oHbEt.. configuration backup, how to, sample config and reminder..

Unable to turn on WSL feature on a Hyper-V Windows VM

2024-02-25T00:09:00.000-08:00

The issue was due to the Virtualization Extension is not enable by default. Every time I tried running WSL after installing the WSL package, i am getting an error that Virtualization is not enabled on BIOS. I think this is a default error. It will not say to you, "Opps, you are running under Hyper-V, enable it first". So after several google, you have to invoke the command as Admin via power shell.

Command:

wsl --helpSet-VMProcessor -VMName mytestmv01 -ExposeVirtualizationExtensions $true

where mytestvm01 is the name of the VM i need to enable WSL and needs virtualization (seems like nested) extension like you do on your bios for none virtualized machine.

Then reconnect to your VM, you should be able to run now your WSL, ubuntu or what ever flavor of linux you like to enable or install that is available from MS.

WSL - Windows Subsystem for Linux networking issue - cannot connect to network when windows is connected to VPN

2024-02-25T00:02:00.000-08:00

I have this issue on WSL on windows 11, when enabling this feature, by default the NetworkingMode is equal to NAT. No issue when connecting to internet from the bash CLI, but when you are connected to a VPN, like on a corporate VPN, the net setup will not allow you to connect to the internal resources. This is not a problem with WSL on Windows 10 though.

So to fix this, I need to set the NetworkingMode to mirrored. This way, what ever the IP you windows get, will have the same IP on your WSL or Linux Terminal.

To make your WSL networkingmode to mirrored, create a config file under your windows user profile.

If my username is windows.user01, then put the config under C:\Users\windows.user01\

File: .wslconfig

Content of file below:

[wsl2]

networkingMode=mirrored

Or if you are on your bash command line, you can just do

vim /mnt/c/Users/oliver.jagape/.wslconfig

and enter below: then save.

[wsl2]

networkingMode=mirrored

Shutdown WSL

--shutdown

Then open back bash, or if you have windows terminal installed, just type bash, and it will open to Linux bash terminal.

2020-10-20T10:21:00.005-07:00

SMTP Issues - Host or domain name not found - Encountered via trustwave Mailmarshal Email SEG

Ok, so we have that issue that the gateway is unable to deliver via MX or even relaying to the MX hosts directly. To make the story short, we found out that the gateway host was restricted, and we requested to allow SMTP port outgoing to ANY ANY. Still not able to, so the additional port needed was... port 53 (DNS) TCP/UPD, allowed to any any. It works.

Resize root partition of RHEL/CentOS Azure VM

2020-10-19T10:20:00.002-07:00

Usually when provisioning VM, on azure spefically, or even on aws, default partition like on the root or / partition is very minimal. We have here a 2GB / partition that we need to increase.

Steps:

1. Stop or deallocate the VM

2. Go to Disk, then OS DIsk and change the value, usually its 30 GB devided by other partition, so if you need to make it 40GB, just add 38, so make the number 68

3. Save and start the VM

4. Login as root via ssh

5. vgdisplay. sample below.

[root@valog02 ~]# vgdisplay

--- Volume group ---

VG Name rootvg

System ID

Format lvm2

Metadata Areas 1

Metadata Sequence No 7

VG Access read/write

VG Status resizable

MAX LV 0

Cur LV 6

Open LV 6

Max PV 0

Cur PV 1

Act PV 1

VG Size <63.02 GiB

PE Size 4.00 MiB

Total PE 16132

Alloc PE / Size 6400 / 25.00 GiB

Free PE / Size 9732 / <38.02 GiB

VG UUID WhcyfU-IClc-LyI5-uSec-5aAL-lyBp-Orfbf0

Notice the #Free PE / Size 9732 / <38.02 GiB#, so we have some 38GB free to use.

Current size is:

/dev/mapper/rootvg-rootlv 2.0G 66M 2.0G 4% /

6. Now, extend it using lvextend. The LV part is "/dev/mapper/rootvg-rootlv", so command would be below. I just made it 37GB instead, so outcome would be 39GB.

lvextend -L +37G /dev/rootvg/rootlv

Sample:

[root@valog02 ~]# lvextend -L +37G /dev/rootvg/rootlv

Size of logical volume rootvg/rootlv changed from 2.00 GiB (512 extents) to 39.00 GiB (9984 extents).

Logical volume rootvg/rootlv successfully resized.

7. Now that we have extended it, we will grow it online.

xfs_growfs /dev/rootvg/rootlv

[root@valog02 ~]# xfs_growfs /dev/rootvg/rootlv

meta-data=/dev/mapper/rootvg-rootlv isize=512 agcount=4, agsize=131072 blks

= sectsz=4096 attr=2, projid32bit=1

= crc=1 finobt=0 spinodes=0

data = bsize=4096 blocks=524288, imaxpct=25

= sunit=0 swidth=0 blks

naming =version 2 bsize=4096 ascii-ci=0 ftype=1

log =internal bsize=4096 blocks=2560, version=2

= sectsz=4096 sunit=1 blks, lazy-count=1

realtime =none extsz=4096 blocks=0, rtextents=0

data blocks changed from 524288 to 10223616

8. Check the size now.

[root@valog02 ~]# df -h

Filesystem Size Used Avail Use% Mounted on

devtmpfs 16G 0 16G 0% /dev

tmpfs 16G 0 16G 0% /dev/shm

tmpfs 16G 34M 16G 1% /run

tmpfs 16G 0 16G 0% /sys/fs/cgroup

/dev/mapper/rootvg-rootlv 39G 70M 39G 1% /

9. Try to reboot if none production yet.

That's all, keep safe everyone.

Adding this from azure site.

https://docs.microsoft.com/en-us/azure/virtual-machines/linux/resize-os-disk-gpt-partition

ZIMBRA Search keyword across all mailbox servers and users on a list.

2019-02-07T16:14:00.002-08:00

The task is to search certain keywords on each mailbox at zimbra, so on the current version, 8.x, we can use the command:

zmmailbox -z -m username@zimbradomain.defined search "Keyword To Search"

So below is actually a sample search result with a keyword "I Love You"

search "I Love You" on user1@domain.com >> this is not part of zimbra search output, its part of the script to check what search keyword used because the keyword may be part of the email body and the result display what is the subject of the email where you can find the Keyword.

