Unable to turn on WSL feature on a Hyper-V Windows VM

 The issue was due to the Virtualization Extension is not enable by default. Every time I tried running WSL after installing the WSL package, i am getting an error that Virtualization is not enabled on BIOS. I think this is a default error. It will not say to you, "Opps, you are running under Hyper-V, enable it first". So after several google, you have to invoke the command as Admin via power shell.

Command:

wsl --helpSet-VMProcessor -VMName mytestmv01 -ExposeVirtualizationExtensions $true

where mytestvm01 is the name of the VM i need to enable WSL and needs virtualization (seems like nested) extension like you do on your bios for none virtualized machine.

Then reconnect to your VM, you should be able to run now your WSL, ubuntu or what ever flavor of linux you like to enable or install that is available from MS.

WSL - Windows Subsystem for Linux networking issue - cannot connect to network when windows is connected to VPN

 I have this issue on WSL on windows 11, when enabling this feature, by default the NetworkingMode is equal to NAT. No issue when connecting to internet from the bash CLI, but when you are connected to a VPN, like on a corporate VPN, the net setup will not allow you to connect to the internal resources. This is not a problem with WSL on Windows 10 though.

So to fix this, I need to set the NetworkingMode to mirrored. This way, what ever the IP you windows get, will have the same IP on your WSL or Linux Terminal.

To make your WSL networkingmode to mirrored, create a config file under your windows user profile.

If my username is windows.user01, then put the config under C:\Users\windows.user01\

File: .wslconfig

Content of file below:

[wsl2]

networkingMode=mirrored

Or if you are on your bash command line, you can just do

vim /mnt/c/Users/oliver.jagape/.wslconfig

and enter below: then save.

[wsl2]

networkingMode=mirrored

Shutdown WSL

--shutdown

Then open back bash, or if you have windows terminal installed, just type bash, and it will open to Linux bash terminal.

SMTP Issues - Host or domain name not found - Encountered via trustwave Mailmarshal Email SEG

Ok, so we have that issue that the gateway is unable to deliver via MX or even relaying to the MX hosts directly. To make the story short, we found out that the gateway host was restricted, and we requested to allow SMTP port outgoing to ANY ANY. Still not able to, so the additional port needed was... port 53 (DNS) TCP/UPD, allowed to any any. It works.

Resize root partition of RHEL/CentOS Azure VM

Usually when provisioning VM, on azure spefically, or even on aws, default partition like on the root or / partition is very minimal. We have here a 2GB / partition that we need to increase.

Steps:

1. Stop or deallocate the VM

2. Go to Disk, then OS DIsk and change the value, usually its 30 GB devided by other partition, so if you need to make it 40GB, just add 38, so make the number 68

3. Save and start the VM

4. Login as root via ssh

5. vgdisplay. sample below.

[root@valog02 ~]# vgdisplay

  --- Volume group ---

  VG Name               rootvg

  System ID

  Format                lvm2

  Metadata Areas        1

  Metadata Sequence No  7

  VG Access             read/write

  VG Status             resizable

  MAX LV                0

  Cur LV                6

  Open LV               6

  Max PV                0

  Cur PV                1

  Act PV                1

  VG Size               <63.02 GiB

  PE Size               4.00 MiB

  Total PE              16132

  Alloc PE / Size       6400 / 25.00 GiB

  Free  PE / Size       9732 / <38.02 GiB

  VG UUID               WhcyfU-IClc-LyI5-uSec-5aAL-lyBp-Orfbf0

Notice the  #Free  PE / Size       9732 / <38.02 GiB#, so we have some 38GB free to use.

Current size is: 

/dev/mapper/rootvg-rootlv   2.0G   66M  2.0G   4% /

6. Now, extend it using lvextend. The LV part is "/dev/mapper/rootvg-rootlv", so command would be below. I just made it 37GB instead, so outcome would be 39GB.

lvextend -L +37G /dev/rootvg/rootlv

Sample:

[root@valog02 ~]# lvextend -L +37G /dev/rootvg/rootlv

  Size of logical volume rootvg/rootlv changed from 2.00 GiB (512 extents) to 39.00 GiB (9984 extents).

  Logical volume rootvg/rootlv successfully resized.

  

                                                 

7. Now that we have extended it, we will grow it online.

                                                 

xfs_growfs /dev/rootvg/rootlv

                                                 

                                                 

                                                 

  [root@valog02 ~]# xfs_growfs /dev/rootvg/rootlv

meta-data=/dev/mapper/rootvg-rootlv isize=512    agcount=4, agsize=131072 blks

         =                       sectsz=4096  attr=2, projid32bit=1

         =                       crc=1        finobt=0 spinodes=0

data     =                       bsize=4096   blocks=524288, imaxpct=25

         =                       sunit=0      swidth=0 blks

naming   =version 2              bsize=4096   ascii-ci=0 ftype=1

log      =internal               bsize=4096   blocks=2560, version=2

         =                       sectsz=4096  sunit=1 blks, lazy-count=1

realtime =none                   extsz=4096   blocks=0, rtextents=0

data blocks changed from 524288 to 10223616

 8. Check the size now.

                                                 

  [root@valog02 ~]# df -h

Filesystem                  Size  Used Avail Use% Mounted on

devtmpfs                     16G     0   16G   0% /dev

tmpfs                        16G     0   16G   0% /dev/shm

tmpfs                        16G   34M   16G   1% /run

tmpfs                        16G     0   16G   0% /sys/fs/cgroup

/dev/mapper/rootvg-rootlv    39G   70M   39G   1% /

    

                                                 

 9. Try to reboot if none production yet.

                                                 

 

                                                 

                                                 

That's all, keep safe everyone.     

