CentOS on nagg.eu

Remotely unlock a full disk encrypted Fedora 40 server

Sun, 20 Oct 2024 00:00:00 +0000

What I have been doing in 2020 and before doesn’t seem to work anymore, ence it is time to publish a new episode of the saga: how to remotely unlock a full disk encrypted Linux machine.
dracut-sshd still works perfectly even though the surroundings changed a bit.

First step is instructing dracut to add dracut-sshd into initramfs:

$ sudo dnf install dracut dracut-network openssh
$ git clone https://github.com/gsauthof/dracut-sshd.git
$ cd dracut-sshd
$ sudo cp -ri 46sshd /usr/lib/dracut/modules.d

Configure grub to instruct dracut to add networking to initramfs:

Remotely unlock a full disk encrypted Fedora 33 server

Tue, 08 Dec 2020 00:00:00 +0000

Last year I blogged on how to remotely unlock a full disk encrypted Fedora/CentOS server.
The software I used, dracut-crypt-ssh, is not supported anymore and stopped working for me on Fedora 32 and 33.
A quick DDG search pointed me in the right direction and made me find a similar software that accomplishes the same task: dracut-sshd.

$ sudo dnf install dracut dracut-network openssh libblkid-devel gcc
$ git clone https://github.com/gsauthof/dracut-sshd.git
$ cd dracut-sshd
$ sudo cp -ri 46sshd /usr/lib/dracut/modules.d

After compiling and installing dracut-crypt-ssh configure grub to instruct dracut to add networking to initramfs:

XMPP audio and video calls

Sun, 03 May 2020 00:00:00 +0000

Ejabberd has supported STUN/TURN for quite some time now, this in conjunction with client support can be used to implement one on one audio and video calls.
Since version 2.8.0 Conversations Android client added audio and video call functionality by leveraging on STUN/TURN and XEP-0215.
The rest of the XMPP world is following the route opened by them, so I expect to see IOS and regular computer XMPP clients to finally implement these new features too in the upcoming months.
Enabling audio and video calls in Ejabberd is actually pretty simple.
Provided you have installed the latest release (version 20.04), edit ejabberd.yml:

Disable head parking Western Digital drives

Sun, 04 Aug 2019 00:00:00 +0000

Most Western Digital hard drives’ firmware let the heads park themselves after a certain amount of seconds in case the disk is not actively performing any operation.
This might be useful to keep power consumption under control but is actually harmful for disks that run 24/7 (WD Red for example).
Luckily there is a way to disable head parking, this can be done directly from Linux using a tool called idle3ctl.

Remotely unlock a full disk encrypted Fedora/CentOS server

Sat, 26 Jan 2019 00:00:00 +0000

The idea here is to be able to power on and unlock a remote Full Disk Encrypted (FDE from now on) server.
I will leave the how “remotely power on” to the reader to figure out and focus on the other part.
The easiest way to accomplish it is by using a program called: dracut-crypt-ssh.


$ yum install dropbear dracut dracut-network openssh libblkid-devel gcc
$ git clone https://github.com/dracut-crypt-ssh/dracut-crypt-ssh.git
$ cd dracut-crypt-ssh
$ ./configure
$ make
$ sudo make install

After compiling and installing dracut-crypt-ssh configure grub to instruct dracut to add networking to initramfs:

Resize QCOW2 disk image

Wed, 05 Dec 2018 00:00:00 +0000

QCOW2 disk images can be easily grown using libvirt command line utils.
Unfortunately it isn’t possible to grow QCOW2 images in-place or online.
First of all, power off the virtual machine, grow the file and make a copy of it:


$ qemu-img resize image.qcow2 +200G
$ cp image.qcow2 image-new.qcow2

Identify the specific partion you intend to grow:


$ virt-filesystems -a image.qcow2 -l
Name Type VFS Label Size Parent
/dev/sda1 filesystem ext4 - 536870912 -
/dev/sda3 filesystem xfs - 45885612000 -

Expand the actual partition:

Nginx and XMPP over TLS

Sun, 28 Oct 2018 00:00:00 +0000

XMPP over TLS (formerly XEP-0368) is a clever mechanism that allows users to connect to a XMPP server from networks that restrict outgoing traffic only to specific ports; this block is circumvent by routing XMPP traffic via port TCP 443.
If the server hosts only a XMPP server setting up XMPP over TLS is pretty easy, just instruct the server to listen on port 443.
If the server also runs a webserver which is listening on port 443 things are a bit more complicated; luckily Nginx provides a way to manage XMPP traffic and redirect it to the XMPP server.