>>Output of search below<<

num: 1, more: false

       Id Type   From                  Subject                                             Date
   ------ ----   -------------------- -------------------------------------------------- --------------
1. -21682 conv   Internal              How can you do that?                                    01/02/19 05:36

>>End of output<<

Going to search via command line, and I have 5 keywords to search and put it on a file at /home/user/keyword_file.txt

Keywords:
I love you
Why do that
Darling
Home
I did not do it

And I have a set of users to search, let say I have 10 users and put it on a file.

/home/user/userlist.txt

user1@domain.com
user2@domain.com and so on..

So below is a script that I have tried, as zimbra user and run it on one of the Mailstore.

#Below is to turn off splitting of multiple word on one line, like "I did not do it"
IFS=$'\n'

#If you want to check command execution
set -x

for keyword in `cat /home/user/keyword_file.txt`
do
for user in `cat /home/user/userlist.txt`
do
echo "search $keyword on mailbox $user"
zmmailbox -z -m $user search "$keyword"
done
done |tee -a /home/user/searchresult.txt
#End here

Just check on the searchresult.txt the results then.

If userslist contains a hundred, you can invoke screen so you can detach and re attach later if you need to check or usually if you did it remotely, so to avoid network disconnect.

Sample haproxy config that proxying a https backend and setup as active passive.

2018-03-07T20:54:00.001-08:00

Sample haproxy config that proxying a https backend and setup as active passive.

global
   # to have these messages end up in /var/log/haproxy.log you will
   # need to:
   #
   # 1) configure syslog to accept network log events. This is done
   #    by adding the '-r' option to the SYSLOGD_OPTIONS in
   #    /etc/sysconfig/syslog
   #
   # 2) configure local2 events to go to the /var/log/haproxy.log
   #   file. A line like the following can be added to
   #   /etc/sysconfig/syslog
   #
   #    local2.*                       /var/log/haproxy.log
   #
   log         127.0.0.1 local2
   tune.ssl.default-dh-param 2048
   chroot      /var/lib/haproxy
   pidfile     /var/run/haproxy.pid
   maxconn     4000
   user        haproxy
   group       haproxy
   daemon

   # turn on stats unix socket
   stats socket /var/lib/haproxy/stats

defaults
   mode                    http
   log                     global
   option                  httplog
   option                  dontlognull
   option http-server-close
   option forwardfor       except 127.0.0.0/8
   option                  redispatch
   retries                 3
   timeout http-request    10s
   timeout queue           1m
   timeout connect         10s
   timeout client          1m
   timeout server          1m
   timeout http-keep-alive 10s
   timeout check           10s
   maxconn                 3000

frontend SHINY_APP
   bind 1.2.3.40:443 ssl crt /etc/ssl/mycert.pem force-tlsv12
   reqadd X-Forwarded-Proto:\ https
   default_backend SHINY_BACKEND_443
   option httplog
   log global

frontend WEB_API
   bind 1.2.3.40:8443 ssl crt /etc/ssl/mycert.pem force-tlsv12
   reqadd X-Forwarded-Proto:\ https
   default_backend WEBAPI_BACKEND_8443
   option httplog
   log global

backend SHINY_BACKEND_443
   balance     roundrobin
   server      MAIN_SHINY_WEB_1.2.3.41 1.2.3.41:443 weight 100 minconn 80 maxconn 180 inter 5s check ssl verify none
   server      BACKUP_SHINY_WEB_1.2.3.42 1.2.3.42:443 weight 100 minconn 80 maxconn 180 inter 5s check ssl verify none backup

backend WEBAPI_BACKEND_8443
   balance     roundrobin
   server      MAIN_WEB_API_1.2.3.43 1.2.3.43:8443 weight 100 minconn 100 maxconn 200 inter 5s check ssl verify none
   server      BACKUP_WEB_API_1.2.3.44 1.2.3.44:8443 weight 100 minconn 100 maxconn 200 inter 5s check ssl verify none backup

listen stats
   bind 1.2.3.40:9999
   stats enable
   stats hide-version
   stats uri /stats
   stats show-desc Shiny Load Balancer Node
   stats refresh 10s
   stats auth admin:password #just change this to your preffered
   stats scope SHINY_BACKEND_443
   stats scope WEBAPI_BACKEND_8443
   stats admin if TRUE
   stats show-legends

# The above is at Centos 7
# to configure the logging, need to edit the rsyslog.conf to accept connection either tcp or udp and set the local2.* to /var/log/haproxy.log, then restart the service.

#The backup keyword at the backend is the setting for the backup role, while the primary is up, there should be none will be routed to the backup. See the documentation of haproxy for further explanation.

Installing commercial wildcard ssl cert on zimbra 8

2018-02-11T18:56:00.003-08:00

Install Commercial SSL Cert at zimbra server (8.8) opensource

Login as root
su - zimbra

This ssl cert is a wildcard certificate

copy csr key, commcercial.crt commercial-gd_bundle.crt to /tmp of the server

change owner or provide read access to the cert files for zimbra user

do a verify

cd /tmp >> this is where the files were uploaded

commercial.key - this is the csr or private key
company.com.crt - this is the ssl cert downloaded from ssl provide
company.com.gd_bundle.crt - the gd_bundle.crt file downloaded from ssl provider

Verify first the certificates.

#command to verify

/opt/zimbra/bin/zmcertmgr verifycrt comm commercial.key company.com.crt company.com.gd_bundle.crt

copy /tmp/commercial.key to /opt/zimbra/ssl/zimbra/commercial/commercial.key

once all are ok, proceed with deployment

This server where this ssl now has been deployed was at a mailstore server, so you may see mailstore related services below.

