TetraWiki - User contributions [en]

ALPHA Cluster Troubleshooting

2014-05-03T09:45:12Z

Shashanksharma: Blanked the page

ALPHA Cluster Troubleshooting

2014-05-03T09:43:05Z

Shashanksharma: Created page with " cs:Connected st:''''''Primary/Unknown''' ds:UpToDate/DUnknown''' r--- ns:0 nr:0 dw:1036 dr:3111 al:0 bm:98 lo:0 pe:0 ua:0 ap:0 (a) If the cluster (/OPT) is mounted on '''P..."

cs:Connected st:''''''Primary/Unknown''' ds:UpToDate/DUnknown''' r---
ns:0 nr:0 dw:1036 dr:3111 al:0 bm:98 lo:0 pe:0 ua:0 ap:0

(a) If the cluster (/OPT) is mounted on '''Primary''' node and showing above error,then run the following commands.

(1) drbdadm -- --discard-my-data connect all (on '''Node2''' with "bad" data)

(2) drbdadm connect all (on '''Node1''' with "good" data)

After running those commands check '''Node1''' .

(3) service drbd status (It will show that data is syncing to '''node2''' disk)

cs:WFConnection st:''''''Secondary/Unknown'''''' ds:'''UpToDate/DUnknown''' C r---
ns:0 nr:0 dw:0 dr:0 al:0 bm:17 lo:0 pe:0 ua:0 ap:0

(a) If the cluster (/OPT) is mounted on '''Secondary''' node and showing above error,then run the following commands.

(1) drbdadm -- --discard-my-data connect all (on '''Node1''' with "bad" data)

(2) drbdadm connect all (on '''Node2''' with "good" data)

After running this command check '''Node2''' .

(3) service drbd status (It will show that data is syncing to '''node1''' disk)

RDM Implementation Details in a Single html

2014-03-02T05:01:54Z

Shashanksharma: master ldap's entries sorted properly. no changes have been made in terms of commands/file edit.

[[category:RDM]]

=Contents=

==Deafault ACLs==
-------------------------------
Default ACLs
-------------------------------

To set defualt ACL, we have to set defualt permissions by below command.
Whenever a file will be created it's owner will be file creator and
permission will be as u:rwx,g:r-x,o:---

#setfacl --set u::rwx,g::r-x,o::--- test

below commands will set default acl to newly created files and directories.

#setfacl -m d:u:a0016:rwx test
#setfacl -m d:u:a0019:rwx test
#setfacl -m d:u:a0032:r-x test

But if these three users does not have a permissoin to access the test
dir, then please do set permission as given below
#setfacl -m u:a0016:rwx test
#setfacl -m u:a0019:rwx test
#setfacl -m u:a0032:r-x test

This will give default permission to a Group.
#setfacl -m d:g:RADLH:rw- testdir

==DNS==

---------
DNS
---------
services of the DNS

/etc/init.d/named start
/etc/init.d/named stop
/etc/init.d/named restart
/etc/init.d/named status

config file path
vim /var/named/chroot/etc/named.conf

zone files path
/var/named/chroot/var/named/

dns log file
tail -f /var/log/messages

==OpenLDAP master/master replication==
---------------------------------
OpenLDAP master/master replication
---------------------------------
master 172.20.1.14
slave 172.20.1.24
binddn="cn=manager,dc=rdm,dc=co,dc=in"

on master

vim /etc/openldap/slapd.conf
-------------------------------------
replica host=172.20.1.24:389
binddn="cn=Manager,dc=rdm,dc=co,dc=in"
bindmethod=simple
credentials=rdmsecret4u001
replogfile /var/lib/ldap/openldap-master-replog
-------------------------------------

touch /var/lib/ldap/ldaprep.log
chown ldap.ldap /var/lib/ldap/ldaprep.log
above file should be writable by ldap, whatever chages are made to ldap are written to this file and when they are reflicated to slave they were be deleted from the file.

on slave

vim /etc/openldap/slapd.conf
-------------------------------------
updatedn "cn=Manager,dc=rdm,dc=co,dc=in"
updateref ldap://172.20.1.14
-------------------------------------
nessus

install
add user
registor
download plugin
start if not
then start services directly.