Adding this from azure site.

https://docs.microsoft.com/en-us/azure/virtual-machines/linux/resize-os-disk-gpt-partition

ZIMBRA Search keyword across all mailbox servers and users on a list.

The task is to search certain keywords on each mailbox at zimbra, so on the current version, 8.x, we can use the command:

zmmailbox -z -m username@zimbradomain.defined search "Keyword To Search"

So below is actually a sample search result with a keyword "I Love You"

search "I Love You" on user1@domain.com >> this is not part of zimbra search output, its part of the script to check what search keyword used because the keyword may be part of the email body and the result display what is the subject of the email where you can find the Keyword.

>>Output of search below<<

num: 1, more: false

       Id  Type   From                  Subject                                             Date
   ------  ----   --------------------  --------------------------------------------------  --------------
1. -21682  conv   Internal              How can you do that?                                    01/02/19 05:36



>>End of output<<

Going to search via command line, and I have 5 keywords to search and put it on a file at /home/user/keyword_file.txt

Keywords:
I love you
Why do that
Darling
Home
I did not do it

And I have a set of users to search, let say I have 10 users and put it on a file.

/home/user/userlist.txt

user1@domain.com
user2@domain.com and so on..

So below is a script that I have tried, as zimbra user and run it on one of the Mailstore.


#Below is to turn off splitting of multiple word on one line, like "I did not do it"
IFS=$'\n'

#If you want to check command execution
set -x

for keyword in `cat /home/user/keyword_file.txt`
do
for user in `cat /home/user/userlist.txt`
do
echo "search $keyword on mailbox $user"
zmmailbox -z -m $user search "$keyword"
done
done |tee -a /home/user/searchresult.txt
#End here

Just check on the searchresult.txt the results then.

If userslist contains a hundred, you can invoke screen so you can detach and re attach later if you need to check or usually if you did it remotely, so to avoid network disconnect.

Sample haproxy config that proxying a https backend and setup as active passive.

Sample haproxy config that proxying a https backend and setup as active passive.



global
   # to have these messages end up in /var/log/haproxy.log you will
   # need to:
   #
   # 1) configure syslog to accept network log events.  This is done
   #    by adding the '-r' option to the SYSLOGD_OPTIONS in
   #    /etc/sysconfig/syslog
   #
   # 2) configure local2 events to go to the /var/log/haproxy.log
   #   file. A line like the following can be added to
   #   /etc/sysconfig/syslog
   #
   #    local2.*                       /var/log/haproxy.log
   #
   log         127.0.0.1 local2
   tune.ssl.default-dh-param 2048
   chroot      /var/lib/haproxy
   pidfile     /var/run/haproxy.pid
   maxconn     4000
   user        haproxy
   group       haproxy
   daemon

   # turn on stats unix socket
   stats socket /var/lib/haproxy/stats

defaults
   mode                    http
   log                     global
   option                  httplog
   option                  dontlognull
   option http-server-close
   option forwardfor       except 127.0.0.0/8
   option                  redispatch
   retries                 3
   timeout http-request    10s
   timeout queue           1m
   timeout connect         10s
   timeout client          1m
   timeout server          1m
   timeout http-keep-alive 10s
   timeout check           10s
   maxconn                 3000


frontend SHINY_APP
   bind 1.2.3.40:443 ssl crt /etc/ssl/mycert.pem force-tlsv12
   reqadd X-Forwarded-Proto:\ https
   default_backend SHINY_BACKEND_443
   option httplog
   log global

frontend WEB_API
   bind 1.2.3.40:8443 ssl crt /etc/ssl/mycert.pem force-tlsv12
   reqadd X-Forwarded-Proto:\ https
   default_backend WEBAPI_BACKEND_8443
   option httplog
   log global


backend SHINY_BACKEND_443
   balance     roundrobin
   server      MAIN_SHINY_WEB_1.2.3.41 1.2.3.41:443 weight 100 minconn 80 maxconn 180 inter 5s check ssl verify none
   server      BACKUP_SHINY_WEB_1.2.3.42 1.2.3.42:443 weight 100 minconn 80 maxconn 180 inter 5s check ssl verify none backup

backend WEBAPI_BACKEND_8443
   balance     roundrobin
   server      MAIN_WEB_API_1.2.3.43 1.2.3.43:8443 weight 100 minconn 100 maxconn 200 inter 5s check ssl verify none
   server      BACKUP_WEB_API_1.2.3.44 1.2.3.44:8443 weight 100 minconn 100 maxconn 200 inter 5s check ssl verify none backup



listen stats
   bind 1.2.3.40:9999
   stats enable
   stats hide-version
   stats uri /stats
   stats show-desc Shiny Load Balancer Node
   stats refresh 10s
   stats auth admin:password #just change this to your preffered
   stats scope SHINY_BACKEND_443
   stats scope WEBAPI_BACKEND_8443
   stats admin if TRUE
   stats show-legends


# The above is at Centos 7
# to configure the logging, need to edit the rsyslog.conf to accept connection either tcp or udp and set the local2.* to /var/log/haproxy.log, then restart the service.

