http://cocnm.computerisms.ca/api.php?action=feedcontributions&feedformat=atom&user=Bob COCNM - User contributions [en] 2026-11-14T11:43:09Z User contributions MediaWiki 1.41.0 http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=511 User Creation Script 2022-11-02T18:47:24Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 600 maxproc<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> groupadd -g 543 fa<br /> groupadd -g 544 movies<br /> groupadd -g 545 cap<br /> groupadd -g 546 tables<br /> groupadd -g 547 observer<br /> groupadd -g 548 obplayer<br /> groupadd -g 549 elasticsearch<br /> groupadd -g 550 solr<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> useradd -u 543 -g fa -r fa<br /> useradd -u 544 -g movies -r movies<br /> useradd -u 545 -g cap -r cap<br /> useradd -u 546 -g tables -r tables<br /> useradd -u 547 -g observer -r observer<br /> useradd -u 548 -g obplayer -r obplayer<br /> useradd -u 549 -g elasticsearch -r elasticsearch<br /> useradd -u 550 -g solr -m -d /usr/local/solr -r solr<br /> useradd -u 551 -g dcc -m -d /usr/local/dcc dcc<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=501 User Creation Script 2022-11-01T16:17:35Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 600 maxproc<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> groupadd -g 543 fa<br /> groupadd -g 544 movies<br /> groupadd -g 545 cap<br /> groupadd -g 546 tables<br /> groupadd -g 547 observer<br /> groupadd -g 548 obplayer<br /> groupadd -g 549 elasticsearch<br /> groupadd -g 550 solr<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> useradd -u 543 -g fa -r fa<br /> useradd -u 544 -g movies -r movies<br /> useradd -u 545 -g cap -r cap<br /> useradd -u 546 -g tables -r tables<br /> useradd -u 547 -g observer -r observer<br /> useradd -u 548 -g obplayer -r obplayer<br /> useradd -u 549 -g elasticsearch -r elasticsearch<br /> useradd -u 550 -g solr -d /usr/local/solr -r solr<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=491 User Creation Script 2022-06-11T00:51:40Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 600 maxproc<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> groupadd -g 543 fa<br /> groupadd -g 544 movies<br /> groupadd -g 545 cap<br /> groupadd -g 546 tables<br /> groupadd -g 547 observer<br /> groupadd -g 548 obplayer<br /> groupadd -g 549 elasticsearch<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> useradd -u 543 -g fa -r fa<br /> useradd -u 544 -g movies -r movies<br /> useradd -u 545 -g cap -r cap<br /> useradd -u 546 -g tables -r tables<br /> useradd -u 547 -g observer -r observer<br /> useradd -u 548 -g obplayer -r obplayer<br /> useradd -u 549 -g elasticsearch -r elasticsearch<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=481 User Creation Script 2021-03-25T19:23:57Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 600 maxproc<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> groupadd -g 543 fa<br /> groupadd -g 544 movies<br /> groupadd -g 545 cap<br /> groupadd -g 546 tables<br /> groupadd -g 547 observer<br /> groupadd -g 548 obplayer<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> useradd -u 543 -g fa -r fa<br /> useradd -u 544 -g movies -r movies<br /> useradd -u 545 -g cap -r cap<br /> useradd -u 546 -g tables -r tables<br /> useradd -u 547 -g observer -r observer<br /> useradd -u 548 -g obplayer -r obplayer<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=471 User Creation Script 2021-03-25T19:23:23Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 600 maxproc<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> groupadd -g 543 fa<br /> groupadd -g 544 movies<br /> groupadd -g 545 cap<br /> groupadd -g 546 tables<br /> groupadd -g 547 observer<br /> groupadd -g 548 obplayer<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> useradd -u 543 -g fa -r fa<br /> useradd -u 544 -g movies -r movies<br /> useradd -u 545 -g cap -r cap<br /> useradd -u 546 -g tables -r tables<br /> useradd -u 546 -g observer -r observer<br /> useradd -u 546 -g obplayer -r obplayer<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=461 User Creation Script 2021-03-24T19:28:39Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 600 maxproc<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> groupadd -g 543 fa<br /> groupadd -g 544 movies<br /> groupadd -g 545 cap<br /> groupadd -g 546 tables<br /> groupadd -g 547 observer<br /> groupadd -g 548 obplayer<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> useradd -u 543 -g fa -r fa<br /> useradd -u 544 -g movies -r movies<br /> useradd -u 545 -g cap -r cap<br /> useradd -u 546 -g tables -r tables<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=Set_up_Basic_Firewall_Functions&diff=460 Set up Basic Firewall Functions 2019-05-07T03:02:20Z <p>Bob: /* Multiple Network Interfaces on Debian */</p> <hr /> <div>&lt;b&gt;TODO: change this to not use ifrename and use udev instead&lt;/b&gt;<br /> <br /> ==System Prep==<br /> *apt-get remove nfs-common rpcbind<br /> *apt-get install ifrename<br /> <br /> ==Multiple Network Interfaces on Debian==<br /> *&lt;b&gt;BIG FAT NOTE: Do not use ifrename on current debian, use udev instead&lt;/b&gt;<br /> **SUBSYSTEM==&quot;net&quot;, ACTION==&quot;add&quot;, DRIVERS==&quot;?*&quot;, ATTR{address}==&quot;00:a0:c9:2e:fe:db&quot;, ATTR{dev_id}==&quot;0x0&quot;, ATTR{type}==&quot;1&quot;, KERNEL==&quot;eth*&quot;, NAME=&quot;eth2&quot;<br /> <br /> *for i in eth0 eth1 eth2; do ADD=$(ifconfig $i | head -1 | cut -f 11 -d &quot; &quot;); echo &quot;$i mac $ADD&quot; &gt;&gt; /etc/iftab; done<br /> *&gt; /etc/network/interfaces; vi [[/etc/network/interfaces]]<br /> <br /> ==Configure Packet Forwarding / Basic IPTables Rules Set / Network Startup Script==<br /> *sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf<br /> *sysctl -p<br /> *mkdir /root/scripts<br /> *vi [[/root/scripts/iptables-restore]]<br /> *iptables-restore &lt; /root/scripts/iptables-restore<br /> *vi [[/root/scripts/netup.sh]]<br /> *vi [[/root/scripts/netdown.sh]]</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=459 User Creation Script 2018-09-25T19:18:14Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 600 maxproc<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> groupadd -g 543 fa<br /> groupadd -g 544 movies<br /> groupadd -g 545 cap<br /> groupadd -g 546 tables<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> useradd -u 543 -g fa -r fa<br /> useradd -u 544 -g movies -r movies<br /> useradd -u 545 -g cap -r cap<br /> useradd -u 546 -g tables -r tables<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=458 User Creation Script 2018-06-26T21:40:21Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 600 maxproc<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> groupadd -g 543 fa<br /> groupadd -g 544 movies<br /> groupadd -g 545 cap<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> useradd -u 543 -g fa -r fa<br /> useradd -u 544 -g movies -r movies<br /> useradd -u 545 -g cap -r cap<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=457 User Creation Script 2018-06-20T01:45:23Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> groupadd -g 543 fa<br /> groupadd -g 544 movies<br /> groupadd -g 545 cap<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> useradd -u 543 -g fa -r fa<br /> useradd -u 544 -g movies -r movies<br /> useradd -u 545 -g cap -r cap<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=456 User Creation Script 2018-04-26T06:00:45Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> groupadd -g 543 fa<br /> groupadd -g 544 movies<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> useradd -u 543 -g fa -r fa<br /> useradd -u 544 -g movies -r movies<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=455 User Creation Script 2017-12-04T21:01:42Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> groupadd -g 543 fa<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> useradd -u 543 -g fa -r fa<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=454 User Creation Script 2017-11-27T17:32:17Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> groupadd -g 540 haproxy<br /> groupadd -g 541 mailconf<br /> groupadd -g 542 time<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> useradd -u 540 -g haproxy -r haproxy<br /> useradd -u 541 -g mailconf -r mailconf<br /> useradd -u 542 -g time -r time<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=/usr/src/qmail-ldap-samba4.patch&diff=453 /usr/src/qmail-ldap-samba4.patch 2017-08-15T21:27:06Z <p>Bob: /* Notes/Caveats/Warnings */</p> <hr /> <div>==Creditation==<br /> *Large parts of this patch came from http://www.mail-archive.com/qmail-ldap@qmail-ldap.org/msg06274.html<br /> *http://permalink.gmane.org/gmane.mail.qmail.ldap/11694 &lt;= auth-dovecot.c.patch<br /> *http://www.mail-archive.com/qmail-ldap@qmail-ldap.org/msg07407.html &lt;= qmail.mailinglist.patches.patch<br /> <br /> ==Notes/Caveats/Warnings==<br /> *near the top are variables LDAPINCLUDES and LDAPLIBS. Make sure they point to the correct openldap version you just built<br /> *Made untested change to this patch for mailAlternateAddress 2014/02/14<br /> **Finally tested and fixed 2017.08.15<br /> <br /> ==qmail-ldap 2012 patch==<br /> &lt;pre&gt;<br /> diff -Naur qmail-1.03/auth_dovecot.c qmail-1.03.patched/auth_dovecot.c<br /> --- qmail-1.03/auth_dovecot.c 2012-12-23 23:10:27.401149120 -0800<br /> +++ qmail-1.03.patched/auth_dovecot.c 2012-12-23 22:57:27.373184614 -0800<br /> @@ -127,7 +127,9 @@<br /> void<br /> auth_init(int argc, char **argv, stralloc *login, stralloc *authdata)<br /> {<br /> +#ifdef DEBUG<br /> extern unsigned long loglevel;<br /> +#endif<br /> char *l, *p;<br /> unsigned int uplen, u;<br /> int n, opt;<br /> @@ -140,10 +142,12 @@<br /> case 'd':<br /> pbstool = optarg;<br /> break;<br /> +#ifdef DEBUG<br /> case 'D':<br /> scan_ulong(optarg, &amp;loglevel);<br /> loglevel &amp;= ~256; /* see auth_mod.c */<br /> break;<br /> +#endif<br /> default:<br /> auth_error(AUTH_CONF);<br /> }<br /> diff -Naur qmail-1.03/Makefile qmail-1.03.patched/Makefile<br /> --- qmail-1.03/Makefile 2012-12-23 23:10:27.397148371 -0800<br /> +++ qmail-1.03.patched/Makefile 2012-12-23 22:57:27.369184384 -0800<br /> @@ -19,12 +19,12 @@<br /> # -DQMQP_COMPRESS to use the QMQP on the fly compression (for clusters)<br /> # -DQUOTATRASH to include the Trash in the quota calculation (normaly it is not)<br /> # -DSMTPEXECCHECK to enable smtp DOS/Windows executable detection<br /> -#LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS -DQMQP_COMPRESS -DSMTPEXECCHECK<br /> +LDAPFLAGS=-DALTQUEUE -DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS -DQMQP_COMPRESS -DSMTPEXECCHECK<br /> <br /> # Perhaps you have different ldap libraries, change them here<br /> -LDAPLIBS=-L/usr/local/lib -lldap -llber<br /> +LDAPLIBS=-L/usr/src/openldap-2.4.33/libraries -lldap -llber<br /> # and change the location of the include files here<br /> -LDAPINCLUDES=-DLDAP_DEPRECATED=1 -I/usr/local/include<br /> +LDAPINCLUDES=-DLDAP_DEPRECATED=1 -I/usr/src/openldap-2.4.25/include<br /> # on Slowaris you need -lresolv and probably a LD_RUN_PATH added like this:<br /> #LDAPLIBS=-L/opt/OpenLDAP/lib -lldap -llber -lresolv -R/opt/OpenLDAP/lib<br /> # for example on my Linux box I use:<br /> @@ -33,7 +33,7 @@<br /> #LDAPINCLUDES=-DLDAP_DEPRECATED=1 -I/opt/OpenLDAP/include<br /> <br /> # ZLIB needed for -DDATA_COMPRESS and -DQMQP_COMPRESS<br /> -#ZLIB=-lz<br /> +ZLIB=-lz<br /> # or you installed zlib in a different path you can use something like this<br /> #ZLIB=-L/opt/zlib/lib -lz<br /> #ZINCLUDES=-I/opt/zlib/include<br /> @@ -43,31 +43,31 @@<br /> # use -DTLS_REMOTE to enable tls support in qmail-remote<br /> # use -DTLS_SMTPD to enable tls support in qmail-smtpd<br /> # use -DTLSDEBUG to enable additional tls debug information in qmail-remote<br /> -#TLS=-DTLS_REMOTE -DTLS_SMTPD<br /> +TLS=-DTLS_REMOTE -DTLS_SMTPD<br /> # Path to OpenSSL includes<br /> -#TLSINCLUDES=-I/usr/local/include<br /> +TLSINCLUDES=-I/usr/local/include<br /> # Path to OpenSSL libraries<br /> -#TLSLIBS=-L/usr/local/lib -lssl -lcrypto<br /> +TLSLIBS=-L/usr/local/lib -lssl -lcrypto<br /> # Path to OpenSSL binary<br /> -#OPENSSLBIN=/usr/local/bin/openssl<br /> -#OPENSSLBIN=openssl<br /> +OPENSSLBIN=/usr/bin/openssl<br /> +OPENSSLBIN=openssl<br /> <br /> # to make the Netscape download progress bar work with qmail-pop3d<br /> # uncomment the next line (allready done)<br /> MNW=-DMAKE_NETSCAPE_WORK <br /> <br /> # to enable the auto-maildir-make feature uncomment the next line<br /> -#MDIRMAKE=-DAUTOMAILDIRMAKE<br /> +MDIRMAKE=-DAUTOMAILDIRMAKE<br /> <br /> # to enable the auto-homedir-make feature uncomment the next line<br /> -#HDIRMAKE=-DAUTOHOMEDIRMAKE<br /> +HDIRMAKE=-DAUTOHOMEDIRMAKE<br /> <br /> # on most systems we need this to make auth_pop and auth_imap<br /> #SHADOWLIBS=-lcrypt<br /> # OpenBSD and other Systems do not have libcrypt, so comment the line out<br /> # if you get linking problems.<br /> # To use shadow passwords under some Linux OS, uncomment the next two lines.<br /> -#SHADOWLIBS=-lcrypt -lshadow<br /> +SHADOWLIBS=-lcrypt<br /> #SHADOWOPTS=-DPW_SHADOW<br /> # To use shadow passwords under Solaris, uncomment the SHADOWOPTS line.<br /> <br /> diff -Naur qmail-1.03/qldap.c qmail-1.03.patched/qldap.c<br /> --- qmail-1.03/qldap.c 2012-12-23 23:10:27.437154714 -0800<br /> +++ qmail-1.03.patched/qldap.c 2012-12-23 22:57:27.369184384 -0800<br /> @@ -681,6 +681,7 @@<br /> qldap_get_status(qldap *q, int *status)<br /> {<br /> int r;<br /> + unsigned long ul,IS_BOUNCE,IS_ACTIVE;<br /> <br /> /* default value */<br /> *status = STATUS_UNDEF;<br /> @@ -689,13 +690,22 @@<br /> if (r == NOSUCH) {<br /> return OK;<br /> } else if (r == OK) {<br /> - if (!case_diffs(ldap_attr.s, ISACTIVE_BOUNCE))<br /> +/*ORIG_CODE if (!case_diffs(ldap_attr.s, ISACTIVE_BOUNCE))<br /> *status = STATUS_BOUNCE;<br /> else if (!case_diffs(ldap_attr.s, ISACTIVE_DELETE))<br /> *status = STATUS_DELETE;<br /> else if (!case_diffs(ldap_attr.s, ISACTIVE_NOACCESS))<br /> *status = STATUS_NOACCESS;<br /> - else *status = STATUS_OK; /* default to OK */<br /> + else *status = STATUS_OK; END_ORIG_CODE*/ /* default to OK */<br /> + <br /> + scan_ulong(ISACTIVE_BOUNCE + '\0', &amp;IS_BOUNCE);<br /> + scan_ulong(ISACTIVE_ACTIVE + '\0', &amp;IS_ACTIVE);<br /> + if (ldap_attr.s[scan_ulong(ldap_attr.s, &amp;ul)] == '\0') {<br /> + ul &amp;= ISACTIVE_MASK; /* mask result */<br /> + if (ul == IS_BOUNCE) *status = STATUS_BOUNCE;<br /> + else if (ul == IS_ACTIVE) *status = STATUS_OK;<br /> + else *status = STATUS_NOACCESS; /* default to NO ACCESS */<br /> + }<br /> /* perhaps we should spill out a warning for unknown settings */<br /> return OK;<br /> }<br /> diff -Naur qmail-1.03/qldap-filter.c qmail-1.03.patched/qldap-filter.c<br /> --- qmail-1.03/qldap-filter.c 2012-12-23 23:10:27.433154249 -0800<br /> +++ qmail-1.03.patched/qldap-filter.c 2012-12-23 22:57:50.553185213 -0800<br /> @@ -107,7 +107,7 @@<br /> return 0;<br /> <br /> if (!filter_start(&amp;filter) ||<br /> - !stralloc_copys(&amp;filter,&quot;(&quot;) ||<br /> + !stralloc_cats(&amp;filter,&quot;(&quot;) ||<br /> !stralloc_cats(&amp;filter, LDAP_UID) ||<br /> !stralloc_cats(&amp;filter, &quot;=&quot;) ||<br /> !filter_escape(&amp;filter, uid, str_len(uid)) ||<br /> @@ -179,7 +179,6 @@<br /> }<br /> extcnt--;<br /> #else<br /> -#error XXX XXX <br /> /* basic qmail-ldap behavior test for username@domain.com and<br /> catchall@domain.com */<br /> ext = 0;<br /> @@ -193,7 +192,7 @@<br /> /* build the search string for the email address */<br /> /* mail address */<br /> if (!filter_start(&amp;filter) ||<br /> - !stralloc_copys(&amp;filter, &quot;(|(&quot;) ||<br /> + !stralloc_cats(&amp;filter, &quot;(|(&quot;) ||<br /> !stralloc_cats(&amp;filter, LDAP_MAIL) ||<br /> !stralloc_cats(&amp;filter, &quot;=&quot;))<br /> return 0;<br /> diff -Naur qmail-1.03/qmail-ldap.h qmail-1.03.patched/qmail-ldap.h<br /> --- qmail-1.03/qmail-ldap.h 2012-12-23 23:10:27.437154714 -0800<br /> +++ qmail-1.03.patched/qmail-ldap.h 2012-12-23 22:57:27.369184384 -0800<br /> @@ -65,7 +65,7 @@<br /> * of the shell are allowed (like &amp;, &amp;, ;, and &lt;,|,&gt;)<br /> * You should know what you are doing when disallowing this */<br /> /* 1 = restriced sanitycheck; 0 = less restriced sanitycheck */<br /> -#define RESTRICT_PROG 1<br /> +#define RESTRICT_PROG 0<br /> <br /> /* ALIASDEVNULL replacement for the std. aliasempty for user with<br /> * neither homeDirectory nor mailMessageStore defined */<br /> @@ -92,11 +92,11 @@<br /> /*********************************************************************<br /> ldap variables used in qmail-lspawn and auth_*<br /> *********************************************************************/<br /> -#define LDAP_MAIL &quot;mail&quot;<br /> +#define LDAP_MAIL &quot;userPrincipalName&quot;<br /> #define LDAP_MAILALTERNATE &quot;mailAlternateAddress&quot;<br /> #define LDAP_QMAILUID &quot;qmailUID&quot;<br /> #define LDAP_QMAILGID &quot;qmailGID&quot;<br /> -#define LDAP_MAILSTORE &quot;mailMessageStore&quot;<br /> +#define LDAP_MAILSTORE &quot;sAMAccountName&quot;<br /> -#define LDAP_HOMEDIR &quot;homeDirectory&quot;<br /> +#define LDAP_HOMEDIR &quot;noSuchDirectory&quot;<br /> #define LDAP_QUOTA &quot;mailQuota&quot;<br /> #define LDAP_QUOTA_SIZE &quot;mailQuotaSize&quot;<br /> @@ -108,10 +108,10 @@<br /> #define LDAP_MODE &quot;deliveryMode&quot;<br /> #define LDAP_REPLYTEXT &quot;mailReplyText&quot;<br /> #define LDAP_DOTMODE &quot;qmailDotMode&quot;<br /> -#define LDAP_UID &quot;uid&quot;<br /> +#define LDAP_UID &quot;userPrincipalName&quot;<br /> #define LDAP_PASSWD &quot;userPassword&quot;<br /> #define LDAP_OBJECTCLASS &quot;objectClass&quot;<br /> -#define LDAP_ISACTIVE &quot;accountStatus&quot;<br /> +#define LDAP_ISACTIVE &quot;userAccountControl&quot;<br /> #define LDAP_PURGE &quot;qmailAccountPurge&quot;<br /> <br /> #define DOTMODE_LDAPONLY &quot;ldaponly&quot;<br /> @@ -132,10 +132,11 @@<br /> #define MODE_PROG &quot;program&quot;<br /> #define MODE_NOREPLY &quot;noreply&quot;<br /> <br /> -#define ISACTIVE_BOUNCE &quot;disabled&quot;<br /> +#define ISACTIVE_BOUNCE &quot;514&quot;<br /> #define ISACTIVE_DELETE &quot;deleted&quot;<br /> #define ISACTIVE_NOACCESS &quot;noaccess&quot;<br /> -#define ISACTIVE_ACTIVE &quot;active&quot;<br /> +#define ISACTIVE_ACTIVE &quot;512&quot;<br /> +#define ISACTIVE_MASK 0x202 /* because 514 is 0x202, 512 is 0x200 */<br /> <br /> /*********************************************************************<br /> ldap variables used in qmail-group<br /> diff -Naur qmail-1.03/qmail-ldaplookup.c qmail-1.03.patched/qmail-ldaplookup.c<br /> --- qmail-1.03/qmail-ldaplookup.c 2012-12-23 23:10:27.437154714 -0800<br /> +++ qmail-1.03.patched/qmail-ldaplookup.c 2012-12-23 23:01:00.333180404 -0800<br /> @@ -223,12 +223,12 @@<br /> switch (mode) {<br /> case mail:<br /> f = filter_mail(value, &amp;done);<br /> - if (value == 0)<br /> + if (f == 0)<br /> strerr_die2sys(1, FATAL, &quot;building filter: &quot;);<br /> break;<br /> case uid:<br /> f = filter_uid(value);<br /> - if (value == 0)<br /> + if (f == 0)<br /> strerr_die2sys(1, FATAL, &quot;building filter: &quot;);<br /> done = 1;<br /> break;<br /> @@ -321,7 +321,7 @@<br /> if (r != OK) fail(q, &quot;qldap_get_status&quot;, r);<br /> switch (status) {<br /> case STATUS_BOUNCE:<br /> - output(subfdout, &quot;%s: %s\n&quot;,<br /> + output(subfdout, &quot;%s: %s -&gt; disabled\n&quot;,<br /> LDAP_ISACTIVE, ISACTIVE_BOUNCE);<br /> break;<br /> case STATUS_NOACCESS:<br /> @@ -329,7 +329,7 @@<br /> LDAP_ISACTIVE, ISACTIVE_NOACCESS);<br /> break;<br /> case STATUS_OK:<br /> - output(subfdout, &quot;%s: %s\n&quot;,<br /> + output(subfdout, &quot;%s: %s -&gt; active\n&quot;,<br /> LDAP_ISACTIVE, ISACTIVE_ACTIVE);<br /> break;<br /> case STATUS_UNDEF:<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=/usr/src/qmail-ldap-samba4.patch&diff=452 /usr/src/qmail-ldap-samba4.patch 2017-08-15T21:26:46Z <p>Bob: </p> <hr /> <div>==Creditation==<br /> *Large parts of this patch came from http://www.mail-archive.com/qmail-ldap@qmail-ldap.org/msg06274.html<br /> *http://permalink.gmane.org/gmane.mail.qmail.ldap/11694 &lt;= auth-dovecot.c.patch<br /> *http://www.mail-archive.com/qmail-ldap@qmail-ldap.org/msg07407.html &lt;= qmail.mailinglist.patches.patch<br /> <br /> ==Notes/Caveats/Warnings==<br /> *near the top are variables LDAPINCLUDES and LDAPLIBS. Make sure they point to the correct openldap version you just built<br /> *Made untested change to this patch for mailAlternateAddress 2014/02/14<br /> <br /> ==qmail-ldap 2012 patch==<br /> &lt;pre&gt;<br /> diff -Naur qmail-1.03/auth_dovecot.c qmail-1.03.patched/auth_dovecot.c<br /> --- qmail-1.03/auth_dovecot.c 2012-12-23 23:10:27.401149120 -0800<br /> +++ qmail-1.03.patched/auth_dovecot.c 2012-12-23 22:57:27.373184614 -0800<br /> @@ -127,7 +127,9 @@<br /> void<br /> auth_init(int argc, char **argv, stralloc *login, stralloc *authdata)<br /> {<br /> +#ifdef DEBUG<br /> extern unsigned long loglevel;<br /> +#endif<br /> char *l, *p;<br /> unsigned int uplen, u;<br /> int n, opt;<br /> @@ -140,10 +142,12 @@<br /> case 'd':<br /> pbstool = optarg;<br /> break;<br /> +#ifdef DEBUG<br /> case 'D':<br /> scan_ulong(optarg, &amp;loglevel);<br /> loglevel &amp;= ~256; /* see auth_mod.c */<br /> break;<br /> +#endif<br /> default:<br /> auth_error(AUTH_CONF);<br /> }<br /> diff -Naur qmail-1.03/Makefile qmail-1.03.patched/Makefile<br /> --- qmail-1.03/Makefile 2012-12-23 23:10:27.397148371 -0800<br /> +++ qmail-1.03.patched/Makefile 2012-12-23 22:57:27.369184384 -0800<br /> @@ -19,12 +19,12 @@<br /> # -DQMQP_COMPRESS to use the QMQP on the fly compression (for clusters)<br /> # -DQUOTATRASH to include the Trash in the quota calculation (normaly it is not)<br /> # -DSMTPEXECCHECK to enable smtp DOS/Windows executable detection<br /> -#LDAPFLAGS=-DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS -DQMQP_COMPRESS -DSMTPEXECCHECK<br /> +LDAPFLAGS=-DALTQUEUE -DQLDAP_CLUSTER -DEXTERNAL_TODO -DDASH_EXT -DDATA_COMPRESS -DQMQP_COMPRESS -DSMTPEXECCHECK<br /> <br /> # Perhaps you have different ldap libraries, change them here<br /> -LDAPLIBS=-L/usr/local/lib -lldap -llber<br /> +LDAPLIBS=-L/usr/src/openldap-2.4.33/libraries -lldap -llber<br /> # and change the location of the include files here<br /> -LDAPINCLUDES=-DLDAP_DEPRECATED=1 -I/usr/local/include<br /> +LDAPINCLUDES=-DLDAP_DEPRECATED=1 -I/usr/src/openldap-2.4.25/include<br /> # on Slowaris you need -lresolv and probably a LD_RUN_PATH added like this:<br /> #LDAPLIBS=-L/opt/OpenLDAP/lib -lldap -llber -lresolv -R/opt/OpenLDAP/lib<br /> # for example on my Linux box I use:<br /> @@ -33,7 +33,7 @@<br /> #LDAPINCLUDES=-DLDAP_DEPRECATED=1 -I/opt/OpenLDAP/include<br /> <br /> # ZLIB needed for -DDATA_COMPRESS and -DQMQP_COMPRESS<br /> -#ZLIB=-lz<br /> +ZLIB=-lz<br /> # or you installed zlib in a different path you can use something like this<br /> #ZLIB=-L/opt/zlib/lib -lz<br /> #ZINCLUDES=-I/opt/zlib/include<br /> @@ -43,31 +43,31 @@<br /> # use -DTLS_REMOTE to enable tls support in qmail-remote<br /> # use -DTLS_SMTPD to enable tls support in qmail-smtpd<br /> # use -DTLSDEBUG to enable additional tls debug information in qmail-remote<br /> -#TLS=-DTLS_REMOTE -DTLS_SMTPD<br /> +TLS=-DTLS_REMOTE -DTLS_SMTPD<br /> # Path to OpenSSL includes<br /> -#TLSINCLUDES=-I/usr/local/include<br /> +TLSINCLUDES=-I/usr/local/include<br /> # Path to OpenSSL libraries<br /> -#TLSLIBS=-L/usr/local/lib -lssl -lcrypto<br /> +TLSLIBS=-L/usr/local/lib -lssl -lcrypto<br /> # Path to OpenSSL binary<br /> -#OPENSSLBIN=/usr/local/bin/openssl<br /> -#OPENSSLBIN=openssl<br /> +OPENSSLBIN=/usr/bin/openssl<br /> +OPENSSLBIN=openssl<br /> <br /> # to make the Netscape download progress bar work with qmail-pop3d<br /> # uncomment the next line (allready done)<br /> MNW=-DMAKE_NETSCAPE_WORK <br /> <br /> # to enable the auto-maildir-make feature uncomment the next line<br /> -#MDIRMAKE=-DAUTOMAILDIRMAKE<br /> +MDIRMAKE=-DAUTOMAILDIRMAKE<br /> <br /> # to enable the auto-homedir-make feature uncomment the next line<br /> -#HDIRMAKE=-DAUTOHOMEDIRMAKE<br /> +HDIRMAKE=-DAUTOHOMEDIRMAKE<br /> <br /> # on most systems we need this to make auth_pop and auth_imap<br /> #SHADOWLIBS=-lcrypt<br /> # OpenBSD and other Systems do not have libcrypt, so comment the line out<br /> # if you get linking problems.<br /> # To use shadow passwords under some Linux OS, uncomment the next two lines.<br /> -#SHADOWLIBS=-lcrypt -lshadow<br /> +SHADOWLIBS=-lcrypt<br /> #SHADOWOPTS=-DPW_SHADOW<br /> # To use shadow passwords under Solaris, uncomment the SHADOWOPTS line.<br /> <br /> diff -Naur qmail-1.03/qldap.c qmail-1.03.patched/qldap.c<br /> --- qmail-1.03/qldap.c 2012-12-23 23:10:27.437154714 -0800<br /> +++ qmail-1.03.patched/qldap.c 2012-12-23 22:57:27.369184384 -0800<br /> @@ -681,6 +681,7 @@<br /> qldap_get_status(qldap *q, int *status)<br /> {<br /> int r;<br /> + unsigned long ul,IS_BOUNCE,IS_ACTIVE;<br /> <br /> /* default value */<br /> *status = STATUS_UNDEF;<br /> @@ -689,13 +690,22 @@<br /> if (r == NOSUCH) {<br /> return OK;<br /> } else if (r == OK) {<br /> - if (!case_diffs(ldap_attr.s, ISACTIVE_BOUNCE))<br /> +/*ORIG_CODE if (!case_diffs(ldap_attr.s, ISACTIVE_BOUNCE))<br /> *status = STATUS_BOUNCE;<br /> else if (!case_diffs(ldap_attr.s, ISACTIVE_DELETE))<br /> *status = STATUS_DELETE;<br /> else if (!case_diffs(ldap_attr.s, ISACTIVE_NOACCESS))<br /> *status = STATUS_NOACCESS;<br /> - else *status = STATUS_OK; /* default to OK */<br /> + else *status = STATUS_OK; END_ORIG_CODE*/ /* default to OK */<br /> + <br /> + scan_ulong(ISACTIVE_BOUNCE + '\0', &amp;IS_BOUNCE);<br /> + scan_ulong(ISACTIVE_ACTIVE + '\0', &amp;IS_ACTIVE);<br /> + if (ldap_attr.s[scan_ulong(ldap_attr.s, &amp;ul)] == '\0') {<br /> + ul &amp;= ISACTIVE_MASK; /* mask result */<br /> + if (ul == IS_BOUNCE) *status = STATUS_BOUNCE;<br /> + else if (ul == IS_ACTIVE) *status = STATUS_OK;<br /> + else *status = STATUS_NOACCESS; /* default to NO ACCESS */<br /> + }<br /> /* perhaps we should spill out a warning for unknown settings */<br /> return OK;<br /> }<br /> diff -Naur qmail-1.03/qldap-filter.c qmail-1.03.patched/qldap-filter.c<br /> --- qmail-1.03/qldap-filter.c 2012-12-23 23:10:27.433154249 -0800<br /> +++ qmail-1.03.patched/qldap-filter.c 2012-12-23 22:57:50.553185213 -0800<br /> @@ -107,7 +107,7 @@<br /> return 0;<br /> <br /> if (!filter_start(&amp;filter) ||<br /> - !stralloc_copys(&amp;filter,&quot;(&quot;) ||<br /> + !stralloc_cats(&amp;filter,&quot;(&quot;) ||<br /> !stralloc_cats(&amp;filter, LDAP_UID) ||<br /> !stralloc_cats(&amp;filter, &quot;=&quot;) ||<br /> !filter_escape(&amp;filter, uid, str_len(uid)) ||<br /> @@ -179,7 +179,6 @@<br /> }<br /> extcnt--;<br /> #else<br /> -#error XXX XXX <br /> /* basic qmail-ldap behavior test for username@domain.com and<br /> catchall@domain.com */<br /> ext = 0;<br /> @@ -193,7 +192,7 @@<br /> /* build the search string for the email address */<br /> /* mail address */<br /> if (!filter_start(&amp;filter) ||<br /> - !stralloc_copys(&amp;filter, &quot;(|(&quot;) ||<br /> + !stralloc_cats(&amp;filter, &quot;(|(&quot;) ||<br /> !stralloc_cats(&amp;filter, LDAP_MAIL) ||<br /> !stralloc_cats(&amp;filter, &quot;=&quot;))<br /> return 0;<br /> diff -Naur qmail-1.03/qmail-ldap.h qmail-1.03.patched/qmail-ldap.h<br /> --- qmail-1.03/qmail-ldap.h 2012-12-23 23:10:27.437154714 -0800<br /> +++ qmail-1.03.patched/qmail-ldap.h 2012-12-23 22:57:27.369184384 -0800<br /> @@ -65,7 +65,7 @@<br /> * of the shell are allowed (like &amp;, &amp;, ;, and &lt;,|,&gt;)<br /> * You should know what you are doing when disallowing this */<br /> /* 1 = restriced sanitycheck; 0 = less restriced sanitycheck */<br /> -#define RESTRICT_PROG 1<br /> +#define RESTRICT_PROG 0<br /> <br /> /* ALIASDEVNULL replacement for the std. aliasempty for user with<br /> * neither homeDirectory nor mailMessageStore defined */<br /> @@ -92,11 +92,11 @@<br /> /*********************************************************************<br /> ldap variables used in qmail-lspawn and auth_*<br /> *********************************************************************/<br /> -#define LDAP_MAIL &quot;mail&quot;<br /> +#define LDAP_MAIL &quot;userPrincipalName&quot;<br /> #define LDAP_MAILALTERNATE &quot;mailAlternateAddress&quot;<br /> #define LDAP_QMAILUID &quot;qmailUID&quot;<br /> #define LDAP_QMAILGID &quot;qmailGID&quot;<br /> -#define LDAP_MAILSTORE &quot;mailMessageStore&quot;<br /> +#define LDAP_MAILSTORE &quot;sAMAccountName&quot;<br /> -#define LDAP_HOMEDIR &quot;homeDirectory&quot;<br /> +#define LDAP_HOMEDIR &quot;noSuchDirectory&quot;<br /> #define LDAP_QUOTA &quot;mailQuota&quot;<br /> #define LDAP_QUOTA_SIZE &quot;mailQuotaSize&quot;<br /> @@ -108,10 +108,10 @@<br /> #define LDAP_MODE &quot;deliveryMode&quot;<br /> #define LDAP_REPLYTEXT &quot;mailReplyText&quot;<br /> #define LDAP_DOTMODE &quot;qmailDotMode&quot;<br /> -#define LDAP_UID &quot;uid&quot;<br /> +#define LDAP_UID &quot;userPrincipalName&quot;<br /> #define LDAP_PASSWD &quot;userPassword&quot;<br /> #define LDAP_OBJECTCLASS &quot;objectClass&quot;<br /> -#define LDAP_ISACTIVE &quot;accountStatus&quot;<br /> +#define LDAP_ISACTIVE &quot;userAccountControl&quot;<br /> #define LDAP_PURGE &quot;qmailAccountPurge&quot;<br /> <br /> #define DOTMODE_LDAPONLY &quot;ldaponly&quot;<br /> @@ -132,10 +132,11 @@<br /> #define MODE_PROG &quot;program&quot;<br /> #define MODE_NOREPLY &quot;noreply&quot;<br /> <br /> -#define ISACTIVE_BOUNCE &quot;disabled&quot;<br /> +#define ISACTIVE_BOUNCE &quot;514&quot;<br /> #define ISACTIVE_DELETE &quot;deleted&quot;<br /> #define ISACTIVE_NOACCESS &quot;noaccess&quot;<br /> -#define ISACTIVE_ACTIVE &quot;active&quot;<br /> +#define ISACTIVE_ACTIVE &quot;512&quot;<br /> +#define ISACTIVE_MASK 0x202 /* because 514 is 0x202, 512 is 0x200 */<br /> <br /> /*********************************************************************<br /> ldap variables used in qmail-group<br /> diff -Naur qmail-1.03/qmail-ldaplookup.c qmail-1.03.patched/qmail-ldaplookup.c<br /> --- qmail-1.03/qmail-ldaplookup.c 2012-12-23 23:10:27.437154714 -0800<br /> +++ qmail-1.03.patched/qmail-ldaplookup.c 2012-12-23 23:01:00.333180404 -0800<br /> @@ -223,12 +223,12 @@<br /> switch (mode) {<br /> case mail:<br /> f = filter_mail(value, &amp;done);<br /> - if (value == 0)<br /> + if (f == 0)<br /> strerr_die2sys(1, FATAL, &quot;building filter: &quot;);<br /> break;<br /> case uid:<br /> f = filter_uid(value);<br /> - if (value == 0)<br /> + if (f == 0)<br /> strerr_die2sys(1, FATAL, &quot;building filter: &quot;);<br /> done = 1;<br /> break;<br /> @@ -321,7 +321,7 @@<br /> if (r != OK) fail(q, &quot;qldap_get_status&quot;, r);<br /> switch (status) {<br /> case STATUS_BOUNCE:<br /> - output(subfdout, &quot;%s: %s\n&quot;,<br /> + output(subfdout, &quot;%s: %s -&gt; disabled\n&quot;,<br /> LDAP_ISACTIVE, ISACTIVE_BOUNCE);<br /> break;<br /> case STATUS_NOACCESS:<br /> @@ -329,7 +329,7 @@<br /> LDAP_ISACTIVE, ISACTIVE_NOACCESS);<br /> break;<br /> case STATUS_OK:<br /> - output(subfdout, &quot;%s: %s\n&quot;,<br /> + output(subfdout, &quot;%s: %s -&gt; active\n&quot;,<br /> LDAP_ISACTIVE, ISACTIVE_ACTIVE);<br /> break;<br /> case STATUS_UNDEF:<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=Set_up_Basic_Firewall_Functions&diff=451 Set up Basic Firewall Functions 2015-11-26T22:28:21Z <p>Bob: </p> <hr /> <div>&lt;b&gt;TODO: change this to not use ifrename and use udev instead&lt;/b&gt;<br /> <br /> ==System Prep==<br /> *apt-get remove nfs-common rpcbind<br /> *apt-get install ifrename<br /> <br /> ==Multiple Network Interfaces on Debian==<br /> *&lt;b&gt;BIG FAT NOTE: Do not use ifrename on current debian, use udev instead&lt;/b&gt;<br /> *for i in eth0 eth1 eth2; do ADD=$(ifconfig $i | head -1 | cut -f 11 -d &quot; &quot;); echo &quot;$i mac $ADD&quot; &gt;&gt; /etc/iftab; done<br /> *&gt; /etc/network/interfaces; vi [[/etc/network/interfaces]]<br /> <br /> ==Configure Packet Forwarding / Basic IPTables Rules Set / Network Startup Script==<br /> *sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf<br /> *sysctl -p<br /> *mkdir /root/scripts<br /> *vi [[/root/scripts/iptables-restore]]<br /> *iptables-restore &lt; /root/scripts/iptables-restore<br /> *vi [[/root/scripts/netup.sh]]<br /> *vi [[/root/scripts/netdown.sh]]</div> Bob http://cocnm.computerisms.ca/index.php?title=Set_up_Basic_Firewall_Functions&diff=450 Set up Basic Firewall Functions 2015-11-26T22:27:54Z <p>Bob: </p> <hr /> <div>&lt;b&gt;TODO: change this to not use ifrename and use udev instead&lt;/b&gt;<br /> &lt;b&gt;BIG FAT NOTE: Do not use ifrename on current debian, use udev instead&lt;/b&gt;<br /> <br /> ==System Prep==<br /> *apt-get remove nfs-common rpcbind<br /> *apt-get install ifrename<br /> <br /> ==Multiple Network Interfaces on Debian==<br /> *for i in eth0 eth1 eth2; do ADD=$(ifconfig $i | head -1 | cut -f 11 -d &quot; &quot;); echo &quot;$i mac $ADD&quot; &gt;&gt; /etc/iftab; done<br /> *&gt; /etc/network/interfaces; vi [[/etc/network/interfaces]]<br /> <br /> ==Configure Packet Forwarding / Basic IPTables Rules Set / Network Startup Script==<br /> *sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf<br /> *sysctl -p<br /> *mkdir /root/scripts<br /> *vi [[/root/scripts/iptables-restore]]<br /> *iptables-restore &lt; /root/scripts/iptables-restore<br /> *vi [[/root/scripts/netup.sh]]<br /> *vi [[/root/scripts/netdown.sh]]</div> Bob http://cocnm.computerisms.ca/index.php?title=Install_LibreSWAN_and_Xl2tpd&diff=449 Install LibreSWAN and Xl2tpd 2015-11-23T19:52:47Z <p>Bob: /* System Prep */</p> <hr /> <div>==System Prep==<br /> *apt-get install libnss3-dev libnspr4-dev pkg-config libpam-dev libcap-ng-dev libcap-ng-utils libselinux-dev libcurl4-nss-dev libgmp3-dev flex bison gcc make libunbound-dev libpcap-dev libnss3-tools ppp libevent-dev libradius1<br /> *apt-get install --no-install-recommends xmlto<br /> *echo &quot;net.ipv4.conf.all.accept_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.all.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.default.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *sysctl -p<br /> *for i in $(ls /proc/sys/net/ipv4/conf/); do echo 0 &gt; /proc/sys/net/ipv4/conf/$i/accept_redirects; echo 0 &gt; /proc/sys/net/ipv4/conf/$i/send_redirects; done<br /> <br /> ==Obtain and Install Libreswan==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://libreswan.org/<br /> *cd /usr/src<br /> *wget https://download.libreswan.org/libreswan-3.12.tar.gz<br /> *tar zxf libreswan-3.12.tar.gz<br /> *cd libreswan-3.12/<br /> *make programs<br /> *make install<br /> <br /> ==Obtain and Install Xl2tpd==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://download.openswan.org/xl2tpd/<br /> *cd /usr/src/<br /> *wget http://download.openswan.org/xl2tpd/xl2tpd-1.3.1.tar.gz<br /> *tar zxf xl2tpd-1.3.1.tar.gz<br /> *cd xl2tpd-1.3.1/<br /> *make<br /> *make install<br /> <br /> ==Configure Libreswan==<br /> *&lt;b&gt;BIG FAT NOTE:&lt;/b&gt;certificate handling changed. see: https://libreswan.org/wiki/3.14_X509<br /> *scp -r root@192.168.26.10:/var/CA/computerisms.com/porchlian.computerisms.com/porchlian.computerisms.com.p12 root@192.168.26.10:/var/CA/computerisms.com/CA/Computerisms.Certificate.Authority.p12 root@192.168.26.10:/var/CA/computerisms.com/Computerisms.Certificate.Authority.crl ~<br /> *certutil -N -d /etc/ipsec.d<br /> **Enter password B0bsGates<br /> *pk12util -i /root/Computerisms.Certificate.Authority.p12 -d /etc/ipsec.d<br /> *certutil -M -n &quot;Computerisms.Certificate.Authority&quot; -d /etc/ipsec.d -t &quot;TC,,&quot;<br /> *pk12util -i /root/porchlian.computerisms.com.p12 -d /etc/ipsec.d<br /> *&gt; /etc/ipsec.conf; vi [[/etc/ipsec.conf]]<br /> *vi [[/etc/ipsec.secrets]]<br /> *vi [[/etc/ipsec.d/nsspassword]]<br /> *cp /root/Computerisms.Certificate.Authority.crl /etc/ipsec.d/crls/<br /> <br /> ==Configure Xl2tpd==<br /> *mkdir /etc/xl2tpd<br /> *vi [[/etc/xl2tpd/xl2tpd.conf]]<br /> *vi [[/etc/xl2tpd/ppp-options.xl2tpd]]<br /> *touch /etc/xl2tpd/xl2tpd.control<br /> <br /> ==Configure RadiusClient==<br /> *&gt; /etc/radiusclient/servers; vi [[/etc/radiusclient/servers]]<br /> *&gt; /etc/radiusclient/radiusclient.conf; vi [[/etc/radiusclient/radiusclient.conf]]<br /> *echo &quot;INCLUDE /etc/radiusclient/dictionary.microsoft&quot; &gt;&gt; /etc/radiusclient/dictionary<br /> *vi [[/etc/radiusclient/dictionary.microsoft]]<br /> <br /> ==Start IPSec and Xl2tpd==<br /> *ipsec setup start; tail -f /var/log/auth.log &lt;b&gt;&lt;= Check for errors&lt;/b&gt;<br /> *xl2tpd -c /etc/xl2tpd/xl2tpd.conf -C /etc/xl2tpd/l2tp-control<br /> *systemctl enable ipsec<br /> <br /> ==Finalize netup.sh script==<br /> *vi [[/root/scripts/netup.sh]]<br /> <br /> ==Configure Adminlian for Testing==<br /> *Use winscp to obtain /var/CA/computerisms.com/BobMiller/bob.miller.p12 and put it on adminlian<br /> *start=&gt;run mmc=&gt;file=&gt;Add/Remove Snapin<br /> *In the left pane, double click certificates=&gt;in new window select computer account=&gt;next=&gt;Local computer=&gt;Finish=&gt;OK<br /> *In the left pane, expand certificates=&gt;right-click personal=&gt;all tasks=&gt;import<br /> *Next=&gt;Click browse button=&gt;Select all file types (bottom right)=&gt;navigate to bob.miller.p12=&gt;open=&gt;next=&gt;enter password (S0ns0fB0b)=&gt;Next=&gt;Automatically Place=&gt;Next=&gt;Finish<br /> *navigate to Network and Sharing center=&gt;set up a new connection=&gt;connect to a workplace=&gt;create new connection=&gt;use my internet=&gt;set internet address as 192.168.25.15=&gt;Set destination name as Computerisms=&gt;Select the box that allows other people to use this connection=&gt;Next=&gt;Enter username (this is the user's name and password from Active Directory)=&gt;Select remember password=&gt;connect<br /> *Let it spin and fail=&gt;Set up the connection anyway<br /> *navigate to change adapter settings=&gt;right-click Computerisms Icon=&gt;properties<br /> *Security tab=&gt;type of vpn is l2tp/IPSec=&gt;Advanced Settings=&gt;deselect Verify Name and Usage=&gt;OK=&gt;Set Data encryption to Option=&gt;OK<br /> <br /> ==Do the Testing With Adminlian==<br /> *&lt;b&gt;Test VPN works/No NAT:&lt;/b&gt;&lt;br&gt; on worklian, disconnect the wireless connection from the .26 network and connect it to the .25 network&lt;br&gt;Test that you can connect to the vpn, ping 192.168.26.10 should work.<br /> *&lt;b&gt;Test Domain Logon over VPN/No NAT:&lt;/b&gt; Log out of the machine, click switch user, then click the icon by the power button in the bottom right corner&lt;br&gt;enter your credentials, your logon script should run.