Archive for the ‘CentOS’ Category
Solution for amavisd error – TROUBLE in process_request: Error writing a SMTP response to the socket: Broken pipe – on OpenVZ server
If you get error messages from amavisd similar to the one posted below on a server which is virtualized with OpenVZ:
Mar 5 09:09:02 v100 amavis[17378]: (17378-14) (!!)TROUBLE in process_request: Error writing a SMTP response to the socket: Broken pipe at (eval 100) line 987, <GEN44> line 31.
then the issue can be caused by the NUMTCPSOCK value in the openvz limits. Even if the barrier of this limit was never met in /proc/user_beancounters, the above error occurs when more then 25% of all TCP sockets were used. The solution is to set the NUMTCPSOCK barrier and limit to a high value in the openvz container configuration file. Here a value that worked for me on a moderately used mailserver:
NUMTCPSOCK=”2000:2000″
Finally restart the OpenVZ VM to apply the new limit value.
Apache mod_security settings for WordPress and ModX
If you use the apache mod_security module on your apache server, you might encounter wrong 403 errors for several URL’s of the cms systems. Here are some exception rules to avoid that:
For WordPress Blogs
<locationmatch "/wp-admin/admin-ajax.php">
SecRuleRemoveById 300013
SecRuleRemoveById 300015
SecRuleRemoveById 300016
SecRuleRemoveById 300017
</locationmatch>
<locationmatch “/wp-admin/page.php”>
SecRuleRemoveById 300013
SecRuleRemoveById 300015
SecRuleRemoveById 300016
SecRuleRemoveById 300017
</locationmatch>
<locationmatch “/wp-admin/post.php”>
SecRuleRemoveById 300013
SecRuleRemoveById 300015
SecRuleRemoveById 300016
SecRuleRemoveById 300017
</locationmatch>
For the ModX CMS
<LocationMatch "/manager/index.php">
SecRuleRemoveById 300016
</LocationMatch>
<LocationMatch “/connectors/resource/index.php”>
SecRuleRemoveById 300013 300014 300015 300016
</LocationMatch>
<LocationMatch “/connectors/element/tv.php”>
SecRuleRemoveById 300013 300016
</LocationMatch>
Add these rules inside the vhost file of the website. If you use ISPConfig to manage the server, then add the rules in the apache directives field of the website settings in ispconfig.
Many thanks to PlanetFox for providing the rules.
How to disable MySQL replication on master/master andmaster/slave setups
The following guide shows how to disable and remove mysql replication from two or more mysql servers. These steps can be used for master/slave and master/master mysql setups. The following SQL commands have to be be executed in phpmyadmin or with the mysql commandline program. It is just important that you are logged in as mysql root user. Below I will use the mysql commandline client.
Login into mysql as root user from commandline:
mysql -u root -p
the mysql command will ask for the mysql root password.
Then execute these commands if the installed mysql version is < 5.5.16:
STOP SLAVE;
RESET SLAVE;
QUIT
use the commands below instead if the mysql version is > 5.5.16
STOP SLAVE;
RESET SLAVE ALL;
QUIT
Now edit the my.cnf file (/etc/mysql/my.cnf) and add a # in front of all lines that start with “replicate-” or “master-”. Example:
# replicate-same-server-id = 0 # master-host = 192.168.0.105 # master-user = slaveuser # master-password = akst6Wqcz2B # master-connect-retry = 60
Then restart mysql:
/etc/init.d/mysql restart
Setting up email routing to gmail / google apps via ISPConfig 3
The following guide describes the steps to add DNS records that route emails from a domain managed in ISPConfig 3 to google apps / gmail. The guide assumes that you have already setup the dns zone for your domain in ispconfig.
Login to ISPConfig, click on the DNS module icon in the upper navigation bar, then open the settings of the DNS zone that you want to redirect to google and click on the “records” tab. You should see a record list similar to this:
Now Delete the existing MX record and the “mail” A-Record. Then add the following new records:
CNAME Record:
Hostname: mail
Target: ghs.google.com.
MX Records:
example.com. ASPMX.L.GOOGLE.COM. 10
example.com. ALT1.ASPMX.L.GOOGLE.COM. 20
example.com. ALT2.ASPMX.L.GOOGLE.COM. 30
example.com. ASPMX2.GOOGLEMAIL.COM. 40
example.com. ASPMX3.GOOGLEMAIL.COM. 50
IMPORTANT: All full domain names like “ghs.google.com.” have to end with a dot, if the dot is missing, the name is treated as subdomain of the zone.