#The backup keyword at the backend is the setting for the backup role, while the primary is up, there should be none will be routed to the backup. See the documentation of haproxy for further explanation.

Installing commercial wildcard ssl cert on zimbra 8

Install Commercial SSL Cert at zimbra server (8.8) opensource

Login as root
su - zimbra

This ssl cert is a wildcard certificate

copy csr key, commcercial.crt commercial-gd_bundle.crt to /tmp of the server

change owner or provide read access to the cert files for zimbra user

do a verify 

cd /tmp >> this is where the files were uploaded

commercial.key - this is the csr or private key
company.com.crt - this is the ssl cert downloaded from ssl provide
company.com.gd_bundle.crt - the gd_bundle.crt file downloaded from ssl provider

Verify first the certificates.

#command to verify

/opt/zimbra/bin/zmcertmgr verifycrt comm commercial.key company.com.crt company.com.gd_bundle.crt

copy /tmp/commercial.key to /opt/zimbra/ssl/zimbra/commercial/commercial.key

once all are ok, proceed with deployment

This server where this ssl now has been deployed was at a mailstore server, so you may see mailstore related services below.

#command to deploy

zmcertmgr deploycrt comm company.com.crt company.com.gd_bundle.crt 

#output below
** Verifying 'company.com.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'
Certificate 'company.com.crt' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match.
** Verifying 'company.com.crt' against 'company.com.gd_bundle.crt'
Valid certificate chain: company.com.crt: OK
** Copying 'company.com.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt'
** Copying 'company.com.gd_bundle.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt'
** Appending ca chain 'company.com.gd_bundle.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt'
** Importing cert '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt' as 'zcs-user-commercial_ca' into cacerts '/opt/zimbra/common/lib/jvm/java/jre/lib/security/cacerts'
** NOTE: restart mailboxd to use the imported certificate.
** Installing imapd certificate '/opt/zimbra/conf/imapd.crt' and key '/opt/zimbra/conf/imapd.key'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/imapd.crt'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/imapd.key'
** Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12'
** Creating keystore '/opt/zimbra/conf/imapd.keystore'
** Installing ldap certificate '/opt/zimbra/conf/slapd.crt' and key '/opt/zimbra/conf/slapd.key'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/slapd.crt'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/slapd.key'
** Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12'
** Creating keystore '/opt/zimbra/mailboxd/etc/keystore'
** Installing mta certificate '/opt/zimbra/conf/smtpd.crt' and key '/opt/zimbra/conf/smtpd.key'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/smtpd.crt'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/smtpd.key'
** Installing proxy certificate '/opt/zimbra/conf/nginx.crt' and key '/opt/zimbra/conf/nginx.key'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/nginx.crt'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/nginx.key'
** NOTE: restart services to use the new certificates.
** Cleaning up 3 files from '/opt/zimbra/conf/ca'
** Removing /opt/zimbra/conf/ca/bea3f1c6.0
** Removing /opt/zimbra/conf/ca/ca.key
** Removing /opt/zimbra/conf/ca/ca.pem
** Copying CA to /opt/zimbra/conf/ca
** Copying '/opt/zimbra/ssl/zimbra/ca/ca.key' to '/opt/zimbra/conf/ca/ca.key'
** Copying '/opt/zimbra/ssl/zimbra/ca/ca.pem' to '/opt/zimbra/conf/ca/ca.pem'
** Creating CA hash symlink 'bea3f1c6.0' -> 'ca.pem'
** Creating /opt/zimbra/conf/ca/commercial_ca_1.crt
** Creating CA hash symlink '27eb7704.0' -> 'commercial_ca_1.crt'
** Creating /opt/zimbra/conf/ca/commercial_ca_2.crt
** Creating CA hash symlink 'cbf06781.0' -> 'commercial_ca_2.crt'
** Creating /opt/zimbra/conf/ca/commercial_ca_3.crt
** Creating CA hash symlink 'f081611a.0' -> 'commercial_ca_3.crt'


#Restart service. zmcontrol restart

You may then verify via web ui.

Could not open file "pg_clog/0XXX"

I need to vacuum full the database but got this error

mydb=# vacuum full;
ERROR:  could not access status of transaction 376865319
DETAIL:  Could not open file "pg_clog/0167": No such file or directory.




Solution per searching google.

-bash-3.2$ dd if=/dev/zero of=/pgsql/data/pg_clog/0167 bs=256k count=1


Then VACCUM FULL again.

Fixing iscsi connectivity issue between Centos 6 and Compellent Storage

Fixing iscsi connectivity issue between Centos 6 and Compellent Storage


I boot a Centos 6 server so it can be mounted with a volume from compellent, but got this issue that the HBA interface cannot be detected at the compellent side but check the connectivity, it able to established connection to iscsi target.


I manually connect the host to the compellent server iscsi ip, so below, I have 8 IP to connect

#connecting
for i in 1 2 3 4 5 6 7 8; do iscsiadm --mode discoverydb --type sendtargets --portal 1.2.3.$i --discover; done

#logging in
iscsiadm -m node -l



#connecting
But i encountered at the compellent an issue where the existing initiator name does not show, so I cannot bind the volume to that said host at compellent.