<br /> *&lt;b&gt;Test Domain Logon over VPN/With NAT:&lt;/b&gt;&lt;br&gt;Shutdown the virtual machine and configure the network connection to use nat instead of bridging, boot up&lt;br&gt;start the logon process and click the network icon&lt;br&gt;Logon and make sure your logon script runs</div> Bob http://cocnm.computerisms.ca/index.php?title=Create_a_Certificate_Authority&diff=448 Create a Certificate Authority 2015-11-17T18:51:29Z <p>Bob: /* Generate the Computerisms Certificate Authority */</p> <hr /> <div>==Notes==<br /> *You can have a CA that is too large. 8196 bits makes the webdav client fail.<br /> *Instead of multiple certs for multiple sites, you can make one cert and put all served domain names in as subjectaltnames, then point all apache virtualhost configs to one cert<br /> <br /> ==Generate the Computerisms Certificate Authority==<br /> *mkdir -p /var/CA/computerisms.com/CA/{certs,crl,newcerts,private}<br /> *cd /var/CA/computerisms.com<br /> *echo 01 &gt; CA/crlnumber<br /> *chmod 700 /var/CA/computerisms.com/CA/private/<br /> *touch /var/CA/computerisms.com/CA/index.txt<br /> *vi [[/var/CA/computerisms.com/computerisms.ssl.conf]] <br /> *openssl req -new -newkey rsa:4096 -keyout CA/private/cakey.pem -out careq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a very strong password for your CA; fill in values as appropriate for you; when setting common name, choose a name indicating this is a CA, like Computerisms Certificate Authority, use (what will be) the system administrator's email address - like bob.miller@computerisms.com, enter the challenge password and optional company as you will&lt;/i&gt;<br /> *openssl ca -create_serial -out CA/cacert.pem -days 3650 -keyfile CA/private/cakey.pem -selfsign -extensions v3_ca_has_san -config computerisms.ssl.conf -infiles careq.pem<br /> **&lt;i&gt;Enter your very strong CA password; examine the output &lt;b&gt;very&lt;/b&gt; carefully for typos and incorrect data; if everything checks out pres y/Enter/y/Enter&lt;/i&gt;<br /> *rm careq.pem<br /> *cp CA/cacert.pem CA/Computerisms.Certificate.Authority<br /> *cd CA/<br /> *openssl pkcs12 -export -in cacert.pem -inkey private/cakey.pem -certfile cacert.pem -name Computerisms.Certificate.Authority -out Computerisms.Certificate.Authority.p12<br /> *vi [[/var/CA/computerisms.com/computerisms.ssl.conf]]<br /> **Find and adjust the [v3_req] section:<br /> &lt;pre&gt;<br /> [ v3_req ]<br /> subjectAltName = DNS:fqdn.computerisms.com ## use this for machines<br /> #subjectAltName = email:move ## use this for CA or person<br /> basicConstraints = CA:FALSE<br /> keyUsage = nonRepudiation, digitalSignature, keyEncipherment ##Use this line for everything except CAs<br /> #keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyCertSign, cRLSign ## Use this line for CAs<br /> &lt;/pre&gt;<br /> <br /> ==Install Computerisms Certificate Authority==<br /> *cp /var/CA/computerisms.com/CA/Computerisms.Certificate.Authority /usr/local/share/ca-certificates/Computerisms.Certificate.Authority.crt<br /> *update-ca-certificates<br /> <br /> ==Create Certificate for porchlian.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:fqdn.computerisms.com/DNS:porchlian.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of porchlian.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir porchlian.computerisms.com<br /> *mv newcert.pem porchlian.computerisms.com/porchlian.computerisms.com.pem<br /> *mv newkey.pem porchlian.computerisms.com/porchlian.computerisms.com.key<br /> *rm newreq.pem <br /> *cd porchlian.computerisms.com<br /> *openssl pkcs12 -export -in porchlian.computerisms.com.pem -inkey porchlian.computerisms.com.key -certfile ../CA/cacert.pem -name porchlian.computerisms.com -out porchlian.computerisms.com.p12<br /> *chmod 640 porchlian.computerisms.com/*.key<br /> <br /> ==Create Certificate for mail.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:porchlian.computerisms.com/DNS:mail.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of mail.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir mail.computerisms.com<br /> *mv newcert.pem mail.computerisms.com/mail.computerisms.com.pem<br /> *mv newkey.pem mail.computerisms.com/mail.computerisms.com.key<br /> *rm newreq.pem <br /> *cd mail.computerisms.com/<br /> *openssl rsa -in mail.computerisms.com.key -out mail.computerisms.com.nopw.key <br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *cat mail.computerisms.com.pem mail.computerisms.com.nopw.key &gt;&gt; mail.computerisms.com.crt<br /> *chmod 640 *.crt *.key<br /> <br /> ==Create Certificate for cal.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:mail.computerisms.com/DNS:cal.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of cal.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir cal.computerisms.com<br /> *mv newcert.pem cal.computerisms.com/cal.computerisms.com.pem<br /> *mv newkey.pem cal.computerisms.com/cal.computerisms.com.key<br /> *rm newreq.pem <br /> *cd cal.computerisms.com/<br /> *openssl rsa -in cal.computerisms.com.key -out cal.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for fetch.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:cal.computerisms.com/DNS:fetch.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of fetch.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir fetch.computerisms.com<br /> *mv newcert.pem fetch.computerisms.com/fetch.computerisms.com.pem<br /> *mv newkey.pem fetch.computerisms.com/fetch.computerisms.com.key<br /> *rm newreq.pem <br /> *cd fetch.computerisms.com/<br /> *openssl rsa -in fetch.computerisms.com.key -out fetch.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for files.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:fetch.computerisms.com/DNS:files.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of files.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir files.computerisms.com<br /> *mv newcert.pem files.computerisms.com/files.computerisms.com.pem<br /> *mv newkey.pem files.computerisms.com/files.computerisms.com.key<br /> *rm newreq.pem <br /> *cd files.computerisms.com/<br /> *openssl rsa -in files.computerisms.com.key -out files.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for rt.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:files.computerisms.com/DNS:rt.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of rt.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir rt.computerisms.com<br /> *mv newcert.pem rt.computerisms.com/rt.computerisms.com.pem<br /> *mv newkey.pem rt.computerisms.com/rt.computerisms.com.key<br /> *rm newreq.pem <br /> *cd rt.computerisms.com/<br /> *openssl rsa -in rt.computerisms.com.key -out rt.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for wiki.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:rt.computerisms.com/DNS:wiki.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of wiki.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir wiki.computerisms.com<br /> *mv newcert.pem wiki.computerisms.com/wiki.computerisms.com.pem<br /> *mv newkey.pem wiki.computerisms.com/wiki.computerisms.com.key<br /> *rm newreq.pem <br /> *cd wiki.computerisms.com/<br /> *openssl rsa -in wiki.computerisms.com.key -out wiki.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for ledger.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:wiki.computerisms.com/DNS:ledger.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of ledger.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir ledger.computerisms.com<br /> *mv newcert.pem ledger.computerisms.com/ledger.computerisms.com.pem<br /> *mv newkey.pem ledger.computerisms.com/ledger.computerisms.com.key<br /> *rm newreq.pem <br /> *cd ledger.computerisms.com/<br /> *openssl rsa -in ledger.computerisms.com.key -out ledger.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for nagios.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:ledger.computerisms.com/DNS:nagios.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of nagios.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir nagios.computerisms.com<br /> *mv newcert.pem nagios.computerisms.com/nagios.computerisms.com.pem<br /> *mv newkey.pem nagios.computerisms.com/nagios.computerisms.com.key<br /> *rm newreq.pem <br /> *cd nagios.computerisms.com/<br /> *openssl rsa -in nagios.computerisms.com.key -out nagios.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for pbx.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:nagios.computerisms.com/DNS:pbx.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of pbx.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir pbx.computerisms.com<br /> *mv newcert.pem pbx.computerisms.com/pbx.computerisms.com.pem<br /> *mv newkey.pem pbx.computerisms.com/pbx.computerisms.com.key<br /> *rm newreq.pem <br /> *cd pbx.computerisms.com/<br /> *openssl rsa -in pbx.computerisms.com.key -out pbx.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for listadmin.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:pbx.computerisms.com/DNS:listadmin.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of pbx.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir listadmin.computerisms.com<br /> *mv newcert.pem listadmin.computerisms.com/listadmin.computerisms.com.pem<br /> *mv newkey.pem listadmin.computerisms.com/listadmin.computerisms.com.key<br /> *rm newreq.pem <br /> *cd listadmin.computerisms.com/<br /> *openssl rsa -in listadmin.computerisms.com.key -out listadmin.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for listarchive.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:listadmin.computerisms.com/DNS:listarchive.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of listarchive.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir listarchive.computerisms.com<br /> *mv newcert.pem listarchive.computerisms.com/listarchive.computerisms.com.pem<br /> *mv newkey.pem listarchive.computerisms.com/listarchive.computerisms.com.key<br /> *rm newreq.pem <br /> *cd listarchive.computerisms.com/<br /> *openssl rsa -in listarchive.computerisms.com.key -out listarchive.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for media.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:listarchive.computerisms.com/DNS:media.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of media.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir media.computerisms.com<br /> *mv newcert.pem media.computerisms.com/media.computerisms.com.pem<br /> *mv newkey.pem media.computerisms.com/media.computerisms.com.key<br /> *rm newreq.pem <br /> *cd media.computerisms.com/<br /> *openssl rsa -in media.computerisms.com.key -out media.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for ups.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:media.computerisms.com/DNS:ups.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of ups.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir ups.computerisms.com<br /> *mv newcert.pem ups.computerisms.com/ups.computerisms.com.pem<br /> *mv newkey.pem ups.computerisms.com/ups.computerisms.com.key<br /> *rm newreq.pem <br /> *cd ups.computerisms.com/<br /> *openssl rsa -in ups.computerisms.com.key -out ups.computerisms.com.nopw.key<br /> **&lt;i&gt;Enter the fairly strong password for this certificate&lt;/i&gt;<br /> *chmod 640 *.key<br /> <br /> ==Create Certificate for dslobby.computerisms.com==<br /> *cd /var/CA/computerisms.com<br /> *sed -i 's/DNS:ups.computerisms.com/DNS:dslobby.computerisms.com/' computerisms.ssl.conf<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> **&lt;i&gt;Choose a fairly strong password for this certificate; enter values appropriate for you; enter a common name of dslobby.computerisms.com; enter (what will be) the administrator's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir dslobby.computerisms.com<br /> *mv newcert.pem dslobby.computerisms.com/dslobby.computerisms.com.pem<br /> *mv newkey.pem dslobby.computerisms.com/dslobby.computerisms.com.key<br /> *rm newreq.pem <br /> *cd dslobby.computerisms.com/<br /> *openssl rsa -in dslobby.computerisms.com.key -out dslobby.computerisms.com.nopw.key <br /> *grep -A 500 BEGIN dslobby.computerisms.com.pem &gt; dslobby.computerisms.com.crt; dslobby.computerisms.com.nopw.key &gt;&gt; dslobby.computerisms.com.crt<br /> *chmod 640 *.key *.crt<br /> <br /> ==Create Personal Certificates==<br /> *cd /var/CA/computerisms.com<br /> *Edit the [ v3_req ] section in computerisms.ssl.conf =&gt; comment the subjectAltName for DNS and uncomment subjectAltName for email<br /> *openssl req -newkey rsa:4096 -keyout newkey.pem -out newreq.pem -config computerisms.ssl.conf<br /> *&lt;i&gt;Choose a fairly strong but user-friendly password for this certificate; enter values appropriate for the individual this certificate is being generated for; enter a common name in the format of &quot;Bob Miller&quot;; enter (what will be) the user's email address - like bob.miller@computerisms.com&lt;/i&gt;<br /> *openssl ca -in newreq.pem -out newcert.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf -extfile computerisms.ssl.conf -extensions usr_cert_has_san<br /> **&lt;i&gt;Enter your very strong CA password; examine the certificate carefully for typos and incorrect data; if everything checks out press y/Enter/y/Enter&lt;/i&gt;<br /> *mkdir BobMiller<br /> *mv newcert.pem BobMiller/bob.miller.pem<br /> *mv newkey.pem BobMiller/bob.miller.key<br /> *rm newreq.pem<br /> *cd BobMiller/<br /> *openssl pkcs12 -export -in bob.miller.pem -inkey bob.miller.key -certfile ../CA/cacert.pem -name bob.miller -out bob.miller.p12<br /> *chmod 640 *.key<br /> <br /> ==Revoking Certificates==<br /> *Revoking a mistakenly named certficate:<br /> *cd /var/CA/computerisms.com<br /> *openssl ca -revoke media.was.ob/media.computerisms.com.pem -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -config computerisms.ssl.conf<br /> *ln -s CA/ demoCA<br /> *echo 01 &gt; CA/crlnumber<br /> *openssl ca -gencrl -crldays 3650 -keyfile ./CA/private/cakey.pem -cert ./CA/cacert.pem -out Computerisms.Certificate.Authority.crl<br /> *samba-tool dns add houselian computerisms.com crl A ext.ern.ip.add<br /> *scp Computerisms.Certificate.Authority.crl root@ext.ern.ip.add:/Computerisms/sites/computerisms.com<br /> *Configure the external server to accept an ServerAlias of crl.computerisms.com, and add crl to your external zone.<br /> *&lt;b&gt;NOT REQUIRED:&lt;/b&gt;openssl crl -in Computerisms.Certificate.Authority.crl -inform PEM -out Computerisms.Certificate.Authority.crl.der -outform DER</div> Bob http://cocnm.computerisms.ca/index.php?title=Install_LibreSWAN_and_Xl2tpd&diff=447 Install LibreSWAN and Xl2tpd 2015-09-21T23:59:02Z <p>Bob: /* Configure Libreswan */</p> <hr /> <div>==System Prep==<br /> *apt-get install libnss3-dev libnspr4-dev pkg-config libpam-dev libcap-ng-dev libcap-ng-utils libselinux-dev libcurl4-nss-dev libgmp3-dev flex bison gcc make libunbound-dev libpcap-dev libnss3-tools ppp libradius1<br /> *echo &quot;net.ipv4.conf.all.accept_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.all.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.default.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *sysctl -p<br /> *for i in $(ls /proc/sys/net/ipv4/conf/); do echo 0 &gt; /proc/sys/net/ipv4/conf/$i/accept_redirects; echo 0 &gt; /proc/sys/net/ipv4/conf/$i/send_redirects; done<br /> <br /> ==Obtain and Install Libreswan==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://libreswan.org/<br /> *cd /usr/src<br /> *wget https://download.libreswan.org/libreswan-3.12.tar.gz<br /> *tar zxf libreswan-3.12.tar.gz<br /> *cd libreswan-3.12/<br /> *make programs<br /> *make install<br /> <br /> ==Obtain and Install Xl2tpd==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://download.openswan.org/xl2tpd/<br /> *cd /usr/src/<br /> *wget http://download.openswan.org/xl2tpd/xl2tpd-1.3.1.tar.gz<br /> *tar zxf xl2tpd-1.3.1.tar.gz<br /> *cd xl2tpd-1.3.1/<br /> *make<br /> *make install<br /> <br /> ==Configure Libreswan==<br /> *&lt;b&gt;BIG FAT NOTE:&lt;/b&gt;certificate handling changed. see: https://libreswan.org/wiki/3.14_X509<br /> *scp -r root@192.168.26.10:/var/CA/computerisms.com/porchlian.computerisms.com/porchlian.computerisms.com.p12 root@192.168.26.10:/var/CA/computerisms.com/CA/Computerisms.Certificate.Authority.p12 root@192.168.26.10:/var/CA/computerisms.com/Computerisms.Certificate.Authority.crl ~<br /> *certutil -N -d /etc/ipsec.d<br /> **Enter password B0bsGates<br /> *pk12util -i /root/Computerisms.Certificate.Authority.p12 -d /etc/ipsec.d<br /> *certutil -M -n &quot;Computerisms.Certificate.Authority&quot; -d /etc/ipsec.d -t &quot;TC,,&quot;<br /> *pk12util -i /root/porchlian.computerisms.com.p12 -d /etc/ipsec.d<br /> *&gt; /etc/ipsec.conf; vi [[/etc/ipsec.conf]]<br /> *vi [[/etc/ipsec.secrets]]<br /> *vi [[/etc/ipsec.d/nsspassword]]<br /> *cp /root/Computerisms.Certificate.Authority.crl /etc/ipsec.d/crls/<br /> <br /> ==Configure Xl2tpd==<br /> *mkdir /etc/xl2tpd<br /> *vi [[/etc/xl2tpd/xl2tpd.conf]]<br /> *vi [[/etc/xl2tpd/ppp-options.xl2tpd]]<br /> *touch /etc/xl2tpd/xl2tpd.control<br /> <br /> ==Configure RadiusClient==<br /> *&gt; /etc/radiusclient/servers; vi [[/etc/radiusclient/servers]]<br /> *&gt; /etc/radiusclient/radiusclient.conf; vi [[/etc/radiusclient/radiusclient.conf]]<br /> *echo &quot;INCLUDE /etc/radiusclient/dictionary.microsoft&quot; &gt;&gt; /etc/radiusclient/dictionary<br /> *vi [[/etc/radiusclient/dictionary.microsoft]]<br /> <br /> ==Start IPSec and Xl2tpd==<br /> *ipsec setup start; tail -f /var/log/auth.log &lt;b&gt;&lt;= Check for errors&lt;/b&gt;<br /> *xl2tpd -c /etc/xl2tpd/xl2tpd.conf -C /etc/xl2tpd/l2tp-control<br /> *systemctl enable ipsec<br /> <br /> ==Finalize netup.sh script==<br /> *vi [[/root/scripts/netup.sh]]<br /> <br /> ==Configure Adminlian for Testing==<br /> *Use winscp to obtain /var/CA/computerisms.com/BobMiller/bob.miller.p12 and put it on adminlian<br /> *start=&gt;run mmc=&gt;file=&gt;Add/Remove Snapin<br /> *In the left pane, double click certificates=&gt;in new window select computer account=&gt;next=&gt;Local computer=&gt;Finish=&gt;OK<br /> *In the left pane, expand certificates=&gt;right-click personal=&gt;all tasks=&gt;import<br /> *Next=&gt;Click browse button=&gt;Select all file types (bottom right)=&gt;navigate to bob.miller.p12=&gt;open=&gt;next=&gt;enter password (S0ns0fB0b)=&gt;Next=&gt;Automatically Place=&gt;Next=&gt;Finish<br /> *navigate to Network and Sharing center=&gt;set up a new connection=&gt;connect to a workplace=&gt;create new connection=&gt;use my internet=&gt;set internet address as 192.168.25.15=&gt;Set destination name as Computerisms=&gt;Select the box that allows other people to use this connection=&gt;Next=&gt;Enter username (this is the user's name and password from Active Directory)=&gt;Select remember password=&gt;connect<br /> *Let it spin and fail=&gt;Set up the connection anyway<br /> *navigate to change adapter settings=&gt;right-click Computerisms Icon=&gt;properties<br /> *Security tab=&gt;type of vpn is l2tp/IPSec=&gt;Advanced Settings=&gt;deselect Verify Name and Usage=&gt;OK=&gt;Set Data encryption to Option=&gt;OK<br /> <br /> ==Do the Testing With Adminlian==<br /> *&lt;b&gt;Test VPN works/No NAT:&lt;/b&gt;&lt;br&gt; on worklian, disconnect the wireless connection from the .26 network and connect it to the .25 network&lt;br&gt;Test that you can connect to the vpn, ping 192.168.26.10 should work.