A long time ago I wrote an entry post about how to set up the SMTP in linux boxes using a relay system you can find the post here: Relay mail from your server without MTA. Remember that SSMTP is not a SMTP service for your system but it’s more than enough for all servers that don’t work as a mail servers. Historically Unix/Linux uses sendmail command to send system notifications but usually this mails are lost because system configurations are not completed. My advice in this sense is use SSMTP.
In the past I used to use SSMTP with a GMail account but security constraints in Google mail services make it difficult to configure today. The new alternative is set up a free Mandrill account as a relay host. Mandrill is a Mailchimp service that allows you to send a lot of emails without problems and there is a free account that allows to send up to 12.000 mails per month free, more than enough usually. If you don’t know how to set up a Mailchimp account the best option to learn how to do it is follow the support documentation it’s very good IMHO.
When you have a lot of linux machines to administer you need something fastly replicable. As you know use Ansible is a very good option. Then I developed a new Ansible role to set up Mandrill accounts to SSMTP services massively using Ansible.
Firstly let me introduce a Windows service called: “Windows Remote Manager” or “WinRM”. This is the Windows feature that allows remote control of Windows machines and many other remote functionalities. In my case I have a Windows 7 laptop with SP1 and PowerShell v3 installed.
Secondly don’t forget that Ansible is developed using Python then a Python library have to manage the WinRM protocol. I’m talking about “pywinrm“. Using this library it’s easy to create simple scripts like that:
In the end it’s time to talk about how to create an Ansible Playbook to deploy anything in a Windows machine. As always the first thing that we need is a hosts file. In the next example there are several ansible variables needed to run Ansible Windows modules on WinRM, all of them are self-explanatory:
[all]10.2.0.42
[all:vars]
ansible_ssh_user=the_username
ansible_ssh_pass=the_password
ansible_ssh_port=5985 #winrm (non-ssl) port
ansible_connection=winrm
The first basic example could be a simple playbook that runs the ‘ipconfig’ command and registers the output in an Ansible variable to be showed later like a debug information:
- name: test raw module hosts: all tasks: - name: run ipconfig raw: ipconfig register: ipconfig - debug: var=ipconfig
As always Ansible have several modules, not only the ‘raw’ module. I committed two examples in my Github account using a module to download URLs and another one that runs Powershell scripts.
My examples are done using Ansible 1.8.2 installed in a Fedora 20. But main problems I’ve found are configuring Windows 7 to accept WinRM connections. Next I attach some references that helped me a lot:
Ansible is a very powerful tool. Using playbooks, something like a cookbook, is very easy to automate maintenance tasks of systems. I used Puppet and other tools like that but IMHO Ansible is the best one.
In some cases you need to manage dynamic systems and take into advantage of Ansible like a Python library is a very good complement for your scripts. This is my last requirement and because of that I decided to share some simple Python snippets that help you to understand how to use Ansible as a Python library.
Firstly an example about how to call an Ansible module with just one host in the inventory (test_modules.py):
#!/usr/bin/python import ansible.runnerimport ansible.playbookimport ansible.inventoryfrom ansible import callbacksfrom ansible import utilsimport json# the fastest way to set up the inventory# hosts listhosts = ["10.11.12.66"]# set up the inventory, if no group is defined then 'all' group is used by defaultexample_inventory = ansible.inventory.Inventory(hosts)pm = ansible.runner.Runner( module_name = 'command', module_args = 'uname -a', timeout = 5, inventory = example_inventory, subset = 'all' # name of the hosts group )out = pm.run()print json.dumps(out, sort_keys=True, indent=4, separators=(',', ': '))
As a second example, we’re going to use a simple Ansible Playbook with that code (test.yml):
- hosts: sample_group_name tasks: - name: just an uname command: uname -a
The Python code which uses that playbook is (test_playbook.py):
#!/usr/bin/python import ansible.runnerimport ansible.playbookimport ansible.inventoryfrom ansible import callbacksfrom ansible import utilsimport json### setting up the inventory## first of all, set up a host (or more)example_host = ansible.inventory.host.Host( name = '10.11.12.66', port = 22 )# with its variables to modify the playbookexample_host.set_variable( 'var', 'foo')## secondly set up the group where the host(s) has to be addedexample_group = ansible.inventory.group.Group( name = 'sample_group_name' )example_group.add_host(example_host)## the last step is set up the invetory itselfexample_inventory = ansible.inventory.Inventory()example_inventory.add_group(example_group)example_inventory.subset('sample_group_name')# setting callbacksstats = callbacks.AggregateStats()playbook_cb = callbacks.PlaybookCallbacks(verbose=utils.VERBOSITY)runner_cb = callbacks.PlaybookRunnerCallbacks(stats, verbose=utils.VERBOSITY)# creating the playbook instance to run, based on "test.yml" filepb = ansible.playbook.PlayBook( playbook = "test.yml", stats = stats, callbacks = playbook_cb, runner_callbacks = runner_cb, inventory = example_inventory, check=True )# running the playbookpr = pb.run() # print the summary of results for each hostprint json.dumps(pr, sort_keys=True, indent=4, separators=(',', ': '))
OpenAM is as much powerful as complicated sometimes. In this case I spent a lot of time understanding how to set simple settings because of that I decide to take note about that in this blog entry.