==NTP Server==

---------
NTP Server
---------
NTP services
/etc/init.d/ntpd status
/etc/init.d/ntpd stop
/etc/init.d/ntpd restart
/etc/init.d/ntpd status

---------
NTP Client
---------
below two commands can be used on linux ntp clients to see the status and query to NTP server

ntpdc -p
ntpdc -l

==ossec agent linux==

----------------------
ossec agent linux
----------------------
below command will be used to add/remove new ossec agents.
/var/ossec/bin/manage_agents

below commands can be used to start/stop the ossec agent

/var/ossec/bin/ossec-control start
/var/ossec/bin/ossec-control stop
/var/ossec/bin/ossec-control restart
/var/ossec/bin/ossec-control status

ossec logs can be check by below command.
tail -f /var/ossec/logs/ossec.log

ossec configuration file is
/var/ossec/etc/ossec.conf

----------------------
ossec agent windows
----------------------
The ossec agent interface on windows can be started via start->program-> ossec->manage agent

From this interface you can check the logs and config file.

==OSSEC Server==

-----------------
OSSEC Server
-----------------
Use below commands start/stop the ossec services

/var/ossec/bin/ossec-control status
/var/ossec/bin/ossec-control stop
/var/ossec/bin/ossec-control restart
/var/ossec/bin/ossec-control status

ossec services log
tail -f /var/ossec/logs/ossec.log

ossec alerts log
tail -f /var/ossec/logs/alerts/alerts.log

ossec configuration file is
/var/ossec/etc/ossec.conf

rootcheck/rootkit logs can be found at the below path
/var/ossec/queue/rootcheck/

syscheck/integrity logs can be found at the below path
/var/ossec/queue/syscheck/

Starting Second OSSEC server
---------------------------
when first ossec is not working then follows below process to up Second ossec server
login to 10.10.10.27 and change ip to 10.10.10.17(down first machine) and start ossec service

OSSIM
-------------
http://10.10.10.18/ossim/index.php
User : admin
Pass :

==Openldap Password Policy on 172.20.1.24==

--------------------------
Openldap Password Policy on 172.20.1.24
--------------------------

Password Policy is defined on the 172.20.1.24 server. Every day it will generate the email alerts for the locked and expired email accounts.
The attributes of this policy is as follows

pwdMinAge: 1 minute
pwdMaxAge: 45 days
pwdMinLength: 7
pwdExpireWarning: 40 days
pwdGraceAuthNLimit: 3
pwdLockoutDuration: 10 minute
pwdMaxFailure: 5

The policy can be change by http://172.20.1.24/phpldapadmin/htdocs/index.php and select "cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in" and do the required change e.g.

pwdExpireWarning, pwdGraceAuthNLimit, pwdLockoutDuration, pwdMinAge etc.

--------------------------
Openldap Password Policy on 172.20.1.24
--------------------------

yum install openldap-servers-overlays

vi /etc/openldap/slapd.conf
---------------------------
add below lines

include /etc/ldap/schema/ppolicy.schema

moduleload ppolicy

overlay ppolicy
ppolicy_default "cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in"
ppolicy_use_lockout
ppolicy_hash_cleartext

---------------------------

vi ppolicy.ldif
---------------------------
dn: ou=Policies,dc=rdm,dc=co,dc=in
ou: Policies
description: Directory policies.
objectclass: organizationalUnit

dn: cn=Standard,ou=Policies,dc=rdm,dc=co,dc=in
cn: Standard
description: Standard password policy.
pwdAttribute: 2.5.4.35
pwdMinAge: 60
# 30 days: 60 sec * 60 min * 24 hr * 30 days
pwdMaxAge: 2592000
pwdCheckQuality: 1
pwdMinLength: 7
# Warn three days in advance
pwdExpireWarning: 2160000
pwdGraceAuthNLimit: 3
pwdLockout: TRUE
pwdLockoutDuration: 1200
pwdMaxFailure: 5
pwdFailureCountInterval: 1200
pwdMustChange: TRUE
pwdAllowUserChange: TRUE
pwdSafeModify: TRUE
objectclass: device
objectclass: pwdPolicy
---------------------------

ldapadd -acvx -D"cn=manager,dc=rdm,dc=co,dc=in" -w rdmsecret4u001 -f ppolicy.ldif

/etc/init.d/ldap restart

Email Alert Scripting
----------------------

vim /root/ppolicy/ppolicy.sh
----------------------
#!/bin/sh
#search qmail users
ldapsearch -x '(&(objectclass=qmailUser))' uid|grep uid:|tr -d ' '|cut -d: -f2 > /root/ppolicy/email_users
#turncat user_expire and locked_user files.
echo > /root/ppolicy/user_expire
echo > /root/ppolicy/locked_user
#search for account expired users
for i in `cat /root/ppolicy/email_users`
do
ldapsearch -x "(&(objectclass=qmailUser)(uid=$i)(pwdChangedTime<=`date '+%Y%m%d%k%M%SZ' -d "30 days ago"`))" uid|grep uid: |tr -d ' ' |cut -d: -f2 >> /root/ppolicy/user_expire
#search for account locked users
locked=`ldapsearch -x "(&(objectclass=qmailUser)(uid=$i))" pwdGraceUseTime -LL |grep -c pwdGraceUseTime`
if [ "$locked" == "3" ]
then
echo $i >> /root/ppolicy/locked_user
fi
done
#generate alerts
sh /root/ppolicy/expireAlert.sh
----------------------