Remote encrypted backup with iSCSI and LUKS2

Mon, 27 Aug 2018 19:19:08 +0000

The idea here is to have a LUKS2 encrypted volume stored on a remote server that allows authenticated clients to load and decrypt the data without letting the server know what is being written, read and stored.
Keep in mind that this solution is not 100% bulletproof, you still kind of have to trust the backup server because a malicious entity might take multiple snapshots of the encrypted iSCSI LUN and try to crack the encryption.

Generate a secure SSH key

Fri, 10 Aug 2018 14:42:19 +0000

In Fedora, CentOS and probably many other Linux distros ssh-keygen; still defaults to RSA 2048.
People have not yet realized that the newer, and also faster, elliptic curve cryptography is available; even between my peers I still see that many of them are using old and insecure RSA based keys. Since SSH clients support multiple keys transitioning to newer keys can be painless:

create a new elliptic curve key;
do not delete the old RSA key;
once you login into a server swap the old key with the new one.
Generating a new secure SSH key is pretty simple, just open a terminal and run:

ssh-keygen -o -a 256 -t ed25519

Configure apcupsd on CentOS

Mon, 25 Jun 2018 18:04:19 +0000

Apcupsd is a powerful daemon that can be used to manage APC UPS, add epel repositories and run:

$ yum install apcupsd

To configure apcupsd edit the following file:

cat /etc/apcupsd/apcupsd.conf"
---
## apcupsd.conf v1.1 ##
# 
# for apcupsd release 3.14.14 (31 May 2016) - redhat
#
# "apcupsd" POSIX config file

#
# Note that the apcupsd daemon must be restarted in order for changes to
# this configuration file to become active.
#

#
# ========= General configuration parameters ============
#

# UPSNAME xxx
# Use this to give your UPS a name in log files and such. This
# is particulary useful if you have multiple UPSes. This does not
# set the EEPROM. It should be 8 characters or less.
UPSNAME apcups

# UPSCABLE <cable>
# Defines the type of cable connecting the UPS to your computer.
#
# Possible generic choices for <cable> are:
# simple, smart, ether, usb
#
# Or a specific cable model number may be used:
# 940-0119A, 940-0127A, 940-0128A, 940-0020B,
# 940-0020C, 940-0023A, 940-0024B, 940-0024C,
# 940-1524C, 940-0024G, 940-0095A, 940-0095B,
# 940-0095C, 940-0625A, M-04-02-2000
#
UPSCABLE usb

# To get apcupsd to work, in addition to defining the cable
# above, you must also define a UPSTYPE, which corresponds to
# the type of UPS you have (see the Description for more details).
# You must also specify a DEVICE, sometimes referred to as a port.
# For USB UPSes, please leave the DEVICE directive blank. For
# other UPS types, you must specify an appropriate port or address.
#
# UPSTYPE DEVICE Description
# apcsmart /dev/tty** Newer serial character device, appropriate for 
# SmartUPS models using a serial cable (not USB).
#
# usb <BLANK> Most new UPSes are USB. A blank DEVICE
# setting enables autodetection, which is
# the best choice for most installations.
#
# net hostname:port Network link to a master apcupsd through apcupsd's 
# Network Information Server. This is used if the
# UPS powering your computer is connected to a 
# different computer for monitoring.
#
# snmp hostname:port:vendor:community
# SNMP network link to an SNMP-enabled UPS device.
# Hostname is the ip address or hostname of the UPS 
# on the network. Vendor can be can be "APC" or 
# "APC_NOTRAP". "APC_NOTRAP" will disable SNMP trap 
# catching; you usually want "APC". Port is usually 
# 161. Community is usually "private".
#
# netsnmp hostname:port:vendor:community
# OBSOLETE
# Same as SNMP above but requires use of the 
# net-snmp library. Unless you have a specific need
# for this old driver, you should use 'snmp' instead.
#
# dumb /dev/tty** Old serial character device for use with 
# simple-signaling UPSes.
#
# pcnet ipaddr:username:passphrase:port
# PowerChute Network Shutdown protocol which can be 
# used as an alternative to SNMP with the AP9617 
# family of smart slot cards. ipaddr is the IP 
# address of the UPS management card. username and 
# passphrase are the credentials for which the card 
# has been configured. port is the port number on 
# which to listen for messages from the UPS, normally 
# 3052. If this parameter is empty or missing, the 
# default of 3052 will be used.
#
# modbus /dev/tty** Serial device for use with newest SmartUPS models
# supporting the MODBUS protocol.
# modbus <BLANK> Leave the DEVICE setting blank for MODBUS over USB
# or set to the serial number of the UPS to ensure 
# that apcupsd binds to that particular unit
# (helpful if you have more than one USB UPS).
#
UPSTYPE usb
DEVICE 