The fix is to rename the initiator name. Use the command

/sbin/iscsi-iname


The above will generate a new name and then put it at /etc/iscsi/initiatorname.iscsi



If you have an existing InitiatorName=iqn.1994-05.com.redhat:fc5b3050bf

and that name either defined on different IP, you may replace that with the new name and restart iscsi service.

Then check at compellent the hba for the host IP equivalent, it should display the new name and the IP and you can now map the volume to the said server. 

sftp chroot environment - config and script

sftp chroot environment


Of course, sshd service should be enabled.


Sample Config:

#/etc/ssh/sshd_config
#
Protocol 2
SyslogFacility AUTHPRIV
MaxAuthTries 5
PubkeyAuthentication yes
PasswordAuthentication yes
ChallengeResponseAuthentication no
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UsePAM yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
X11Forwarding yes
Ciphers aes128-ctr,aes192-ctr,aes256-ctr
MACs hmac-sha1,hmac-ripemd160
Subsystem       sftp    internal-sftp

Match Group sftpusers
        ChrootDirectory /home/sftpusers/%u
        ForceCommand internal-sftp
###EOF



Sample sftp adduser script

#/usr/local/sbin/sftp_adduser.sh
#!/bin/bash
#
if [ $# -lt 1 ]; then
        echo "Usage: `basename $0`" sftp username
        echo "   eg. `basename $0` "sftp_something
        exit 1
fi
RANPASS=`date +%s | sha256sum | base64 | head -c 8 ; echo`
USERNAME=$1
SFTPHOME=/home/sftpusers
SFTPSHELL=/usr/libexec/openssh/sftp-server

id $USERNAME 2> /dev/null 1>  /dev/null
if [ $? -eq 0 ]
then
echo "$1 already exist, please try again using another name"
exit

else
        useradd -d $SFTPHOME/$USERNAME -s $SFTPSHELL -p $RANPASS $USERNAME
        echo $RANPASS > /tmp/passwd.tmp001
        sleep 1
        passwd --stdin < /tmp/passwd.tmp001 $USERNAME
        echo $USERNAME >> /etc/listfile/sshusers

        #set permission
        usermod -g sftpusers $USERNAME
        usermod -G sftpusers $USERNAME

        #This is the default folder for sftp users
        mkdir $SFTPHOME/$USERNAME/FILES
     
        #set permissions
        chown root $SFTPHOME/$USERNAME
        chmod go-w $SFTPHOME/$USERNAME
        chown $USERNAME:sftpusers $SFTPHOME/$USERNAME/FILES
        chmod u+rwX $SFTPHOME/$USERNAME
        chmod 755 $SFTPHOME/$USERNAME
        chmod g+rx $SFTPHOME/$USERNAME

        #Details
        echo USER CREATED: $USERNAME
        echo USER DEFINED PASSWORD: $RANPASS
        echo FTP INTERNAL IP: 1.2.3.4
        echo FTP EXTERNAL IP: 111.222.112.221
        echo USER: $USERNAME has been created at ftp 1.2.3.4 | mail -s "created at sftp 1.2.3.4 on `date`" admin@myhost.com
fi

haproxy sample config used on actual setup

OS : Centos 6.8
Real Servers are CentOS 5.11



#---------------------------------------------------------------------
# Example configuration for a possible web application.  See the
# full configuration options online.
#
#   http://haproxy.1wt.eu/download/1.4/doc/configuration.txt
#
#---------------------------------------------------------------------

#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
    #
    log         127.0.0.1 local2
    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     600                                                                                                                                           user        haproxy                                                                                                                                         group       haproxy                                                                                                                                       daemon                                                                                                                                                  
                                                                                                                                                           
    # turn on stats unix socket                                                                                                                             stats socket /var/lib/haproxy/stats                                                                                                                 tune.ssl.default-dh-param 2048                                                                                                                          
#---------------------------------------------------------------------                                                         # common defaults that all the 'listen' and 'backend' sections will                                                                   # use if not designated in their block                                                                                                            
#---------------------------------------------------------------------                                                                                      
defaults                                                                                                                                                    
   mode                    http                                                                                                                            
   log                     global                                                                                                                          
   option tcplog                                                                                                                                          
   option                  dontlognull                                                                                                                  
   option forwardfor       except 127.0.0.0/8                                                                                                              
    option http-server-close                                                                                                                                
    option abortonclose                                                                                                                                    
    option                  redispatch                                                                                                                      
    retries                 3                                                                                                                              
    ####
    timeout http-request    60s
    timeout queue           60m
    timeout connect         300s #s
    timeout client          60m
    timeout server          60m
    timeout http-keep-alive 5s
    timeout check           10s