vim /root/ppolicy/expireAlert.sh
----------------------
#!/bin/sh
#send email password expiration alert to user and edp
for i in `cat /root/ppolicy/user_expire`
do
cat /root/ppolicy/expiremsg |mail -s "Password Expiration Notice" $i@rdm.co.in
done
#send email to edp about locked users
cat /root/ppolicy/locked_user | mail -s "Email Account Locked Users " edp@rdm.co.in
----------------------

==NFS Details==

----------
NFS
----------
below command can be used to start/stop NFS service

/etc/init.d/nfs start
/etc/init.d/nfs stop
/etc/init.d/nfs restart
/etc/init.d/nfs status

==Qmail Details ==
-----------
Qmail
-----------
There are two qmail instance.
First instance sends(local) and receive all mails.
Second instance sends non-local mails

qmailctl stat

vi /etc/inittab ;init q
--------------------------------------
#SV:123456:respawn:/command/svscanboot

comment will stop qmail
and uncoment will start the qmail server

SV:123456:respawn:/command/svscanboot
--------------------------------------

below commands can be used to see the current logs.

tail -f /var/log/qmail/qmail-send/current |tai64nlocal
tail -f /var/log/qmail/qmail-smtp/current |tai64nlocal
tail -f /var/log/qmail/qmail-pop3d/current |tai64nlocal

tail -f /var/log/qmail2/qmail2-send/current |tai64nlocal
tail -f /var/log/qmail2/qmail2-smtp/current |tai64nlocal

tail -f /var/log/maillog

below log file is of scanner logs
tail -f /var/spool/qmailscan/qmail-queue.log

commands to strat and stop spamassassin.

/etc/init.d/spamassassin status
/etc/init.d/spamassassin stop
/etc/init.d/spamassassin restart

to start imap service
/etc/init.d/imap start

to start imapproxy
/usr/local/sbin/in.imapproxyd

to start clam Anti Virus servie
/usr/local/sbin/clamd

There are two nfs mounting. First qmailnfs and second is sophosAV

below command will mount the NFS from 10.10.10.16 in /home/vmail
mount -t nfs -o tcp,rsize=32768,wsize=32768 10.10.10.16:/home/vmail /home/vmail/

The mounting parameter for sophos is configured into /etc/fstab.
to mount sophos below command can be used.
mount -a

below commands are for ldap server
/etc/init.d/ldap status
/etc/init.d/ldap stop
/etc/init.d/ldap restart
/etc/init.d/ldap status

==Other Details==

rsync_ossec
----------------
15 * * * * rsync -auvrl --delete /var/ossec rsync://10.10.10.27/OSSEC

above cron job runs on every hour at 15 Minutes

backup from 10.10.10.17:/var/ossec 10.10.10.27:/var/ossec

rsync_qmailnfs

0 2 * * * /root/rsync_qmailnfs.sh
above cron job take mail backup

backup from 10.10.10.16:/home/vmail to 10.10.10.26:/home/vmail
rsync_sambanfs
----------------
0 * * * * /root/rsync_sambanfs.sh
above cron job run on starting of every hour and take backup

backup is from 10.10.10.15:/data to 10.10.10.25:/data

rsync_update_backup
---------------------
30 * * * * /root/rsync_update_backup.sh
above cron job runs on every hour at 30 Minutes

backup from /data to /backup_update_only

You have to delete old /backup_update_only weekly or monthly
----------
NFS
----------
below command can be used to start/stop NFS service
/etc/init.d/nfs start
/etc/init.d/nfs stop
/etc/init.d/nfs restart
/etc/init.d/nfs status

use below command to open truecrypt GUI panel
truecrypt

cronjob -l
-------------------------
0 * * * * /root/rsync_sambanfs.sh
-------------------------
This cron job take backup from new SambaNFS to old SambaNFS every hour.

