy, I created an alias called 'restart-apache' in my ~/.kshrc file (which is sourced from ~/.profile) which does 'sudo apachectl stop && sleep 5 && sudo apachectl start'. Once I did all that, the Apache server was serving up my small collection of mostly static websites without issue. I decided to go back to <a href="http://trac.obfuscurity.com/blogsum/">Blogsum</a> for my blog, mostly because it's simple and designed by an OpenBSD developer, Jason Dixon. Blogsum is easy to set up by following the included package documentation. Blogsum consists of a couple of small Perl scripts along with a SQLite database for articles and comments. Blogsum uses Recaptcha for spam control which seems to work pretty well. I also tested out WordPress on my OpenBSD box and downloaded the latest version from the WordPress website (I went this way instead of the WordPress package just because WordPress seems to get lots of security updates and I wanted to see if I could use the latest and greatest). I installed MySQL and PHP and got those working in the chroot. For PHP, all you need to do is create a symlink to the php5.conf as explained in the php5-core package instructions.: <code> Install notice: To enable the php5 module please create a symbolic link from /var/www/conf/modules.sample/php5.conf to /var/www/conf/modules/php5.conf. ln -s /var/www/conf/modules.sample/php5.conf \ /var/www/conf/modules The recommended php configuration has been installed to /var/www/conf/php.ini.</code> For MySQL, the main thing is to create a /var/www/var/run/mysql directory and then add a few lines in /etc/rc.local to create a hard link to the MySQL socket file into the chroot. Something like the following in /etc/rc.local: <code>rm -f /var/www/var/run/mysql/mysql.sock /usr/local/share/mysql/mysql.server start sleep 5 ln /var/run/mysql/mysql.sock /var/www/var/run/mysql/mysql.sock</code> should do the trick, although there are other ways to accomplish the same thing. After that, I followed the basic WordPress installation instructions (the "5 Minute Install"), created my database, restarted Apache, and it worked. After installing WordPress, the Akismet anti-spam plugin reported it could not connect to the Akismet servers. This problem was caused because Akismet requires 'allow_url_fopen = On' in /var/www/conf/php.ini, which is set to 'Off' by default. I made that change in the php.ini file, restarted Apache, and then Akismet connected to its servers. After confirming everything worked, I removed WordPress entirely. ;-) I like simple, Blogsum is simple, and for now it meets my needs. But I seem to change blog software far too often, so maybe WordPress will reappear some day. <h2>Email</h2> I then decided to set up email. I ran my own email server years ago, but over time moved to third-party providers like <a href="http://www.fastmail.fm">Fastmail</a> and <a href="http://www.tuffmail.com">Tuffmail</a> (and of course, Gmail for my Gmail accounts). Still, I wanted to run my own email server again because keeping everything in the cloud or on third-party servers is something I am trying to minimize. The first thing was to install Dovecot. Dovecot is very easy to set up and it's been my IMAP server of choice for years. Even when I did not run a true mail server, I've always synced my email accounts using OfflineIMAP and ran a local Dovecot instance to access my email. In this case, there were several flavors of the Dovecot package to choose from, including versions with support for MySQL, LDAP, etc. I did not need any of those things so I just installed the standard flavor Dovecot package. The main config file is /etc/dovecot.conf and it is very well commented. The first change I made was to move imap and imaps (SSL IMAP) to non-standard ports (i.e. other than 143 and 993, respectively). I keep mail in ~/Maildir so that was a simple one line change in dovecot.conf. I also followed the steps displayed in the Dovecot package install message to create the SSL certificates for dovecot and get Dovecot to start on boot: <code>Install notice: Files to facilitate the generation of a self-signed certificate and key for Dovecot have been installed: /etc/ssl/dovecot-openssl.cnf (Edit this accordingly!) /usr/local/sbin/dovecot-mkcert.sh If this has been or will be accomplished by other means, use the following paths for the files: /etc/ssl/dovecotcert.pem /etc/ssl/private/dovecot.pem If you wish to have Dovecot started automatically at boot time, simply add the follow lines to /etc/rc.local: if [ -x /usr/local/sbin/dovecot ]; then echo -n ' dovecot'; /usr/local/sbin/dovecot fi</code> After I got Dovecot installed and working, I decided to install Postfix to use as a MTA. OpenBSD comes with Sendmail in the base install, but following the instructions from the Postfix package, it's one command to change from Sendmail to Postfix: <code>Install notice: Postfix can be set up to replace sendmail entirely. Please read the documentation at file:/usr/local/share/doc/postfix/html/index.html or http://www.postfix.org/ carefully before you decide to do this! To replace sendmail with postfix you have to install a new mailer.conf using the following command: /usr/local/sbin/postfix-enable If you want to restore sendmail, this is done using the following command: /usr/local/sbin/postfix-disable</code> There are a few more steps involved, such as editing the root user's crontab and making a few changes to /etc/rc.conf.local (see <a href="http://blog.endpoint.com/2008/08/switching-from-sendmail-to-postfix-on.html">this</a> howto). Once installed, setting up Postfix is a bit more of a challenge, and this is one package that I definitely feel my knowledge is lacking. I wanted to have authenticated SMTP connections, but had difficulty getting SSL to work correctly with the postfix-sasl2 flavor of the package. I'm sure I could have figured it out in time, but for now, I wanted something straightforward. I came across <a href="http://marc.info/?l=openbsd-misc&m=126529732630274&w=2">this mailing list post</a> which describes (from what I understand) how to get the standard flavor Postfix package to use Dovecot's certificates for encrypted and authenticated SMTP settings. I followed those instructions and edited /etc/postfix/main.cf and /etc/postfix/master.cf accordingly. I also added an smtps service line at the bottom of /etc/services and /var/spool/postfix/etc/services like this: <code># Custom smtps 465/tcp #smtp protocol over TLS/SSL</code> After doing so, I was able to send email using encrypted and authenticated SMTP over port 465. As to my various email domains and addresses, I followed the instructions on the Postfix website on how to use <a href="http://www.postfix.org/VIRTUAL_README.html#virtual_alias">separate virtual domains with UNIX accounts</a>. Basically, I created a /etc/postfix/virtual file with my email accounts pointing to my UNIX account, executed <code>/usr/local/sbin/postmap /etc/postfix/virtual</code> and email started flowing. Once Dovecot and Postfix were working nicely together, I decided to put in another piece of the puzzle: webmail. I've used <a href="http://squirrelmail.org/">Squirrelmail</a> for ages and frankly, it's a bit long in the tooth. So I decided to go with Roundcube, which Tuffmail uses, and is pretty nice-looking. Again, there were several flavors of OpenBSD packages, one with MySQL, one with PostgreSQL, and one with SQLite. A database is needed to store user account information. Since I would be the only user, I went with the SQLite flavor, which seemed simpler and lighter. I had to make several symlinks to include the other PHP modules that Roundcube required. This was all very easy and simple to do with OpenBSD's excellent package documentation output in the terminal. After making all those symlinks, I followed the package instructions for Roundcube: <code>Install notice: With Apache, AllowOverride settings are required on the /var/www/roundcubemail directory. You can configure this as follows: # ln -s /var/www/conf/modules.sample/roundcubemail.conf \ /var/www/conf/modules # apachectl stop # apachectl start Create a link into an appropriate part of the web-server's document root, e.g.: # ln -s ../roundcubemail /var/www/htdocs Next, follow /var/www/roundcubemail/INSTALL or /var/www/roundcubemail/UPGRADING</code> During the Roundcube web install, I had to manually tweak Roundcube's main.inc.php and db.inc.php files in order to add my custom IMAP port and the SQLite db information. I installed mini_sendmail-chroot from packages which installs in /var/www/bin and can pass email from the chroot to the local Postfix server. Initially, I setup Roundcube over regular HTTP just to make sure it was all working. Once I confirmed it worked, I decided I wanted Roundcube to sit on an HTTPS connection, so I edited my vhosts.conf to enable an SSL connection to my webmail. This mostly involved creating a separate name based virtual directive listening on port 443 for Roundcube and copying three lines from the default httpd.conf into that directive to enable