#command to deploy

zmcertmgr deploycrt comm company.com.crt company.com.gd_bundle.crt

#output below
** Verifying 'company.com.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'
Certificate 'company.com.crt' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match.
** Verifying 'company.com.crt' against 'company.com.gd_bundle.crt'
Valid certificate chain: company.com.crt: OK
** Copying 'company.com.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt'
** Copying 'company.com.gd_bundle.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt'
** Appending ca chain 'company.com.gd_bundle.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt'
** Importing cert '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt' as 'zcs-user-commercial_ca' into cacerts '/opt/zimbra/common/lib/jvm/java/jre/lib/security/cacerts'
** NOTE: restart mailboxd to use the imported certificate.
** Installing imapd certificate '/opt/zimbra/conf/imapd.crt' and key '/opt/zimbra/conf/imapd.key'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/imapd.crt'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/imapd.key'
** Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12'
** Creating keystore '/opt/zimbra/conf/imapd.keystore'
** Installing ldap certificate '/opt/zimbra/conf/slapd.crt' and key '/opt/zimbra/conf/slapd.key'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/slapd.crt'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/slapd.key'
** Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12'
** Creating keystore '/opt/zimbra/mailboxd/etc/keystore'
** Installing mta certificate '/opt/zimbra/conf/smtpd.crt' and key '/opt/zimbra/conf/smtpd.key'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/smtpd.crt'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/smtpd.key'
** Installing proxy certificate '/opt/zimbra/conf/nginx.crt' and key '/opt/zimbra/conf/nginx.key'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/nginx.crt'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/nginx.key'
** NOTE: restart services to use the new certificates.
** Cleaning up 3 files from '/opt/zimbra/conf/ca'
** Removing /opt/zimbra/conf/ca/bea3f1c6.0
** Removing /opt/zimbra/conf/ca/ca.key
** Removing /opt/zimbra/conf/ca/ca.pem
** Copying CA to /opt/zimbra/conf/ca
** Copying '/opt/zimbra/ssl/zimbra/ca/ca.key' to '/opt/zimbra/conf/ca/ca.key'
** Copying '/opt/zimbra/ssl/zimbra/ca/ca.pem' to '/opt/zimbra/conf/ca/ca.pem'
** Creating CA hash symlink 'bea3f1c6.0' -> 'ca.pem'
** Creating /opt/zimbra/conf/ca/commercial_ca_1.crt
** Creating CA hash symlink '27eb7704.0' -> 'commercial_ca_1.crt'
** Creating /opt/zimbra/conf/ca/commercial_ca_2.crt
** Creating CA hash symlink 'cbf06781.0' -> 'commercial_ca_2.crt'
** Creating /opt/zimbra/conf/ca/commercial_ca_3.crt
** Creating CA hash symlink 'f081611a.0' -> 'commercial_ca_3.crt'

#Restart service. zmcontrol restart

You may then verify via web ui.

Could not open file "pg_clog/0XXX"

2018-01-31T16:37:00.005-08:00

I need to vacuum full the database but got this error

mydb=# vacuum full;
ERROR: could not access status of transaction 376865319
DETAIL: Could not open file "pg_clog/0167": No such file or directory.

Solution per searching google.

-bash-3.2$ dd if=/dev/zero of=/pgsql/data/pg_clog/0167 bs=256k count=1

Then VACCUM FULL again.

Fixing iscsi connectivity issue between Centos 6 and Compellent Storage

2018-01-28T21:26:00.001-08:00

Fixing iscsi connectivity issue between Centos 6 and Compellent Storage

I boot a Centos 6 server so it can be mounted with a volume from compellent, but got this issue that the HBA interface cannot be detected at the compellent side but check the connectivity, it able to established connection to iscsi target.

I manually connect the host to the compellent server iscsi ip, so below, I have 8 IP to connect

#connecting
for i in 1 2 3 4 5 6 7 8; do iscsiadm --mode discoverydb --type sendtargets --portal 1.2.3.$i --discover; done

#logging in
iscsiadm -m node -l

#connecting
But i encountered at the compellent an issue where the existing initiator name does not show, so I cannot bind the volume to that said host at compellent.

The fix is to rename the initiator name. Use the command

/sbin/iscsi-iname

The above will generate a new name and then put it at /etc/iscsi/initiatorname.iscsi

If you have an existing InitiatorName=iqn.1994-05.com.redhat:fc5b3050bf

and that name either defined on different IP, you may replace that with the new name and restart iscsi service.

Then check at compellent the hba for the host IP equivalent, it should display the new name and the IP and you can now map the volume to the said server.

sftp chroot environment - config and script

2018-01-02T22:44:00.003-08:00

sftp chroot environment

Of course, sshd service should be enabled.

Sample Config:

#/etc/ssh/sshd_config
#
Protocol 2
SyslogFacility AUTHPRIV
MaxAuthTries 5
PubkeyAuthentication yes
PasswordAuthentication yes
ChallengeResponseAuthentication no
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UsePAM yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
X11Forwarding yes
Ciphers aes128-ctr,aes192-ctr,aes256-ctr
MACs hmac-sha1,hmac-ripemd160
Subsystem sftp internal-sftp

Match Group sftpusers
ChrootDirectory /home/sftpusers/%u
ForceCommand internal-sftp
###EOF

Sample sftp adduser script

#/usr/local/sbin/sftp_adduser.sh
#!/bin/bash
#
if [ $# -lt 1 ]; then
echo "Usage: `basename $0`" sftp username
echo " eg. `basename $0` "sftp_something
exit 1
fi
RANPASS=`date +%s | sha256sum | base64 | head -c 8 ; echo`
USERNAME=$1
SFTPHOME=/home/sftpusers
SFTPSHELL=/usr/libexec/openssh/sftp-server

id $USERNAME 2> /dev/null 1> /dev/null
if [ $? -eq 0 ]
then
echo "$1 already exist, please try again using another name"
exit

else
useradd -d $SFTPHOME/$USERNAME -s $SFTPSHELL -p $RANPASS $USERNAME
echo $RANPASS > /tmp/passwd.tmp001
sleep 1
passwd --stdin < /tmp/passwd.tmp001 $USERNAME
echo $USERNAME >> /etc/listfile/sshusers

