We’ve all used DD before:
dd if=/dev/sda of=/dev/sdb

But someone pointed out there was a better way – a way that would allow retrieval of data even if the drive was dying. DD was never supposed to be able to do that, so it’s generally not the best tool to use.

apt-get install gddrescue
ddrescue -v /dev/sda /dev/sdb

That’s it.
Oh, I learned about ddrescue from Dimitar Darazhanski’s blog.

After setting up a BIND DNS on my Ubuntu 10.04 x32 server, I decided I should probably make a mail server too. I wanted to be able to access the mail from my iPhone.

Postfix was installed by default as I needed sendmail for some other php scripts I had previously written/edited. Otherwise you can always apt-get install postfix

I let webmin install dovecot for me. Dovecot is a POP3/IMAP server that will communicate with postfix’s mail system. Basically it’ll read the mail from /var/mail (which I had to edit – more on that later). I then set the DNS name for mail.mydomain.tld using BIND on webmin.

Use webmin and open up Servers > Dovecot
Click Networking and Protocols
I selected POP3
Click Save
Click on User and Login Options
SASL authentication realms: mail.yourdomain.tld
Authentication methods: plain text
Click save
Click on Mail Files
Select Inbox under /var/mail, folders in ~/mail
Click apply configuration

Then I made sure that port 110 was opened up on the firewall and away I went. I could now connect to the server via POP3 on the iPhone and retrieve my mail. However, I could not send mail. The fix for that (Found from Jimmy’s Weblog):
apt-get install postfix-tls sasl2-bin libsasl2 libsasl2-modules
nano /etc/default/saslauthd

START=yes
MECHANISMS=”pam”

nano /etc/postfix/sasl/smtpd.conf

pwcheck_method: saslauthd

nano /etc/postfix/main.cf

smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions =
permit_sasl_authenticated,
permit_mynetworks,
reject_unauth_destination

rm -r /var/run/saslauthd/
mkdir -p /var/spool/postfix/var/run/saslauthd
ln -s /var/spool/postfix/var/run/saslauthd /var/run
chgrp sasl /var/spool/postfix/var/run/saslauthd
adduser postfix sasl

/etc/init.d/postfix restart
/etc/init.d/saslauthd start

Honestly by that time I had changed a few other things in the postfix configuration, so hopefully this still works. If I ever set it up again or do a dry run on a secondary test system (ie if I find the time to QA my own work) then I will most definitely put up any updates. Any issues let me know.

Log into your server
wget http://downloads.sourceforge.net/project/webadmin/webmin/1.510/webmin_1.510-2_all.deb
sudo dpkg -i webmin_1.510-2_all.deb
If you get errors, just type sudo apt-get install -f (this will install all the required pre-reqs)

And then I usually update the server:
apt-get update
apt-get upgrade
apt-get dist-upgrade

And then make sure you change the security on webmin:
Login to https://yourip:10000 as your root user
Click on Webmin, then Webmin Configuration
Click on IP access control
Only allow from the following:

127.0.0.1
192.168.1.0
OtherIP
ETC

***EDIT***
http://downloads.sourceforge.net/project/webadmin/webmin/1.570/webmin_1.570_all.deb
http://superb-dca2.dl.sourceforge.net/project/webadmin/webmin/1.580/webmin_1.580_all.deb

Customer purchased Comcast Business cable for their primary internet provider. They also purchase a domain name through godaddy. I used to think godaddy was a horrible/awful/pile of dung, but now that I’m starting to find out where everything is hidden they’re turning out to be moderately OK.

Background:
Ubuntu 10.04 x32 Server LAMP
BIND 9.7.0
Webmin 1.510
Sonicwall TZ180W Enhanced
Godaddy account information and domain name

I updated their ubuntu server from 9.04 to 9.10, then now to 10.04. I installed webmin as the customer wanted a GUI to be able to edit the config files. And, despite resistance from CLI users, webmin is a pretty powerful suite. I secured the server as much as I could. I then made sure that port 53 for UDP and TCP was opened for DNS to/from the server.

Now the fun part begins. Login on your webmin server (usually https://webminserver’sIPaddress:10000) and navigate to Servers > Bind DNS Server.

Create BIND Master Zone
Under Existing DNS Zones, Click on Create Master Zone.

Zone type: Forward
Domain Name/Network: yourdomain.tld
Records file: Automatic
Master server: yourdomain.tld, uncheck Add NS record for master server
Email address: admin@yourdomain.tld
Use zone template: No
IP Address for template records: Your PUBLIC IP address
Add reverses for template addresses: Yes
Leave the TTL as is, unless you want longer/shorter timeouts
Click Create

Add Name Records
Now you should be in the Address Records for your new domain. If not, navigate to Servers > BIND DNS Server > Existing DNS Zones > Yourdomain.tld > Address.
NOTE: Notice the ‘.’ at the end of the names.

Name: ns1.yourdomain.tld.
Time-To-Live: default
Address: Your PUBLIC IP address
Update reverse: Yes
Create
Name: ns2.yourdomain.tld.
Time-To-Live: default
Address: Your PUBLIC IP address
Update reverse: Yes
Create
Name: yourdomain.tld.
Time-To-Live: default
Address: Your PUBLIC IP address
Update Reverse: Yes
Create
Name: www.yourdomain.tld.
Time-To-Live: default
Address: Your PUBLIC IP address
Update Reverse: Yes
Create

Add Name Servers
Return to Record Types. Now click on Name Server.