==Samba==

--------------
Samba
--------------
audit logs can be see by below command
tail -f /var/log/samba/audit.log

All other logs will be into below directory
cd /var/log/samba/

samba start/stop commands.
/etc/init.d/smb status
/etc/init.d/smb stop
/etc/init.d/smb restart
/etc/init.d/smb status

There are two nfs mounting. First sambanfs and second is sophosAV

below command will mount the NFS from 10.10.10.15 in /home and /data
mount -t nfs -o rsize=32768,wsize=32768,timeo=15,tcp 10.10.10.15:/data /data
mount -t nfs -o rsize=32768,wsize=32768,timeo=15,tcp 10.10.10.15:/home /home

The mounting parameter for sophos is configured into /etc/fstab.
to mount sophos below command can be used.
mount -a

below commands are for fedora directory server
/etc/init.d/dirsrv status
/etc/init.d/dirsrv stop
/etc/init.d/dirsrv restart
/etc/init.d/dirsrv status

below commands are for fedora directory server admin console
/etc/init.d/dirsrv-admin status
/etc/init.d/dirsrv-admin stop
/etc/init.d/dirsrv-admin restart
/etc/init.d/dirsrv-admin status

ldapsearch -x
will show all the users including their attributes

below command will start the fedora DS admin console.
389-console

Second samba 10.10.10.24 starting process
----------------------------------------
down first samba 10.10.10.14 (dns1) and login to second samba(dns2) 10.10.10.24 (aditional ip)(the second samba should be up for Fedora DS replication, it's Fedora DS is read only, no changes directly on it will work)

run below commands on second samba 10.10.10.24
ifup eth0
ifup eth0:0
ifup eth0:1
ifup eth0:2
ifup eth0:3
ifup eth0:4
ifup eth0:5
service smb start

above service and ip will be up temporerly, when this machine will reboot this has to do again.
------------------------------------------

LRS Samba
------------------------------------------
10.10.10.28
57.56.131.200
samba pdc with ldap

below commands are for ldap server
/etc/init.d/ldap status
/etc/init.d/ldap stop
/etc/init.d/ldap restart
/etc/init.d/ldap status

All other logs will be into below directory
cd /var/log/samba/

samba start/stop commands.
/etc/init.d/smb status
/etc/init.d/smb stop
/etc/init.d/smb restart
/etc/init.d/smb status

==Sophos Anti Virus ==

------------------------------------------
Sophos AV
----------
start/stop commands.

/etc/init.d/sav-protect start/stop/restart/status
/etc/init.d/sav-rms start/stop/restart/status
/etc/init.d/sav-web start/stop/restart/status

WEB GUI url

http://127.0.0.1:8081
User : sc
Pass : sc123

Sophos installation path

/opt/sophos-av/

== Sudo Details ==

------
SUDO
------

visudo
-----------------------------
tetra ALL=(ALL) ALL
vineet ALL=(ALL) ALL
pradeep ALL=(ALL) ALL
sunil ALL=(ALL) ALL

## Sudo Log
##Details By Tetra
Defaults logfile=/var/log/sudo.log
------------------------------

remote root login disabled as follows.

vim /etc/ssh/sshd_config
------------------------------
chanage
#PermitRootLogin no
to
PermitRootLogin no
------------------------------

Then restart sshd service.

/etc/init.d/sshd restart

tail -f /var/log/sudo.log

== Truecrypt Encryption==

truecrypt
------------------
Truecrypt partition mounting at 10.10.10.28 LRS_Samba

open truecrypt interface select device "/dev/xvda3"
click mount
click "options >"
enter password(tc123), mount directory , and "mount options :" acl

or

command line mount:
truecrypt -p tc123 /dev/xvda3 /FTPDATA --fs-options=acl --protect-hidden=no --keyfiles= 2>/dev/null

command line unmount:
truecrypt -d /FTPDATA/

==Linux Servers Users ==

--------------------------------
Linux Servers Users and Password
--------------------------------
The root user login on all linux servers is not allowed. To do some administrative work on linux, login with your given user name and use sudo before every admin command to run that command.
e.g.

sudo tail -f /var/log/qmail/qmail-send/current

The users are

tetra
vineet
pradeep
sunil
root - remote login disabled.
--------------------------------

Sophos AV linux client GUI user and pass for all linux clients
--------------------------------
url
http://127.0.0.1:8081

User : sc
Pass : sc123
--------------------------------

Fedora DS console Login
--------------------------------
389-console
User : admin
Pass : ADMIN_rdm23
--------------------------------

Ossec Web GUI
--------------------------------
url
http://10.10.10.17/ossec

User : admin
Pass : admin
--------------------------------

Nessus
--------------------------------
Installed on Anshu machine
url https://10.10.10.204:8834
User : admin
Pass : admin
--------------------------------

OSSIM
--------------------------------
http://10.10.10.18
User : admin
Pass : rdm_sys_0510
--------------------------------
--------
Web
--------
http service start/stop commands

/etc/init.d/httpd start
/etc/init.d/httpd stop
/etc/init.d/httpd restart
/etc/init.d/httpd status

html/website pages path
/var/www/website/

http log files are give below
tail -f /var/log/httpd/www.rdm.co.in-access_log
tail -f /var/log/httpd/www.rdm.co.in-error_log
tail -f /var/log/httpd/www.rdmfamily.in-error_log
tail -f /var/log/httpd/www.rdmfamily.in-access_log
tail -f /var/log/messages