#set permission
usermod -g sftpusers $USERNAME
usermod -G sftpusers $USERNAME

#This is the default folder for sftp users
mkdir $SFTPHOME/$USERNAME/FILES

#set permissions
chown root $SFTPHOME/$USERNAME
chmod go-w $SFTPHOME/$USERNAME
chown $USERNAME:sftpusers $SFTPHOME/$USERNAME/FILES
chmod u+rwX $SFTPHOME/$USERNAME
chmod 755 $SFTPHOME/$USERNAME
chmod g+rx $SFTPHOME/$USERNAME

#Details
echo USER CREATED: $USERNAME
echo USER DEFINED PASSWORD: $RANPASS
echo FTP INTERNAL IP: 1.2.3.4
echo FTP EXTERNAL IP: 111.222.112.221
echo USER: $USERNAME has been created at ftp 1.2.3.4 | mail -s "created at sftp 1.2.3.4 on `date`" admin@myhost.com
fi

haproxy sample config used on actual setup

2017-05-18T19:34:00.002-07:00

OS : Centos 6.8
Real Servers are CentOS 5.11

#---------------------------------------------------------------------
# Example configuration for a possible web application. See the
# full configuration options online.
#
# http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
#
#---------------------------------------------------------------------

#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
#
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 600 user haproxy group haproxy daemon

# turn on stats unix socket stats socket /var/lib/haproxy/stats tune.ssl.default-dh-param 2048
#--------------------------------------------------------------------- # common defaults that all the 'listen' and 'backend' sections will # use if not designated in their block
#---------------------------------------------------------------------
defaults
mode http
log global
option tcplog
option dontlognull
option forwardfor except 127.0.0.0/8
option http-server-close
option abortonclose
option redispatch
retries 3
####
timeout http-request 60s
timeout queue 60m
timeout connect 300s #s
timeout client 60m
timeout server 60m
timeout http-keep-alive 5s
timeout check 10s

#tune.ssl.default-dh-param 2048

frontend WEBAPPS_HTTP
bind 10.1.1.12:80
reqadd X-Forwarded-Proto:\ http
default_backend WEBAPPS_Backend

frontend WEBAPPS_HTTPS
bind 10.1.1.12:443 ssl crt /etc/ssl/webapps.pem force-tlsv12
reqadd X-Forwarded-Proto:\ https
default_backend WEBAPPS_Backend

backend WEBAPPS_Backend
balance roundrobin
stick-table type ip size 1m expire 1h
stick on src
option abortonclose
option forwardfor except 127.0.0.0/8
option http-server-close
option httpchk HEAD /check.html HTTP/1.0
server WEB_10.1.1.13 10.1.1.13:80 weight 20 minconn 80 maxconn 180 inter 5s check
server WEB_10.1.1.14 10.1.1.14:80 weight 20 minconn 80 maxconn 180 inter 5s check
server WEB_10.1.1.16 10.1.1.16:80 weight 20 minconn 80 maxconn 160 inter 5s check

listen stats 10.1.1.12:8443
mode http
log global

maxconn 10

timeout client 100s
timeout server 100s
timeout connect 100s
timeout queue 100s

stats enable
stats hide-version
stats refresh 10s
stats show-node
stats scope WEBAPPS_Backend
stats auth hauser:Passworditsuptoyou
stats uri /stats
stats admin if TRUE

could not create unique index "pg_statistic_relid_att_inh_index" on postgresql 9.3 - FIXED

2017-04-27T17:43:00.003-07:00

I have a newly restored database via symantec backup but got a problem.

Scenario:

Postgresql version: 9.3 - Centos
Able to access the database, via command line and pgadmin4 only, pgadmin 3 does not work.
When creating any table, I cannot create, it will not proceed.
When doing command reindex system DBNAME, i am stuck with the error below.

DBNAME=# reindex system DBNAME;
NOTICE: table "pg_catalog.pg_class" was reindexed
ERROR: could not create unique index "pg_statistic_relid_att_inh_index"
DETAIL: Key (starelid, staattnum, stainherit)=(2610, 15, f) is duplicated.

LOG:
Apr 26 14:50:44 stationname postgres[5452]: [10-2] 2017-04-26 14:50:44 PHT postgres DBNAME 127.0.0.1 DETAIL: Key (starelid, staattnum, stainherit)=(2610, 15, f) is duplicated.

Got a tip from one blog I found to check if there were really a duplicate by sql command below: (link of blog: http://www.pateldenish.com/2016/09/recovering-corrupted-postgres-database.html)

select starelid, staattnum, stainherit from pg_catalog.pg_statistic where starelid=2610 order by 2;

DBNAME=# select starelid, staattnum, stainherit from pg_catalog.pg_statistic where starelid=2610 order by 2;
starelid | staattnum | stainherit
----------+-----------+------------
2610 | 1 | f
2610 | 2 | f
2610 | 3 | f
2610 | 4 | f
2610 | 5 | f
2610 | 6 | f
2610 | 7 | f
2610 | 8 | f
2610 | 9 | f
2610 | 10 | f
2610 | 11 | f
2610 | 12 | f
2610 | 13 | f
2610 | 14 | f
2610 | 15 | f
2610 | 16 | f
2610 | 17 | f
2610 | 18 | f
(18 rows)

but there wee no duplicates found.

So since I dont have a choice because I cannot seem to create any additional table, then I may need to restore another one from backup, and since I still have a running backup, so before doing another restore, I tried deleting the reported duplicate by command below:

DBNAME=# delete from pg_catalog.pg_statistic where starelid=2610 and staattnum=15;
DELETE 1

DBNAME=# reindex database DBNAME;
NOTICE: table "pg_catalog.pg_class" was reindexed
ERROR: could not create unique index "pg_statistic_relid_att_inh_index"
DETAIL: Key (starelid, staattnum, stainherit)=(2610, 13, f) is duplicated.

DBNAME=# delete from pg_catalog.pg_statistic where starelid=2610 and staattnum=13;
DELETE 1

After the last deletion of duplicate, I able to reindex system and reindex database and seems those indexes were recreated and my issue on creating any table was fixed.

Small bash script to create or reset nginx reverse proxy protected password

2017-04-25T19:50:00.001-07:00

Create a file /etc/nginx/listofuser

say it contains username

user1
user2
user3

Then, create a hidden file /etc/nginx/.users

Create a bash script and put it at cron, say daily so once run, it will reset the proxy password to daily and email the result to users on the list with CC on admin.