    #tune.ssl.default-dh-param 2048

frontend WEBAPPS_HTTP
        bind 10.1.1.12:80
        reqadd X-Forwarded-Proto:\ http
        default_backend WEBAPPS_Backend
       
frontend WEBAPPS_HTTPS
        bind 10.1.1.12:443 ssl crt /etc/ssl/webapps.pem force-tlsv12
        reqadd X-Forwarded-Proto:\ https
        default_backend WEBAPPS_Backend

backend WEBAPPS_Backend
        balance roundrobin
        stick-table type ip size 1m expire 1h
        stick on src
        option abortonclose
        option forwardfor except 127.0.0.0/8
        option http-server-close
        option httpchk HEAD /check.html HTTP/1.0
        server WEB_10.1.1.13 10.1.1.13:80 weight 20 minconn 80 maxconn 180 inter 5s check
        server WEB_10.1.1.14 10.1.1.14:80 weight 20 minconn 80 maxconn 180 inter 5s check
        server WEB_10.1.1.16 10.1.1.16:80 weight 20 minconn 80 maxconn 160 inter 5s check

listen  stats 10.1.1.12:8443
        mode            http
        log             global

        maxconn 10

        timeout client     100s
        timeout server     100s
        timeout connect    100s
        timeout queue   100s

        stats enable
        stats hide-version
        stats refresh 10s
        stats show-node
        stats scope WEBAPPS_Backend
        stats auth hauser:Passworditsuptoyou
        stats uri /stats
        stats admin if TRUE

could not create unique index "pg_statistic_relid_att_inh_index" on postgresql 9.3 - FIXED

I have a newly restored database via symantec backup but got a problem.

Scenario:

• Postgresql version: 9.3 - Centos
• Able to access the database, via command line and pgadmin4 only, pgadmin 3 does not work.
• When creating any table, I cannot create, it will not proceed.
• When doing command reindex system DBNAME, i am stuck with the error below.
  
  DBNAME=# reindex system DBNAME;
  NOTICE: table "pg_catalog.pg_class" was reindexed
  ERROR: could not create unique index "pg_statistic_relid_att_inh_index"
  DETAIL: Key (starelid, staattnum, stainherit)=(2610, 15, f) is duplicated.
  
  LOG:
  Apr 26 14:50:44 stationname postgres[5452]: [10-2] 2017-04-26 14:50:44 PHT postgres DBNAME 127.0.0.1 DETAIL: Key (starelid, staattnum, stainherit)=(2610, 15, f) is duplicated.
  
  
  Got a tip from one blog I found to check if there were really a duplicate by sql command below: (link of blog: http://www.pateldenish.com/2016/09/recovering-corrupted-postgres-database.html)
  
  select starelid, staattnum, stainherit from pg_catalog.pg_statistic where starelid=2610 order by 2;
  
  
  DBNAME=# select starelid, staattnum, stainherit from pg_catalog.pg_statistic where starelid=2610 order by 2;
  starelid | staattnum | stainherit
  ----------+-----------+------------
  2610 | 1 | f
  2610 | 2 | f
  2610 | 3 | f
  2610 | 4 | f
  2610 | 5 | f
  2610 | 6 | f
  2610 | 7 | f
  2610 | 8 | f
  2610 | 9 | f
  2610 | 10 | f
  2610 | 11 | f
  2610 | 12 | f
  2610 | 13 | f
  2610 | 14 | f
  2610 | 15 | f
  2610 | 16 | f
  2610 | 17 | f
  2610 | 18 | f
  (18 rows)
  
  
  but there wee no duplicates found.
  
  So since I dont have a choice because I cannot seem to create any additional table, then I may need to restore another one from backup, and since I still have a running backup, so before doing another restore, I tried deleting the reported duplicate by command below:
  
  DBNAME=# delete from pg_catalog.pg_statistic where starelid=2610 and staattnum=15;
  DELETE 1
  
  DBNAME=# reindex database DBNAME;
  NOTICE: table "pg_catalog.pg_class" was reindexed
  ERROR: could not create unique index "pg_statistic_relid_att_inh_index"
  DETAIL: Key (starelid, staattnum, stainherit)=(2610, 13, f) is duplicated.
  
  DBNAME=# delete from pg_catalog.pg_statistic where starelid=2610 and staattnum=13;
  DELETE 1
  
  
  After the last deletion of duplicate, I able to reindex system and reindex database and seems those indexes were recreated and my issue on creating any table was fixed.
  
  
  
  

Small bash script to create or reset nginx reverse proxy protected password

Create a file /etc/nginx/listofuser

say it contains username

user1
user2
user3

Then, create a hidden file /etc/nginx/.users


Create a bash script and put it at cron, say daily so once run, it will reset the proxy password to daily and email the result to users on the list with CC on admin.


##############################################################################
#!/bin/bash


for USERNAME in `cat /etc/nginx/listofusers`
do
#Random Pass generation using openssl
RANPASS=`openssl rand -base64 32 | sha256sum | base64 | head -c 8 ; echo`

#htpasswd command
/usr/bin/htpasswd -b /etc/nginx/.users $USERNAME $RANPASS

#email the results to users
echo -e "USER: $USERNAME \nPASSWORD: $RANPASS \n \nPlease login at https://myproxy.example.com \n \nNote: Please expect email notification that it has been changed at the end of the day" | mail -s "password changed at myproxy on `date`" -r noreply@example.com $USERNAME@example.com,admin@example.com

done
###############################################################################

or if you want to load it at command line only and output the user and pass and check the file  /etc/nginx/.users, see below


#################################################################
#!/bin/bash
for USERNAME in `cat /etc/nginx/listofusers`
do

#Random pass generation using openssl (found it by googling)
RANPASS=`openssl rand -base64 32 | sha256sum | base64 | head -c 8 ; echo`

#htpasswd command
/usr/bin/htpasswd -b /etc/nginx/.users $USERNAME $RANPASS

#display the output after execution
echo "USER: $USERNAME"
echo "PASSWORD: $RANPASS"

done
#################################################################

[root@localhost ~]# /usr/local/bin/test.sh
Updating password for user user1
USER: user1
PASSWORD: ZTkxMTQ0
Updating password for user user2
USER: user2
PASSWORD: ZDc4MTMz
Updating password for user user3
USER: user3
PASSWORD: NTIwOGUx