==FTP==

--------
FTP
--------
ftp service start/stop commands

/etc/init.d/vsftpd start
/etc/init.d/vsftpd stop
/etc/init.d/vsftpd restart
/etc/init.d/vsftpd status

ftp log file
tail -f /var/log/messages

FTP users are
--------------------------------
User home direcotry
--------------------------------
logistics /var/www/website/rdmfamily/Routes
hr /var/www/website/rdmfamily
admin /var/www/website

to change ftp users password run below command
passwd logistics
passwd hr
passwd admin

==Webmin==

--------------
Webmin is installed on all Linux servers

URL access
http://ip:10000

User : root
Pass : <rootpass>

==XEN Services==

------------------------------------------
XEN services/vm status/start/stop commands
------------------------------------------

To start and stop use below xen commands

/etc/init.d/xend status
/etc/init.d/xend start
/etc/init.d/xend stop
/etc/init.d/xend restart

/etc/init.d/xendomains status
/etc/init.d/xendomains start
/etc/init.d/xendomains stop
/etc/init.d/xendomains restart

below command will list running virtual machines.
xm list

below command will start the qmail from the command line.

xm create qmail

below command will open virt-manager to see virtual machines.
virt-manager -- will open GUI

Zimbra logo change

2014-02-12T07:19:39Z

Shashanksharma:

[[Category:Zimbra]]

''' == Changing Logo for the second Domain besmech.com ( [[Virtual Domain on Zimbra]] ) for witalsee zimbra server == '''

su - zimbra
mkdir /opt/zimbra/jetty/webapps/zimbra/skins/logos

'''Create two logos of pixels :- 459x218(LoginBanner.png) & 74x35(AppBanner.png)'''

'''move the images in the directory /opt/zimbra/jetty/webapps/zimbra/skins/logos/'''

chown zimbra.zimbra AppBanner.png
chown zimbra.zimbra LoginBanner.png
zmprov modifyDomain besmech.com zimbraSkinLogoLoginBanner /zimbra/skins/logos/LoginBanner.png
zmprov modifyDomain besmech.com zimbraSkinLogoAppBanner /zimbra/skins/logos/AppBanner.png
zmmailboxdctl restart

'''Open mail.besmech.com to confirm (Clear browser cache/cookies)'''

Main Page/Add rules in spamassasin for spam tagging

2014-02-06T05:15:31Z

Shashanksharma:

[[category:Qmail]]
[[category:Zimbra]]

== Word of Caution for this document as document not approved - Biswajit Banerjee ==

== To reduce spam we need to add rules in spamassassin ==

This can be achieve by tuning spamassassin and applying / adding rules for effective spam filtering.

----
For some cases only whitelisting and blacklisting of domain does not help . hence we need custom rules for such cases.
----

== where to write the rules : ==

/etc/mail/spamassassin/local.cf
----

== Writing basic rules ==

== Body rules : ==

These rules search the body of the message with a regular expression and if it matches, the corresponding score is assigned.

body EXAMPLE_RULE /test/
score EXAMPLE_RULE 0.1
describe EXAMPLE_RULE This is a simple test rule

This rule does a simple case-sensitive search of the body of the email for the string "test" and adds a 0.1 to the score of the email if it finds it
It will match "test" but also "testing" and "attest"
In regular expressions a \b can be used to indicate where a word-break (anything that isn't an alphanumeric character or underscore) must exist for a match. Our rule above can be made to not match "testing" or "attest" like so:

body EXAMPLE_RULE /\btest\b/

The rule can also be made case-insensitive by adding an i to the end, like this:

body EXAMPLE_RULE /\btest\b/i
score EXAMPLE_RULE 0.1

Now the rule will match any combination of upper or lower case that spells "test" surrounded by word breaks of some form.

== Header rules ==

Header rules let you check a message header for a string. Most commonly these rules check the Subject, From, or To, but they can be written to check any message header, including non-standard ones
fOR SUBJECT RULES :
header EXAMPLE_SUBJECT Subject =~ /\btest\b/i
score EXAMPLE_SUBJECT 0.1

The above rule will match a subject: line containing "test" or a SUBJECT: line containing "test". The first part before the =~ indicates what the name of the header you want to check

Checking the From: line, or any other header, works much the same:

header EXAMPLE_FROM From =~ /test\.com/i
score EXAMPLE_FROM 0.1

== THERE WAS A CASE WHERE SPAM USED TO COME FROM DIFFRENT DOMAINS OF SIMILAR NAME ( MYJAMANA 1 , MYJAMAN2, MYJAMANA3, MYJAMANA4 ETC.) FOR THIS THE FROM RULE IS APPLICABLE ==

