Linux Help and Info Center

Guide : Whitelist Hosts In Postfix

If you run a mail server and use blacklists to block spam, you probably know this problem from time to time your customers complain they can not receive e-mails from certain freemailers. Most often this occurs because a freemailer has been abused to send spam and thus obtained a blacklist. This little guide shows you how such a whitelist Postfix mail server to make your customers happy.
I'm not issue any guarantee that it works for you!

If a blacklisted server tries to send mail to your server, you should find something like this in your mail log:

SMTP error from remote mail server after RCPT TO:<bla@example.com>: host mail.example.com [4.3.2.1]: 554 5.7.1 Service unavailable; Client host [1.2.3.4] blocked using dnsbl.sorbs.net; Currently Sending Spam See: http://www.sorbs.net/lookup.shtml?1.2.3.4

In this example, the mail server 1.2.3.4 is blacklisted and therefore blocked.

To whitelist that server, create the file /etc/postfix/rbl_override where you list all IP addresses or host names (one per line!) that you want to whitelist:

vi /etc/postfix/rbl_override1.2.3.4 OK

1.2.3.5 OK
mail.freemailer.tld OK

After you've created/modified that file, you must runpostmap /etc/postfix/rbl_override

Next open /etc/postfix/main.cf and search for the smtpd_recipient_restrictions parameter. Add check_client_access hash:/etc/postfix/rbl_override to that parameter, after reject_unauth_destination, but before the first blacklist.

So if smtpd_recipient_restrictions looks like this now...

vi /etc/postfix/main.cf

[...]
smtpd_recipient_restrictions = reject_invalid_hostname,
   reject_unauth_pipelining,
   permit_mynetworks,
   permit_sasl_authenticated,
   reject_unauth_destination,
   reject_rbl_client multi.uribl.com,
   reject_rbl_client dsn.rfc-ignorant.org,
   reject_rbl_client dul.dnsbl.sorbs.net,
   reject_rbl_client list.dsbl.org,
   reject_rbl_client sbl-xbl.spamhaus.org,
   reject_rbl_client bl.spamcop.net,
   reject_rbl_client dnsbl.sorbs.net,
   reject_rbl_client cbl.abuseat.org,
   reject_rbl_client ix.dnsbl.manitu.net,
   reject_rbl_client combined.rbl.msrbl.net,
   reject_rbl_client rabl.nuclearelephant.com,
   permit
[...]

... modify it so that it looks as follows:

[...]
smtpd_recipient_restrictions = reject_invalid_hostname,
   reject_unauth_pipelining,
   permit_mynetworks,
   permit_sasl_authenticated,
   reject_unauth_destination,
   check_client_access hash:/etc/postfix/rbl_override,
   reject_rbl_client multi.uribl.com,
   reject_rbl_client dsn.rfc-ignorant.org,
   reject_rbl_client dul.dnsbl.sorbs.net,
   reject_rbl_client list.dsbl.org,
   reject_rbl_client sbl-xbl.spamhaus.org,
   reject_rbl_client bl.spamcop.net,
   reject_rbl_client dnsbl.sorbs.net,
   reject_rbl_client cbl.abuseat.org,
   reject_rbl_client ix.dnsbl.manitu.net,
   reject_rbl_client combined.rbl.msrbl.net,
   reject_rbl_client rabl.nuclearelephant.com,
   permit
[...]

That's it! Restart Postfix, and you're done:

/etc/init.d/postfix restart

Guide : Fix MySQL Replication

If you set up replication MySQL, you probably know this problem: there are sometimes complaints that cause invalid MySQL replication does not work. In this small guide I explain how you can repair on the MySQL slave replication without the need to establish from scratch.

I'm not issue any guarantee that it works for you!

1 Identifying The Problem

To find out whether replication is/is not working and what has caused to stop it, you can take a look at the logs. On Debian, for example, MySQL logs to /var/log/syslog:

grep mysql /var/log/syslog

server1:/home/admin# grep mysql /var/log/syslog

May 29 09:56:08 http2 mysqld[1380]: 080529 9:56:08 [ERROR] Slave: Error 'Table 'mydb.taggregate_temp_1212047760' doesn't exist' on query. Default database: 'mydb'. Query: 'UPDATE thread AS thread,taggregate_temp_1212047760 AS aggregate

May 29 09:56:08 http2 mysqld[1380]: ^ISET thread.views = thread.views + aggregate.views

May 29 09:56:08 http2 mysqld[1380]: ^IWHERE thread.threadid = aggregate.threadid', Error_code: 1146

May 29 09:56:08 http2 mysqld[1380]: 080529 9:56:08 [ERROR] Error running query, slave SQL thread aborted. Fix the problem, and restart the slave SQL thread with "SLAVE START". We stopped at log 'mysql-bin.001079' position 203015142

server1:/home/admin#

You can see what query caused the error, and at what log position the replication stopped.