The resulting record list should look like this:
Convert Linux deb and rpm packages into the respectively other format with alien
Sometimes you are forced to compile packages from source because they are not present in your current distribution’s package format, which can be really annoying. While this is the safer option, there is also a quicker alternative, which is converting existing packages into the one you need with alien.
sudo apt-get install alien
Before you use it, make sure to have read the alien man page!
man alien
If you’re on Ubuntu for example and need a package that is only available in the rpm format, power your terminal and convert the package (the following is available as deb, it’s just an example):
sudo alien clementine-1.0.1-1.fc16.x86_64.rpm
The package will then be converted. There are a few points that you should be aware of though:
- Dependencies of converted packages will not be resolved. If you install it anyway, your update manager may notice the missing dependencies and install them however.
- It is not recommended to use alien for critical packages. The man page gives further info on that.
Using document templates in Linux
The usual thing you find when you right-click your desktop to create a new document is the option to create an empty text document. This selection can be widened however by using the Templates folder in your home folder. Any document that is put in there will be selectable; this is also possible with pictures and other formats. Pinguy OS for example provides and excellent working system out of the box and comes with multiple file templates installed:
The string Untitled is put in front every newly created document from a template. To remove an item from the list, just remove it from your Templates folder. By making a document invisible in the Templates folder it is also removed from the list.
How to delete saved passwords for network drives on Linux desktops
The majority of graphical environments let you choose to remember the passwords you enter somewhere to ease access to something but they usually don’t tell you how to delete them again. Most Linux desktop distributions have a tool installed where all your saved passwords for network drives are stored in that is called Passwords and Keys.
You can find the saved passwords right on the first
Debugging of ISPConfig 3 server actions in case of a failure
The follwing article describes the steps that can be taken to debug the ISPConfig 3 server scripts.
Enable the debug Loglevel in ISPConfig
Login to the ISPConfig intterface and set the log level to Debug under System > System > Server Config (see also chapter 4.9.2.2 of the ISPConfig 3 manual) for the affected server. After one or two minutes, there should be more detailed messages in ISPConfig’s system log (Monitor > System State (All Servers) > Show System-Log).
Disable the server.sh cronjob
Go to the command line of the server on which the error happens (on multiserver systems, it is often the slave and not the master) and run (as root):
crontab -e
Comment out the server.sh cron job:
#* * * * * /usr/local/ispconfig/server/server.sh > /dev/null >> /var/log/ispconfig/cron.log
Run the server script manually to get detailed debug output
Then run the command:
/usr/local/ispconfig/server/server.sh
This will display any errors directly on the command line which should help you to fix the error. If you have fixed
the error, please don’t forget to uncomment the server.sh cron job again.
Enhanced e-mail SPAM protection in ISPConfig 3
The command below enables a stricter SPAM handling for postfix on ISPConfig 3 servers.
In Detail:
- Reject sender hostnames with invalid syntax
- Reject sender hostnames that are no fully qualified domains (e.g. reject “server1″ but allow server1.domain.tld)
- Reject sender domains that have no DNS records
- Check sender IP addresses against realtime blacklists.
First make a backup of the postfix main.cf file in case that you want to reverse the changes later:
cp -pf /etc/postfix/main.cf /etc/postfix/main.cf.bak
Then execute this command to enable the additional spam protection functions (the command is one line!).
postconf -e ‘smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_non_fqdn_hostname, reject_unknown_recipient_domain, reject_non_fqdn_recipient, reject_unauth_destination, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_rbl_client cbl.abuseat.org,reject_rbl_client dul.dnsbl.sorbs.net,reject_rbl_client ix.dnsbl.manitu.net, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, reject_unauth_destination’
Then restart postfix:
/etc/init.d/postfix restart
Send all outgoing email trough one IP address in postfix
When a server has more then one IP address, then postfix will use all IP addresses randomly to send out emails. This can cause your emails to be listed as SPAM on other servers because the sending IP does not match the reverse IP of the server hostname. The solution is to bind postfix to the primary IP address of the server.
Edit the postfix main.cf file:
vi /etc/postfix/main.cf
and add the line:
smtp_bind_address = 192.168.0.1
were 192.168.0.1 has to be replaced with the primary IP address of the server. Then restart postfix:
/etc/init.d/postfix restart