There's also an option to look at all the headers and match if any of them contain the specified regex:

header LOCAL_DEMONSTRATION_ALL ALL =~ /test\.com/i
score LOCAL_DEMONSTRATION_ALL 0.1

Not very commonly used, but this feature can also be used to do a case-sensitive check on a header name (it will look at the whole lines, not just the parts after the colon)

header LOCAL_DEMONSTRATION_WEIRD_FROM ALL =~ /^FrOM\:/

== A few short words about the behavior of the "score" command ==
- rules with a score set to 0 are not evaluated at all.
- rules with no score statement will be scored at 1.0, unless 3 or 4 is true
- rules starting with a double __ are evaluated with no score, and are intended for use in meta rules where you don't
want the sub-rules to have a score.
- although intended for the sa development effort, any rule starting with T_ will be treated as a "test" rule and will
be run with a score of 0.01 (nearly 0). This can be handy when testing rules so you don't have to create score lines
for them if you think you're not going to keep them.

Malware Issue

2014-01-24T07:54:38Z

Shashanksharma:

[[Category:Zimbra]]

'''Malware Issue faced and rectified on Linux Mail Servers'''

Symtoms
1) Load will gradually rise.
2) CPU Utilization will rise.
3) Both became stable at a level(around 20 load)
4) Wierd applications would found running when you monitor TOP.

Steps to find out the location of malware
1) Monitor cpu usage using TOP command
2) Any service which is using CPU around 200% , monitor that service.
3) Using ps -elf | grep "--service name--" , find out wether the service is genuine or froud.
4) Find out the location of that malware. (Basically it is found in tmp directory - /tmp , /usr/tmp , /var/tmp or at /root/ or / )

Steps to secure our machine
1) First of all kill that process using its PROCESS ID( mind that you use its PID)
2) As if you delete the malware, it will be regenarated. So you have to clean that file and make sure it won't regenerate.
3) Then echo > --malware-- ( empty the contents of malware fle)
4) Then chmod 000 --malware--
5) Then chattr +i --malware-- (apply chattr so that it the malware could be created again,hence system is secured)
***(--malware-- has to be replaced with the name of malware present on the server, ex. meep.pl , a , b , etc.)

Usual location of these malwares
1) /tmp
2) /var/tmp --80% of times malware is found here.
3) /usr/tmp
4) /root/ --hidden file would be found here ( like .kpoll )
5) / --hidden file would be found here

Victims
1) Systems with high end configuration (All mail servers, Basically Zimbra ones because of their high configuration)
2) Systems with high clock frequency/ RAM/ Dedicated Graphic Card (Nvidia/AMD Radion)
3) Systems with great uptime

''For help - malware are basically of names like - a,b,meep.sh,xd.pl,minerd,minerd32,minerd64,kpoll,fuss. and are found 80% of times at /var/tmp/''

For more details you can visit -> http://goo.gl/eOcSsn

Malware Issue

2014-01-24T07:42:05Z

Shashanksharma:

[[Category:Zimbra]]

'''Malware Issue faced and rectified on Linux Mail Servers'''

Symtoms
1) Load will gradually rise.
2) CPU Utilization will rise.
3) Both became stable at a level(around 20 load)
4) Wierd applications would found running when you monitor TOP.

Steps to find out the location of malware
1) Monitor cpu usage using TOP command
2) Any service which is using CPU around 200% , monitor that service.
3) Using ps -elf | grep "--service name--" , find out wether the service is genuine or froud.
4) Find out the location of that malware. (Basically it is found in tmp directory - /tmp , /usr/tmp , /var/tmp or at /root/ or / )

Steps to secure our machine
1) First of all kill that process using its PROCESS ID( mind that you use its PID)
2) As if you delete the malware, it will be regenarated. So you have to clean that file and make sure it won't regenerate.
3) Then echo > --malware-- ( empty the contents of malware fle)
4) Then chmod 000 --malware--
5) Then chattr +i --malware-- (apply chattr so that it the malware could be created again,hence system is secured)

Usual location of these malwares
1) /tmp
2) /var/tmp --80% of times malware is found here.
3) /usr/tmp
4) /root/ --hidden file would be found here ( like .kpoll )
5) / --hidden file would be found here

Victims
1) Systems with high end configuration (All mail servers, Basically Zimbra ones because of their high configuration)
2) Systems with high clock frequency/ RAM/ Dedicated Graphic Card (Nvidia/AMD Radion)
3) Systems with great uptime

''For help - malware are basically of names like - a,b,meep.sh,xd.pl,minerd,minerd32,minerd64,kpoll,fuss. and are found 80% of times at /var/tmp/''

For more details you can visit -> http://goo.gl/eOcSsn

Malware Issue

2014-01-24T06:38:34Z

Shashanksharma:

Malware Issue

2014-01-24T06:37:35Z

Shashanksharma:

[[Category:Zimbra]]

'''Malware Issue faced and rectified on Linux Mail Servers'''

[[Symtoms]]
1) Load will gradually rise.
2) CPU Utilization will rise.
3) Both became stable at a level(around 20 load)
4) Wierd applications would found running when you monitor TOP.