<br /> *&lt;b&gt;Test Domain Logon over VPN/No NAT:&lt;/b&gt; Log out of the machine, click switch user, then click the icon by the power button in the bottom right corner&lt;br&gt;enter your credentials, your logon script should run.<br /> *&lt;b&gt;Test Domain Logon over VPN/With NAT:&lt;/b&gt;&lt;br&gt;Shutdown the virtual machine and configure the network connection to use nat instead of bridging, boot up&lt;br&gt;start the logon process and click the network icon&lt;br&gt;Logon and make sure your logon script runs</div> Bob http://cocnm.computerisms.ca/index.php?title=/root/scripts/bwrpt.pl&diff=446 /root/scripts/bwrpt.pl 2015-08-12T19:19:12Z <p>Bob: </p> <hr /> <div>&lt;h5&gt;New Script - Please read the notes at the top as things have changed since [[/root/scripts/bwrprt.sh]]&lt;/h5&gt;<br /> &lt;pre&gt;<br /> #!/usr/bin/perl<br /> <br /> # Written by Bob Miller - bob@computerisms.ca<br /> # Converted from Bash Script Feb 2014 and<br /> # modified to account for &gt;4GB/hour internet connections<br /> <br /> ## This should cover any packages required on a standard debian box:<br /> ## apt-get install libfile-tail-perl libtext-trim-perl libdatetime-format-mail-perl libnet-sslglue-perl nbtscan<br /> <br /> ## This script depends on configuration of the iptaccount module available in xtables-addons<br /> ## It assumes each subnet matches one physical interface which matches one iptaccount table name<br /> ## Some iptables rules like this should work:<br /> ## iptables -t filter -I FORWARD -j ACCOUNT --addr 192.168.25.0/24 --tname lan<br /> ## iptables -t mangle -I POSTROUTING -j ACCOUNT --addr 0/0 --tname wan<br /> <br /> ## Set cron to run this often enough that the $wrap variable is not exceeded in one run<br /> ## For example, on slow connections, this can be run once per hour, on fast connections every<br /> ## 10 minutes. It needs to be run offset so that the reporting fires before midnight, something<br /> ## Like so will do (note busy systems may need to run 2 minutes before midnight to give the <br /> ## script time to run instead of one minute):<br /> ## 9-59/10 * * * * PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; /usr/bin/perl /root/scripts/bwrpt.pl<br /> <br /> #bwrpt.pl<br /> use strict;<br /> use warnings;<br /> use Time::Piece;<br /> use Time::Seconds;<br /> use File::Path qw(make_path);<br /> use File::Tail;<br /> use Text::Trim;<br /> use Net::SMTP;<br /> use Net::SSLGlue::SMTP;<br /> use DateTime;<br /> use DateTime::Format::Mail;<br /> <br /> <br /> ####################################################################################<br /> ####################################################################################<br /> ## ##<br /> ## Configuration Options ##<br /> ## ##<br /> ####################################################################################<br /> ####################################################################################<br /> <br /> ## Configure WAN ehternet port and matching --tname from iptables<br /> our $wanface = &quot;eth0&quot;;<br /> our $wanipt = &quot;wan&quot;;<br /> <br /> ## From your iptables, list all --tname values here except the wan<br /> our @iptname = (&quot;computerisms&quot;, &quot;computerisms-pub&quot;, &quot;computerisms2vpn&quot;);<br /> <br /> ## Set the base directory to store daily data<br /> our $base = &quot;/root/scripts/bwdata&quot;;<br /> <br /> ## Set 32-bit system or 64-bit system<br /> our $wrap = 4294967295; ## Uncomment this for 32-bit<br /> #our $wrap = 18446744073709551615; ## Uncomment this for 64-bit<br /> <br /> ## Set these values as per the cronjob to the last run of the day to generate and send a report.<br /> our $rpthour = &quot;23&quot;;<br /> our $rptmin = &quot;59&quot;;<br /> <br /> ## Set Mega or Mibi<br /> our $mb = &quot;1000&quot;; ## Uncomment this line for Mega<br /> #our $mb = &quot;1024&quot;; ## Uncomment this line for Mibi<br /> <br /> ## Set this to the max bandwidth in GB(GiB) before incurring overage charges<br /> our $maxbw = &quot;90&quot;;<br /> <br /> ## Set how often the script runs in minutes; used to make sure a machine reboot doesn't trigger a wrap count<br /> our $cycle = &quot;10&quot;;<br /> <br /> ## Configure mail settings<br /> our $smtpserver = &quot;mail.computerisms.com&quot;;<br /> our $mailfrom = &quot;porchlian\@computerisms.com&quot;;<br /> our $mailto = &quot;bob.miller\@computerisms.com&quot;;<br /> our $mailhello = &quot;porchlian.computerisms.com&quot;;<br /> our $smtpauthname = &quot;bob.miller\@computerisms.com&quot;;<br /> our $smtpauthpass = &quot;XXXXXXXXXXXXXX&quot;;<br /> <br /> <br /> ####################################################################################<br /> ####################################################################################<br /> ## ##<br /> ## You should not need to change anything below here ##<br /> ## ##<br /> ####################################################################################<br /> ####################################################################################<br /> <br /> ## Populate time and date variables<br /> <br /> our $date = Time::Piece-&gt;new;<br /> our $time = $date-&gt;time;<br /> our $hour = $date-&gt;hour;<br /> our $min = $date-&gt;min;<br /> our $month = $date-&gt;strftime('%Y/%m');<br /> our $thisday = $date-&gt;strftime('%d');<br /> our $today = $date-&gt;ymd(&quot;/&quot;);<br /> our $yesterday = ($date - ONE_DAY)-&gt;ymd(&quot;/&quot;);<br /> our $tzdate = DateTime-&gt;now(time_zone =&gt; &quot;local&quot;);<br /> our $rfc2822 = DateTime::Format::Mail-&gt;format_datetime($tzdate);<br /> <br /> <br /> ## Test if Today's directory exists, if not create it<br /> <br /> if (!-d &quot;$base&quot;.&quot;/&quot;.&quot;$today&quot;.&quot;/&quot;) {<br /> make_path(&quot;$base&quot;.&quot;/&quot;.&quot;$today&quot;);<br /> }<br /> <br /> ## Set System Executables<br /> <br /> our $doipt = qx(which iptaccount) or die &quot;cannot find iptaccount program $!&quot;;<br /> our $donbt = qx(which nbtscan) or die &quot;cannot find nbtscan program $!&quot;;<br /> chomp ($doipt, $donbt);<br /> <br /> ## Did we reboot since last run?<br /> our $reboot;<br /> my $uptime = qx(cat /proc/uptime | cut -f 1 -d &quot; &quot;);<br /> if ($uptime*60 &lt; $cycle) {<br /> $reboot =&quot;99&quot;;<br /> } else {<br /> $reboot = &quot;0&quot;;<br /> }<br /> <br /> <br /> ## Now Collect iptaccount data for internal subnets<br /> <br /> for my $curiptname (@iptname) {<br /> if (!-d &quot;$base&quot;.&quot;/&quot;.&quot;$today&quot;.&quot;/&quot;.&quot;$curiptname&quot;.&quot;/&quot;) {<br /> make_path(&quot;$base&quot;.&quot;/&quot;.&quot;$today&quot;.&quot;/&quot;.&quot;$curiptname&quot;);<br /> }<br /> my @ipt = qx($doipt -s -l $curiptname);<br /> my ($lastrun, $hostname);<br /> foreach my $i (@ipt) {<br /> next if $i =~ /^\D/;<br /> chomp $i;<br /> my @ip = split(';', $i);<br /> my $curfile=&quot;$base&quot;.&quot;/&quot;.&quot;$today&quot;.&quot;/&quot;.&quot;$curiptname&quot;.&quot;/&quot;.&quot;$ip[0]&quot;;<br /> if (!-e $curfile) {<br /> if (-e &quot;$base&quot;.&quot;/&quot;.&quot;$yesterday&quot;.&quot;/&quot;.&quot;$curiptname&quot;.&quot;/&quot;.&quot;$ip[0]&quot;) {<br /> my $lastfile = File::Tail-&gt;new(name =&gt; &quot;$base&quot;.&quot;/&quot;.&quot;$yesterday&quot;.&quot;/&quot;.&quot;$curiptname&quot;.&quot;/&quot;.&quot;$ip[0]&quot;, tail =&gt; 1);<br /> $lastrun = $lastfile -&gt; read;<br /> my @resetday = split (/ /, $lastrun);<br /> @resetday[5..9,11] = (0) x 6;<br /> $lastrun = &quot;@resetday&quot;;<br /> chomp $lastrun;<br /> } else {<br /> $lastrun = &quot;0 0 0 0 0 0 0 0 0 0 undef 0 &quot;;<br /> chomp $lastrun;<br /> }<br /> } else {<br /> my $lastfile = File::Tail-&gt;new(name =&gt; &quot;$base&quot;.&quot;/&quot;.&quot;$today&quot;.&quot;/&quot;.&quot;$curiptname&quot;.&quot;/&quot;.&quot;$ip[0]&quot;, tail =&gt; 1) or die $!;<br /> $lastrun = $lastfile -&gt; read;<br /> chomp $lastrun;<br /> }<br /> my @lastrun = split(/ /, $lastrun);<br /> my ($sincelastin, $curttlin, $sincelastout, $curttlout);<br /> if ($lastrun[1] &gt; $ip[2] &amp;&amp; $reboot != &quot;99&quot;) {<br /> $lastrun[8]++;<br /> $sincelastin = $wrap+$ip[2]-$lastrun[1];<br /> $curttlin = $lastrun[5]+$sincelastin;<br /> } else {<br /> $sincelastin = $ip[2]-$lastrun[1];<br /> $curttlin = $lastrun[5]+$sincelastin;<br /> }<br /> if ($lastrun[2] &gt; $ip[4] &amp;&amp; $reboot != &quot;99&quot;) {<br /> $lastrun[9]++;<br /> $sincelastout = $wrap+$ip[4]-$lastrun[2];<br /> $curttlout = $lastrun[6]+$sincelastout;<br /> } else {<br /> $sincelastout = $ip[4]-$lastrun[2];<br /> $curttlout = $lastrun[6]+$sincelastout;<br /> }<br /> my $runttl = $curttlin+$curttlout;<br /> next if ( $sincelastin == 0 &amp;&amp; $sincelastout == 0 );<br /> my @hostlook;<br /> my $lookup = qx($donbt -s : $ip[0]);<br /> if ( $lookup ne '' ) {<br /> my @hostlook = split (/:/, $lookup);<br /> $hostname = $hostlook[1];<br /> $hostname = trim($hostname);<br /> chomp $hostname;<br /> } else {<br /> $lookup = qx(grep $ip[0] /proc/net/arp);<br /> if ( $lookup ne '' ) {<br /> @hostlook = split (' ', $lookup);<br /> $hostname = $hostlook[3];<br /> $hostname = trim($hostname);<br /> chomp $hostname;<br /> $hostname=$lastrun[10] if ( $hostname =~ /incomplete/ ); <br /> $hostname=$lastrun[10] if ( $hostname =~ /00:00:00:00:00:00/ ); <br /> } else { <br /> $hostname = &quot;NOT DEFINABLE&quot;;<br /> chomp $hostname;<br /> }<br /> }<br /> if ( $hostname ne &quot;$lastrun[10]&quot; ) {<br /> $lastrun[11]++;<br /> }<br /> open IP, &quot;&gt;&gt; $curfile&quot; or die $!;<br /> if ( -z $curfile) {<br /> print IP &quot;timestamp iptin iptout insince outsince runttlin runttlout runttl wrapin wrapout hostname hostchange\n&quot;;<br /> }<br /> print IP &quot;$time $ip[2] $ip[4] $sincelastin $sincelastout $curttlin $curttlout $runttl $lastrun[8] $lastrun[9] $hostname $lastrun[11]\n&quot;;<br /> }<br /> }<br /> <br /> ## Now do data for WAN port<br /> <br /> my $curfile=&quot;$base&quot;.&quot;/&quot;.&quot;$today&quot;.&quot;/&quot;.&quot;$wanface&quot;;<br /> my ($lastrun, $curwanipt, $sincelastipt, $ttlipt, $insince, $runttlin, $outsince, $runttlout);<br /> if (!-e $curfile) {<br /> open WAN, &quot;&gt;&gt; $curfile&quot; or die $!;<br /> print WAN &quot;timestamp ipt sysin sysout iptsince runipt insince outsince runttlin runttlout runttl wrapipt wrapin wrapout\n&quot;;<br /> if (-e &quot;$base&quot;.&quot;/&quot;.&quot;$yesterday&quot;.&quot;/&quot;.&quot;$wanface&quot;) {<br /> my $lastfile = File::Tail-&gt;new(name =&gt; &quot;$base&quot;.&quot;/&quot;.&quot;$yesterday&quot;.&quot;/&quot;.&quot;$wanface&quot;, tail =&gt; 1) or die $!;<br /> $lastrun = $lastfile -&gt; read;<br /> my @resetday = split (/ /, $lastrun);<br /> @resetday[4..13] = (0) x 10;<br /> $lastrun = &quot;@resetday&quot;;<br /> chomp $lastrun;<br /> } else {<br /> $lastrun = &quot;0 0 0 0 0 0 0 0 0 0 0 0 0 0&quot;;<br /> chomp $lastrun;<br /> }<br /> } else {<br /> my $lastfile = File::Tail-&gt;new(name =&gt; &quot;$base&quot;.&quot;/&quot;.&quot;$today&quot;.&quot;/&quot;.&quot;$wanface&quot;, tail =&gt; 1) or die $!;<br /> $lastrun = $lastfile -&gt; read;<br /> chomp $lastrun;<br /> }<br /> my @ipt = qx($doipt -s -l $wanipt);<br /> foreach my $j (@ipt) {<br /> if ($j =~ /^\d/) {<br /> chomp $j;<br /> my @ipt = split(';', $j);<br /> $curwanipt =$ipt[2];<br /> last;<br /> }<br /> }<br /> open RX, &quot;/sys/class/net/$wanface/statistics/rx_bytes&quot; or die $!;<br /> open TX, &quot;/sys/class/net/$wanface/statistics/tx_bytes&quot; or die $!;<br /> my $sysin = &lt;RX&gt;;<br /> my $sysout = &lt;TX&gt;;<br /> chomp ($sysin, $sysout);<br /> my @lastrun = split(/ /, $lastrun);<br /> if ($lastrun[1] &gt; $curwanipt &amp;&amp; $reboot != &quot;99&quot;) {<br /> $lastrun[11]++;<br /> $sincelastipt = $wrap+$curwanipt-$lastrun[1];<br /> $ttlipt = $lastrun[5]+$sincelastipt;<br /> } else {<br /> $sincelastipt = $curwanipt-$lastrun[1];<br /> $ttlipt = $sincelastipt+$lastrun[5];<br /> }<br /> if ($lastrun[2] &gt; $sysin &amp;&amp; $reboot != &quot;99&quot;) {<br /> $lastrun[12]++;<br /> $insince = $wrap+$sysin-$lastrun[2];<br /> $runttlin = $lastrun[8]+$insince;<br /> } else {<br /> $insince = $sysin-$lastrun[2];<br /> $runttlin = $insince+$lastrun[8];<br /> }<br /> if ($lastrun[3] &gt; $sysout &amp;&amp; $reboot != &quot;99&quot;) {<br /> $lastrun[13]++;<br /> $outsince = $wrap+$sysout-$lastrun[3];<br /> $runttlout = $lastrun[9]+$outsince;<br /> } else {<br /> $outsince = $sysout-$lastrun[3];<br /> $runttlout = $outsince+$lastrun[9];<br /> }<br /> my $runttl = $runttlin+$runttlout;<br /> open WAN, &quot;&gt;&gt;$curfile&quot; or die $!;<br /> print WAN &quot;$time $curwanipt $sysin $sysout $sincelastipt $ttlipt $insince $outsince $runttlin $runttlout $runttl $lastrun[11] $lastrun[12] $lastrun[13]\n&quot;;<br /> close WAN;<br /> <br /> ## We should have a pretty comprehensive data set now, let's generate a report:<br /> <br /> if ( $hour == $rpthour &amp;&amp; $min == $rptmin) {<br /> my ($wanfile, $mtdwan, $mtdlan, $runipt, $runsysin, $runsysout, $runsysttl, $mtdreadwan, $mtdreadlan, $day, $daysip, $todayipt, $todaysysin, $todaysysout, $todaysysttl, $mtdttlin, $mtdttlout, $mtdttl);<br /> my @mtdreadwan;<br /> my @mtdreadlan;<br /> my %daily=();<br /> my $rptfile = &quot;$base&quot;.&quot;/&quot;.&quot;$today&quot;.&quot;/&quot;.&quot;Daily.rpt&quot;;<br /> opendir (DAYS,&quot;$base&quot;.&quot;/&quot;.&quot;$month&quot;) or die &quot;Can't open days $!&quot;;<br /> while (my $day = readdir(DAYS)) {<br /> next if $day =~ /^\D/;<br /> my $wanfile = File::Tail-&gt;new(name =&gt; &quot;$base&quot;.&quot;/&quot;.&quot;$month&quot;.&quot;/&quot;.&quot;$day&quot;.&quot;/&quot;.&quot;$wanface&quot;, tail =&gt; 1);<br /> $mtdwan = $wanfile -&gt; read; <br /> @mtdreadwan = split (/ /, $mtdwan);<br /> $runipt += $mtdreadwan[5];<br /> $runsysin += $mtdreadwan[8];<br /> $runsysout += $mtdreadwan[9];<br /> $runsysttl += $mtdreadwan[10];<br /> if ($day == $thisday) {<br /> $todayipt = $mtdreadwan[5];<br /> $todaysysin = $mtdreadwan[8];<br /> $todaysysout = $mtdreadwan[9];<br /> $todaysysttl = $mtdreadwan[10];<br /> }<br /> foreach my $i (@iptname) {<br /> next if (!-e &quot;$base&quot;.&quot;/&quot;.&quot;$month&quot;.&quot;/&quot;.&quot;$day&quot;.&quot;/&quot;.&quot;$i&quot;);<br /> opendir (IPT, &quot;$base&quot;.&quot;/&quot;.&quot;$month&quot;.&quot;/&quot;.&quot;$day&quot;.&quot;/&quot;.&quot;$i&quot;) or die &quot;can't open $i days-iptname $!&quot;;<br /> while (my $daysip = readdir(IPT)) {<br /> next if $daysip =~ /^\D/;<br /> my $lanfile = File::Tail-&gt;new(name =&gt; &quot;$base&quot;.&quot;/&quot;.&quot;$month&quot;.&quot;/&quot;.&quot;$day&quot;.&quot;/&quot;.&quot;$i&quot;.&quot;/&quot;.&quot;$daysip&quot;, tail =&gt; 1);<br /> $mtdlan = $lanfile -&gt; read;<br /> @mtdreadlan = split (/ /, $mtdlan);<br /> $daily{$day}{$i}{$daysip}{ttlin} = $mtdreadlan[5];<br /> $daily{$day}{$i}{$daysip}{ttlout} = $mtdreadlan[6];<br /> $daily{$day}{$i}{$daysip}{ttl} = $mtdreadlan[7];<br /> $daily{$i}{$daysip}{mtdttlin} += $mtdreadlan[5];<br /> $daily{$i}{$daysip}{mtdttlout} += $mtdreadlan[6];<br /> $daily{$i}{$daysip}{mtdttl} += $mtdreadlan[7];<br /> $daily{$day}{$i}{$daysip}{devname} = $mtdreadlan[10]; <br /> $daily{$day}{$i}{$daysip}{devchange} = $mtdreadlan[11]; <br /> $daily{$i}{mtdin} += $daily{$day}{$i}{$daysip}{ttlin};<br /> $daily{$i}{mtdout} += $daily{$day}{$i}{$daysip}{ttlout};<br /> $daily{$i}{mtd} += $daily{$day}{$i}{$daysip}{ttl};<br /> if ( $day == $thisday ) {<br /> $daily{$i}{dailyttlin} += $mtdreadlan[5];<br /> $daily{$i}{dailyttlout} += $mtdreadlan[6];<br /> $daily{$i}{dailyttl} += $mtdreadlan[7];<br /> }<br /> } <br /> }<br /> }<br /> my $percentage = int($runsysttl/($maxbw*$mb*$mb*$mb)*100);<br /> open RPT, &quot;&gt;&gt; $rptfile&quot; or die $!;<br /> print RPT &quot;****************************************************************************\n&quot;;<br /> print RPT &quot;****************************************************************************\n&quot;;<br /> print RPT &quot;** **\n&quot;;<br /> print RPT &quot;** DAILY BANDWIDTH REPORT **\n&quot;;<br /> print RPT &quot;** For day ending: $today **\n&quot;;<br /> print RPT &quot;** Explanations and Documentation: **\n&quot;;<br /> print RPT &quot;** http://help.computerisms.ca/index.php?title=Daily_Bandwidth_Report **\n&quot;;<br /> print RPT &quot;** **\n&quot;;<br /> print RPT &quot;****************************************************************************\n&quot;;<br /> print RPT &quot;****************************************************************************\n&quot;;<br /> print RPT &quot;\n&quot;;<br /> print RPT &quot;\n&quot;;<br /> print RPT &quot;============================================================================\n&quot;;<br /> print RPT &quot;SUMMARY\n&quot;;<br /> print RPT &quot;============================================================================\n&quot;;<br /> print RPT &quot;\n&quot;;<br /> print RPT &quot; Percentage of Allowed Bandwidth Used This Month: $percentage%\n&quot;;<br /> print RPT &quot;\n&quot;;<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;&quot;, &quot;Today&quot;, &quot;&quot;, &quot;This Month&quot;, &quot;&quot;);<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;Raw Data on External Port&quot;, int($todaysysttl/$mb/$mb), &quot;MB&quot;, int($runsysttl/$mb/$mb), &quot;MB&quot;);<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;Accounted Data on External Port&quot;, int($todayipt/$mb/$mb), &quot;MB&quot;, int($runipt/$mb/$mb), &quot;MB&quot;);<br /> print RPT &quot;\n&quot;;<br /> foreach my $i (@iptname) {<br /> if ( ! defined $daily{$i}{mtd} ) { <br /> $daily{$i}{mtd} = 0;<br /> }<br /> if ( ! defined $daily{$i}{dailyttl} ) {<br /> $daily{$i}{dailyttl} = 0;<br /> }<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;Accounted Data on $i&quot;, int($daily{$i}{dailyttl}/$mb/$mb), &quot;MB&quot;, int($daily{$i}{mtd}/$mb/$mb), &quot;MB&quot;);<br /> }<br /> print RPT &quot;\n&quot;;<br /> print RPT &quot;============================================================================\n&quot;;<br /> print RPT &quot;INTERNET USAGE - DETAILED REPORT\n&quot;;<br /> print RPT &quot;============================================================================\n&quot;;<br /> print RPT &quot;\n&quot;;<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;&quot;, &quot;Today&quot;, &quot;&quot;, &quot;This Month&quot;, &quot;&quot;);<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;Raw Data - Download &quot;, int($todaysysin/$mb/$mb), &quot;MB&quot;, int($runsysin/$mb/$mb), &quot;MB&quot;);<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;Raw Data - Upload&quot;, int($todaysysout/$mb/$mb), &quot;MB&quot;, int($runsysout/$mb/$mb), &quot;MB&quot;);<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;Raw Data - Total Usage&quot;, int($todaysysttl/$mb/$mb), &quot;MB&quot;, int($runsysttl/$mb/$mb), &quot;MB&quot;);<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;Accounted Data - Total Usage&quot;, int($todayipt/$mb/$mb), &quot;MB&quot;, int($runipt/$mb/$mb), &quot;MB&quot;);<br /> print RPT &quot;\n&quot;;<br /> foreach my $i (@iptname) {<br /> my $uci = uc $i;<br /> print RPT &quot;============================================================================\n&quot;;<br /> print RPT &quot;$uci USAGE - DETAILED REPORT\n&quot;;<br /> print RPT &quot;============================================================================\n&quot;;<br /> print RPT &quot;\n&quot;;<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;&quot;, &quot;Today&quot;, &quot;&quot;, &quot;This Month&quot;, &quot;&quot;);<br /> for my $def ( $daily{$i}{dailyttlin}, $daily{$i}{mtdin}, $daily{$i}{dailyttlout}, $daily{$i}{mtdout}, $daily{$i}{dailyttl}, $daily{$i}{mtd} ) {<br /> if ( ! defined $def ) { <br /> $def = 0;<br /> }<br /> }<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;Accounted Data - Download &quot;, int($daily{$i}{dailyttlout}/$mb/$mb), &quot;MB&quot;, int($daily{$i}{mtdout}/$mb/$mb), &quot;MB&quot;);<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;Accounted Data - Upload &quot;, int($daily{$i}{dailyttlin}/$mb/$mb), &quot;MB&quot;, int($daily{$i}{mtdin}/$mb/$mb), &quot;MB&quot;);<br /> printf (RPT &quot;%-36s%17s%3s%17s%3s\n&quot;, &quot;Accounted Data - Total Usage &quot;, int($daily{$i}{dailyttl}/$mb/$mb), &quot;MB&quot;, int($daily{$i}{mtd}/$mb/$mb), &quot;MB&quot;);<br /> print RPT &quot;\n&quot;;<br /> }<br /> foreach my $i ( keys %{$daily{$thisday}} ) {<br /> my $uci = uc $i;<br /> print RPT &quot;============================================================================\n&quot;;<br /> print RPT &quot;$uci HOSTS - SUMMARY REPORT - VALUES IN MB\n&quot;;<br /> print RPT &quot;============================================================================\n&quot;;<br /> print RPT &quot;\n&quot;;<br /> printf (RPT &quot;%-15s%6s%6s%6s%6s%6s%6s%19s%6s\n&quot;, &quot;IP ADDR&quot;, &quot;DAYDN&quot;, &quot;DAYUP&quot;, &quot;DAYTL&quot;, &quot;MTDDN&quot;, &quot;MTDUP&quot;, &quot;MTDTL&quot;, &quot;Last Seen Host &quot;, &quot;Host #&quot;);<br /> foreach my $ips (sort ( keys %{$daily{$thisday}{$i}} ) ) {<br /> printf (RPT &quot;%-15s%6s%6s%6s%6s%6s%6s%19s%6s\n&quot;, $ips, int($daily{$thisday}{$i}{$ips}{ttlout}/$mb/$mb), int($daily{$thisday}{$i}{$ips}{ttlin}/$mb/$mb), int($daily{$thisday}{$i}{$ips}{ttl}/$mb/$mb), int($daily{$i}{$ips}{mtdttlout}/$mb/$mb), int($daily{$i}{$ips}{mtdttlin}/$mb/$mb), int($daily{$i}{$ips}{mtdttl}/$mb/$mb), $daily{$thisday}{$i}{$ips}{devname}, $daily{$thisday}{$i}{$ips}{devchange});<br /> }<br /> }<br /> close (RPT);<br /> ## Send the report<br /> <br /> open DRPT, &quot;&lt; $rptfile&quot;;<br /> my $dailyreport = do { local $/; &lt;DRPT&gt; };<br /> <br /> my $smtp = Net::SMTP-&gt;new( &quot;$smtpserver&quot;, SSL =&gt; 1, Hello =&gt; &quot;$mailhello&quot;, SSL_ca_path =&gt; '/etc/ssl/certs', SSL_verify_mode =&gt; 0) or die &quot;Failed to open SMTP connection: $!