# POLLTIME <int>
# Interval (in seconds) at which apcupsd polls the UPS for status. This
# setting applies both to directly-attached UPSes (UPSTYPE apcsmart, usb, 
# dumb) and networked UPSes (UPSTYPE net, snmp). Lowering this setting
# will improve apcupsd's responsiveness to certain events at the cost of
# higher CPU utilization. The default of 60 is appropriate for most
# situations.
POLLTIME 60

# LOCKFILE <path to lockfile>
# Path for device lock file. This is the directory into which the lock file
# will be written. The directory must already exist; apcupsd will not create
# it. The actual name of the lock file is computed from DEVICE.
# Not used on Win32.
LOCKFILE /var/lock

# SCRIPTDIR <path to script directory>
# Directory in which apccontrol and event scripts are located.
SCRIPTDIR /etc/apcupsd

# PWRFAILDIR <path to powerfail directory>
# Directory in which to write the powerfail flag file. This file
# is created when apcupsd initiates a system shutdown and is
# checked in the OS halt scripts to determine if a killpower
# (turning off UPS output power) is required.
PWRFAILDIR /etc/apcupsd

# NOLOGINDIR <path to nologin directory>
# Directory in which to write the nologin file. The existence
# of this flag file tells the OS to disallow new logins.
NOLOGINDIR /etc


#
# ======== Configuration parameters used during power failures ==========
#

# The ONBATTERYDELAY is the time in seconds from when a power failure
# is detected until we react to it with an onbattery event.
#
# This means that, apccontrol will be called with the powerout argument
# immediately when a power failure is detected. However, the
# onbattery argument is passed to apccontrol only after the 
# ONBATTERYDELAY time. If you don't want to be annoyed by short
# powerfailures, make sure that apccontrol powerout does nothing
# i.e. comment out the wall.
ONBATTERYDELAY 6

# 
# Note: BATTERYLEVEL, MINUTES, and TIMEOUT work in conjunction, so
# the first that occurs will cause the initation of a shutdown.
#

# If during a power failure, the remaining battery percentage
# (as reported by the UPS) is below or equal to BATTERYLEVEL, 
# apcupsd will initiate a system shutdown.
BATTERYLEVEL 5

# If during a power failure, the remaining runtime in minutes 
# (as calculated internally by the UPS) is below or equal to MINUTES,
# apcupsd, will initiate a system shutdown.
MINUTES 10

# If during a power failure, the UPS has run on batteries for TIMEOUT
# many seconds or longer, apcupsd will initiate a system shutdown.
# A value of 0 disables this timer.
#
# Note, if you have a Smart UPS, you will most likely want to disable
# this timer by setting it to zero. That way, you UPS will continue
# on batteries until either the % charge remaing drops to or below BATTERYLEVEL,
# or the remaining battery runtime drops to or below MINUTES. Of course,
# if you are testing, setting this to 60 causes a quick system shutdown
# if you pull the power plug. 
# If you have an older dumb UPS, you will want to set this to less than
# the time you know you can run on batteries.
TIMEOUT 60

# Time in seconds between annoying users to signoff prior to
# system shutdown. 0 disables.
#ANNOY 300
ANNOY 0

# Initial delay after power failure before warning users to get
# off the system.
#ANNOYDELAY 60
ANNOYDELAY 1

# The condition which determines when users are prevented from
# logging in during a power failure.
# NOLOGON <string> [ disable | timeout | percent | minutes | always ]
NOLOGON disable

# If KILLDELAY is non-zero, apcupsd will continue running after a
# shutdown has been requested, and after the specified time in
# seconds attempt to kill the power. This is for use on systems
# where apcupsd cannot regain control after a shutdown.
# KILLDELAY <seconds> 0 disables
KILLDELAY 0

#
# ==== Configuration statements for Network Information Server ====
#

# NETSERVER [ on | off ] on enables, off disables the network
# information server. If netstatus is on, a network information
# server process will be started for serving the STATUS and
# EVENT data over the network (used by CGI programs).
NETSERVER on