Below are encrypted password file per htpasswd default encryption (CRYPT)

[root@localhost ~]# cat /etc/nginx/.users
user1:$apr1$HJ7/Q/qG$UTO3KujLj3rkANcNpHked1
user2:$apr1$uk59ZMD4$c4zjvMXarVK9zI7nKthz60
user3:$apr1$iIOsYmbh$GdKdkMjwfi4VEHfwTnER60

Below is the portion where you will set on your nginx config under location parameter

    auth_basic "Protected";
    auth_basic_user_file /etc/nginx/.users;

How to import multiple filters of a zimbra users.

To extract the filter of a single user at zimbra cli.


User the command below: example user is testsharedmbox@example.com
as zimbra user at cli, execute:

zmprov ga testsharedmbox@example.com zimbraMailSieveScript

Output below:


# name testsharedmbox@example.com
zimbraMailSieveScript: require ["fileinto", "reject", "tag", "flag"];

# Redirect
if anyof (header :matches ["subject"] "*") {
    redirect "user1@yahoo.com";
    redirect "user2@gmail.com";
    redirect "user3@linux.com";
    keep;
    stop;
}

So just imagine if you have 1000 redirect, so just use a little bash. Convert the above output to become like below as bash executable.

####

zmprov ma testsharedmbox@example.com zimbraMailSieveScript 'require ["fileinto", "reject", "tag", "flag"];

# Redirect
if anyof (header :matches ["subject"] "*") {
    redirect "user1@yahoo.com";
    redirect "user2@gmail.com";
    redirect "user3@linux.com";
    keep;
    stop;
}'

####

Tunnel RDP via ssh

I have a ssh server serve as proxy and i want to tunnel the rdp on it


SSH Server (example only)
Public: 11.11.22.22
Internal: 10.10.1.1

Windows server that I need to RDP via SSH Server
Internal IP: 10.10.1.2

IP of my workstation:
Public: 9.9.9.9 (example only)


So I am going to ssh with below parameters:

ssh -L 12389:10.10.1.2:3389 user@11.11.22.22

Once connected, I can now RDP to 127.0.0.1:12389

So as long as you are connected to 11.11.22.22, RDP is tunneled.

Enabling Transparent Data Encryption on Postgresql 9.3

Well, this is actually copied from this link.

https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fpgsqldeepdive.blogspot.com%2F2015%2F06%2Fpostgresql-nec-tde.html&edit-text=&act=url

But then, below are my steps.


Specs: Current posstgresql server is 9.3.10

yum install --enablerepo=pgdg93 postgresql93-devel gmake make gcc gcc-c++ postgresql93-test yum-utils rpm-build bison flex perl-ExtUtils-Embed "perl(ExtUtils::MakeMaker)" python-devel tcl-devel readline-devel zlib-devel openssl-devel krb5-devel e2fsprogs-devel gettext libxml2-devel libxslt-devel pam-devel uuid-devel openldap-devel openjade opensp docbook-dtds docbook-style-dsssl rpm-build git


It will update the current postgres-9.3 so be sure you have a backup of you current database.


cd /root
mkdir src
cd src
yumdownloader --source postgresql93
rpm -ivh postgresql93-9.3.11-1PGDG.rhel6.src.rpm
cd /root/rpmbuild
rpmbuild -bp SPECS/postgresql-9.3.spec

mkdir /usr/local/src/
cd /usr/local/src/
git clone https://github.com/nec-postgres/tdeforpg.git
ll /root/rpmbuild/BUILD/postgresql-9.3.11/
export PGSRC=/root/rpmbuild/BUILD/postgresql-9.3.11/
export PGHOME=/usr/pgsql-9.3
export TDEHOME=/usr/local/src/tdeforpg
export PATH=/usr/pgsql-9.3/bin/:$PATH

ln -s /usr/pgsql-9.3/lib/pgcrypto.so /usr/lib64/libpgcrypto.so

cd $PGSRC
./configure

cd /usr/local/src/tdeforpg/SOURCES/data_encryption/

ln -s /root/rpmbuild/BUILD/postgresql-9.3.11/src/backend/utils/errcodes.h /root/rpmbuild/BUILD/postgresql-9.3.11/src/include/utils/errcodes.h

sh makedencryption.sh 93 $PGSRC

ln -s /usr/local/src/tdeforpg/SOURCES/data_encryption/93/data_encryption93.so.1.1.1.1 /usr/lib64/data_encryption.so
chown postgres:postgres -R -v /usr/local/src/tdeforpg

Apped the below line at current postgresql.conf

shared_preload_libraries='/usr/lib64/data_encryption.so'
encrypt.enable = on

Then connect to the database that you want the encryption to be enabled.

as super user.

psql -U pgadminuser -h 127.0.0.1 mycompanydb

then execute

create extension pgcrypto;

then exit.