&quot;;;<br /> $smtp-&gt;auth (&quot;$smtpauthname&quot;,&quot;$smtpauthpass&quot;);<br /> $smtp-&gt;mail (&quot;$mailfrom&quot;);<br /> $smtp-&gt;to (&quot;$mailto&quot;, &quot;$mailto2&quot;);<br /> $smtp-&gt;data();<br /> $smtp-&gt;datasend(&quot;From: $mailfrom\n&quot;);<br /> $smtp-&gt;datasend(&quot;To: $mailto, $mailto2\n&quot;);<br /> $smtp-&gt;datasend(&quot;Subject: Daily BWRprt - Monthly usage is $percentage %\n&quot;);<br /> $smtp-&gt;datasend(&quot;Date: $rfc2822\n&quot;);<br /> $smtp-&gt;datasend(&quot;\n&quot;);<br /> $smtp-&gt;datasend(&quot;$dailyreport\n&quot;);<br /> $smtp-&gt;dataend();<br /> $smtp-&gt;quit;<br /> }<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=/lib/systemd/system/daemontools.service&diff=445 /lib/systemd/system/daemontools.service 2015-08-10T17:55:27Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> [Unit]<br /> Description=DJB daemontools<br /> After=sysinit.target<br /> <br /> [Service]<br /> ExecStart=/command/svscanboot<br /> Restart=always<br /> <br /> [Install]<br /> WantedBy=multi-user.target<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=Organize_Hardware&diff=444 Organize Hardware 2015-07-18T20:19:37Z <p>Bob: /* Physical Hardware */</p> <hr /> <div>==Network Topology==<br /> &lt;pre&gt;<br /> - 192.168.26.99 (wlan0) <br /> worklian (Ubuntu Workstation) - 192.168.25.99 (eth0)<br /> ^<br /> | (switch/WAP - 192.168.26.2)<br /> V 192.168.26.0/24 ====&gt; 192.168.26.10 &lt;= houselian (PDC/Primary Server)<br /> WAN &lt;=&gt; 192.168.25.0/24 ^ \=&gt; 192.168.26.11 &lt;= shedlian (Backup Server)<br /> ^ | \=&gt; 192.168.26.100 &lt;= adminlian (Windows Workstation) &lt;= connects in bridged mode on the wireless link on worklian<br /> | | \=&gt; 192.168.26.99 &lt;= worklian (Wireless interface connects to switch/WAP)<br /> V V <br /> 192.168.25.15 &lt;= porchlian ====&gt; 192.168.26.1 (eth1)<br /> (eth0) \==&gt; 192.168.27.1 (eth2) &lt;= Public Network for foriegn machines =&gt;<br /> &lt;/pre&gt;<br /> <br /> ==Additional Resources==<br /> *My true production domain name is computerisms.ca. Since I find it confusing to have the test and the real environment be the same name, computerisms.com will be the domain we are building. I already have ownership of the name<br /> <br /> ==Physical Hardware==<br /> <br /> &lt;h4&gt;Windows Workstation - adminlian.computerisms.com&lt;/h4&gt;<br /> *required for testing and configuration<br /> *configured to run in a &quot;work&quot; network environment, and enable discovery. <br /> *configure ip address to be 192.168.26.100/gw=192.168.26.1/dns=192.168.26.10<br /> *dns won't work yet, this is not a problem now.<br /> *In this case I will be using Windows 7 SP1 freshly installed and updated on a Virtual Machine installed on my:<br /> <br /> &lt;h4&gt;SSH Client - worklian.computerisms.com&lt;/h4&gt;<br /> *generate an ssh key (ssh-keygen -b 2048 -t rsa)<br /> *in this case I will be using my ubuntu workstation<br /> <br /> &lt;h4&gt;Digital Signage Remote - dslobby.computerisms.com&lt;/h4&gt;<br /> *An ubuntu virtual machine<br /> *configure with IP address 192.168.26.25<br /> *No special config required; by the time you need this, everything else will be in place<br /> <br /> &lt;h4&gt;Firewall - porchlian.computerisms.com&lt;/h4&gt;<br /> *computer does need to be reliable, but not smart. Use an old workstation.<br /> *this computer must have at least 2 network cards. larger networks with multiple subnets will probably need at least 3<br /> *in this case I am using a very old dell dimension with 3 NICs<br /> *install debian testing (jessie)<br /> *create the file /root/.ssh/authorized_keys and put your public ssh key in it.<br /> *cp /etc/vim/vimrc /root/.vimrc<br /> **edit /root/.vimrc and find the line 'set compatible'; uncomment it and change it to 'set nocompatible'<br /> *edit /root/.bashrc, enable colours and any other personal preferences<br /> **PS1=&quot;\[\e]0;${debian_chroot:+($debian_chroot)}\h \a\]$PS1&quot; ##tab names on Tilda<br /> *set apt repositories to contain contrib and non-free (optional, if needed for drivers)<br /> *apt-get install ssh ntp rsync tcpdump nmap<br /> *apt-get remove rpcbind nfs-common<br /> *mkdir /root/scripts<br /> *configure external eth0 interface as 192.168.25.15/gw=192.168.25.1/dns=192.168.25.1<br /> *configure internal eth1 interface as 192.168.26.1/255.255.255.0<br /> *configure internal eth2 interface as 192.168.27.1/255.255.255.0<br /> <br /> &lt;h4&gt;Server - houselian.computerisms.com&lt;/h4&gt;<br /> *this will be the workhorse of the network. This will be the PDC and lots of other things<br /> **for a network of one for testing, I am sure any p3 or better will work fine. <br /> **in a production environment you will need to split this into multiple machines<br /> *in this case I am using a ~10 year old HP rackmount server<br /> *install debian testing (jessie)<br /> *create the file /root/.ssh/authorized_keys and put your public ssh key in it.<br /> *cp /etc/vim/vimrc /root/.vimrc<br /> **edit /root/.vimrc and find the line 'set compatible'; uncomment it and change it to 'set nocompatible'<br /> *edit /root/.bashrc, enable colours and any other personal preferences<br /> *set apt repositories to contain contrib and non-free (optional, if needed for drivers)<br /> *apt-get install ssh ntp rsync build-essential bind9<br /> *apt-get remove rpcbind<br /> *mkdir /root/scripts<br /> *configure your resolv.conf to use 'nameserver 127.0.0.1' <br /> *configure eth0 interface as 192.168.26.10<br /> <br /> &lt;h4&gt;Backups - shedlian.computerisms.com&lt;/h4&gt;<br /> *this computer really does not need to be smart, only reliable<br /> **in a testing environment, huge storage is not required<br /> ***However, install the OS on a small partition and leave the majority of the disk to be partitioned later<br /> **in production this machine needs to have plenty of sata ports or some such<br /> *in this case I am using another old dell dimension<br /> *install debian testing (jessie)<br /> *create the file /root/.ssh/authorized_keys and put your public ssh key in it.<br /> *cp /etc/vim/vimrc /root/.vimrc<br /> **edit /root/.vimrc and find the line 'set compatible'; uncomment it and change it to 'set nocompatible'<br /> *edit /root/.bashrc, enable colours and any other personal preferences<br /> *set apt repositories to contain contrib and non-free (optional, if needed for drivers)<br /> *apt-get install ntp ssh<br /> *apt-get remove rpcbind<br /> *configure eth0 interface as 192.168.25.11<br /> <br /> &lt;h4&gt;Switch&lt;/h4&gt;<br /> *for a one person test scenario, you can use a hub.<br /> *scale up accordingly<br /> *in this case, I am using a linksys wireless G unit flashed with openwrt. <br /> **The wan port is taped over to prevent accidents. Always do this when you use wireless routers for switches.<br /> <br /> ==Plug It In==<br /> *everything has a fixed ip, so test basic connectivity. make sure everybody can see everybody.<br /> <br /> ==Notes==<br /> *dpkg --clear-avail&lt;br&gt;^^ This command fixes the &quot;dpkg: warning: parsing file&quot; errors</div> Bob http://cocnm.computerisms.ca/index.php?title=Install_Daemontools&diff=443 Install Daemontools 2015-06-18T01:01:17Z <p>Bob: /* Make Daemontools boot automatically with systemd */</p> <hr /> <div>==Server Prep==<br /> *apt-get install build-essential<br /> <br /> ==Obtain and install==<br /> *cd /usr/src<br /> *wget http://cr.yp.to/daemontools/daemontools-0.76.tar.gz<br /> *tar zxf daemontools-0.76.tar.gz <br /> *cd admin/daemontools-0.76/<br /> *sed -i 's/extern int errno;/#include &lt;errno.h&gt;/' src/error.h<br /> *./package/install<br /> <br /> ==Configure==<br /> *echo &quot;alias t64='tail -f current | tai64nlocal'&quot; &gt;&gt; /root/.bashrc<br /> *echo &quot;alias l64='cat current | tai64nlocal | less'&quot; &gt;&gt; /root/.bashrc<br /> *echo &quot;alias t64all='tail -f /service/*/log/main/current | tai64nlocal'&quot; &gt;&gt; /root/.bashrc<br /> *echo &quot;alias sv='svstat /service/*'&quot; &gt;&gt; /root/.bashrc<br /> *echo &quot;PATH=/usr/local/nagios/bin:/usr/local/nagios/sbin:/usr/local/samba/bin/:/usr/local/samba/sbin/:/var/qmail/bin/:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin&quot; &gt;&gt; /root/.bashrc<br /> *echo &quot;export PATH&quot; &gt;&gt; /root/.bashrc<br /> *mkdir -p -m 1755 /var/service/age.errors<br /> *mkdir -p -m 0755 /var/service/age.errors/log<br /> *vi [[/var/service/age.errors/run]]<br /> *vi [[/var/service/multilog.run]]<br /> *ln -s /var/service/multilog.run /var/service/age.errors/log/run<br /> *chmod 0755 /var/service/age.errors/run<br /> *chmod 0755 /var/service/age.errors/log/run<br /> *cd /service/<br /> *ln -s /var/service/age.errors/<br /> <br /> ==Make Daemontools boot automatically with systemd==<br /> *vi [[/lib/systemd/system/daemontools.service]]<br /> *ln -s /lib/systemd/system/daemontools.service /etc/systemd/system/multi-user.target.wants/daemontools.service</div> Bob http://cocnm.computerisms.ca/index.php?title=/lib/systemd/system/daemontools.service&diff=442 /lib/systemd/system/daemontools.service 2015-06-18T00:59:12Z <p>Bob: Created page with &quot;&lt;pre&gt; [Unit] Description=DJB daemontools After=sysinit.target [Service] ExecStart=/command/svscanboot3 Restart=always [Install] WantedBy=multi-user.target &lt;/pre&gt;&quot;</p> <hr /> <div>&lt;pre&gt;<br /> [Unit]<br /> Description=DJB daemontools<br /> After=sysinit.target<br /> <br /> [Service]<br /> ExecStart=/command/svscanboot3<br /> Restart=always<br /> <br /> [Install]<br /> WantedBy=multi-user.target<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=Install_Daemontools&diff=441 Install Daemontools 2015-06-18T00:58:49Z <p>Bob: /* Configure */</p> <hr /> <div>==Server Prep==<br /> *apt-get install build-essential<br /> <br /> ==Obtain and install==<br /> *cd /usr/src<br /> *wget http://cr.yp.to/daemontools/daemontools-0.76.tar.gz<br /> *tar zxf daemontools-0.76.tar.gz <br /> *cd admin/daemontools-0.76/<br /> *sed -i 's/extern int errno;/#include &lt;errno.h&gt;/' src/error.h<br /> *./package/install<br /> <br /> ==Configure==<br /> *echo &quot;alias t64='tail -f current | tai64nlocal'&quot; &gt;&gt; /root/.bashrc<br /> *echo &quot;alias l64='cat current | tai64nlocal | less'&quot; &gt;&gt; /root/.bashrc<br /> *echo &quot;alias t64all='tail -f /service/*/log/main/current | tai64nlocal'&quot; &gt;&gt; /root/.bashrc<br /> *echo &quot;alias sv='svstat /service/*'&quot; &gt;&gt; /root/.bashrc<br /> *echo &quot;PATH=/usr/local/nagios/bin:/usr/local/nagios/sbin:/usr/local/samba/bin/:/usr/local/samba/sbin/:/var/qmail/bin/:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin&quot; &gt;&gt; /root/.bashrc<br /> *echo &quot;export PATH&quot; &gt;&gt; /root/.bashrc<br /> *mkdir -p -m 1755 /var/service/age.errors<br /> *mkdir -p -m 0755 /var/service/age.errors/log<br /> *vi [[/var/service/age.errors/run]]<br /> *vi [[/var/service/multilog.run]]<br /> *ln -s /var/service/multilog.run /var/service/age.errors/log/run<br /> *chmod 0755 /var/service/age.errors/run<br /> *chmod 0755 /var/service/age.errors/log/run<br /> *cd /service/<br /> *ln -s /var/service/age.errors/<br /> <br /> ==Make Daemontools boot automatically with systemd==<br /> *vi [[/lib/systemd/system/daemontools.service]]</div> Bob http://cocnm.computerisms.ca/index.php?title=/var/CA/computerisms.com/computerisms.ssl.conf&diff=440 /var/CA/computerisms.com/computerisms.ssl.conf 2015-06-10T18:11:12Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> HOME = .<br /> RANDFILE = $ENV::HOME/.rnd<br /> oid_section = new_oids<br /> [ new_oids ]<br /> [ ca ]<br /> default_ca = CA_default # The default ca section<br /> [ CA_default ]<br /> dir = ./CA # Where everything is kept<br /> certs = $dir/certs # Where the issued certs are kept<br /> crl_dir = $dir/crl # Where the issued crl are kept<br /> database = $dir/index.txt # database index file.<br /> new_certs_dir = $dir/newcerts # default place for new certs.<br /> certificate = $dir/cacert.pem # The CA certificate<br /> serial = $dir/serial # The current serial number<br /> crlnumber = $dir/crlnumber # the current crl number<br /> crl = $dir/crl.pem # The current CRL<br /> private_key = $dir/private/cakey.pem # The private key<br /> RANDFILE = $dir/private/.rand # private random number file<br /> x509_extensions = usr_cert # The extentions to add to the cert<br /> name_opt = ca_default # Subject Name options<br /> cert_opt = ca_default # Certificate field options<br /> crl_extensions = crl_ext<br /> default_days = 3650 # how long to certify for<br /> default_crl_days = 10 # how long before next CRL<br /> default_md = sha1 # which md to use.<br /> preserve = no # keep passed DN ordering<br /> policy = policy_match<br /> copy_extensions = copy<br /> [ policy_match ]<br /> countryName = match<br /> stateOrProvinceName = match<br /> organizationName = match<br /> organizationalUnitName = optional<br /> commonName = supplied<br /> emailAddress = optional<br /> [ policy_anything ]<br /> countryName = optional<br /> stateOrProvinceName = optional<br /> localityName = optional<br /> organizationName = optional<br /> organizationalUnitName = optional<br /> commonName = supplied<br /> emailAddress = optional<br /> [ req ]<br /> default_bits = 4096<br /> default_keyfile = privkey.pem<br /> distinguished_name = req_distinguished_name<br /> attributes = req_attributes<br /> x509_extensions = v3_ca # The extentions to add to the self signed cert<br /> string_mask = default <br /> req_extensions = v3_req # The extensions to add to a certificate request<br /> [ req_distinguished_name ]<br /> countryName = Country Name (2 letter code)<br /> countryName_default = CA<br /> countryName_min = 2<br /> countryName_max = 2<br /> stateOrProvinceName = State or Province Name (full name)<br /> stateOrProvinceName_default = Yukon<br /> localityName = Locality Name (eg, city)<br /> localityName_default = Whitehorse<br /> 0.organizationName = Organization Name (eg, company)<br /> 0.organizationName_default = Computerisms<br /> organizationalUnitName = Organizational Unit Name (eg, section)<br /> organizationalUnitName_default = Administrator<br /> commonName = Common Name (eg, YOUR name)<br /> commonName_max = 64<br /> emailAddress = Email Address<br /> emailAddress_max = 64<br /> [ req_attributes ]<br /> [ usr_cert ]<br /> basicConstraints = CA:FALSE<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid,issuer<br /> crlDistributionPoints = URI:http://crl.computerisms.com/Computerisms.Certificate.Authority.crl<br /> [ usr_cert_has_san ]<br /> basicConstraints = CA:FALSE<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid,issuer<br /> crlDistributionPoints = URI:http://crl.computerisms.com/Computerisms.Certificate.Authority.crl<br /> [ v3_req ]<br /> #subjectAltName = DNS:fqdn.computerisms.com ## use this for machines<br /> subjectAltName = email:move ## use this for CA or person<br /> basicConstraints = CA:FALSE<br /> #keyUsage = nonRepudiation, digitalSignature, keyEncipherment ##Use this line for everything except CAs <br /> #extendedKeyUsage = serverAuth ## Enable this line for VPN firewall certs<br /> keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyCertSign, cRLSign ## Use this line for CAs<br /> [ v3_ca ]<br /> subjectAltName = email:move<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid:always,issuer:always<br /> basicConstraints = CA:true<br /> crlDistributionPoints = URI:http://crl.computerisms.com/Computerisms.Certificate.Authority.crl<br /> [ v3_ca_has_san ]<br /> subjectKeyIdentifier = hash<br /> authorityKeyIdentifier = keyid:always,issuer:always<br /> basicConstraints = CA:true<br /> crlDistributionPoints = URI:http://crl.computerisms.com/Computerisms.Certificate.Authority.crl<br /> [ crl_ext ]<br /> authorityKeyIdentifier = keyid:always,issuer:always<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=Install_Rsnapshot&diff=439 Install Rsnapshot 2015-03-17T01:18:57Z <p>Bob: /* Set Up All the Automation */</p> <hr /> <div>==System Prep==<br /> *&lt;b&gt;Note: In production this machine should be in a different building than houselian&lt;/b&gt;<br /> *apt-get install rsnapshot<br /> *Set up partitioning and fstab with the following considerations:<br /> **mount your backup volume under /home/backups<br /> **carve a 5 GB partition and mount it under /home/porchlian<br /> **carve a 20 GB partition and mount it under /home/houselian<br /> <br /> ==Configure Rsnapshot==<br /> *mkdir /home/backups<br /> *&gt; /etc/rsnapshot.conf; vi [[/etc/rsnapshot.conf]]<br /> *vi [[/root/scripts/rsnap.daily.sh]]<br /> <br /> ==Configure Exim==<br /> *dpkg-reconfigure exim4-config<br /> *send by smart host, no local mail=&gt;set System Name as computerisms.com=&gt;Set IP as 127.0.0.1=&gt;No destinations accepted=&gt;set Visible Name as computerisms.com=&gt;Set hostname as mail.computerisms.com=&gt;no=&gt;no<br /> <br /> ==Distribute SSH Keys==<br /> *ssh-keygen -b 4096 -t rsa (empty passphrase)<br /> *i=$(cat /root/.ssh/id_rsa.pub); ssh root@192.168.26.10 &quot;echo $i &gt;&gt; /root/.ssh/authorized_keys&quot;<br /> *i=$(cat /root/.ssh/id_rsa.pub); ssh root@192.168.26.1 &quot;echo $i &gt;&gt; /root/.ssh/authorized_keys&quot;<br /> *ssh root@192.168.26.10 &lt;b&gt;&lt;= Make sure you can log in without a password&lt;/b&gt;<br /> *exit<br /> *ssh root@192.168.26.1 &lt;b&gt;&lt;= Make sure you can log in without a password&lt;/b&gt;<br /> *exit<br /> <br /> ==Set Up Database Dumps and Samba Backups==<br /> *ssh root@192.168.26.10<br /> *mkdir /root/SQLDumps<br /> *mkdir /usr/local/SambaBackups<br /> *chmod 750 /root/S* /root/scripts/<br /> *vi [[/root/scripts/SQLdump.sh]]<br /> *sed 's!WHERE=/usr/local/backups!WHERE=/usr/local/SambaBackups!' /usr/src/samba-4.0.7/source4/scripting/bin/samba_backup &gt; /usr/local/samba/bin/samba_backup<br /> *crontab -e<br /> **10 21 * * * bash /root/scripts/SQLdump.sh<br /> **10 42 * * * bash /usr/local/samba/bin/samba_backup<br /> *exit<br /> <br /> ==Set Up All the Automation==<br /> *crontab -e<br /> **00 21 * * * bash /root/scripts/rsnap.daily.sh<br /> **01 21 * * 6 /usr/bin/rsnapshot weekly<br /> **02 21 * * * nice -10 rsync -aHAXx --delete --exclude *.gvfs --exclude /proc --exclude /sys --exclude /dev --exclude /media --exclude /mnt --exclude /home --exclude /service root@192.168.26.10:/* /home/houselian<br /> **03 21 * * * nice -10 rsync -aHAXx --delete --exclude *.gvfs --exclude /proc --exclude /sys --exclude /dev --exclude /media --exclude /mnt root@192.168.26.1:/* /home/porchlian<br /> <br /> ==Restoring Porchlian/Houselian==<br /> *reverse the rsync to a partition on a new drive, use a boot disk to install grub2 on that drive, and it will boot</div> Bob http://cocnm.computerisms.ca/index.php?title=Install_LibreSWAN_and_Xl2tpd&diff=438 Install LibreSWAN and Xl2tpd 2014-12-24T01:13:45Z <p>Bob: /* Start IPSec and Xl2tpd */</p> <hr /> <div>==System Prep==<br /> *apt-get install libnss3-dev libnspr4-dev pkg-config libpam-dev libcap-ng-dev libcap-ng-utils libselinux-dev libcurl4-nss-dev libgmp3-dev flex bison gcc make libunbound-dev libpcap-dev libnss3-tools ppp libradius1<br /> *echo &quot;net.ipv4.conf.all.accept_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.all.