SSL: <code>SSLEngine On SSLCertificateFile /etc/ssl/server.crt SSLCertificateKeyFile /etc/ssl/private/server.key</code> I also followed the excellent instructions in the OpenBSD FAQ on <a href="http://www.openbsd.org/faq/faq10.html#HTTPS">how to create the SSL certificates</a>. I restarted Apache and connected to my webmail over HTTPS. <h2>Firewall and Anti-spam</h2> As the last step in the email process, I decided to get spamd going. Spamd is a graylisting anti-spam measure, which also comes in the OpenBSD base install. It works in conjunction with PF, the awesome OpenBSD firewall, and does a great job at combating spam. I took this opportunity to set up PF itself as well. I will not go into detail about PF because there are far better resources already out there than what I could provide -- starting with the offical OpenBSD <a href="http://openbsd.org/faq/pf/index.html">PF Guide</a>. Additionally, a very good third-party PF resource is Peter N.M. Hansteen's <a href="http://home.nuug.no/~peter/pf/">site</a>. Peter also wrote the excellent <a href="http://nostarch.com/pf2.htm">The Book of PF</a> which I have and highly recommend. Peter's website and book contain a wealth of information on PF including how to set up and use spamd. Another good spamd howto I found is <a href="http://www.unixtechnics.org/openbsd-spamd.html">here</a>. <h2>Other</h2> Finally, I pulled over my .gnupg, .mutt, and .irssi folders in order to have those things available. I run irssi in <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tmux&sektion=1">tmux</a> (having ditched GNU Screen) since tmux comes with the OpenBSD base install. If you know GNU Screen, then you should pretty much feel at home with tmux. A few of the keybindings are different, but if you want, you can override those with a user config file to simulate GNU Screen. The tmux man page is very helpful. <h2>Summary</h2> Overall, I am really happy with this setup and the machine is working great. Plus, it was a fun project to boot. Thanks to all the OpenBSD developers for their hard work at making the operating system and packages secure and easy to set up and configure. If you like OpenBSD or want to support their work in things like PF or OpenSSH, consider <a href="http://openbsd.org/orders.html">ordering</a> a CD set -- they come with cool stickers. ;-) Files and diffs: <ul> <li>/etc/dovecot.conf <a href="http://chessgriffin.com/files/config/openbsd/dovecot.conf.diff">diff</a></li> <li>/etc/postfix/main.cf <a href="http://chessgriffin.com/files/config/openbsd/main.cf.diff">diff</a></li> <li>/etc/postfix/master.cf <a href="http://chessgriffin.com/files/config/openbsd/master.cf.diff">diff</a></li> <li><a href="http://chessgriffin.com/files/config/openbsd/rc.conf.local">/etc/rc.conf.local</a></li> <li><a href="http://chessgriffin.com/files/config/openbsd/rc.local">/etc/rc.local</a></li> <li>/var/www/conf/httpd.conf <a href="http://chessgriffin.com/files/config/openbsd/httpd.diff">diff</a></li> <li>/var/www/roundcubemail/config/db.cf <a href="http://chessgriffin.com/files/config/openbsd/roundcube-db.cf.diff">diff</a></li> <li>/var/www/roundcubemail/config/main.cf <a href="http://chessgriffin.com/files/config/openbsd/roundcube-main.cf.diff">diff</a></li> <li>output of <a href="http://chessgriffin.com/files/config/openbsd/pkg-info"</a>pkg_info</a></li> </ul> chess bsd http://blog.chessgriffin.com/2011/05/OpenBSD-4.9-server-setup#comments Mon, 09 May 2011 14:48:48 UTC Spring 2011 http://blog.chessgriffin.com/2011/03/Spring-2011 Yeah, yeah. I know — the rarely updated blog syndrome. ;-) I will begin by stating that reports of my death are greatly exaggerated. I also have not spent time in jail. But thanks for asking, heh. So what have I been up to? Work and family stuff, mostly. I did run a half-marathon last November and continue to run about 10-15 miles per week. I’ve never been much of a runner so the fact that I enjoy it continually amazes me. I also /finally/ signed up for a Twitter account (@chessgriffin) only about 5 years after everybody else. I have no idea if I’ll stick with it, but it’s interesting for now. Feel free to “follow” me if you want. I’ve got some audio/podio book recommendations that I”ll post there soonish. Not much news on the Linux front since my hacking time has been severely curtailed. In fact, I have not really kept up with Linux news too much. Has Libranet made a comeback yet? Later, peeps. chess general http://blog.chessgriffin.com/2011/03/Spring-2011#comments Mon, 21 Mar 2011 20:50:27 UTC