# NISIP <dotted notation ip address>
# IP address on which NIS server will listen for incoming connections.
# This is useful if your server is multi-homed (has more than one
# network interface and IP address). Default value is 0.0.0.0 which
# means any incoming request will be serviced. Alternatively, you can
# configure this setting to any specific IP address of your server and 
# NIS will listen for connections only on that interface. Use the
# loopback address (127.0.0.1) to accept connections only from the
# local machine.
NISIP 127.0.0.1

# NISPORT <port> default is 3551 as registered with the IANA
# port to use for sending STATUS and EVENTS data over the network.
# It is not used unless NETSERVER is on. If you change this port,
# you will need to change the corresponding value in the cgi directory
# and rebuild the cgi programs.
NISPORT 3551

# If you want the last few EVENTS to be available over the network
# by the network information server, you must define an EVENTSFILE.
EVENTSFILE /var/log/apcupsd.events

# EVENTSFILEMAX <kilobytes>
# By default, the size of the EVENTSFILE will be not be allowed to exceed
# 10 kilobytes. When the file grows beyond this limit, older EVENTS will
# be removed from the beginning of the file (first in first out). The
# parameter EVENTSFILEMAX can be set to a different kilobyte value, or set
# to zero to allow the EVENTSFILE to grow without limit.
EVENTSFILEMAX 10

#
# ========== Configuration statements used if sharing =============
# a UPS with more than one machine

#
# Remaining items are for ShareUPS (APC expansion card) ONLY
#

# UPSCLASS [ standalone | shareslave | sharemaster ]
# Normally standalone unless you share an UPS using an APC ShareUPS
# card.
UPSCLASS standalone

# UPSMODE [ disable | share ]
# Normally disable unless you share an UPS using an APC ShareUPS card.
UPSMODE disable

#
# ===== Configuration statements to control apcupsd system logging ========
#

# Time interval in seconds between writing the STATUS file; 0 disables
STATTIME 0

# Location of STATUS file (written to only if STATTIME is non-zero)
STATFILE /var/log/apcupsd.status

# LOGSTATS [ on | off ] on enables, off disables
# Note! This generates a lot of output, so if 
# you turn this on, be sure that the
# file defined in syslog.conf for LOG_NOTICE is a named pipe.
# You probably do not want this on.
LOGSTATS off

# Time interval in seconds between writing the DATA records to
# the log file. 0 disables.
DATATIME 0

# FACILITY defines the logging facility (class) for logging to syslog. 
# If not specified, it defaults to "daemon". This is useful 
# if you want to separate the data logged by apcupsd from other
# programs.
#FACILITY DAEMON

#
# ========== Configuration statements used in updating the UPS EPROM =========
#

#
# These statements are used only by apctest when choosing "Set EEPROM with conf
# file values" from the EEPROM menu. THESE STATEMENTS HAVE NO EFFECT ON APCUPSD.
#

# UPS name, max 8 characters 
#UPSNAME UPS_IDEN

# Battery date - 8 characters
#BATTDATE mm/dd/yy

# Sensitivity to line voltage quality (H cause faster transfer to batteries) 
# SENSITIVITY H M L (default = H)
#SENSITIVITY H

# UPS delay after power return (seconds)
# WAKEUP 000 060 180 300 (default = 0)
#WAKEUP 60

# UPS Grace period after request to power off (seconds)
# SLEEP 020 180 300 600 (default = 20)
#SLEEP 180

# Low line voltage causing transfer to batteries
# The permitted values depend on your model as defined by last letter 
# of FIRMWARE or APCMODEL. Some representative values are:
# D 106 103 100 097
# M 177 172 168 182
# A 092 090 088 086
# I 208 204 200 196 (default = 0 => not valid)
#LOTRANSFER 208

# High line voltage causing transfer to batteries
# The permitted values depend on your model as defined by last letter 
# of FIRMWARE or APCMODEL. Some representative values are:
# D 127 130 133 136
# M 229 234 239 224
# A 108 110 112 114
# I 253 257 261 265 (default = 0 => not valid)
#HITRANSFER 253

# Battery charge needed to restore power
# RETURNCHARGE 00 15 50 90 (default = 15)
#RETURNCHARGE 15

# Alarm delay 
# 0 = zero delay after pwr fail, T = power fail + 30 sec, L = low battery, N = never
# BEEPSTATE 0 T L N (default = 0)
#BEEPSTATE T

# Low battery warning delay in minutes
# LOWBATT 02 05 07 10 (default = 02)
#LOWBATT 2

# UPS Output voltage when running on batteries
# The permitted values depend on your model as defined by last letter 
# of FIRMWARE or APCMODEL. Some representative values are:
# D 115
# M 208
# A 100
# I 230 240 220 225 (default = 0 => not valid)
#OUTPUTVOLTS 230

# Self test interval in hours 336=2 weeks, 168=1 week, ON=at power on
# SELFTEST 336 168 ON OFF (default = 336)
#SELFTEST 336

The configuration I use is pretty simple, basically shutdown the server if the power is down for more than one minute.
ANNOY flag is also disabled (set to 0) because I do not need it on headless servers.