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.default.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *sysctl -p<br /> *for i in $(ls /proc/sys/net/ipv4/conf/); do echo 0 &gt; /proc/sys/net/ipv4/conf/$i/accept_redirects; echo 0 &gt; /proc/sys/net/ipv4/conf/$i/send_redirects; done<br /> <br /> ==Obtain and Install Libreswan==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://libreswan.org/<br /> *cd /usr/src<br /> *wget https://download.libreswan.org/libreswan-3.12.tar.gz<br /> *tar zxf libreswan-3.12.tar.gz<br /> *cd libreswan-3.12/<br /> *make programs<br /> *make install<br /> <br /> ==Obtain and Install Xl2tpd==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://download.openswan.org/xl2tpd/<br /> *cd /usr/src/<br /> *wget http://download.openswan.org/xl2tpd/xl2tpd-1.3.1.tar.gz<br /> *tar zxf xl2tpd-1.3.1.tar.gz<br /> *cd xl2tpd-1.3.1/<br /> *make<br /> *make install<br /> <br /> ==Configure Libreswan==<br /> *scp -r root@192.168.26.10:/var/CA/computerisms.com/porchlian.computerisms.com/porchlian.computerisms.com.p12 root@192.168.26.10:/var/CA/computerisms.com/CA/Computerisms.Certificate.Authority.p12 root@192.168.26.10:/var/CA/computerisms.com/Computerisms.Certificate.Authority.crl ~<br /> *certutil -N -d /etc/ipsec.d<br /> **Enter password B0bsGates<br /> *pk12util -i /root/Computerisms.Certificate.Authority.p12 -d /etc/ipsec.d<br /> *certutil -M -n &quot;Computerisms.Certificate.Authority&quot; -d /etc/ipsec.d -t &quot;TC,,&quot;<br /> *pk12util -i /root/porchlian.computerisms.com.p12 -d /etc/ipsec.d<br /> *&gt; /etc/ipsec.conf; vi [[/etc/ipsec.conf]]<br /> *vi [[/etc/ipsec.secrets]]<br /> *vi [[/etc/ipsec.d/nsspassword]]<br /> *cp /root/Computerisms.Certificate.Authority.crl /etc/ipsec.d/crls/<br /> <br /> ==Configure Xl2tpd==<br /> *mkdir /etc/xl2tpd<br /> *vi [[/etc/xl2tpd/xl2tpd.conf]]<br /> *vi [[/etc/xl2tpd/ppp-options.xl2tpd]]<br /> *touch /etc/xl2tpd/xl2tpd.control<br /> <br /> ==Configure RadiusClient==<br /> *&gt; /etc/radiusclient/servers; vi [[/etc/radiusclient/servers]]<br /> *&gt; /etc/radiusclient/radiusclient.conf; vi [[/etc/radiusclient/radiusclient.conf]]<br /> *echo &quot;INCLUDE /etc/radiusclient/dictionary.microsoft&quot; &gt;&gt; /etc/radiusclient/dictionary<br /> *vi [[/etc/radiusclient/dictionary.microsoft]]<br /> <br /> ==Start IPSec and Xl2tpd==<br /> *ipsec setup start; tail -f /var/log/auth.log &lt;b&gt;&lt;= Check for errors&lt;/b&gt;<br /> *xl2tpd -c /etc/xl2tpd/xl2tpd.conf -C /etc/xl2tpd/l2tp-control<br /> *systemctl enable ipsec<br /> <br /> ==Finalize netup.sh script==<br /> *vi [[/root/scripts/netup.sh]]<br /> <br /> ==Configure Adminlian for Testing==<br /> *Use winscp to obtain /var/CA/computerisms.com/BobMiller/bob.miller.p12 and put it on adminlian<br /> *start=&gt;run mmc=&gt;file=&gt;Add/Remove Snapin<br /> *In the left pane, double click certificates=&gt;in new window select computer account=&gt;next=&gt;Local computer=&gt;Finish=&gt;OK<br /> *In the left pane, expand certificates=&gt;right-click personal=&gt;all tasks=&gt;import<br /> *Next=&gt;Click browse button=&gt;Select all file types (bottom right)=&gt;navigate to bob.miller.p12=&gt;open=&gt;next=&gt;enter password (S0ns0fB0b)=&gt;Next=&gt;Automatically Place=&gt;Next=&gt;Finish<br /> *navigate to Network and Sharing center=&gt;set up a new connection=&gt;connect to a workplace=&gt;create new connection=&gt;use my internet=&gt;set internet address as 192.168.25.15=&gt;Set destination name as Computerisms=&gt;Select the box that allows other people to use this connection=&gt;Next=&gt;Enter username (this is the user's name and password from Active Directory)=&gt;Select remember password=&gt;connect<br /> *Let it spin and fail=&gt;Set up the connection anyway<br /> *navigate to change adapter settings=&gt;right-click Computerisms Icon=&gt;properties<br /> *Security tab=&gt;type of vpn is l2tp/IPSec=&gt;Advanced Settings=&gt;deselect Verify Name and Usage=&gt;OK=&gt;Set Data encryption to Option=&gt;OK<br /> <br /> ==Do the Testing With Adminlian==<br /> *&lt;b&gt;Test VPN works/No NAT:&lt;/b&gt;&lt;br&gt; on worklian, disconnect the wireless connection from the .26 network and connect it to the .25 network&lt;br&gt;Test that you can connect to the vpn, ping 192.168.26.10 should work.<br /> *&lt;b&gt;Test Domain Logon over VPN/No NAT:&lt;/b&gt; Log out of the machine, click switch user, then click the icon by the power button in the bottom right corner&lt;br&gt;enter your credentials, your logon script should run.<br /> *&lt;b&gt;Test Domain Logon over VPN/With NAT:&lt;/b&gt;&lt;br&gt;Shutdown the virtual machine and configure the network connection to use nat instead of bridging, boot up&lt;br&gt;start the logon process and click the network icon&lt;br&gt;Logon and make sure your logon script runs</div> Bob http://cocnm.computerisms.ca/index.php?title=/root/scripts/netup.sh&diff=437 /root/scripts/netup.sh 2014-11-20T21:41:10Z <p>Bob: /* Finalized Config */</p> <hr /> <div>==Initial Config==<br /> <br /> &lt;pre&gt;<br /> #!/bin/sh<br /> sysctl -p<br /> iptables-restore &lt; /root/scripts/iptables-restore<br /> &lt;/pre&gt;<br /> <br /> ==Finalized Config==<br /> &lt;pre&gt;<br /> #!/bin/sh<br /> sysctl -p<br /> /sbin/iptables-restore &lt; /root/scripts/iptables-restore<br /> /bin/bash /root/scripts/qos.reset.sh<br /> /bin/bash /root/scripts/qos.sh<br /> ##Note with libreswan3.9 and systemd, this line will hang the box on bootup:<br /> #/usr/local/sbin/ipsec setup start<br /> /usr/local/sbin/xl2tpd -c /etc/xl2tpd/xl2tpd.conf -C /etc/xl2tpd/xl2tpd.control<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=Install_LibreSWAN_and_Xl2tpd&diff=436 Install LibreSWAN and Xl2tpd 2014-11-20T21:40:33Z <p>Bob: /* Configure Xl2tpd */</p> <hr /> <div>==System Prep==<br /> *apt-get install libnss3-dev libnspr4-dev pkg-config libpam-dev libcap-ng-dev libcap-ng-utils libselinux-dev libcurl4-nss-dev libgmp3-dev flex bison gcc make libunbound-dev libpcap-dev libnss3-tools ppp libradius1<br /> *echo &quot;net.ipv4.conf.all.accept_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.all.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.default.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *sysctl -p<br /> *for i in $(ls /proc/sys/net/ipv4/conf/); do echo 0 &gt; /proc/sys/net/ipv4/conf/$i/accept_redirects; echo 0 &gt; /proc/sys/net/ipv4/conf/$i/send_redirects; done<br /> <br /> ==Obtain and Install Libreswan==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://libreswan.org/<br /> *cd /usr/src<br /> *wget https://download.libreswan.org/libreswan-3.12.tar.gz<br /> *tar zxf libreswan-3.12.tar.gz<br /> *cd libreswan-3.12/<br /> *make programs<br /> *make install<br /> <br /> ==Obtain and Install Xl2tpd==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://download.openswan.org/xl2tpd/<br /> *cd /usr/src/<br /> *wget http://download.openswan.org/xl2tpd/xl2tpd-1.3.1.tar.gz<br /> *tar zxf xl2tpd-1.3.1.tar.gz<br /> *cd xl2tpd-1.3.1/<br /> *make<br /> *make install<br /> <br /> ==Configure Libreswan==<br /> *scp -r root@192.168.26.10:/var/CA/computerisms.com/porchlian.computerisms.com/porchlian.computerisms.com.p12 root@192.168.26.10:/var/CA/computerisms.com/CA/Computerisms.Certificate.Authority.p12 root@192.168.26.10:/var/CA/computerisms.com/Computerisms.Certificate.Authority.crl ~<br /> *certutil -N -d /etc/ipsec.d<br /> **Enter password B0bsGates<br /> *pk12util -i /root/Computerisms.Certificate.Authority.p12 -d /etc/ipsec.d<br /> *certutil -M -n &quot;Computerisms.Certificate.Authority&quot; -d /etc/ipsec.d -t &quot;TC,,&quot;<br /> *pk12util -i /root/porchlian.computerisms.com.p12 -d /etc/ipsec.d<br /> *&gt; /etc/ipsec.conf; vi [[/etc/ipsec.conf]]<br /> *vi [[/etc/ipsec.secrets]]<br /> *vi [[/etc/ipsec.d/nsspassword]]<br /> *cp /root/Computerisms.Certificate.Authority.crl /etc/ipsec.d/crls/<br /> <br /> ==Configure Xl2tpd==<br /> *mkdir /etc/xl2tpd<br /> *vi [[/etc/xl2tpd/xl2tpd.conf]]<br /> *vi [[/etc/xl2tpd/ppp-options.xl2tpd]]<br /> *touch /etc/xl2tpd/xl2tpd.control<br /> <br /> ==Configure RadiusClient==<br /> *&gt; /etc/radiusclient/servers; vi [[/etc/radiusclient/servers]]<br /> *&gt; /etc/radiusclient/radiusclient.conf; vi [[/etc/radiusclient/radiusclient.conf]]<br /> *echo &quot;INCLUDE /etc/radiusclient/dictionary.microsoft&quot; &gt;&gt; /etc/radiusclient/dictionary<br /> *vi [[/etc/radiusclient/dictionary.microsoft]]<br /> <br /> ==Start IPSec and Xl2tpd==<br /> *ipsec setup start; tail -f /var/log/auth.log &lt;b&gt;&lt;= Check for errors&lt;/b&gt;<br /> *xl2tpd -C /etc/xl2tpd/l2tp-control<br /> *systemctl enable ipsec<br /> <br /> ==Finalize netup.sh script==<br /> *vi [[/root/scripts/netup.sh]]<br /> <br /> ==Configure Adminlian for Testing==<br /> *Use winscp to obtain /var/CA/computerisms.com/BobMiller/bob.miller.p12 and put it on adminlian<br /> *start=&gt;run mmc=&gt;file=&gt;Add/Remove Snapin<br /> *In the left pane, double click certificates=&gt;in new window select computer account=&gt;next=&gt;Local computer=&gt;Finish=&gt;OK<br /> *In the left pane, expand certificates=&gt;right-click personal=&gt;all tasks=&gt;import<br /> *Next=&gt;Click browse button=&gt;Select all file types (bottom right)=&gt;navigate to bob.miller.p12=&gt;open=&gt;next=&gt;enter password (S0ns0fB0b)=&gt;Next=&gt;Automatically Place=&gt;Next=&gt;Finish<br /> *navigate to Network and Sharing center=&gt;set up a new connection=&gt;connect to a workplace=&gt;create new connection=&gt;use my internet=&gt;set internet address as 192.168.25.15=&gt;Set destination name as Computerisms=&gt;Select the box that allows other people to use this connection=&gt;Next=&gt;Enter username (this is the user's name and password from Active Directory)=&gt;Select remember password=&gt;connect<br /> *Let it spin and fail=&gt;Set up the connection anyway<br /> *navigate to change adapter settings=&gt;right-click Computerisms Icon=&gt;properties<br /> *Security tab=&gt;type of vpn is l2tp/IPSec=&gt;Advanced Settings=&gt;deselect Verify Name and Usage=&gt;OK=&gt;Set Data encryption to Option=&gt;OK<br /> <br /> ==Do the Testing With Adminlian==<br /> *&lt;b&gt;Test VPN works/No NAT:&lt;/b&gt;&lt;br&gt; on worklian, disconnect the wireless connection from the .26 network and connect it to the .25 network&lt;br&gt;Test that you can connect to the vpn, ping 192.168.26.10 should work.<br /> *&lt;b&gt;Test Domain Logon over VPN/No NAT:&lt;/b&gt; Log out of the machine, click switch user, then click the icon by the power button in the bottom right corner&lt;br&gt;enter your credentials, your logon script should run.<br /> *&lt;b&gt;Test Domain Logon over VPN/With NAT:&lt;/b&gt;&lt;br&gt;Shutdown the virtual machine and configure the network connection to use nat instead of bridging, boot up&lt;br&gt;start the logon process and click the network icon&lt;br&gt;Logon and make sure your logon script runs</div> Bob http://cocnm.computerisms.ca/index.php?title=/etc/ipsec.d/nsspassword&diff=435 /etc/ipsec.d/nsspassword 2014-11-20T02:24:03Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> NSS Certificate DB:B0bsGates<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=Install_LibreSWAN_and_Xl2tpd&diff=434 Install LibreSWAN and Xl2tpd 2014-11-19T23:15:40Z <p>Bob: /* Obtain and Install Libreswan */</p> <hr /> <div>==System Prep==<br /> *apt-get install libnss3-dev libnspr4-dev pkg-config libpam-dev libcap-ng-dev libcap-ng-utils libselinux-dev libcurl4-nss-dev libgmp3-dev flex bison gcc make libunbound-dev libpcap-dev libnss3-tools ppp libradius1<br /> *echo &quot;net.ipv4.conf.all.accept_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.all.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.default.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *sysctl -p<br /> *for i in $(ls /proc/sys/net/ipv4/conf/); do echo 0 &gt; /proc/sys/net/ipv4/conf/$i/accept_redirects; echo 0 &gt; /proc/sys/net/ipv4/conf/$i/send_redirects; done<br /> <br /> ==Obtain and Install Libreswan==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://libreswan.org/<br /> *cd /usr/src<br /> *wget https://download.libreswan.org/libreswan-3.12.tar.gz<br /> *tar zxf libreswan-3.12.tar.gz<br /> *cd libreswan-3.12/<br /> *make programs<br /> *make install<br /> <br /> ==Obtain and Install Xl2tpd==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://download.openswan.org/xl2tpd/<br /> *cd /usr/src/<br /> *wget http://download.openswan.org/xl2tpd/xl2tpd-1.3.1.tar.gz<br /> *tar zxf xl2tpd-1.3.1.tar.gz<br /> *cd xl2tpd-1.3.1/<br /> *make<br /> *make install<br /> <br /> ==Configure Libreswan==<br /> *scp -r root@192.168.26.10:/var/CA/computerisms.com/porchlian.computerisms.com/porchlian.computerisms.com.p12 root@192.168.26.10:/var/CA/computerisms.com/CA/Computerisms.Certificate.Authority.p12 root@192.168.26.10:/var/CA/computerisms.com/Computerisms.Certificate.Authority.crl ~<br /> *certutil -N -d /etc/ipsec.d<br /> **Enter password B0bsGates<br /> *pk12util -i /root/Computerisms.Certificate.Authority.p12 -d /etc/ipsec.d<br /> *certutil -M -n &quot;Computerisms.Certificate.Authority&quot; -d /etc/ipsec.d -t &quot;TC,,&quot;<br /> *pk12util -i /root/porchlian.computerisms.com.p12 -d /etc/ipsec.d<br /> *&gt; /etc/ipsec.conf; vi [[/etc/ipsec.conf]]<br /> *vi [[/etc/ipsec.secrets]]<br /> *vi [[/etc/ipsec.d/nsspassword]]<br /> *cp /root/Computerisms.Certificate.Authority.crl /etc/ipsec.d/crls/<br /> <br /> ==Configure Xl2tpd==<br /> *mkdir /etc/xl2tpd<br /> *vi [[/etc/xl2tpd/xl2tpd.conf]]<br /> *vi [[/etc/xl2tpd/ppp-options.xl2tpd]]<br /> <br /> ==Configure RadiusClient==<br /> *&gt; /etc/radiusclient/servers; vi [[/etc/radiusclient/servers]]<br /> *&gt; /etc/radiusclient/radiusclient.conf; vi [[/etc/radiusclient/radiusclient.conf]]<br /> *echo &quot;INCLUDE /etc/radiusclient/dictionary.microsoft&quot; &gt;&gt; /etc/radiusclient/dictionary<br /> *vi [[/etc/radiusclient/dictionary.microsoft]]<br /> <br /> ==Start IPSec and Xl2tpd==<br /> *ipsec setup start; tail -f /var/log/auth.log &lt;b&gt;&lt;= Check for errors&lt;/b&gt;<br /> *xl2tpd -C /etc/xl2tpd/l2tp-control<br /> *systemctl enable ipsec<br /> <br /> ==Finalize netup.sh script==<br /> *vi [[/root/scripts/netup.sh]]<br /> <br /> ==Configure Adminlian for Testing==<br /> *Use winscp to obtain /var/CA/computerisms.com/BobMiller/bob.miller.p12 and put it on adminlian<br /> *start=&gt;run mmc=&gt;file=&gt;Add/Remove Snapin<br /> *In the left pane, double click certificates=&gt;in new window select computer account=&gt;next=&gt;Local computer=&gt;Finish=&gt;OK<br /> *In the left pane, expand certificates=&gt;right-click personal=&gt;all tasks=&gt;import<br /> *Next=&gt;Click browse button=&gt;Select all file types (bottom right)=&gt;navigate to bob.miller.p12=&gt;open=&gt;next=&gt;enter password (S0ns0fB0b)=&gt;Next=&gt;Automatically Place=&gt;Next=&gt;Finish<br /> *navigate to Network and Sharing center=&gt;set up a new connection=&gt;connect to a workplace=&gt;create new connection=&gt;use my internet=&gt;set internet address as 192.168.25.15=&gt;Set destination name as Computerisms=&gt;Select the box that allows other people to use this connection=&gt;Next=&gt;Enter username (this is the user's name and password from Active Directory)=&gt;Select remember password=&gt;connect<br /> *Let it spin and fail=&gt;Set up the connection anyway<br /> *navigate to change adapter settings=&gt;right-click Computerisms Icon=&gt;properties<br /> *Security tab=&gt;type of vpn is l2tp/IPSec=&gt;Advanced Settings=&gt;deselect Verify Name and Usage=&gt;OK=&gt;Set Data encryption to Option=&gt;OK<br /> <br /> ==Do the Testing With Adminlian==<br /> *&lt;b&gt;Test VPN works/No NAT:&lt;/b&gt;&lt;br&gt; on worklian, disconnect the wireless connection from the .26 network and connect it to the .25 network&lt;br&gt;Test that you can connect to the vpn, ping 192.168.26.10 should work.<br /> *&lt;b&gt;Test Domain Logon over VPN/No NAT:&lt;/b&gt; Log out of the machine, click switch user, then click the icon by the power button in the bottom right corner&lt;br&gt;enter your credentials, your logon script should run.<br /> *&lt;b&gt;Test Domain Logon over VPN/With NAT:&lt;/b&gt;&lt;br&gt;Shutdown the virtual machine and configure the network connection to use nat instead of bridging, boot up&lt;br&gt;start the logon process and click the network icon&lt;br&gt;Logon and make sure your logon script runs</div> Bob http://cocnm.computerisms.ca/index.php?title=Shape/Track_Bandwidth_-_Finalize_IPTables&diff=433 Shape/Track Bandwidth - Finalize IPTables 2014-11-07T22:49:07Z <p>Bob: /* Install and Configure Bandwidth Accounting and Reporting */</p> <hr /> <div>==System Prep==<br /> *apt-get install tcng xtables-addons-source xtables-addons-common nbtscan linux-headers-$(uname -r) automake libtool libfile-tail-perl libtext-trim-perl libdatetime-format-mail-perl libnet-sslglue-perl<br /> *&lt;b&gt;Note: &lt;/b&gt;as of Apr2014, tcng must be installed from wheezy (update sources.list &amp;&amp; apt-get install tcng/wheezy)<br /> <br /> ==Configure Traffic Control==<br /> *vi [[/root/scripts/qos.tc]]<br /> *echo \#\!