To verify that the replication is really not working, log in to MySQL:

mysql -u root -p

On the MySQL shell, run:

mysql> SHOW SLAVE STATUS \G

If one of Slave_IO_Running or Slave_SQL_Running is set to No, then the replication is broken:

mysql> SHOW SLAVE STATUS \G

*************************** 1. row ***************************

Slave_IO_State: Waiting for master to send event

Master_Host: 1.2.3.4

Master_User: slave_user

Master_Port: 3306

Connect_Retry: 60

Master_Log_File: mysql-bin.001079

Read_Master_Log_Pos: 269214454

Relay_Log_File: slave-relay.000130

Relay_Log_Pos: 100125935

Relay_Master_Log_File: mysql-bin.001079

Slave_IO_Running: Yes

Slave_SQL_Running: No

Replicate_Do_DB: mydb

Replicate_Ignore_DB:

Replicate_Do_Table:

Replicate_Ignore_Table:

Replicate_Wild_Do_Table:

Replicate_Wild_Ignore_Table:

Last_Errno: 1146

Last_Error: Error 'Table 'mydb.taggregate_temp_1212047760' doesn't exist' on query. Default database: 'mydb'.
Query: 'UPDATE thread AS thread,taggregate_temp_1212047760 AS aggregate

SET thread.views = thread.views + aggregate.views

WHERE thread.threadid = aggregate.threadid'

Skip_Counter: 0

Exec_Master_Log_Pos: 203015142

Relay_Log_Space: 166325247

Until_Condition: None

Until_Log_File:

Until_Log_Pos: 0

Master_SSL_Allowed: No

Master_SSL_CA_File:

Master_SSL_CA_Path:

Master_SSL_Cert:

Master_SSL_Cipher:

Master_SSL_Key:

Seconds_Behind_Master: NULL

1 row in set (0.00 sec)

mysql>

2 Repairing The Replication

Just to go sure, we stop the slave:

mysql> STOP SLAVE;

Fixing the problem is actually quite easy. We tell the slave to simply skip the invalid SQL query:

mysql> SET GLOBAL SQL_SLAVE_SKIP_COUNTER = 1;

This tells the slave to skip one query (which is the invalid one that caused the replication to stop). If you'd like to skip two queries, you'd use SET GLOBAL SQL_SLAVE_SKIP_COUNTER = 2; instead and so on.

That's it already. Now we can start the slave again...

mysql> START SLAVE;

... and check if replication is working again:

mysql> SHOW SLAVE STATUS \G

mysql> SHOW SLAVE STATUS \G

*************************** 1. row ***************************

Slave_IO_State: Waiting for master to send event

Master_Host: 1.2.3.4

Master_User: slave_user

Master_Port: 3306

Connect_Retry: 60

Master_Log_File: mysql-bin.001079

Read_Master_Log_Pos: 447560366

Relay_Log_File: slave-relay.000130

Relay_Log_Pos: 225644062

Relay_Master_Log_File: mysql-bin.001079

Slave_IO_Running: Yes

Slave_SQL_Running: Yes

Replicate_Do_DB: mydb

Replicate_Ignore_DB:

Replicate_Do_Table:

Replicate_Ignore_Table:

Replicate_Wild_Do_Table:

Replicate_Wild_Ignore_Table:

Last_Errno: 0

Last_Error:

Skip_Counter: 0

Exec_Master_Log_Pos: 447560366

Relay_Log_Space: 225644062

Until_Condition: None

Until_Log_File:

Until_Log_Pos: 0

Master_SSL_Allowed: No

Master_SSL_CA_File:

Master_SSL_CA_Path:

Master_SSL_Cert:

Master_SSL_Cipher:

Master_SSL_Key:

Seconds_Behind_Master: 0

1 row in set (0.00 sec)

mysql>

As you see, both Slave_IO_Running and Slave_SQL_Running are set to Yes now.

Now leave the MySQL shell...

mysql> quit;

... and check the log again:

grep mysql /var/log/syslog

The last line says that replication has started again, and if you see no errors after that line, everything is ok.