APC UPS and HP server gen8 not restarting automatically when power goes back online after shutdown procedure is already starded but not completed

Mon, 25 Jun 2018 17:35:54 +0000

I have got my hands on an APC UPS and some HP gen8 server, installed apcupsd on CentOS 7, connected the USB cable and everything was working fine except for this very annoying issue I had: * power goes down (pull the UPS power cord).

after some minutes the UPS battery threshold is triggered and the server shutdown procedure is launched by apcupsd.
power goes back up (plug in the power cord) while the server is already shutting down but the shutdown sequence is not yet completed.

RESULT: the server will not power itself up even if the correct setting is selected in BIOS (last power state or always on).
If the power stays offline for enough time for the server to completely shutdown and for the UPS to also shutdown once the power goes back online the server starts up automatically like it is supposed to do.
The only workaround I could think of to solve the issue is running a cron job on the router, which is running OpenWRT, to trigger wake-on-LAN for the server.
I don’t really like this solution, it feels hackish but still I could not find a better way to make the damn server power on automatically all by himself.
As for OpenWRT and wake-on-LAN, first of all install etherwake from LuCI or opkg:

OpenVPN: tun tap invalid argument (code=22)

Fri, 11 May 2018 12:29:10 +0000

After upgrading my OpenVPN server to CentOS 7.5 I had trouble connecting to it.
Specifically, I had two different issues:
** the laptop, which is running Fedora 28, was able to connect just fine but DNS resolution was broken.
** OpenVPN for Android was also connecting just fine but reporting a weird error: OpenVPN: tun tap invalid argument (code=22).
The first one was caused by me because after the CentOS upgrade procedure was completed I also run yum autoremove which deleted dnsmasq; the solution was fairly simple, reinstall and reconfigure dnsmasq.
For the second issue the solution was to enable comp-lzo and voilà, everything started working again.

Self hosting Firefox Sync on CentOS 7

Wed, 18 Oct 2017 17:22:49 +0000

Configuring this piece of poorly documented bloated shit Mozilla came up with was a huge pain in the ass, so excuse the colored language but I am fucking pissed.
The idea was to finally implement a system to synchronize Firefox’s bookmarks across multiple devices without giving Mozilla all my personal data.
After some minutes spent researching the subject on the interweb I found out the synchronization system is a huge clusterfuck comprised of multiple components:

CentOS and yum - Error: rpmdb open failed

Tue, 29 Aug 2017 12:23:37 +0000

Today I had Ansible reporting an error on one of my CentOS machines while performing the usual upgrade procedure.
I SSH’d into the host to check what was wrong and run yum clean all && yum update manually just to be greeted with the following error:

rpmdb: PANIC: fatal region error detected; run recovery
error: db3 error(-30974) from dbenv->open: DB_RUNRECOVERY: Fatal error, run database recovery
error: cannot open Packages index using db3 - (-30974)
error: cannot open Packages database in /var/lib/rpm
CRITICAL:yum.main:

Error: rpmdb open failed

The solution to the issue luckily was fairly simple and quick:

NFS on Fedora

Thu, 20 Jul 2017 20:33:48 +0000

NFS allows to share files and folders over network and is much much faster than samba while using way less resources.
To setup a NFS server on Fedora 26 install:

$ dnf install nfs-utils

Shared directories are listed in the following configuration file:

---
# Syntax
# <path> <ipaddr>(<option>)
/home/user/Public 192.168.0.0/255.255.255.0(ro,sync)

More information can be found here: Fedora NFS administration guide.
In the above example, the the directory ‘/home/user/Public’ can be accessed by every client in the same LAN with read-only permissions.
In case SELinux is active and enforcing rules some further configuration might be required:

Monitor hard disk health status with smartd on Linux

Thu, 02 Feb 2017 10:20:34 +0000

This does not really works, read this: https://nagg.eu/monitor-hard-disk-smart-status-in-python/

First of all install smartmontools, it has the same name on pretty much every distro:

$ emerge -a1 smartmontools

Proceed to edit its configuration file, at the bottom of the file there is a quick explaination of all the available parameters:

cat/etc/smartd.conf
---
DEVICESCAN -H -R 1 -R 5 -R 7 -R 10 -R 11 -R 196 -R 197 -R 199 -R 200 -m user@domain.tld -n standby,10,q

Parameter -H tells smartd to check the result of overall-health self-assesment test which is pretty much useless, -R is used to specify a single SMART attribute, if its value changes a mail is sent to user@domain.tld.
To send emails a MTA must be installed, in centos that is sendmail, in gentoo it is not strictly necessary to have a full fledget MTA installed, nullmailer will suffice.
If it is not already installed:

mdadm RAID on Linux

Thu, 21 Jan 2016 21:06:19 +0000

Every time I have to setup a software RAID in Linux using mdadm I forget something, this time I am writing it down once and for all (or at least I hope so).
For the sake of simplicity I will use the creation of a RAID1 as example but this very same procedure can be applied for any other kind of RAID.

RAID array creation

1. Partition the drives

This step must be repeated for each drive of the array (/dev/sdb and /dev/sdc in my case).

Defragment XFS file system

Wed, 20 Jan 2016 18:18:18 +0000

XFS just like EXT4 (I wrote a post about it last year) supports online defragmentation, to manage those volumes on CentOS and Fedora xfsprogs package is needed.
Fragmentation level of XFS volumes can be checked with the command:

[root@CentOS ~]$ xfs_db -c frag -r /dev/sdb1
actual 4491, ideal 4006, fragmentation factor 10.80%

To perform online defragmentation of XFS volumes run the following command:

CentOS, DNSCrypt and pdnsd

Sun, 01 Nov 2015 22:40:27 +0000

DNSCrypt installation process is pretty simple since it is present in the repository, pdnsd on the other hand is missing, luckily compiling from source is not that hard.
For the sake of completeness I will also cover the procedure to install DNSCrypt from source, alternatively yum install dnscrypt-proxy.
Install the required dependencies and get the source code:

[root@CentOS ~]# yum install gcc libsodium-devel libtool-ltdl-dev git wget
[root@CentOS ~]# git clone https://github.com/jedisct1/dnscrypt-proxy.git
[root@CentOS ~]# wget http://members.home.nl/p.a.rombouts/pdnsd/releases/pdnsd-1.2.9a-par.tar.gz

pdnsd

Compile and install:

ejabberd and fail2ban

Wed, 16 Sep 2015 18:54:42 +0000

Fail2ban is a useful tool capable of mitigating brute force attacks performed against a multitude of services (ejabberd in our case).
Configuration is split between a multitude of files: jail.conf defines which filters are active while the filters scripts are placed in ./filter.d directory.

[root@CentOS ~]# vi /etc/fail2ban/jail.conf
---
bantime = 1200
findtime = 1200
maxretry = 10

backend = auto

[ejabberd-auth]
enabled = true
port = 5222,5280,7777
action = iptables-multiport[name=ejabberd, port="5222,5269,5280,777", protocol=tcp]
logpath = /var/log/ejabberd/ejabberd.log
---

[root@CentOS ~]# vi /etc/fail2ban/filter.d/ejabberd-auth.conf
---
[Definition]

failregex = ^=INFO REPORT====  ===\nI\(<0\.\d+\.0>:ejabberd_c2s:\d+\) : \([^)]+\) Failed authentication for .+ from IP <HOST> \({{(?:\d+,){3}\d+},\d+}\)$
                ^(?:\.\d+)? \[info\] <0\.\d+\.\d>@ejabberd_c2s:wait_for_feature_request:\d+ \([^\)]+\) Failed authentication for \S+ from IP <HOST>$
                ^.* Failed authentication for \S+ from <HOST>$
                ^.* from <<"<HOST>">> failed with error: <<"inexistent-account">>$
                ^.* from <<"<HOST>">> failed with error: <<"bad-password">>$
                ^.* from <<"<HOST>">> failed with error: <<"badformed-jid">>$

ignoreregex =

[Init]

journalmatch =
---

The first two regular expressions are for user authentication while the others are for administration panel login.
Other useful commands are:

Defragment EXT4 file system

Fri, 10 Apr 2015 16:55:03 +0000

EXT4 is usually pretty good at keeping files fragmentation at minimum, but, sometimes, especially if dealing with really huge files, some fragmentation may actually occur.
Luckily EXT4 supports online defragmentation, command fsck displays, among other things, fragmentation percentage:

[root@fedora ~]$ fsck.ext4 -fvn /dev/sda1
e2fsck 1.42.12 (29-Aug-2014)
Warning! /dev/sda1 is mounted.
Warning: skipping journal recovery because doing a read-only filesystem check.
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

 429 inodes used (1.31%, out of 32768)
 **5 non-contiguous files (1.2%)**
 1 non-contiguous directory (0.2%)
 # of inodes with ind/dind/tind blocks: 0/0/0
 Extent depth histogram: 420
 45161 blocks used (34.46%, out of 131072)
 0 bad blocks
 1 large file

 402 regular files
 17 directories
 0 character device files
 0 block device files
 0 fifos
 0 links
 1 symbolic link (1 fast symbolic link)
 0 sockets
------------
 420 files

The command e4defrag, which is contained in e2fsprogs, can be used to perform online defragmentation of EXT4 volumes.

Email server: Dovecot and Postfix

Fri, 20 Feb 2015 14:23:20 +0000

Postfix configuration

Install the required software:

$ yum install postfix postgrey dovecot fail2ban spamassassin 
spamass-milter-postfix opendkim

Create TLS certificate, key and CA authority (replace mail.domain.tld with a valid domain name):

$ mkdir /etc/postfix/ssl
$ cd /etc/postfix/ssl
$ openssl genrsa -aes256 -out mail.domain.tld.key 4096
$ chmod 600 mail.domain.tld.key
$ openssl req -sha256 -new -key mail.domain.tld.key -out mail.domain.tld.csr
$ openssl x509 -sha256 -req -days 1825 -in mail.domain.tld.csr -signkey mail.domain.tld.key -out mail.domain.tld.crt
$ openssl rsa -in mail.domain.tld.key -out mail.domain.tld.key.nopass
$ mv mail.domain.tld.key.nopass mail.domain.tld.key
$ openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650 -sha256
$ chmod 600 mail.domain.tld.key
$ chmod 600 cakey.pem
$ openssl dhparam -out dhparams.pem 4096
$ chmod 600 dhparams.pem

Edit main.cf file accordingly (the other lines should be ok by default).
No SQL database is used, for user authentication postfix relies on Linux users, email data are stored in ~/Maildir.

ejabberd XMPP server configuration guide

Mon, 11 Aug 2014 16:08:21 +0000

I will be keeping this post up to date to keep track on how to configure and mantain an ejabberd server working efficiently and secure. I strongly advise any reader to read carefully what is written here and not just copy-and-paste the configuration file.
My blog also contains a bunch of other posts regarding ejabberd that are worth giving a look at, use the search form.

Server


CentOS 7.5.1804 x86_64
Erlang/OTP 21.1.1-1 x86_64
ejabberd 18.09

Client


LineageOS 15.1 (Android Nougat)
Conversations 2.3.5+fcr

.:. Installation and initial configuration

Download and install erlang (release numbers here may not be up to date):

Nginx and password protected pages

Wed, 05 Mar 2014 11:26:24 +0000

To password protect a directory xyz and every file and subdirectory in it open the configuration file (nginx.conf or one of the virtual host configuration files) and add the following two lines:

location /xyz/ {
 auth_basic "Restricted Area";
 auth_basic_user_file conf.d/htpasswd;
}

htpasswd file must be encrypted, it can be created using a tool named htpasswd.

[root@xenserver ~]# cd /etc/nginx/conf.d/
[root@xenserver ~]# htpasswd -b htpasswd user password

CentOS 6.4, QEMU+KVM

Mon, 19 Aug 2013 22:54:50 +0000

It’s summer, it’s hot as hell, I am back home from mountains and I’ve plenty of free time.
Between a barbecue and the next one I spend my time playing with and learning new stuff: this week new stuff is called QEMU-KVM.
Yesterday I also tried XenServer but to be honest I wasn’t impressed, it just look like to be an old version of CentOS minimal install with some custom repos and a fancy GUI.
I played with it for just a bunch of hours, but the thing that just performing an installation on a software RAID-1 turned out to be a PITA to say the least is a clear sign that it’s not the best tool for my needs.
I swapped a couple of HDDs and in 2 minutes I went back to the already installed CentOS 6.4 with QEMU+KVM.
The client machine, for what it matters, is my Fedora 19 x86_64 workstation, virsh and virt-manager the tools I use for remote administration tasks.
Installing QEMU-KVM is just a matter of typing yum install libvirtd qemu-kvm bla bla bla, chkconfig libvirtd on and doing a system reboot (better safe than sorry).
The tricky part at least for me was setting up a damn bridged network interface, luckily I found this great writeup.
I am going to report here what I did to setup a couple of bridged network interfaces on my setup.