##############################################################################
#!/bin/bash

for USERNAME in `cat /etc/nginx/listofusers`
do
#Random Pass generation using openssl
RANPASS=`openssl rand -base64 32 | sha256sum | base64 | head -c 8 ; echo`

#htpasswd command
/usr/bin/htpasswd -b /etc/nginx/.users $USERNAME $RANPASS

#email the results to users
echo -e "USER: $USERNAME \nPASSWORD: $RANPASS \n \nPlease login at https://myproxy.example.com \n \nNote: Please expect email notification that it has been changed at the end of the day" | mail -s "password changed at myproxy on `date`" -r noreply@example.com $USERNAME@example.com,admin@example.com

done
###############################################################################

or if you want to load it at command line only and output the user and pass and check the file /etc/nginx/.users, see below

#################################################################
#!/bin/bash
for USERNAME in `cat /etc/nginx/listofusers`
do

#Random pass generation using openssl (found it by googling)
RANPASS=`openssl rand -base64 32 | sha256sum | base64 | head -c 8 ; echo`

#htpasswd command
/usr/bin/htpasswd -b /etc/nginx/.users $USERNAME $RANPASS

#display the output after execution
echo "USER: $USERNAME"
echo "PASSWORD: $RANPASS"

done
#################################################################

[root@localhost ~]# /usr/local/bin/test.sh
Updating password for user user1
USER: user1
PASSWORD: ZTkxMTQ0
Updating password for user user2
USER: user2
PASSWORD: ZDc4MTMz
Updating password for user user3
USER: user3
PASSWORD: NTIwOGUx

Below are encrypted password file per htpasswd default encryption (CRYPT)

[root@localhost ~]# cat /etc/nginx/.users
user1:$apr1$HJ7/Q/qG$UTO3KujLj3rkANcNpHked1
user2:$apr1$uk59ZMD4$c4zjvMXarVK9zI7nKthz60
user3:$apr1$iIOsYmbh$GdKdkMjwfi4VEHfwTnER60

Below is the portion where you will set on your nginx config under location parameter

auth_basic "Protected";
auth_basic_user_file /etc/nginx/.users;

How to import multiple filters of a zimbra users.

2017-03-05T21:38:00.002-08:00

To extract the filter of a single user at zimbra cli.

User the command below: example user is testsharedmbox@example.com
as zimbra user at cli, execute:

zmprov ga testsharedmbox@example.com zimbraMailSieveScript

Output below:

# name testsharedmbox@example.com
zimbraMailSieveScript: require ["fileinto", "reject", "tag", "flag"];

# Redirect
if anyof (header :matches ["subject"] "*") {
redirect "user1@yahoo.com";
redirect "user2@gmail.com";
redirect "user3@linux.com";
keep;
stop;
}

So just imagine if you have 1000 redirect, so just use a little bash. Convert the above output to become like below as bash executable.

####

zmprov ma testsharedmbox@example.com zimbraMailSieveScript 'require ["fileinto", "reject", "tag", "flag"];

# Redirect
if anyof (header :matches ["subject"] "*") {
redirect "user1@yahoo.com";
redirect "user2@gmail.com";
redirect "user3@linux.com";
keep;
stop;
}'

####

Tunnel RDP via ssh

2016-06-24T03:07:00.003-07:00

I have a ssh server serve as proxy and i want to tunnel the rdp on it

SSH Server (example only)
Public: 11.11.22.22
Internal: 10.10.1.1

Windows server that I need to RDP via SSH Server
Internal IP: 10.10.1.2

IP of my workstation:
Public: 9.9.9.9 (example only)

So I am going to ssh with below parameters:

ssh -L 12389:10.10.1.2:3389 user@11.11.22.22

Once connected, I can now RDP to 127.0.0.1:12389

So as long as you are connected to 11.11.22.22, RDP is tunneled.

Enabling Transparent Data Encryption on Postgresql 9.3

2016-02-29T00:38:00.002-08:00

Well, this is actually copied from this link.

https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fpgsqldeepdive.blogspot.com%2F2015%2F06%2Fpostgresql-nec-tde.html&edit-text=&act=url

But then, below are my steps.

Specs: Current posstgresql server is 9.3.10

yum install --enablerepo=pgdg93 postgresql93-devel gmake make gcc gcc-c++ postgresql93-test yum-utils rpm-build bison flex perl-ExtUtils-Embed "perl(ExtUtils::MakeMaker)" python-devel tcl-devel readline-devel zlib-devel openssl-devel krb5-devel e2fsprogs-devel gettext libxml2-devel libxslt-devel pam-devel uuid-devel openldap-devel openjade opensp docbook-dtds docbook-style-dsssl rpm-build git

It will update the current postgres-9.3 so be sure you have a backup of you current database.

cd /root
mkdir src
cd src
yumdownloader --source postgresql93
rpm -ivh postgresql93-9.3.11-1PGDG.rhel6.src.rpm
cd /root/rpmbuild
rpmbuild -bp SPECS/postgresql-9.3.spec

mkdir /usr/local/src/
cd /usr/local/src/
git clone https://github.com/nec-postgres/tdeforpg.git
ll /root/rpmbuild/BUILD/postgresql-9.3.11/
export PGSRC=/root/rpmbuild/BUILD/postgresql-9.3.11/
export PGHOME=/usr/pgsql-9.3
export TDEHOME=/usr/local/src/tdeforpg
export PATH=/usr/pgsql-9.3/bin/:$PATH

ln -s /usr/pgsql-9.3/lib/pgcrypto.so /usr/lib64/libpgcrypto.so

cd $PGSRC
./configure

cd /usr/local/src/tdeforpg/SOURCES/data_encryption/

ln -s /root/rpmbuild/BUILD/postgresql-9.3.11/src/backend/utils/errcodes.h /root/rpmbuild/BUILD/postgresql-9.3.11/src/include/utils/errcodes.h

sh makedencryption.sh 93 $PGSRC

ln -s /usr/local/src/tdeforpg/SOURCES/data_encryption/93/data_encryption93.so.1.1.1.1 /usr/lib64/data_encryption.so
chown postgres:postgres -R -v /usr/local/src/tdeforpg

Apped the below line at current postgresql.conf

shared_preload_libraries='/usr/lib64/data_encryption.so'
encrypt.enable = on

Then connect to the database that you want the encryption to be enabled.

as super user.

psql -U pgadminuser -h 127.0.0.1 mycompanydb

then execute

create extension pgcrypto;

then exit.