Using Mono To Set Up A Shockvoice Server

It is a step-by-step instructions on how to install Shockvoice on a Linux machine. Shockvoice is a voice-over-IP communication tool. This tool is slightly different in its characteristics. It is simply a code in C # and, therefore, works on almost any platform of interest, whether Windows, Unix, Macintosh or Solaris. The customer will only be available for Windows at first.

First you need the latest version. NET interpreter for

http://www.go-mono.com/mono-downloads/download.html

If your system is not listed you can download a complete binary package
which can be found here:

http://www.mono-project.com/Other_Downloads

In our case we will install Mono by using the packaged installer from
this source:

wget
http://ftp.novell.com/pub/mono/archive/1.9.1/linux-installer/2/mono-1.9.1_2-installer.bin

Make it executable:

chmod +x mono-1.9.1_2-installer.bin

... and run it:

./mono-1.9.1_2-installer.bin

Follow the instructions on the screen. In our case we will install the
binary to /opt. Once
Mono is installed we need to get the latest server version of
Shockvoice. Download the latest version from the Shockvoice
downloadserver:

http://www.shockvoice.net/downloads.php

In our case we will download the Linux Server_v0.8.0pre2

Create the directory where you want to install Shockvoice.

mkdir -p /usr/share/shockvoice

Download the package:

wget
ftp://ftp.shockvoice.org/shockvoice/0.8.x/svserver-0.8.0pre2-linux.tar.gz

Unpack the package into the newly created directory:

tar -C /usr/share/shockvoice -xvzf
svserver-0.8.0pre2-linux.tar.gz

Before we will run the install.sh script, we have to choose our database type.
In this example
we choose MySQL as our favorite database. We have to do
some stuff before that.
If you want to use Sqlite as your favorite database you can have to use the
shockvoice.s3db file as
your database. Now set up the MySQL part.

Create the database:

mysql -uroot -p create shockvoice

Now import the tables to the database.

mysql -uroot -p shockvoice <
/usr/share/shockvoice.mysql.sql

Now we need to create a database user (we will name him svuser) and
grant him permissions to use the shockvoice database.

mysql -uroot -p

Enter Password:

GRANT USAGE ON shockvoice.* TO
svuser@localhost
IDENTIFIED BY '<yourpassword>';

GRANT ALL ON shockvoice.* TO
svuser@localhost IDENTIFIED
BY "<yourpassword>";

FLUSH PRIVILEGES;

Change to the directory and start the install.sh
script.

cd /usr/share/shockvoice
&& ./install.sh

Follow the instructions on the screen.

This script will create and configure the service_start, service_stop
and the config.xml file. It will try to locate the necessary files from your Mono installation. Please make sure you have mono installed before running this script.

Continue? (y/n) y

Do you have unpacked Shockvoice in /usr/share/shockvoice? (y/n) y

Do you want to create the service_start and service_stop file?
(recommend) (y/n) y

searching for mono...

Found mono binary in /opt/mono-1.9/bin/mono .. good

searching for mono-service.exe...

Found mono-service.exe binary in
/opt/mono-1.9/lib/mono/gac/mono-service/2.0.0.0__0738eb9f132ed756/mono-service.exe
.. good

Creating startscript

Creating stopscript

Do you want to create the config.xml file? (y/n) y

Creating config.xml

Please enter type of database you want to use. (e.g. sqlite, mysql or
postgres)

mysql

Please enter server which stores the database Shockvoice. (e.g.
shockvoice.s3db for sqlite or localhost for mysql)

localhost

Please enter name of the database. (leave empty for sqlite)

shockvoice

Please enter username who connects to the database. (leave empty for
sqlite)

svuser

Please enter password for database user. (leave empty for sqlite)

<yourpassword>

Database type: mysql

Database server: localhost

Database name: shockvoice

Database user: svuser

Database password: <yourpassword>

Is this Correct? (y/n) y

Remember to setup the MySql database and User!

Configfile created!

Note: If you get an error like '==:
unexpected operator' try changing the first line of the install.sh
script to

#!/bin/bash

The next thing we have
to do is to copy the libMonoPosixHelper.so
and libsvcodec.so to a
location where Mono will find them. e.g. /usr/lib:

cp libMonoPosixHelper.so libsvcodec.so
/usr/lib

That's it. Now start the server with:

./service_start

Fedora : mod_geoip For Apache2

The guide explains how to set up mod_geoip with Apache2 on a Fedora 9. mod_geoip looks up at the client IP address end-user. This allows you to redirect or prevent users based on their country. You can also use this technology for your Openx (formerly known as OpenAds or phpAdsNew) ad server to allow geographical targeting.

I'm not issue any guarantee that it works for you!