nginx and TLS v1.2

Sat, 10 Aug 2013 14:03:39 +0000

Given that SSL and TLS, especially v1.0, suffer from serious security issues (e.g. https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS) I thought it would be a good idea to use the latest and more secure version of it: v1.2.
On CentOS 6.4 the openssl version included is quite old and doesn’t support TLS v1.1 and 1.2.
So, first of all we have to install the latest version 1.0.1e, it can be done compiling from sources or by adding a third party repository; I chose the latter.

WordPress admin, SSL, Apache + nginx

Tue, 30 Jul 2013 15:49:37 +0000

Let’s say we have a WordPress blog and we would like to encrypt our login pages and the whole back-end of the site.
There are many ways to do it, but since I already have a nginx instance configured as reverse proxy running in front of Apache I’ll use it to protect my admin pages and logins.
In this page I’ll not cover Apache’s configuration, which, by the way, is trivial to say the least, so please refer to this other post: Apache + nginx as reverse proxy.
Using the configuration posted in the above’s link as starting point, to add SSL encryption to admin pages we should add a couple more bunch of lines of code.
First of all, we must create our own Certificate Authority and issue a SSL certificate.
Another option is buying a certificate, but I don’t trust CA (certificate forgery anyone?) and I don’t mind having a properly signed certificate for a page I am the only one accessing to.
Follows a brief explanation on how to create a CA and issue a certificate.

OpenVPN server and CentOS

Sun, 19 May 2013 17:52:52 +0000

OpenVPN is the de facto standard VPN free open source software; it is widely used, tested, well documented and also included in the CentOS repos (EPEL).

.:. Server side configuration

yum install openvpn easy-rsa dnsmasq

When yum is done installing the required packages, copy the sample config file.

cp /usr/share/doc/openvpn-*/sample/sample-config-files/server.conf /etc/openvpn

Uncomment/edit the following lines in /etc/openvpn/server.conf:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh4096.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
key-direction 0
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
auth SHA512
cipher AES-256-GCM
#comp-lzo # Disable LZO compression
persist-key
persist-tun
status openvpn-status.log
;log openvpn.log # disable log, optional
;log-append openvpn.log # disable log, optional
user nobody
group nobody

Now, create two folders easy-rsa/keys in /etc/openvpn and copy some files into them:

XRDP and CentOS 6

Fri, 26 Apr 2013 14:30:32 +0000

Yesterday’s night I installed a test machine to play with KVM and some other stuff, obviously the OS of choice is the trusty CentOS.
I did a pretty minimal net-install but decided to install gnome desktop environment anyway because why not, not that it will be of much use, but still.
Anyway, since the machine is an headless server it’s mandatory to be able to control it remotely, like the past 2 or 3 times, I installed XRDP expecting everything will be fine and working without any problem.
And here is when I was wrong.
It’s been quite a long time since the last time I installed XRDP somewhere, but I clearly remember it working flawless without any kind of manual configuration.
I did the usual yum install xrdp, confirm the installation, bla bla bla, service xrdp start and both sesman and xrdp started with no problem.
Then, when I went back to my workstation (Fedora 18 x64) and tried to connect to the server using Remmina Remote Desktop Client at first it seems to be working but once I typed user ID, password and press OK I got prompted the following error:

Samba 4, simple directory sharing

Sat, 19 Jan 2013 17:23:11 +0000

With Samba being the clusterfuck it is, every time a new version is released you have to expect something to be messed up.
This time they added a bunch of new features like MS Active Directory support, too bad that now the simple directory sharing is broken/not working like it did before.
Something like 1 year ago I wrote a small guide about how to setup a Samba share on Centos 6 and I used the same smb.conf file on more than 10 machines without any problem since yesterday, when I tried it on my fresh installed Fedora 18 (which uses Samba 4.0.0). First of all, in the “Standalone Server Options” is reported that “security” options “share and server” are deprecated; too bad I just used “share” to save me the hassle of setting up a new user and stuff even if I would like the directory to be fully accessible by everyone without any restriction.
I tried it anyway with “security = share” but there was no way to make the folder accessible, when trying to access the Samba share I always got a popup in which I had to login.
So, at the end of the story, like it or not, I had to setup a new user, create a samba user and edit the “smb.conf” file.