Follow the ff:

cd $TDEHOME/SOURCES
sh bin/cipher_setup.sh $PGHOME


Transparent data encryption feature setup script
Please select from the setup menu below
Transparent data encryption feature setup menu
1: activate  the transparent data encryption feature
2: inactivate the transparent data encryption feature
select menu [1 - 2] > 1
Please enter database server port to connect : 5432
Please enter database user name to connect : pgadminuser
Please enter password for authentication :
Please enter database name to connect : mycompanydb


CREATE LANGUAGE
INFO: Transparent data encryption feature has been activated



cd $TDEHOME/SOURCES
sh bin/cipher_key_regist.sh /usr/pgsql-9.3
=== Database connection information ===
Please enter database server port to connect : 5432
Please enter database user name to connect : pgadminuser
Please enter password for authentication :
Please enter database name to connect : mycompanydb
=== Regist new cipher key ===
Please enter the new cipher key :  "make sure you remember this"
Please retype the new cipher key :
Please enter the algorithm for new cipher key : aes

Are you sure to register new cipher key(y/n) : y

Try to check cipherkey table


[root@MyServer SOURCES]# psql -U pgadminuser -h 127.0.0.1 mycompanydb
Password for user pgadminuser:
psql (9.3.11)
Type "help" for help.

mycompanydb=# select * from cipher_key_table;
                                                                                                 key                                                        
                                         | algorithm
-------------------------------------------------------------------------------------------------------------------------------------------------------------
-----------------------------------------+-----------
 \xc38f3e4f1305863e66e2ac3e4eaffe7617e09c7c6f8f3e4f1305863e66e
2ac3e4eaffe7617e09c7c6f8f3e4f1305863e66e2ac3e4eaffe7617e
09c7c6f8f3e4f1305863e66e2ac3e4eaffe7617e09c7c6f

7dacc2290d1ce491c620e0b43702a1f8509656c6 | aes
(1 row)

mycompanydb=#



Then developers will be the one to continue.

Deleting a message per subject via CLI on zimbra

Deleting a message per subject via CLI on zimbra

The scenario:

You want to delete a message that has been accidentally sent to a bunch of zimbra users and you need to delete those message with out accessing the mailbox of those who received one by one on the web. So you might be ending doing it on a CLI mode.

Assuming that you able to open one of the message that you need to delete. If you view the full headers, you will find that it contain inside the header a msgid:

sample:

msgid:609947668.476624.1447370486564.JavaMail.zimbra@my.company.com

Assuming the the senders zimbra domain is my.company.company

the contents of the message ID is common to all that received the common message.

assuming that you have a list file at /tmp/userlists.txt containing

user1@my.company.com
user2@my.company.com
user3@my.company.com
user4@my.company.com
user5@my.company.com


I used this command to generate first the user with message ID for deletion. Make sure to run this under zimbra user.

for i in `cat /tmp/userlists.txt`; do echo $i,`zmmailbox -z -m $i s -t message -l 1 "msgid:609947668.476624.1447370486564.JavaMail.zimbra@my.company.com" |grep mess |awk '{print $2,$3,$4,$5}'`; done |tee -a /tmp/outputlist.txt

I pipe the output at /tmp/outputlist.txt


Sample output that will fill the file is below:


user1@my.company.com,57 mess Userx MYSPAM:
user2@my.company.com,1705 mess Userx MYSPAM:
user3@my.company.com,505 mess Userx MYSPAM:
user4@my.company.com,4705 mess Userx MYSPAM:
user5@my.company.com,9715 mess Userx MYSPAM:


The Numbers are the MSG ID
UserX is the sender
MYSPAM is the Subject.

I intended to do it to display the Sender and Subject so to double check that the message ID is the exact ID i need to delete.

The awk part is the one that will display the tab needed.

Now, I need to generate the email and the message ID.

cat /tmp/outputlist.txt |awk '{priont $1}' > /tmp/fordeletelist.txt

Outbut is now a csv.

user1@my.company.com,57
user2@my.company.com,1705
user3@my.company.com,505
user4@my.company.com,4705
user5@my.company.com,9715


Then use bash IFS for the little script.

while IFS=, read USER ID; do echo deleting message id $ID from $USER; zmmailbox -z -m $USER dm $ID; done < /tmp/fordeletelist.txt

It will search the user and the message ID which is the number on the file and will delete it. If you have a thousand to delete, it will be helpfull.

By the way, google and there are also scripts provided already, just modified it for my need.

Joining CentOS and authenticate to ACtive Directory using winbind

Joining CentOS and authenticate to ACtive Directory using winbind


- Make sure that you have a working DNS that can resolve the domain you are going to join and authenticate the CentOS server. Check /etc/resolv.conf


Install the ff:
yum install authconfig krb5-workstation pam_krb5 samba-common

Execute the command:

Assuming the domain is MYCOMPANY.COM




authconfig --disablecache --enablewinbind --enablewinbindauth --smbsecurity=ads --smbworkgroup=MYCOMPANY --smbrealm=MYCOMPANY.COM --enablewinbindusedefaultdomain --enablekrb5 --krb5realm=MYCOMPANY.COM --enablekrb5kdcdns --enablekrb5realmdns --enablelocauthorize --enablepamaccess --smbidmapuid=16777216-16777300 --krb5kdc=srv001.mycompany.com --krb5adminserver=srv001.mycompany.com --winbindtemplateshell=/bin/bash --updateall


The command above will change the /etc/samba/smb.conf and /etc/krb5.conf

Once done on the authconfig command, issue the command below:

kinit admin.user@MYCOMPANY.COM #This will ask for your password that you use on your AD domain to login, and will tell you if the server was joined successfully.