1 Preliminary Note

I'm assuming that you have a running Fedora 9 system with a working Apache2 + PHP

2 Installing mod_geoip

To install mod_geoip, we simply run:

yum install mod_geoip

You will then find the GeoIP database (GeoIP.dat) in the /usr/share/GeoIP directory. As the geographic allocation of IP addresses can change over time, it's a good idea to download the newest GeoIP.dat now:

cd /usr/share/GeoIP/

mv GeoIP.dat GeoIP.dat_orig

wget http://www.maxmind.com/download/geoip/database/GeoIP.dat.gz

gunzip GeoIP.dat.gz

Next we restart Apache:

/etc/init.d/httpd restart

That's it already!

3 A Short Test

To see if mod_geoip is working correctly, we can create a small PHP file in one of our web spaces (e.g. /var/www/html):

vi /var/www/html/geoiptest.php

<?php
print_r($_SERVER);
?>

Call that file in a browser, and it should display the SERVER array including values for GEOIP_COUNTRY_CODE, GEOIP_CONTINENT_CODE, and GEOIP_COUNTRY_NAME (make sure that you're calling the file from a public IP address, not a local one).

Array

(

[GEOIP_CONTINENT_CODE] => EU

[GEOIP_COUNTRY_CODE] => DE

[GEOIP_COUNTRY_NAME] => Germany

[HTTP_HOST] => 84.143.142.69

[HTTP_USER_AGENT] => Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14

[HTTP_ACCEPT] => text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5

[HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5

[HTTP_ACCEPT_ENCODING] => gzip,deflate

[HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.7

[HTTP_KEEP_ALIVE] => 300

[HTTP_CONNECTION] => keep-alive

[PATH] => /sbin:/usr/sbin:/bin:/usr/bin

[SERVER_SIGNATURE] => <address>Apache/2.2.8 (Fedora) Server at 84.143.142.69 Port 80</address>

[SERVER_SOFTWARE] => Apache/2.2.8 (Fedora)

[SERVER_NAME] => 84.143.142.69

[SERVER_ADDR] => 192.168.0.100

[SERVER_PORT] => 80

[REMOTE_ADDR] => 84.143.142.69

[DOCUMENT_ROOT] => /var/www/html

[SERVER_ADMIN] => root@localhost

[SCRIPT_FILENAME] => /var/www/html/geoiptest.php

[REMOTE_PORT] => 57421

[GATEWAY_INTERFACE] => CGI/1.1

[SERVER_PROTOCOL] => HTTP/1.1

[REQUEST_METHOD] => GET

[QUERY_STRING] =>

[REQUEST_URI] => /geoiptest.php

[SCRIPT_NAME] => /geoiptest.php

[PHP_SELF] => /geoiptest.php

[REQUEST_TIME] => 1211819286

)

If you want to use Apache2 + mod_geoip for your OpenX ad server, make sure you select MaxMind mod_apache GeoIP under Settings > Main Settings > Geotargeting Settings:

4 Use Cases

You can use mod_geoip to redirect or block/allow users based on their country. You can find some useful examples for this here: http://www.maxmind.com/app/mod_geoip

5 Links

mod_geoip: http://www.maxmind.com/app/mod_geoip

Apache: http://httpd.apache.org

Fedora: http://fedoraproject.org

Trick: Fedora 9 "Sulphur" - The Perfect Server

It is a detailed description on how to set up a server Fedora 9, which offers all services needed by ISPs and hosters: Apache web server (SSL compatible) with PHP5 and Ruby, server Postfix mail with SMTP AUTH and TLS, BIND DNS server, Proftpd FTP server, MySQL, dovecote POP3/IMAP, Quota, Firewall, etc. This tutorial is written for 32-bit version of Fedora 9, but should apply to 64-bit version with very few changes.

I'll use the following software:

* Web Server: Apache 2.2.8
* PHP 5.2.5
* Ruby
* Server database: MySQL 5.0.51
* Mail Server: Postfix
* DNS: BIND9 (chroot)
* FTP server: proftpd
* POP3/IMAP server: dovecote
* Webalizer statistics for website

In the end, you should have a system that works reliably, and if you want, you can install free control panel hosting ISPConfig (ie, ISPConfig runs on it out of the box).

Read more at Howtoforge.com

Linux Help and Info Center

Guide : Whitelist Hosts In Postfix

Guide : Fix MySQL Replication

Using Mono To Set Up A Shockvoice Server

Fedora : mod_geoip For Apache2

Trick: Fedora 9 "Sulphur" - The Perfect Server

Blog Archive

Categories

Subscribe To