\/bin\/bash &gt; /root/scripts/qos.sh; tcng /root/scripts/qos.tc &gt;&gt; /root/scripts/qos.sh<br /> *vi [[/root/scripts/qos.reset.sh]]<br /> *bash /root/scripts/qos.reset.sh; bash /root/scripts/qos.sh<br /> <br /> ==Install and Configure Bandwidth Accounting and Reporting==<br /> *m-a prepare<br /> *m-a a-i -t xtables-addons-source<br /> **NOV7/2014 - build fails. $(ln -s /usr/src /tmp/buildd); $(m-a a-i -t xtables-addons-source); let it fail; $(cd /usr/src/modules/xtables-addons; ./configure; make; make install)<br /> *echo xt_ACCOUNT &gt;&gt; /etc/modules<br /> *modprobe xt_ACCOUNT<br /> *depmod -a<br /> *vi [[/root/scripts/bwrpt.pl]]<br /> *crontab -e<br /> **9-59/10 * * * * PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; /usr/bin/perl /root/scripts/bwrpt.pl &lt;b&gt;&lt;= Note: on large networks this can take a few minutes to run, and it needs to complete it's data collection before 00:00, so you may need to set it to start at 58 or 57&lt;/b&gt;<br /> <br /> ==Finalize IPTables Configuration==<br /> *vi [[/root/scripts/iptables-restore#Completed|/root/scripts/iptables-restore]]<br /> *iptables-restore &lt; /root/scripts/iptables-restore<br /> *iptaccount -a &lt;b&gt;&lt;= Make sure these three lines show up:&lt;/b&gt;&lt;br&gt;Found table: wan&lt;br&gt;Found table: computerisms&lt;br&gt;Found table: pubaccess<br /> *From worklian:<br /> **telnet 192.168.25.15 25 &lt;b&gt;&lt;= Make sure you can telnet to ports 25, 80, 443, 587, 993, 995&lt;/b&gt;<br /> <br /> ==Notes==<br /> *Aug30/2014 =&gt; module-assistant fails to build xtables-addons. after it fails do:<br /> **cd /usr/src/modules/xtables-addons/<br /> **/bin/bash build-aux/missing autoconf<br /> **./configure<br /> **make -j1<br /> **m-a a-i -t -O xtables-addons</div> Bob http://cocnm.computerisms.ca/index.php?title=Shape/Track_Bandwidth_-_Finalize_IPTables&diff=432 Shape/Track Bandwidth - Finalize IPTables 2014-11-07T22:48:53Z <p>Bob: /* Install and Configure Bandwidth Accounting and Reporting */</p> <hr /> <div>==System Prep==<br /> *apt-get install tcng xtables-addons-source xtables-addons-common nbtscan linux-headers-$(uname -r) automake libtool libfile-tail-perl libtext-trim-perl libdatetime-format-mail-perl libnet-sslglue-perl<br /> *&lt;b&gt;Note: &lt;/b&gt;as of Apr2014, tcng must be installed from wheezy (update sources.list &amp;&amp; apt-get install tcng/wheezy)<br /> <br /> ==Configure Traffic Control==<br /> *vi [[/root/scripts/qos.tc]]<br /> *echo \#\!\/bin\/bash &gt; /root/scripts/qos.sh; tcng /root/scripts/qos.tc &gt;&gt; /root/scripts/qos.sh<br /> *vi [[/root/scripts/qos.reset.sh]]<br /> *bash /root/scripts/qos.reset.sh; bash /root/scripts/qos.sh<br /> <br /> ==Install and Configure Bandwidth Accounting and Reporting==<br /> *m-a prepare<br /> *m-a a-i -t xtables-addons-source<br /> **##NOV7/2014 - build fails. $(ln -s /usr/src /tmp/buildd); $(m-a a-i -t xtables-addons-source); let it fail; $(cd /usr/src/modules/xtables-addons; ./configure; make; make install)<br /> *echo xt_ACCOUNT &gt;&gt; /etc/modules<br /> *modprobe xt_ACCOUNT<br /> *depmod -a<br /> *vi [[/root/scripts/bwrpt.pl]]<br /> *crontab -e<br /> **9-59/10 * * * * PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; /usr/bin/perl /root/scripts/bwrpt.pl &lt;b&gt;&lt;= Note: on large networks this can take a few minutes to run, and it needs to complete it's data collection before 00:00, so you may need to set it to start at 58 or 57&lt;/b&gt;<br /> <br /> ==Finalize IPTables Configuration==<br /> *vi [[/root/scripts/iptables-restore#Completed|/root/scripts/iptables-restore]]<br /> *iptables-restore &lt; /root/scripts/iptables-restore<br /> *iptaccount -a &lt;b&gt;&lt;= Make sure these three lines show up:&lt;/b&gt;&lt;br&gt;Found table: wan&lt;br&gt;Found table: computerisms&lt;br&gt;Found table: pubaccess<br /> *From worklian:<br /> **telnet 192.168.25.15 25 &lt;b&gt;&lt;= Make sure you can telnet to ports 25, 80, 443, 587, 993, 995&lt;/b&gt;<br /> <br /> ==Notes==<br /> *Aug30/2014 =&gt; module-assistant fails to build xtables-addons. after it fails do:<br /> **cd /usr/src/modules/xtables-addons/<br /> **/bin/bash build-aux/missing autoconf<br /> **./configure<br /> **make -j1<br /> **m-a a-i -t -O xtables-addons</div> Bob http://cocnm.computerisms.ca/index.php?title=Organize_Hardware&diff=431 Organize Hardware 2014-11-07T20:41:44Z <p>Bob: /* Physical Hardware */</p> <hr /> <div>==Network Topology==<br /> &lt;pre&gt;<br /> - 192.168.26.99 (wlan0) <br /> worklian (Ubuntu Workstation) - 192.168.25.99 (eth0)<br /> ^<br /> | (switch/WAP - 192.168.26.2)<br /> V 192.168.26.0/24 ====&gt; 192.168.26.10 &lt;= houselian (PDC/Primary Server)<br /> WAN &lt;=&gt; 192.168.25.0/24 ^ \=&gt; 192.168.26.11 &lt;= shedlian (Backup Server)<br /> ^ | \=&gt; 192.168.26.100 &lt;= adminlian (Windows Workstation) &lt;= connects in bridged mode on the wireless link on worklian<br /> | | \=&gt; 192.168.26.99 &lt;= worklian (Wireless interface connects to switch/WAP)<br /> V V <br /> 192.168.25.15 &lt;= porchlian ====&gt; 192.168.26.1 (eth1)<br /> (eth0) \==&gt; 192.168.27.1 (eth2) &lt;= Public Network for foriegn machines =&gt;<br /> &lt;/pre&gt;<br /> <br /> ==Additional Resources==<br /> *My true production domain name is computerisms.ca. Since I find it confusing to have the test and the real environment be the same name, computerisms.com will be the domain we are building. I already have ownership of the name<br /> <br /> ==Physical Hardware==<br /> <br /> &lt;h4&gt;Windows Workstation - adminlian.computerisms.com&lt;/h4&gt;<br /> *required for testing and configuration<br /> *configured to run in a &quot;work&quot; network environment, and enable discovery. <br /> *configure ip address to be 192.168.26.100/gw=192.168.26.1/dns=192.168.26.10<br /> *dns won't work yet, this is not a problem now.<br /> *In this case I will be using Windows 7 SP1 freshly installed and updated on a Virtual Machine installed on my:<br /> <br /> &lt;h4&gt;SSH Client - worklian.computerisms.com&lt;/h4&gt;<br /> *generate an ssh key (ssh-keygen -b 2048 -t rsa)<br /> *in this case I will be using my ubuntu workstation<br /> <br /> &lt;h4&gt;Digital Signage Remote - dslobby.computerisms.com&lt;/h4&gt;<br /> *An ubuntu virtual machine<br /> *configure with IP address 192.168.26.25<br /> *No special config required; by the time you need this, everything else will be in place<br /> <br /> &lt;h4&gt;Firewall - porchlian.computerisms.com&lt;/h4&gt;<br /> *computer does need to be reliable, but not smart. Use an old workstation.<br /> *this computer must have at least 2 network cards. larger networks with multiple subnets will probably need at least 3<br /> *in this case I am using a very old dell dimension with 3 NICs<br /> *install debian testing (jessie)<br /> *create the file /root/.ssh/authorized_keys and put your public ssh key in it.<br /> *cp /etc/vim/vimrc /root/.vimrc<br /> **edit /root/.vimrc and find the line 'set compatible'; uncomment it and change it to 'set nocompatible'<br /> *edit /root/.bashrc, enable colours and any other personal preferences<br /> *set apt repositories to contain contrib and non-free (optional, if needed for drivers)<br /> *apt-get install ssh ntp rsync tcpdump nmap<br /> *apt-get remove rpcbind nfs-common<br /> *mkdir /root/scripts<br /> *configure external eth0 interface as 192.168.25.15/gw=192.168.25.1/dns=192.168.25.1<br /> *configure internal eth1 interface as 192.168.26.1/255.255.255.0<br /> *configure internal eth2 interface as 192.168.27.1/255.255.255.0<br /> <br /> &lt;h4&gt;Server - houselian.computerisms.com&lt;/h4&gt;<br /> *this will be the workhorse of the network. This will be the PDC and lots of other things<br /> **for a network of one for testing, I am sure any p3 or better will work fine. <br /> **in a production environment you will need to split this into multiple machines<br /> *in this case I am using a ~10 year old HP rackmount server<br /> *install debian testing (jessie)<br /> *create the file /root/.ssh/authorized_keys and put your public ssh key in it.<br /> *cp /etc/vim/vimrc /root/.vimrc<br /> **edit /root/.vimrc and find the line 'set compatible'; uncomment it and change it to 'set nocompatible'<br /> *edit /root/.bashrc, enable colours and any other personal preferences<br /> *set apt repositories to contain contrib and non-free (optional, if needed for drivers)<br /> *apt-get install ssh ntp rsync build-essential bind9<br /> *apt-get remove rpcbind<br /> *mkdir /root/scripts<br /> *configure your resolv.conf to use 'nameserver 127.0.0.1' <br /> *configure eth0 interface as 192.168.26.10<br /> <br /> &lt;h4&gt;Backups - shedlian.computerisms.com&lt;/h4&gt;<br /> *this computer really does not need to be smart, only reliable<br /> **in a testing environment, huge storage is not required<br /> ***However, install the OS on a small partition and leave the majority of the disk to be partitioned later<br /> **in production this machine needs to have plenty of sata ports or some such<br /> *in this case I am using another old dell dimension<br /> *install debian testing (jessie)<br /> *create the file /root/.ssh/authorized_keys and put your public ssh key in it.<br /> *cp /etc/vim/vimrc /root/.vimrc<br /> **edit /root/.vimrc and find the line 'set compatible'; uncomment it and change it to 'set nocompatible'<br /> *edit /root/.bashrc, enable colours and any other personal preferences<br /> *set apt repositories to contain contrib and non-free (optional, if needed for drivers)<br /> *apt-get install ntp ssh<br /> *apt-get remove rpcbind<br /> *configure eth0 interface as 192.168.25.11<br /> <br /> &lt;h4&gt;Switch&lt;/h4&gt;<br /> *for a one person test scenario, you can use a hub.<br /> *scale up accordingly<br /> *in this case, I am using a linksys wireless G unit flashed with openwrt. <br /> **The wan port is taped over to prevent accidents. Always do this when you use wireless routers for switches.<br /> <br /> ==Plug It In==<br /> *everything has a fixed ip, so test basic connectivity. make sure everybody can see everybody.<br /> <br /> ==Notes==<br /> *dpkg --clear-avail&lt;br&gt;^^ This command fixes the &quot;dpkg: warning: parsing file&quot; errors</div> Bob http://cocnm.computerisms.ca/index.php?title=Install_LibreSWAN_and_Xl2tpd&diff=430 Install LibreSWAN and Xl2tpd 2014-10-29T20:04:04Z <p>Bob: /* Obtain and Install Libreswan */</p> <hr /> <div>==System Prep==<br /> *apt-get install libnss3-dev libnspr4-dev pkg-config libpam-dev libcap-ng-dev libcap-ng-utils libselinux-dev libcurl4-nss-dev libgmp3-dev flex bison gcc make libunbound-dev libpcap-dev libnss3-tools ppp libradius1<br /> *echo &quot;net.ipv4.conf.all.accept_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.all.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.default.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *sysctl -p<br /> *for i in $(ls /proc/sys/net/ipv4/conf/); do echo 0 &gt; /proc/sys/net/ipv4/conf/$i/accept_redirects; echo 0 &gt; /proc/sys/net/ipv4/conf/$i/send_redirects; done<br /> <br /> ==Obtain and Install Libreswan==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://libreswan.org/<br /> *cd /usr/src<br /> *wget https://download.libreswan.org/libreswan-3.11.tar.gz<br /> *tar zxf libreswan-3.11.tar.gz<br /> *cd libreswan-3.11/<br /> *make programs<br /> *make install<br /> <br /> ==Obtain and Install Xl2tpd==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://download.openswan.org/xl2tpd/<br /> *cd /usr/src/<br /> *wget http://download.openswan.org/xl2tpd/xl2tpd-1.3.1.tar.gz<br /> *tar zxf xl2tpd-1.3.1.tar.gz<br /> *cd xl2tpd-1.3.1/<br /> *make<br /> *make install<br /> <br /> ==Configure Libreswan==<br /> *scp -r root@192.168.26.10:/var/CA/computerisms.com/porchlian.computerisms.com/porchlian.computerisms.com.p12 root@192.168.26.10:/var/CA/computerisms.com/CA/Computerisms.Certificate.Authority.p12 root@192.168.26.10:/var/CA/computerisms.com/Computerisms.Certificate.Authority.crl ~<br /> *certutil -N -d /etc/ipsec.d<br /> **Enter password B0bsGates<br /> *pk12util -i /root/Computerisms.Certificate.Authority.p12 -d /etc/ipsec.d<br /> *certutil -M -n &quot;Computerisms.Certificate.Authority&quot; -d /etc/ipsec.d -t &quot;TC,,&quot;<br /> *pk12util -i /root/porchlian.computerisms.com.p12 -d /etc/ipsec.d<br /> *&gt; /etc/ipsec.conf; vi [[/etc/ipsec.conf]]<br /> *vi [[/etc/ipsec.secrets]]<br /> *vi [[/etc/ipsec.d/nsspassword]]<br /> *cp /root/Computerisms.Certificate.Authority.crl /etc/ipsec.d/crls/<br /> <br /> ==Configure Xl2tpd==<br /> *mkdir /etc/xl2tpd<br /> *vi [[/etc/xl2tpd/xl2tpd.conf]]<br /> *vi [[/etc/xl2tpd/ppp-options.xl2tpd]]<br /> <br /> ==Configure RadiusClient==<br /> *&gt; /etc/radiusclient/servers; vi [[/etc/radiusclient/servers]]<br /> *&gt; /etc/radiusclient/radiusclient.conf; vi [[/etc/radiusclient/radiusclient.conf]]<br /> *echo &quot;INCLUDE /etc/radiusclient/dictionary.microsoft&quot; &gt;&gt; /etc/radiusclient/dictionary<br /> *vi [[/etc/radiusclient/dictionary.microsoft]]<br /> <br /> ==Start IPSec and Xl2tpd==<br /> *ipsec setup start; tail -f /var/log/auth.log &lt;b&gt;&lt;= Check for errors&lt;/b&gt;<br /> *xl2tpd -C /etc/xl2tpd/l2tp-control<br /> *systemctl enable ipsec<br /> <br /> ==Finalize netup.sh script==<br /> *vi [[/root/scripts/netup.sh]]<br /> <br /> ==Configure Adminlian for Testing==<br /> *Use winscp to obtain /var/CA/computerisms.com/BobMiller/bob.miller.p12 and put it on adminlian<br /> *start=&gt;run mmc=&gt;file=&gt;Add/Remove Snapin<br /> *In the left pane, double click certificates=&gt;in new window select computer account=&gt;next=&gt;Local computer=&gt;Finish=&gt;OK<br /> *In the left pane, expand certificates=&gt;right-click personal=&gt;all tasks=&gt;import<br /> *Next=&gt;Click browse button=&gt;Select all file types (bottom right)=&gt;navigate to bob.miller.p12=&gt;open=&gt;next=&gt;enter password (S0ns0fB0b)=&gt;Next=&gt;Automatically Place=&gt;Next=&gt;Finish<br /> *navigate to Network and Sharing center=&gt;set up a new connection=&gt;connect to a workplace=&gt;create new connection=&gt;use my internet=&gt;set internet address as 192.168.25.15=&gt;Set destination name as Computerisms=&gt;Select the box that allows other people to use this connection=&gt;Next=&gt;Enter username (this is the user's name and password from Active Directory)=&gt;Select remember password=&gt;connect<br /> *Let it spin and fail=&gt;Set up the connection anyway<br /> *navigate to change adapter settings=&gt;right-click Computerisms Icon=&gt;properties<br /> *Security tab=&gt;type of vpn is l2tp/IPSec=&gt;Advanced Settings=&gt;deselect Verify Name and Usage=&gt;OK=&gt;Set Data encryption to Option=&gt;OK<br /> <br /> ==Do the Testing With Adminlian==<br /> *&lt;b&gt;Test VPN works/No NAT:&lt;/b&gt;&lt;br&gt; on worklian, disconnect the wireless connection from the .26 network and connect it to the .25 network&lt;br&gt;Test that you can connect to the vpn, ping 192.168.26.10 should work.<br /> *&lt;b&gt;Test Domain Logon over VPN/No NAT:&lt;/b&gt; Log out of the machine, click switch user, then click the icon by the power button in the bottom right corner&lt;br&gt;enter your credentials, your logon script should run.<br /> *&lt;b&gt;Test Domain Logon over VPN/With NAT:&lt;/b&gt;&lt;br&gt;Shutdown the virtual machine and configure the network connection to use nat instead of bridging, boot up&lt;br&gt;start the logon process and click the network icon&lt;br&gt;Logon and make sure your logon script runs</div> Bob http://cocnm.computerisms.ca/index.php?title=Organize_Hardware&diff=429 Organize Hardware 2014-10-29T16:32:17Z <p>Bob: /* Network Topology */</p> <hr /> <div>==Network Topology==<br /> &lt;pre&gt;<br /> - 192.168.26.99 (wlan0) <br /> worklian (Ubuntu Workstation) - 192.168.25.99 (eth0)<br /> ^<br /> | (switch/WAP - 192.168.26.2)<br /> V 192.168.26.0/24 ====&gt; 192.168.26.10 &lt;= houselian (PDC/Primary Server)<br /> WAN &lt;=&gt; 192.168.25.0/24 ^ \=&gt; 192.168.26.11 &lt;= shedlian (Backup Server)<br /> ^ | \=&gt; 192.168.26.100 &lt;= adminlian (Windows Workstation) &lt;= connects in bridged mode on the wireless link on worklian<br /> | | \=&gt; 192.168.26.99 &lt;= worklian (Wireless interface connects to switch/WAP)<br /> V V <br /> 192.168.25.15 &lt;= porchlian ====&gt; 192.168.26.1 (eth1)<br /> (eth0) \==&gt; 192.168.27.1 (eth2) &lt;= Public Network for foriegn machines =&gt;<br /> &lt;/pre&gt;<br /> <br /> ==Additional Resources==<br /> *My true production domain name is computerisms.ca. Since I find it confusing to have the test and the real environment be the same name, computerisms.com will be the domain we are building. I already have ownership of the name<br /> <br /> ==Physical Hardware==<br /> <br /> &lt;h4&gt;Windows Workstation - adminlian.computerisms.com&lt;/h4&gt;<br /> *required for testing and configuration<br /> *configured to run in a &quot;work&quot; network environment, and enable discovery. <br /> *configure ip address to be 192.168.26.100/gw=192.168.26.1/dns=192.168.26.10<br /> *dns won't work yet, this is not a problem now.<br /> *In this case I will be using Windows 7 SP1 freshly installed and updated on a Virtual Machine installed on my:<br /> <br /> &lt;h4&gt;SSH Client - worklian.computerisms.com&lt;/h4&gt;<br /> *generate an ssh key (ssh-keygen -b 2048 -t rsa)<br /> *in this case I will be using my ubuntu workstation<br /> <br /> &lt;h4&gt;Digital Signage Remote - dslobby.computerisms.com&lt;/h4&gt;<br /> *An ubuntu virtual machine<br /> *configure with IP address 192.168.26.25<br /> *No special config required; by the time you need this, everything else will be in place<br /> <br /> &lt;h4&gt;Firewall - porchlian.computerisms.com&lt;/h4&gt;<br /> *computer does need to be reliable, but not smart. Use an old workstation.<br /> *this computer must have at least 2 network cards. larger networks with multiple subnets will probably need at least 3<br /> *in this case I am using a very old dell dimension with 3 NICs<br /> *install debian testing (jessie)<br /> *create the file /root/.ssh/authorized_keys and put your public ssh key in it.<br /> *cp /etc/vim/vimrc /root/.vimrc<br /> **edit /root/.vimrc and find the line 'set compatible'; uncomment it and change it to 'set nocompatible'<br /> *edit /root/.bashrc, enable colours and any other personal preferences<br /> *set apt repositories to contain contrib and non-free (optional, if needed for drivers)<br /> *apt-get install ssh ntp rsync tcpdump nmap<br /> *apt-get remove rpcbind nfs-common<br /> *mkdir /root/scripts<br /> *configure external eth0 interface as 192.168.25.15/gw=192.168.25.1/dns=192.168.25.1<br /> *configure internal eth1 interface as 192.168.26.1/255.255.255.0<br /> *configure internal eth2 interface as 192.168.27.1/255.255.255.0<br /> <br /> &lt;h4&gt;Server - houselian.computerisms.com&lt;/h4&gt;<br /> *this will be the workhorse of the network. This will be the PDC and lots of other things<br /> **for a network of one for testing, I am sure any p3 or better will work fine. <br /> **in a production environment you will need to split this into multiple machines<br /> *in this case I am using a ~10 year old HP rackmount server<br /> *install debian testing (jessie)<br /> *create the file /root/.ssh/authorized_keys and put your public ssh key in it.