Follow the ff:

cd $TDEHOME/SOURCES
sh bin/cipher_setup.sh $PGHOME

Transparent data encryption feature setup script
Please select from the setup menu below
Transparent data encryption feature setup menu
1: activate the transparent data encryption feature
2: inactivate the transparent data encryption feature
select menu [1 - 2] > 1
Please enter database server port to connect : 5432
Please enter database user name to connect : pgadminuser
Please enter password for authentication :
Please enter database name to connect : mycompanydb

CREATE LANGUAGE
INFO: Transparent data encryption feature has been activated

cd $TDEHOME/SOURCES
sh bin/cipher_key_regist.sh /usr/pgsql-9.3
=== Database connection information ===
Please enter database server port to connect : 5432
Please enter database user name to connect : pgadminuser
Please enter password for authentication :
Please enter database name to connect : mycompanydb
=== Regist new cipher key ===
Please enter the new cipher key : "make sure you remember this"
Please retype the new cipher key :
Please enter the algorithm for new cipher key : aes

Are you sure to register new cipher key(y/n) : y

Try to check cipherkey table

[root@MyServer SOURCES]# psql -U pgadminuser -h 127.0.0.1 mycompanydb
Password for user pgadminuser:
psql (9.3.11)
Type "help" for help.

mycompanydb=# select * from cipher_key_table;
key
| algorithm
-------------------------------------------------------------------------------------------------------------------------------------------------------------
-----------------------------------------+-----------
\xc38f3e4f1305863e66e2ac3e4eaffe7617e09c7c6f8f3e4f1305863e66e
2ac3e4eaffe7617e09c7c6f8f3e4f1305863e66e2ac3e4eaffe7617e
09c7c6f8f3e4f1305863e66e2ac3e4eaffe7617e09c7c6f

7dacc2290d1ce491c620e0b43702a1f8509656c6 | aes
(1 row)

mycompanydb=#

Then developers will be the one to continue.

Deleting a message per subject via CLI on zimbra

2015-11-15T21:59:00.006-08:00

Deleting a message per subject via CLI on zimbra

The scenario:

You want to delete a message that has been accidentally sent to a bunch of zimbra users and you need to delete those message with out accessing the mailbox of those who received one by one on the web. So you might be ending doing it on a CLI mode.

Assuming that you able to open one of the message that you need to delete. If you view the full headers, you will find that it contain inside the header a msgid:

sample:

msgid:609947668.476624.1447370486564.JavaMail.zimbra@my.company.com

Assuming the the senders zimbra domain is my.company.company

the contents of the message ID is common to all that received the common message.

assuming that you have a list file at /tmp/userlists.txt containing

user1@my.company.com
user2@my.company.com
user3@my.company.com
user4@my.company.com
user5@my.company.com

I used this command to generate first the user with message ID for deletion. Make sure to run this under zimbra user.

for i in `cat /tmp/userlists.txt`; do echo $i,`zmmailbox -z -m $i s -t message -l 1 "msgid:609947668.476624.1447370486564.JavaMail.zimbra@my.company.com" |grep mess |awk '{print $2,$3,$4,$5}'`; done |tee -a /tmp/outputlist.txt

I pipe the output at /tmp/outputlist.txt

Sample output that will fill the file is below:

user1@my.company.com,57 mess Userx MYSPAM:
user2@my.company.com,1705 mess Userx MYSPAM:
user3@my.company.com,505 mess Userx MYSPAM:
user4@my.company.com,4705 mess Userx MYSPAM:
user5@my.company.com,9715 mess Userx MYSPAM:

The Numbers are the MSG ID
UserX is the sender
MYSPAM is the Subject.

I intended to do it to display the Sender and Subject so to double check that the message ID is the exact ID i need to delete.

The awk part is the one that will display the tab needed.

Now, I need to generate the email and the message ID.

cat /tmp/outputlist.txt |awk '{priont $1}' > /tmp/fordeletelist.txt

Outbut is now a csv.

user1@my.company.com,57
user2@my.company.com,1705
user3@my.company.com,505
user4@my.company.com,4705
user5@my.company.com,9715

Then use bash IFS for the little script.

while IFS=, read USER ID; do echo deleting message id $ID from $USER; zmmailbox -z -m $USER dm $ID; done < /tmp/fordeletelist.txt

It will search the user and the message ID which is the number on the file and will delete it. If you have a thousand to delete, it will be helpfull.

By the way, google and there are also scripts provided already, just modified it for my need.

Joining CentOS and authenticate to ACtive Directory using winbind

2015-11-04T22:45:00.004-08:00

Joining CentOS and authenticate to ACtive Directory using winbind

- Make sure that you have a working DNS that can resolve the domain you are going to join and authenticate the CentOS server. Check /etc/resolv.conf

Install the ff:
yum install authconfig krb5-workstation pam_krb5 samba-common

Execute the command:

Assuming the domain is MYCOMPANY.COM

authconfig --disablecache --enablewinbind --enablewinbindauth --smbsecurity=ads --smbworkgroup=MYCOMPANY --smbrealm=MYCOMPANY.COM --enablewinbindusedefaultdomain --enablekrb5 --krb5realm=MYCOMPANY.COM --enablekrb5kdcdns --enablekrb5realmdns --enablelocauthorize --enablepamaccess --smbidmapuid=16777216-16777300 --krb5kdc=srv001.mycompany.com --krb5adminserver=srv001.mycompany.com --winbindtemplateshell=/bin/bash --updateall

The command above will change the /etc/samba/smb.conf and /etc/krb5.conf

Once done on the authconfig command, issue the command below:

kinit admin.user@MYCOMPANY.COM #This will ask for your password that you use on your AD domain to login, and will tell you if the server was joined successfully.