Once accepted, you may join to domain.

net join -w MYCOMPANY.COM -U admin.user #Again will ask for a password.
/etc/init.d/winbind restart
chkconfig winbind on

Some Backup script for postgresql 9.3 database - using parallel run

#!/bin/bash                                                                                                                                                                       
#set-x                                                                                                                                                                             
#Original Script Owner#
# #backuppostgresql.sh                                                                                                                                                             
#by #CraigSanders                                                                                                                                                                 
#this script is public domain.  feel free to use or modify as you like.
## Modified by: yongitz and ohbet - 2015 of September
#Note
# to restore database from this backup
# Command is: /usr/pgsql-9.3/bin/pg_restore -j -Fd $DATA
# where data is the path of the backup /db/BACKUP/Date-of-backup/Database_Name-folder
# /usr/pgsql-9.3/bin/pg_restore -j -Fd /db/BACKUP/2015-09-04/database_folder
# See postgresql 9.3 manual page for details
#
PGDUMP="/usr/pgsql-9.3/bin/pg_dump"
PSQL="/usr/pgsql-9.3/bin/psql"
#
# directory to save backups in, must be owned by postgres user
BASE_DIR="/db/BACKUP"
#Make some checking if backup folder is available
#
if ! ls $BASE_DIR > /dev/null 2>&1; then            
        echo "Backup directory $BASE_DIR does not exist. Backup processes terminated." | mail -s "!!! ALERT - BACKUP PROCESS FAILED @ DBSERVERXYZ !!!" db.admin@mycompany.com
exit 1
fi
#Create the Base Directory
YMD=$(date "+%Y-%m-%d")
DIR="$BASE_DIR/$YMD"
ls -l $BASE_DIR
mkdir -p $DIR
cd $DIR
#
# get list of databases in system , exclude the tempate db and other db not needed, db below are example only
DBS=$($PSQL -l -t | egrep -v 'template[01]|dbxyz|db2|db_warehouse' | awk '{print $1}' | grep -v '|'|grep -v '^$')
#
# now loop through each individual database
for database in $DBS; do
    DATA=$DIR/$database
    # dump data
    if [ $database = db_live_final ]; then
    # Remarks: j8 = 8 parallel process to run: at 9.3 and above
    # Remarks: -N backup_tables and -N DBX_* are schema that are excluded on backup
     $PGDUMP -v -j8 -N backup_tables -N DBX_* -Fd -f $DATA $database
    else
     $PGDUMP -v -j8 -Fd -f $DATA $database
    fi
done

 
#copy conf files currently used.
cp /db/pgsql/9.3/data/*.conf $DIR/
#

#Create readme for restore
cat < $DIR/Restore_readme.txt
To restore database from this backup
Use Command:
/usr/pgsql-9.3/bin/pg_restore -j -Fd /path/to/backup/folder/per/db/name
where data is the path of the backup /db/BACKUP/Date-of-backup/Database_Name-folder
Sample Below:
/usr/pgsql-9.3/bin/pg_restore -j -Fd /db/BACKUP/2015-09-04/database_folder
See postgresql 9.3 manual page for further details
EOF
#

# delete backup files older than 30 days
OLD=$(find $BASE_DIR -type d -mtime +30)
if [ -n "$OLD" ] ; then
        echo deleting old backup files: $OLD
        echo $OLD | xargs rm -rf
fi






Then save this as bash script and put on a cron to run daily.

Redirect http to https with multiple VirtualHost on apache

Goal: Redirect all http to https, domain are config.example.com and configure.example.com.

When first try on it, I encountered redirect problem, when you dont place carefully the virtual host, redirection will got problem, so on my example, I need to place carefully, config http then https, and configure http then https. It should also redirect properly when you have a sub folder.

Note: I changed the tags to |



|VirtualHost *:80|
ServerName config.example.com/
RedirectMatch 301 /(.*)$ https://config.example.com/$1



|/VirtualHost|


|VirtualHost *:443|
        SSLEngine on
        SSLProtocol -ALL -SSLv3 +TLSv1
        SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
        SSLCertificateFile /etc/pki/example_cert_2017/example.com.crt
        SSLCertificateKeyFile /etc/pki/example_cert_2017/example.key
        SSLCertificateChainFile /etc/pki/example_cert_2017/gd_bundle.crt
        ServerName config.example.com
        ServerAlias config.example.com
        DocumentRoot "/data/www/config"
        ErrorLog logs/ssl-config-error_log
        CustomLog logs/ssl-config-access.log common
|/VirtualHost|


|VirtualHost *:80|
ServerName configure.example.com
RedirectMatch 301 /(.*)$ https://configure.example.com/$1
|/VirtualHost|


|VirtualHost *:443|
        SSLEngine on
        SSLProtocol -ALL -SSLv3 +TLSv1
        SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
        SSLCertificateFile /etc/pki/example_cert_2017/example.com.crt
        SSLCertificateKeyFile /etc/pki/example_cert_2017/example.key
        SSLCertificateChainFile /etc/pki/example_cert_2017/gd_bundle.crt
        ServerName configure.example.com
        ServerAlias configure.example.com
        DocumentRoot "/data/www/configure"
        ErrorLog logs/ssl-configure-error_log
        CustomLog logs/ssl-configure-access.log common
 |/VirtualHost|