[[Steps to find out the location of malware]]
1) Monitor cpu usage using TOP command
2) Any service which is using CPU around 200% , monitor that service.
3) Using ps -elf | grep "--service name--" , find out wether the service is genuine or froud.
4) Find out the location of that malware. (Basically it is found in tmp directory - /tmp , /usr/tmp , /var/tmp or at /root/ or / )

[[Steps to secure our machine]]
1) First of all kill that process using its PROCESS ID( mind that you use its PID)
2) As if you delete the malware, it will be regenarated. So you have to clean that file and make sure it won't regenerate.
3) Then echo > --malware-- ( empty the contents of malware fle)
4) Then chmod 000 --malware--
5) Then chattr +i --malware-- (apply chattr so that it the malware could be created again,hence system is secured)

''For help - malware are basically of names like - a,b,meep.sh,xd.pl,minerd,minerd32,minerd64,kpoll,fuss. and are found 80% of times at /var/tmp/''

Malware Issue

2014-01-24T06:35:23Z

Shashanksharma: Created page with "Category:Zimbra '''Malware Issue faced and rectified on Linux Mail Servers''' Symtoms 1) Load will gradually rise. 2) CPU Utilization will rise. 3) Bot..."

[[Category:Zimbra]]

[['''Malware Issue faced and rectified on Linux Mail Servers''']]

[[Symtoms]]
1) Load will gradually rise.
2) CPU Utilization will rise.
3) Both became stable at a level(around 20 load)
4) Wierd applications would found running when you monitor TOP.

[[Steps to find out the location of malware]]
1) Monitor cpu usage using TOP command
2) Any service which is using CPU around 200% , monitor that service.
3) Using ps -elf | grep "--service name--" , find out wether the service is genuine or froud.
4) Find out the location of that malware. (Basically it is found in tmp directory - /tmp , /usr/tmp , /var/tmp or at /root/ or / )

[[Steps to secure our machine]]
1) First of all kill that process using its PROCESS ID( mind that you use its PID)
2) As if you delete the malware, it will be regenarated. So you have to clean that file and make sure it won't regenerate.
3) Then echo > --malware-- ( empty the contents of malware fle)
4) Then chmod 000 --malware--
5) Then chattr +i --malware-- (apply chattr so that it the malware could be created again,hence system is secured)

''For help - malware are basically of names like - a,b,meep.sh,xd.pl,minerd,minerd32,minerd64,kpoll,fuss. and are found 80% of times at /var/tmp/''

Mahuaa cluster issue

2013-12-03T07:14:53Z

Shashanksharma:

Scenerio :
There are two nodes (mail.mahuaatv.com & mail1.mahuaatv.com) of cluster running at Mahuaa. Basically what happened was that
mail1.mahuaatv.com stopped working. Neither approachable via ping nor by ssh.

What We Did To Resue the Issue :
> Shutted down both the systems.
> Node 1 was brought up.
> After proper startup of node 1, node 2 was brought up.
> Here we face an issue that node 1 was not coming up and stuck at boot process. Issue was regarding the disk issue.
> Then finally after 2-3 tries, We removed lan cable & it automatically started.
> Both machines were up but neither if them was in network(i.e. not accessible via global ip)
> Then machine was brought in local n/w and it was accessed via taking teamviewer of a local machine and through that machine to server.
> Then following was done on server :

On Node 2 :

/etc/init.d/heartbeat stop
Stopped heartbeat

tailf /var/log/ha-log
checked logs wether the heartbeat is properly shutting down or not

cat /proc/drbd
checked wether this machine is now secondary or not.

df -h
checked wether the /home is unmounted or not.

now to Node 1 :

/etc/init.d/heartbeat stop
/etc/init.d/heartbeat start
restart the service

tail -f /var/log/ha-log
checked the logs wether the heartbeat is properly started or not.

cat /proc/drbd
check wether the server is primary or not.

cat /etc/ha.d/haresources
in this file we check what ip has to be assigned to node 1 , what services to be started, which partition to be mounter and where.

now check ip address
ifconfig

Check wether the /home partition is mounted or not.
df-h

now check wether all the services are up or not which are defined in /etc/ha.d/haresources /etc/ha.d/haresources file.

example :
[root@mail ~]# cat /etc/ha.d/haresources
mail.mahuaatv.com IPaddr::193.168.0.222/24/eth1 drbddisk::r0 Filesystem::/dev/drbd0::/home::ext3 mysqld dovecot clam_permissions clamd amavisd postfix httpd crond

[root@mail ~]# /etc/init.d/mysqld status
mysqld (pid 24486) is running...