First of all don’t forget to set the environment variables and go to ssoadm path:
anonymous (id=anonymous,ou=user,dc=openam) demo (id=demo,ou=user,dc=openam) serviceusername (id=serviceusername,ou=user,dc=openam) amAdmin (id=amAdmin,ou=user,dc=openam) Search of Identities of type User in realm, / succeeded.
But as you can see it doesn’t work and I don’t know how to solve it.
Taking a look to GUI get to identities list with: Access Control > / (Top Level Realm) > Privileges
In this webpage you have a list of role identities, in my case I have only this: “All Authenticated Users”. Inside this identity I can set different privileges:
REST calls for Policy Evaluation (EntitlementRestAccess)
Read and write access to all log files (LogAdmin)
REST calls for searching entitlements (PrivilegeRestReadAccess)
Read access to all log files (LogRead)
Read and write access to all federation metadata configurations (FederationAdmin)
Read and write access only for policy properties (PolicyAdmin)
Read and write access to all configured Agents (AgentAdmin)
Read and write access to all realm and policy properties (RealmAdmin)
REST calls for managing entitlements (PrivilegeRestAccess)
Write access to all log files (LogWrite)
If we want to remove a privilege:
root@vm:/opt/openam/ssoadmin/openam/bin# ./ssoadm remove-privileges -u amAdmin -f /tmp/oam.pwd -e / -g EntitlementRestAccess -i "All Authenticated Users" -t rolePrivileges were removed from identity, All Authenticated Users of type, role in realm, /.
or adding a privilege:
root@vm:/opt/openam/ssoadmin/openam/bin# ./ssoadm add-privileges -u amAdmin -f /tmp/oam.pwd -e / -g EntitlementRestAccess -i "All Authenticated Users" -t role
Using sslsnoop you can dump SSH keys used in a session and decode ciphered traffic. Supported algorithms are: aes128-ctr, aes192-ctr, aes256-ctr, blowfish-cbc, cast128-cbc.
Basic sslsnoop information:
$ sudo sslsnoop # try ssh, sshd and ssh-agent... for various things $ sudo sslsnoop-openssh live `pgrep ssh` # dumps SSH decrypted traffic in outputs/ $ sudo sslsnoop-openssh offline --help # dumps SSH decrypted traffic in outputs/ from a pcap file $ sudo sslsnoop-openssl `pgrep ssh-agent` # dumps RSA and DSA keys
Reading time: < 1 minute
Specially when you have to look up inside Postfix logs or Syslog in general it could be the swiss knife tool you need: timegrep.
You have to know that the tool is developed using Python. And is very easy to upgrade or fork the code.
Reading time: < 1 minute
Really useful command of ssh package to add public key of your user account to a remote SSH server and then access there with passwordless authentication method.
ssh-copy-id [-i [identity_file]] [user@]machine
In the past I wrote a simple cookbook to explain this process but now this is as simple as possible. Don't forget ssh-copy-id is the most easy way to add your ssh public key in remote servers.
Configure spamassassin is never easy to do. But when you look for information in Google usually you will be mad . The most common help method in linux is use ‘man command’ but it doesn’t work or information is not enough usually.
After a lucky search I found this command to get an extended information about how to configure spamassassin.conf file.
Aquesta setmana he tingut un expedient X’s amb el servidor d’oriolrius.cat que tinc virtualitzat en un servidor de Xen. La qüestió és que segons Xen la màquina estava corrent normal però encanvi no podia accedir ni a la consola ni enlloc. Ja que la màquina no estava a la llista de processesos del sistema. Així doncs, després de més d’1any he hagut d’aprendre alguna comanda de Xen CLI per poder solucionar el problema.
Per obtenir la llista de màquines virtuals que té el sistema:
xevm-list
amb aquesta comanda podem obtenir el uuid, aquest identificador ens serà útil per poder forçar la màquina perquè es pari. Això ho podem fer així:
Llavors podem eliminar el domini que ens causa problemes així:
/opt/xensource/debug/destroy_domain-domid1
Si la comanda no retorna error vol dir que hem pogut eliminar el domini i ja podem tornar a executar la comanda xe vm-reset-powerstate.
Gràcies a això he pogut fer-li entendre al Xen server que la màquina estava parada i des de la GUI he tornat a iniciar la màquina sense problemes. En el meu cas aquesta anomalia s’havia donat degut a que el sistema s’havia quedat sense memòria, o sigui, que entenc que hi hauria alguna part del hypervisor que tindria leaks de memòria.