Once accepted, you may join to domain.

net join -w MYCOMPANY.COM -U admin.user #Again will ask for a password.
/etc/init.d/winbind restart
chkconfig winbind on

Some Backup script for postgresql 9.3 database - using parallel run

2015-09-03T17:46:00.000-07:00

#!/bin/bash
#set-x
#Original Script Owner#
# #backuppostgresql.sh
#by #CraigSanders
#this script is public domain. feel free to use or modify as you like.
## Modified by: yongitz and ohbet - 2015 of September
#Note
# to restore database from this backup
# Command is: /usr/pgsql-9.3/bin/pg_restore -j -Fd $DATA
# where data is the path of the backup /db/BACKUP/Date-of-backup/Database_Name-folder
# /usr/pgsql-9.3/bin/pg_restore -j -Fd /db/BACKUP/2015-09-04/database_folder
# See postgresql 9.3 manual page for details
#
PGDUMP="/usr/pgsql-9.3/bin/pg_dump"
PSQL="/usr/pgsql-9.3/bin/psql"
#
# directory to save backups in, must be owned by postgres user
BASE_DIR="/db/BACKUP"
#Make some checking if backup folder is available
#
if ! ls $BASE_DIR > /dev/null 2>&1; then
        echo "Backup directory $BASE_DIR does not exist. Backup processes terminated." | mail -s "!!! ALERT - BACKUP PROCESS FAILED @ DBSERVERXYZ !!!" db.admin@mycompany.com
exit 1
fi
#Create the Base Directory
YMD=$(date "+%Y-%m-%d")
DIR="$BASE_DIR/$YMD"
ls -l $BASE_DIR
mkdir -p $DIR
cd $DIR
#
# get list of databases in system , exclude the tempate db and other db not needed, db below are example only
DBS=$($PSQL -l -t | egrep -v 'template[01]|dbxyz|db2|db_warehouse' | awk '{print $1}' | grep -v '|'|grep -v '^$')
#
# now loop through each individual database
for database in $DBS; do
    DATA=$DIR/$database
    # dump data
    if [ $database = db_live_final ]; then
    # Remarks: j8 = 8 parallel process to run: at 9.3 and above
    # Remarks: -N backup_tables and -N DBX_* are schema that are excluded on backup
     $PGDUMP -v -j8 -N backup_tables -N DBX_* -Fd -f $DATA $database
    else
     $PGDUMP -v -j8 -Fd -f $DATA $database
    fi
done

#copy conf files currently used.
cp /db/pgsql/9.3/data/*.conf $DIR/
#

#Create readme for restore
cat < $DIR/Restore_readme.txt
To restore database from this backup
Use Command:
/usr/pgsql-9.3/bin/pg_restore -j -Fd /path/to/backup/folder/per/db/name
where data is the path of the backup /db/BACKUP/Date-of-backup/Database_Name-folder
Sample Below:
/usr/pgsql-9.3/bin/pg_restore -j -Fd /db/BACKUP/2015-09-04/database_folder
See postgresql 9.3 manual page for further details
EOF
#

# delete backup files older than 30 days
OLD=$(find $BASE_DIR -type d -mtime +30)
if [ -n "$OLD" ] ; then
        echo deleting old backup files: $OLD
        echo $OLD | xargs rm -rf
fi

Then save this as bash script and put on a cron to run daily.

Redirect http to https with multiple VirtualHost on apache

2014-11-16T17:59:00.003-08:00

Goal: Redirect all http to https, domain are config.example.com and configure.example.com.

When first try on it, I encountered redirect problem, when you dont place carefully the virtual host, redirection will got problem, so on my example, I need to place carefully, config http then https, and configure http then https. It should also redirect properly when you have a sub folder.

Note: I changed the tags to |

|VirtualHost *:80|
ServerName config.example.com/
RedirectMatch 301 /(.*)$ https://config.example.com/$1

|/VirtualHost|

|VirtualHost *:443|
        SSLEngine on
        SSLProtocol -ALL -SSLv3 +TLSv1
        SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
        SSLCertificateFile /etc/pki/example_cert_2017/example.com.crt
        SSLCertificateKeyFile /etc/pki/example_cert_2017/example.key
        SSLCertificateChainFile /etc/pki/example_cert_2017/gd_bundle.crt
        ServerName config.example.com
        ServerAlias config.example.com
        DocumentRoot "/data/www/config"
        ErrorLog logs/ssl-config-error_log
        CustomLog logs/ssl-config-access.log common
|/VirtualHost|

|VirtualHost *:80|
ServerName configure.example.com
RedirectMatch 301 /(.*)$ https://configure.example.com/$1
|/VirtualHost|

|VirtualHost *:443|
        SSLEngine on
        SSLProtocol -ALL -SSLv3 +TLSv1
        SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
        SSLCertificateFile /etc/pki/example_cert_2017/example.com.crt
        SSLCertificateKeyFile /etc/pki/example_cert_2017/example.key
        SSLCertificateChainFile /etc/pki/example_cert_2017/gd_bundle.crt
        ServerName configure.example.com
        ServerAlias configure.example.com
        DocumentRoot "/data/www/configure"
        ErrorLog logs/ssl-configure-error_log
        CustomLog logs/ssl-configure-access.log common
|/VirtualHost|

Zimbra email retention under 30 days

2014-11-12T00:24:00.003-08:00

Normally, zimbra COS can allocate only at least 30 Days and more of email retention, and if lower than 30 days is required, COS is not capable. (Well, you may correct my if I am wrong)

Below is a sample script to do the Job.

1. Create a zimbra distro list that will become the bases of user list that have a threshold. For example, 7days_users@list.example.com is the distro, member of this will have a retention of 7 days.