[root@mail ~]# /etc/init.d/dovecot status
dovecot (pid 24536) is running...

[root@mail ~]# /etc/init.d/clamd status
clamd (pid 24617) is running...

[root@mail ~]# /etc/init.d/amavisd status
amavisd (pid 25009 25008 25006 25004 25003 25002 25001 25000 24999 24998 24660) is running...
amavis-milter is stopped

[root@mail ~]# /etc/init.d/postfix status
master (pid 24743) is running...

[root@mail ~]# /etc/init.d/httpd status
httpd (pid 24785) is running...

[root@mail ~]# /etc/init.d/crond status
crond (pid 24823) is running...

now check wether the node is primary and is uptodate :

[root@mail ~]# cat /proc/drbd
version: 8.0.16 (api:86/proto:86)
GIT-hash: d30881451c988619e243d6294a899139eed1183d build by mockbuild@v20z-x86-64.home.local, 2009-08-22 13:23:56
0: cs:Connected st:Primary/Secondary ds:UpToDate/UpToDate C r---
ns:30232760 nr:8 dw:29180096 dr:2144235 al:35473 bm:787 lo:0 pe:0 ua:0 ap:0
resync: used:0/61 hits:0 misses:0 starving:0 dirty:0 changed:0
act_log: used:0/257 hits:7259549 misses:36475 starving:0 dirty:1002 changed:35473

---DONE---

Monitoring Incoming & outgoing mails in zimbra

2013-09-23T12:51:14Z

Shashanksharma:

Here is how to configure a particular mail id to hold a record of all either incoming,or outgoing mails from a particular server or a particular email
id in Zimbra.

Source -> http://www.postfix.org/ADDRESS_REWRITING_README.html#auto_bcc
-> http://www.zimbra.com/forums/administrators/28958-solved-sender_bcc_maps-not-receiving-mail-lt.html

Changes in /etc/postfix/main.cf :
#Add following line to get a bcc copy to your email id when some one send a mail:
sender_bcc_maps = hash:/etc/sender_bcc
#Add following line to get a bcc copy to your email id when some one receive a mail:
recipient_bcc_maps = hash:/etc/recipient_bcc
:wq!

# vim /etc/sender_bcc
@domain.com outgoing@domain.com #to get sent mails of whole server
user@domain.com user_outgoing@domain.com #to get sent mails of particular user

# vim /etc/recipient_bcc
@domain.com imcoming@domain.com #to get received mails of whole server
user@domain.com user_incoming@domain.com #to get received mails of particular user

Now run the following commands
# /opt/zimbra/postfix/sbin/postmap /etc/sender_bcc
# /opt/zimbra/postfix/sbin/postmap /etc/recipient_bcc
# /opt/zimbra/postfix/sbin/postfix reload

---DONE---
Working fine on TIPL**

Monitoring Incoming & outgoing mails in zimbra

2013-09-23T11:49:43Z

Shashanksharma: Created page with " Here is how to configure a particular mail id to hold a record of all either incoming,or outgoing mails from a particular server or a particular email id in Zimbra. C..."

Here is how to configure a particular mail id to hold a record of all either incoming,or outgoing mails from a particular server or a particular email
id in Zimbra.

Changes in /etc/postfix/main.cf :
#Add following line to get a bcc copy to your email id when some one send a mail:
sender_bcc_maps = hash:/etc/sender_bcc
#Add following line to get a bcc copy to your email id when some one receive a mail:
recipient_bcc_maps = hash:/etc/recipient_bcc
:wq!

# vim /etc/sender_bcc
@domain.com outgoing@domain.com #to get sent mails of whole server
user@domain.com user_outgoing@domain.com #to get sent mails of particular user

# vim /etc/recipient_bcc
@domain.com imcoming@domain.com #to get received mails of whole server
user@domain.com user_incoming@domain.com #to get received mails of particular user

Now run the following commands
# /opt/zimbra/postfix/sbin/postmap /etc/sender_bcc
# /opt/zimbra/postfix/sbin/postmap /etc/recipient_bcc
# /opt/zimbra/postfix/sbin/postfix reload

---DONE---
Working fine on TIPL**