Zone Name:
Time-To-Live: 300
Name Server: ns1.yourdomain.tld.
Create
Zone Name:
Time-To-Live: 300
Name Server: ns2.yourdomain.tld.
Create

Restart BIND
You have two ways to do this (well, more than that, but you know how it is):

1.) Login as root using SSH to your BIND Server. Run:
sudo /etc/init.d/bind9 restart
2.) On Webmin, Click on System > Bootup and Shutdown > bind9
Click on the Restart Now button

Test your configuration:

Login to your BIND Server using SSH
nano /etc/resolv.conf
search yourdomain.tld
nameserver 127.0.0.1
Add ‘#’ to any other name servers in the list
Save and Exit Nano
dig yourdomain.tld
Make sure the HEADER Flags have: qr aa rd ra. Well, the ‘aa’ is the most important part – that shows it’s that authority for this domain.

Change the DNS Servers of your Godaddy account

Login on your godaddy domain manager
I added the DNS entries for ns1.yourdomain.tld and ns2.yourdomain.tld in the custom DNS area. Point those both to your public IP address.
In the lower left corner of the Domain Manager screen (after you click on the domain you want to manage) you will see a Host Summary area.
Add NS1.yourdomain.tld with your PUBLIC IP
Add NS2.yourdomain.tld with your PUBLIC IP
I had to wait 5 minutes or so before everything was happy.

Now change the DNS servers from NSxx.DOMAINCONTROL.COM to NS1.YOURDOMAIN.TLD AND NS2.YOURDOMAIN.TLD.

If you get a message about your name servers not being registered, you probably forgot to add the domains into the Host Summary area. Either that or you haven’t waited long enough.

I needed to give access to a user (a web developer) but didn’t want them to be able to go anywhere but their home directory. The server is running Ubuntu 9.10 x32. No GUI.

A brief search found a shell called Iron Bars restricted SHell for linux (IBSH). This also allows you to prohibit certain commands from running.

wget http://downloads.sourceforge.net/project/ibsh/ibsh-binary/ibsh_debian_binary/debian_ibsh.deb?use_mirror=cdnetworks-us-1
dpkg -i debian_ibsh.deb
apt-get install -f
nano /etc/ibsh/globals.cmds

You can put whatever commands you want to allow in that file. Save it.

nano /etc/passwd
Change the shell of the user to /bin/ibsh

Login as the user and test it out. Try to cd /etc or rm -rf / and see what happens.

***EDIT***
The Link is http://downloads.sourceforge.net/project/ibsh/ibsh/ibsh-0.3a/ibsh-0.3a-i386-linuxbsd-src.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fibsh%2F&ts=1288626692&use_mirror=iweb

I downloaded the DVD torrent for CentOS 5.4. It’s large. 3.72GB large. It’s the i386 version.

I needed it for testing as it’s closer to RHEL than Debian is. 🙂

So I selected install – generic install – but ONLY install the server portion. I don’t need that crazy GUI. Or do I?

After installation I ran the usual:
yum update
yum -y install httpd php mysql mysql-server php-mysql
/sbin/chkconfig httpd on
/sbin/chkconfig --add mysqld
/sbin/chkconfig mysqld on

Then I started the services:
/sbin/service httpd start
/sbin/service mysqld start

Opened up my browser to the IP of the new server. Page not found. Damn.

OK, let’s see if the server can access itself:
lynx http://127.0.0.1
Command not found

Damn. Install lynx:
yum install lynx
lynx http://127.0.0.1
Default CentOS page! Yay!

Well, by default, CentOS installs SELinux. I don’t care for MAC security as this is a pure test dev machine, so I’ll remove that:
nano /etc/selinux/config
SELINUX = disabled
Save, Reboot.

Page not found. Argh, must be the default firewall crap that is on by default. I shall remove that as well:
/sbin/service iptables save
/sbin/service iptables stop
/sbin/chkconfig iptables off
I rebooted once again by accident as I hit the power button on the wrong virtual machine. Oh well.

Default CentOS Page! Yay!

I wanted a network time protocol server running on my Ubuntu server – so I could point various other computer-related items to that instead of hitting the internet.

Login as root on your Ubuntu server
apt-get remove ntpdate
apt-get install ntp
nano /etc/ntp.conf

I have the following servers in my list:

server ntp.ubuntu.com
server us.pool.ntp.org
server 10.1.0.14 (a MS domain controller)

Then under the restrict for users (at the bottom of the config file):
restrict 10.4.0.0 mask 255.255.255.0 nomodify notrap
restrict 10.1.0.0 mask 255.255.255.0 nomodify notrap
restrict 10.2.0.0 mask 255.255.255.0 nomodify notrap
restrict 10.3.0.0 mask 255.255.255.0 nomodify notrap

Ctrl + X
Y
/etc/init.d/ntp restart

You can see what servers are giving you data with this:
ntpq -np

You can always run ntpdate ip_of_server to update on the client side:
ntpdate 10.4.0.253