2. The script.

#!/bin/bash
#Generate the members of 7days_users and pipe it on a temp file.
zmprov gdlm 7days_users@list.example.com |egrep -v '^#|members' > /tmp/_TMP7days
#
for USER in `cat /tmp/_TMP7days`
do
zmmailbox -z -m $USER s -t message -l 1000 "before:`date +%x --date="7 days ago"`" |grep mess |awk '{print $2}' > /tmp/7days_$USER
done
##delete ID
for UserName in `cat /tmp/_TMP7days`
do
for MAILID in `cat /tmp/7days_$UserName`
do
zmmailbox -z -m $UserName dm $MAILID
done
done
#end of script

Updating openssl to latest

2014-10-06T17:51:00.003-07:00

Updating openssl to latest

Download the latest openssl source, as of this writing, the latest is the one I installed.

https://www.openssl.org/source/

 Bytes      Timestamp       Filename
________ ____________________ ____________________________
 5149260 Sep 25 22:45:26 2014 openssl-1.0.2-beta3.tar.gz (MD5) (SHA1) (PGP sign)
 1404199 Aug 20 12:52:55 2014 openssl-fips-ecp-2.0.8.tar.gz (MD5) (SHA1) (PGP sign)
 1424766 Aug 20 12:52:46 2014 openssl-fips-2.0.8.tar.gz (MD5) (SHA1) (PGP sign)
 3727934 Aug  6 23:56:45 2014 openssl-0.9.8zb.tar.gz (MD5) (SHA1) (PGP sign)
 3994771 Aug  6 23:56:45 2014 openssl-1.0.0n.tar.gz (MD5) (SHA1) (PGP sign)
 4422117 Aug  6 23:56:45 2014 openssl-1.0.1i.tar.gz (MD5) (SHA1) (PGP sign)  [LATEST]
 4872101 Jul 22 22:53:02 2014 openssl-1.0.2-beta2.tar.gz (MD5) (SHA1) (PGP sign)
 1438620 Jul  4 01:21:08 2014 openssl-fips-2.0.7.tar.gz (MD5) (SHA1) (PGP sign)
 1417674 Jul  4 01:21:08 2014 openssl-fips-ecp-2.0.7.tar.gz (MD5) (SHA1) (PGP sign)

Login to your server as root.
wget https://www.openssl.org/source/openssl-1.0.1i.tar.gz
as root
tar xzvf openssl-1.0.1i.tar.gz
cd openssl-1.0.1i
./config
make
make test
make install
Installation is at /usr/local/ssl/bin/openssl
move old openssl
mv /usr/bin/openssl /root/openssl-old
ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
check version

openssl version

OpenSSL 1.0.1i 6 Aug 2014

Though its better to recompile it as RPM on your build server so as to follow best practice that your production server particular to the one that facing internet should not contain any compiler.

Reversing SVN using good revision number

2013-06-25T00:32:00.004-07:00

When updating the codes or code only using svn, below usually is the output:

-bash-3.2$ svn update --force
svn.user@192.168.1.1's password:
U code01.php
Updated to revision 15701.

but if the dev team wants to revert that to previous revision because there was an error on the code, then the possible command is below:

say, the good revision is 15690 as per dev.

-bash-3.2$ svn merge -r HEAD:15690 code01.php
svn.user@192.168.1.1's password:
--- Reverse-merging r15701 through r15691 into 'code01.php':
U code01.php

Now reverted back to a good revision.

Monitoring a directory for new file, deleted file, modified file with inotifywait and send thru email

2013-06-20T06:13:00.001-07:00

On my setup, I am using CentOS

Add epel repo

yum install inotify-tools

create a bash script at /usr/ocal/bin/inotify_daemon.sh with entry below:

#!/bin/bash
pgrep inotifywait > /dev/null
if [ $? -eq 0 ]
then
exit
else
inotifywait --format '%w%f %e %T' --timefmt '%Y/%m/%d-%H:%M:%S' -e create,delete,modify,move -mrq /path/to/folder/ |while read file;do echo $file | mail -s "activity alert" myuser@mydomain.com; done &
fi

then create a cron entry at crontab or root cron.

* * * * * /usr/ocal/bin/inotify_daemon.sh

The cron will run and if inotify_daemon.sh get accidentally killed, it will run it again. If already running, then it will exit.

I assume that the server has a working smtp and tested to relay email to a ligit and working email system.

Sample email body once it will work is below:

/path/to/folder/test2 DELETE,ISDIR 2013/06/20-05:11:09

the notification that the folder has been deleted.

chroot sftp

2013-06-18T00:38:00.006-07:00

Please update the openssl-server at least

openssh-server-5-xx or

openssh-server-6-xx

CentOS 6.3 has openssh-server-5-xx already.

Ok, assuming that above version has been aquired.

below are my process.. some process are based on results if you google sftp + chroot, just make my self a note to remember.

I am creating a user.sftp user account and sftpusers group as sample.

1. create a group named sftpusers -- groupadd sftpusers

2. mkdir /ftp/sftpusers ---------> this will be my users root home directory.

3. add a user to be used for sftp

useradd -g sftpusers -d /ftp/sftpusers/user.sftp -s /sbin/nologin user.sftp

4. edit the file /etc/ssh/sshd_config

comment out the line that contains:

Subsystem sftp /usr/libexec/openssh/sftp-server

and replaced with:

#----

#Subsystem sftp /usr/libexec/openssh/sftp-server

Subsystem sftp internal-sftp

#----

then append the Match Group entry.

#----

Match Group sftpusers

ChrootDirectory /ftp/sftpusers/%u

ForceCommand internal-sftp

#----

5. create a folder inside /ftp/sftpusers/user.sftp/ and name it anything, here, I named it upload_dir

mkdir /ftp/sftpusers/user.sftp/upload_dir

6. ownership

chown root /ftp/sftpusers/user.sftp

chmod go-w /ftp/sftpusers/user.sftp

chown user.sftp:sftpusers /ftp/sftpusers/user.sftp/upload_dir

chmod u+rwX /ftp/sftpusers/user.sftp

chmod g+rx /ftp/sftpusers/user.sftp

check the owner, should be

drwxr-xr-x. 3 root sftpusers 4096 Jun 17 21:45 user.sftp

7. restart sshd service

when user is able to login via sftp client, if he tries to travserve to other dir..

error will be like below.

ftp> cd /etc/

Couldn't canonicalise: No such file or directory

sftp> ls