<br /> *cp /etc/vim/vimrc /root/.vimrc<br /> **edit /root/.vimrc and find the line 'set compatible'; uncomment it and change it to 'set nocompatible'<br /> *edit /root/.bashrc, enable colours and any other personal preferences<br /> *set apt repositories to contain contrib and non-free (optional, if needed for drivers)<br /> *apt-get install ssh ntp rysnc build-essential bind9<br /> *apt-get remove rpcbind<br /> *mkdir /root/scripts<br /> *configure your resolv.conf to use 'nameserver 127.0.0.1' <br /> *configure eth0 interface as 192.168.26.10<br /> <br /> &lt;h4&gt;Backups - shedlian.computerisms.com&lt;/h4&gt;<br /> *this computer really does not need to be smart, only reliable<br /> **in a testing environment, huge storage is not required<br /> ***However, install the OS on a small partition and leave the majority of the disk to be partitioned later<br /> **in production this machine needs to have plenty of sata ports or some such<br /> *in this case I am using another old dell dimension<br /> *install debian testing (jessie)<br /> *create the file /root/.ssh/authorized_keys and put your public ssh key in it.<br /> *cp /etc/vim/vimrc /root/.vimrc<br /> **edit /root/.vimrc and find the line 'set compatible'; uncomment it and change it to 'set nocompatible'<br /> *edit /root/.bashrc, enable colours and any other personal preferences<br /> *set apt repositories to contain contrib and non-free (optional, if needed for drivers)<br /> *apt-get install ntp ssh<br /> *apt-get remove rpcbind<br /> *configure eth0 interface as 192.168.25.11<br /> <br /> &lt;h4&gt;Switch&lt;/h4&gt;<br /> *for a one person test scenario, you can use a hub.<br /> *scale up accordingly<br /> *in this case, I am using a linksys wireless G unit flashed with openwrt. <br /> **The wan port is taped over to prevent accidents. Always do this when you use wireless routers for switches.<br /> <br /> ==Plug It In==<br /> *everything has a fixed ip, so test basic connectivity. make sure everybody can see everybody.<br /> <br /> ==Notes==<br /> *dpkg --clear-avail&lt;br&gt;^^ This command fixes the &quot;dpkg: warning: parsing file&quot; errors</div> Bob http://cocnm.computerisms.ca/index.php?title=/usr/local/etc/dovecot/dovecot-ldap.conf.master&diff=428 /usr/local/etc/dovecot/dovecot-ldap.conf.master 2014-09-11T00:10:06Z <p>Bob: </p> <hr /> <div>==Administrator only==<br /> &lt;pre&gt;<br /> hosts = 192.168.26.10:389<br /> debug_level = 0<br /> auth_bind = yes<br /> auth_bind_userdn = %Ln@computerisms.com<br /> base = dn=computerisms,dn=com<br /> scope = subtree<br /> user_filter = (&amp;(sAMAccountName=administrator))<br /> pass_filter = (&amp;(sAMAccountName=administrator))<br /> &lt;/pre&gt;<br /> <br /> ==Domain Admins group==<br /> &lt;pre&gt;<br /> hosts = 192.168.26.10:389<br /> debug_level = 0<br /> auth_bind = yes<br /> auth_bind_userdn = %Ln@computerisms.com<br /> base = dn=computerisms,dn=com<br /> scope = subtree<br /> user_filter = (&amp;(memberOf=CN=Domain Admins,CN=Users,DC=computerisms,DC=com))<br /> pass_filter = (&amp;(memberOf=CN=Domain Admins,CN=Users,DC=computerisms,DC=com))<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=/root/scripts/netup.sh&diff=427 /root/scripts/netup.sh 2014-08-31T02:07:57Z <p>Bob: /* Finalized Config */</p> <hr /> <div>==Initial Config==<br /> <br /> &lt;pre&gt;<br /> #!/bin/sh<br /> sysctl -p<br /> iptables-restore &lt; /root/scripts/iptables-restore<br /> &lt;/pre&gt;<br /> <br /> ==Finalized Config==<br /> &lt;pre&gt;<br /> #!/bin/sh<br /> sysctl -p<br /> /sbin/iptables-restore &lt; /root/scripts/iptables-restore<br /> /bin/bash /root/scripts/qos.reset.sh<br /> /bin/bash /root/scripts/qos.sh<br /> ##Note with libreswan3.9 and systemd, this line will hang the box on bootup:<br /> #/usr/local/sbin/ipsec setup start<br /> /usr/local/sbin/xl2tpd -C /etc/xl2tpd/xl2tpd.conf<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=Install_LibreSWAN_and_Xl2tpd&diff=426 Install LibreSWAN and Xl2tpd 2014-08-31T02:07:12Z <p>Bob: /* Start IPSec and Xl2tpd */</p> <hr /> <div>==System Prep==<br /> *apt-get install libnss3-dev libnspr4-dev pkg-config libpam-dev libcap-ng-dev libcap-ng-utils libselinux-dev libcurl4-nss-dev libgmp3-dev flex bison gcc make libunbound-dev libpcap-dev libnss3-tools ppp libradius1<br /> *echo &quot;net.ipv4.conf.all.accept_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.all.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.default.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *sysctl -p<br /> *for i in $(ls /proc/sys/net/ipv4/conf/); do echo 0 &gt; /proc/sys/net/ipv4/conf/$i/accept_redirects; echo 0 &gt; /proc/sys/net/ipv4/conf/$i/send_redirects; done<br /> <br /> ==Obtain and Install Libreswan==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://libreswan.org/<br /> *cd /usr/src<br /> *wget https://download.libreswan.org/libreswan-3.9.tar.gz<br /> *tar zxf libreswan-3.9.tar.gz<br /> *cd libreswan-3.9/<br /> *make programs<br /> *make install<br /> <br /> ==Obtain and Install Xl2tpd==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://download.openswan.org/xl2tpd/<br /> *cd /usr/src/<br /> *wget http://download.openswan.org/xl2tpd/xl2tpd-1.3.1.tar.gz<br /> *tar zxf xl2tpd-1.3.1.tar.gz<br /> *cd xl2tpd-1.3.1/<br /> *make<br /> *make install<br /> <br /> ==Configure Libreswan==<br /> *scp -r root@192.168.26.10:/var/CA/computerisms.com/porchlian.computerisms.com/porchlian.computerisms.com.p12 root@192.168.26.10:/var/CA/computerisms.com/CA/Computerisms.Certificate.Authority.p12 root@192.168.26.10:/var/CA/computerisms.com/Computerisms.Certificate.Authority.crl ~<br /> *certutil -N -d /etc/ipsec.d<br /> **Enter password B0bsGates<br /> *pk12util -i /root/Computerisms.Certificate.Authority.p12 -d /etc/ipsec.d<br /> *certutil -M -n &quot;Computerisms.Certificate.Authority&quot; -d /etc/ipsec.d -t &quot;TC,,&quot;<br /> *pk12util -i /root/porchlian.computerisms.com.p12 -d /etc/ipsec.d<br /> *&gt; /etc/ipsec.conf; vi [[/etc/ipsec.conf]]<br /> *vi [[/etc/ipsec.secrets]]<br /> *vi [[/etc/ipsec.d/nsspassword]]<br /> *cp /root/Computerisms.Certificate.Authority.crl /etc/ipsec.d/crls/<br /> <br /> ==Configure Xl2tpd==<br /> *mkdir /etc/xl2tpd<br /> *vi [[/etc/xl2tpd/xl2tpd.conf]]<br /> *vi [[/etc/xl2tpd/ppp-options.xl2tpd]]<br /> <br /> ==Configure RadiusClient==<br /> *&gt; /etc/radiusclient/servers; vi [[/etc/radiusclient/servers]]<br /> *&gt; /etc/radiusclient/radiusclient.conf; vi [[/etc/radiusclient/radiusclient.conf]]<br /> *echo &quot;INCLUDE /etc/radiusclient/dictionary.microsoft&quot; &gt;&gt; /etc/radiusclient/dictionary<br /> *vi [[/etc/radiusclient/dictionary.microsoft]]<br /> <br /> ==Start IPSec and Xl2tpd==<br /> *ipsec setup start; tail -f /var/log/auth.log &lt;b&gt;&lt;= Check for errors&lt;/b&gt;<br /> *xl2tpd -C /etc/xl2tpd/l2tp-control<br /> *systemctl enable ipsec<br /> <br /> ==Finalize netup.sh script==<br /> *vi [[/root/scripts/netup.sh]]<br /> <br /> ==Configure Adminlian for Testing==<br /> *Use winscp to obtain /var/CA/computerisms.com/BobMiller/bob.miller.p12 and put it on adminlian<br /> *start=&gt;run mmc=&gt;file=&gt;Add/Remove Snapin<br /> *In the left pane, double click certificates=&gt;in new window select computer account=&gt;next=&gt;Local computer=&gt;Finish=&gt;OK<br /> *In the left pane, expand certificates=&gt;right-click personal=&gt;all tasks=&gt;import<br /> *Next=&gt;Click browse button=&gt;Select all file types (bottom right)=&gt;navigate to bob.miller.p12=&gt;open=&gt;next=&gt;enter password (S0ns0fB0b)=&gt;Next=&gt;Automatically Place=&gt;Next=&gt;Finish<br /> *navigate to Network and Sharing center=&gt;set up a new connection=&gt;connect to a workplace=&gt;create new connection=&gt;use my internet=&gt;set internet address as 192.168.25.15=&gt;Set destination name as Computerisms=&gt;Select the box that allows other people to use this connection=&gt;Next=&gt;Enter username (this is the user's name and password from Active Directory)=&gt;Select remember password=&gt;connect<br /> *Let it spin and fail=&gt;Set up the connection anyway<br /> *navigate to change adapter settings=&gt;right-click Computerisms Icon=&gt;properties<br /> *Security tab=&gt;type of vpn is l2tp/IPSec=&gt;Advanced Settings=&gt;deselect Verify Name and Usage=&gt;OK=&gt;Set Data encryption to Option=&gt;OK<br /> <br /> ==Do the Testing With Adminlian==<br /> *&lt;b&gt;Test VPN works/No NAT:&lt;/b&gt;&lt;br&gt; on worklian, disconnect the wireless connection from the .26 network and connect it to the .25 network&lt;br&gt;Test that you can connect to the vpn, ping 192.168.26.10 should work.<br /> *&lt;b&gt;Test Domain Logon over VPN/No NAT:&lt;/b&gt; Log out of the machine, click switch user, then click the icon by the power button in the bottom right corner&lt;br&gt;enter your credentials, your logon script should run.<br /> *&lt;b&gt;Test Domain Logon over VPN/With NAT:&lt;/b&gt;&lt;br&gt;Shutdown the virtual machine and configure the network connection to use nat instead of bridging, boot up&lt;br&gt;start the logon process and click the network icon&lt;br&gt;Logon and make sure your logon script runs</div> Bob http://cocnm.computerisms.ca/index.php?title=Install_LibreSWAN_and_Xl2tpd&diff=425 Install LibreSWAN and Xl2tpd 2014-08-30T23:36:37Z <p>Bob: /* Obtain and Install Libreswan */</p> <hr /> <div>==System Prep==<br /> *apt-get install libnss3-dev libnspr4-dev pkg-config libpam-dev libcap-ng-dev libcap-ng-utils libselinux-dev libcurl4-nss-dev libgmp3-dev flex bison gcc make libunbound-dev libpcap-dev libnss3-tools ppp libradius1<br /> *echo &quot;net.ipv4.conf.all.accept_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.all.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *echo &quot;net.ipv4.conf.default.send_redirects = 0&quot; &gt;&gt; /etc/sysctl.conf<br /> *sysctl -p<br /> *for i in $(ls /proc/sys/net/ipv4/conf/); do echo 0 &gt; /proc/sys/net/ipv4/conf/$i/accept_redirects; echo 0 &gt; /proc/sys/net/ipv4/conf/$i/send_redirects; done<br /> <br /> ==Obtain and Install Libreswan==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://libreswan.org/<br /> *cd /usr/src<br /> *wget https://download.libreswan.org/libreswan-3.9.tar.gz<br /> *tar zxf libreswan-3.9.tar.gz<br /> *cd libreswan-3.9/<br /> *make programs<br /> *make install<br /> <br /> ==Obtain and Install Xl2tpd==<br /> *&lt;b&gt;Find latest downloads here: &lt;/b&gt;http://download.openswan.org/xl2tpd/<br /> *cd /usr/src/<br /> *wget http://download.openswan.org/xl2tpd/xl2tpd-1.3.1.tar.gz<br /> *tar zxf xl2tpd-1.3.1.tar.gz<br /> *cd xl2tpd-1.3.1/<br /> *make<br /> *make install<br /> <br /> ==Configure Libreswan==<br /> *scp -r root@192.168.26.10:/var/CA/computerisms.com/porchlian.computerisms.com/porchlian.computerisms.com.p12 root@192.168.26.10:/var/CA/computerisms.com/CA/Computerisms.Certificate.Authority.p12 root@192.168.26.10:/var/CA/computerisms.com/Computerisms.Certificate.Authority.crl ~<br /> *certutil -N -d /etc/ipsec.d<br /> **Enter password B0bsGates<br /> *pk12util -i /root/Computerisms.Certificate.Authority.p12 -d /etc/ipsec.d<br /> *certutil -M -n &quot;Computerisms.Certificate.Authority&quot; -d /etc/ipsec.d -t &quot;TC,,&quot;<br /> *pk12util -i /root/porchlian.computerisms.com.p12 -d /etc/ipsec.d<br /> *&gt; /etc/ipsec.conf; vi [[/etc/ipsec.conf]]<br /> *vi [[/etc/ipsec.secrets]]<br /> *vi [[/etc/ipsec.d/nsspassword]]<br /> *cp /root/Computerisms.Certificate.Authority.crl /etc/ipsec.d/crls/<br /> <br /> ==Configure Xl2tpd==<br /> *mkdir /etc/xl2tpd<br /> *vi [[/etc/xl2tpd/xl2tpd.conf]]<br /> *vi [[/etc/xl2tpd/ppp-options.xl2tpd]]<br /> <br /> ==Configure RadiusClient==<br /> *&gt; /etc/radiusclient/servers; vi [[/etc/radiusclient/servers]]<br /> *&gt; /etc/radiusclient/radiusclient.conf; vi [[/etc/radiusclient/radiusclient.conf]]<br /> *echo &quot;INCLUDE /etc/radiusclient/dictionary.microsoft&quot; &gt;&gt; /etc/radiusclient/dictionary<br /> *vi [[/etc/radiusclient/dictionary.microsoft]]<br /> <br /> ==Start IPSec and Xl2tpd==<br /> *ipsec setup restart; tail -f /var/log/auth.log &lt;b&gt;&lt;= Check for errors&lt;/b&gt;<br /> *xl2tpd -C /etc/xl2tpd/l2tp-control<br /> <br /> ==Finalize netup.sh script==<br /> *vi [[/root/scripts/netup.sh]]<br /> <br /> ==Configure Adminlian for Testing==<br /> *Use winscp to obtain /var/CA/computerisms.com/BobMiller/bob.miller.p12 and put it on adminlian<br /> *start=&gt;run mmc=&gt;file=&gt;Add/Remove Snapin<br /> *In the left pane, double click certificates=&gt;in new window select computer account=&gt;next=&gt;Local computer=&gt;Finish=&gt;OK<br /> *In the left pane, expand certificates=&gt;right-click personal=&gt;all tasks=&gt;import<br /> *Next=&gt;Click browse button=&gt;Select all file types (bottom right)=&gt;navigate to bob.miller.p12=&gt;open=&gt;next=&gt;enter password (S0ns0fB0b)=&gt;Next=&gt;Automatically Place=&gt;Next=&gt;Finish<br /> *navigate to Network and Sharing center=&gt;set up a new connection=&gt;connect to a workplace=&gt;create new connection=&gt;use my internet=&gt;set internet address as 192.168.25.15=&gt;Set destination name as Computerisms=&gt;Select the box that allows other people to use this connection=&gt;Next=&gt;Enter username (this is the user's name and password from Active Directory)=&gt;Select remember password=&gt;connect<br /> *Let it spin and fail=&gt;Set up the connection anyway<br /> *navigate to change adapter settings=&gt;right-click Computerisms Icon=&gt;properties<br /> *Security tab=&gt;type of vpn is l2tp/IPSec=&gt;Advanced Settings=&gt;deselect Verify Name and Usage=&gt;OK=&gt;Set Data encryption to Option=&gt;OK<br /> <br /> ==Do the Testing With Adminlian==<br /> *&lt;b&gt;Test VPN works/No NAT:&lt;/b&gt;&lt;br&gt; on worklian, disconnect the wireless connection from the .26 network and connect it to the .25 network&lt;br&gt;Test that you can connect to the vpn, ping 192.168.26.10 should work.<br /> *&lt;b&gt;Test Domain Logon over VPN/No NAT:&lt;/b&gt; Log out of the machine, click switch user, then click the icon by the power button in the bottom right corner&lt;br&gt;enter your credentials, your logon script should run.<br /> *&lt;b&gt;Test Domain Logon over VPN/With NAT:&lt;/b&gt;&lt;br&gt;Shutdown the virtual machine and configure the network connection to use nat instead of bridging, boot up&lt;br&gt;start the logon process and click the network icon&lt;br&gt;Logon and make sure your logon script runs</div> Bob http://cocnm.computerisms.ca/index.php?title=Shape/Track_Bandwidth_-_Finalize_IPTables&diff=424 Shape/Track Bandwidth - Finalize IPTables 2014-08-30T23:26:13Z <p>Bob: /* Finalize IPTables Configuration */</p> <hr /> <div>==System Prep==<br /> *apt-get install tcng xtables-addons-source xtables-addons-common nbtscan linux-headers-$(uname -r) automake libtool libfile-tail-perl libtext-trim-perl libdatetime-format-mail-perl libnet-sslglue-perl<br /> *&lt;b&gt;Note: &lt;/b&gt;as of Apr2014, tcng must be installed from wheezy (update sources.list &amp;&amp; apt-get install tcng/wheezy)<br /> <br /> ==Configure Traffic Control==<br /> *vi [[/root/scripts/qos.tc]]<br /> *echo \#\!\/bin\/bash &gt; /root/scripts/qos.sh; tcng /root/scripts/qos.tc &gt;&gt; /root/scripts/qos.sh<br /> *vi [[/root/scripts/qos.reset.sh]]<br /> *bash /root/scripts/qos.reset.sh; bash /root/scripts/qos.sh<br /> <br /> ==Install and Configure Bandwidth Accounting and Reporting==<br /> *m-a prepare<br /> *m-a a-i -t xtables-addons-source<br /> *echo xt_ACCOUNT &gt;&gt; /etc/modules<br /> *modprobe xt_ACCOUNT<br /> *depmod -a<br /> *vi [[/root/scripts/bwrpt.pl]]<br /> *crontab -e<br /> **9-59/10 * * * * PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; /usr/bin/perl /root/scripts/bwrpt.pl &lt;b&gt;&lt;= Note: on large networks this can take a few minutes to run, and it needs to complete it's data collection before 00:00, so you may need to set it to start at 58 or 57&lt;/b&gt;<br /> <br /> ==Finalize IPTables Configuration==<br /> *vi [[/root/scripts/iptables-restore#Completed|/root/scripts/iptables-restore]]<br /> *iptables-restore &lt; /root/scripts/iptables-restore<br /> *iptaccount -a &lt;b&gt;&lt;= Make sure these three lines show up:&lt;/b&gt;&lt;br&gt;Found table: wan&lt;br&gt;Found table: computerisms&lt;br&gt;Found table: pubaccess<br /> *From worklian:<br /> **telnet 192.168.25.15 25 &lt;b&gt;&lt;= Make sure you can telnet to ports 25, 80, 443, 587, 993, 995&lt;/b&gt;<br /> <br /> ==Notes==<br /> *Aug30/2014 =&gt; module-assistant fails to build xtables-addons. after it fails do:<br /> **cd /usr/src/modules/xtables-addons/<br /> **/bin/bash build-aux/missing autoconf<br /> **./configure<br /> **make -j1<br /> **m-a a-i -t -O xtables-addons</div> Bob http://cocnm.computerisms.ca/index.php?title=Shape/Track_Bandwidth_-_Finalize_IPTables&diff=423 Shape/Track Bandwidth - Finalize IPTables 2014-08-30T22:29:42Z <p>Bob: /* Install and Configure Bandwidth Accounting and Reporting */</p> <hr /> <div>==System Prep==<br /> *apt-get install tcng xtables-addons-source xtables-addons-common nbtscan linux-headers-$(uname -r) automake libtool libfile-tail-perl libtext-trim-perl libdatetime-format-mail-perl libnet-sslglue-perl<br /> *&lt;b&gt;Note: &lt;/b&gt;as of Apr2014, tcng must be installed from wheezy (update sources.list &amp;&amp; apt-get install tcng/wheezy)<br /> <br /> ==Configure Traffic Control==<br /> *vi [[/root/scripts/qos.tc]]<br /> *echo \#\!\/bin\/bash &gt; /root/scripts/qos.sh; tcng /root/scripts/qos.tc &gt;&gt; /root/scripts/qos.sh<br /> *vi [[/root/scripts/qos.reset.sh]]<br /> *bash /root/scripts/qos.reset.sh; bash /root/scripts/qos.sh<br /> <br /> ==Install and Configure Bandwidth Accounting and Reporting==<br /> *m-a prepare<br /> *m-a a-i -t xtables-addons-source<br /> *echo xt_ACCOUNT &gt;&gt; /etc/modules<br /> *modprobe xt_ACCOUNT<br /> *depmod -a<br /> *vi [[/root/scripts/bwrpt.pl]]<br /> *crontab -e<br /> **9-59/10 * * * * PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; /usr/bin/perl /root/scripts/bwrpt.pl &lt;b&gt;&lt;= Note: on large networks this can take a few minutes to run, and it needs to complete it's data collection before 00:00, so you may need to set it to start at 58 or 57&lt;/b&gt;<br /> <br /> ==Finalize IPTables Configuration==<br /> *vi [[/root/scripts/iptables-restore#Completed|/root/scripts/iptables-restore]]<br /> *iptables-restore &lt; /root/scripts/iptables-restore<br /> *iptaccount -a &lt;b&gt;&lt;= Make sure these three lines show up:&lt;/b&gt;&lt;br&gt;Found table: wan&lt;br&gt;Found table: computerisms&lt;br&gt;Found table: pubaccess<br /> *From worklian:<br /> **telnet 192.168.25.15 25 &lt;b&gt;&lt;= Make sure you can telnet to ports 25, 80, 443, 587, 993, 995&lt;/b&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=/root/scripts/iptables-restore&diff=422 /root/scripts/iptables-restore 2014-08-30T21:58:50Z <p>Bob: /* Completed */</p> <hr /> <div>==Basic==<br /> &lt;pre&gt;<br /> *nat<br /> :PREROUTING ACCEPT [0:0]<br /> :INPUT ACCEPT [0:0]<br /> :OUTPUT ACCEPT [0:0]<br /> :POSTROUTING ACCEPT [0:0]<br /> -A POSTROUTING -s 192.168.26.0/24 -o eth0 -j SNAT --to-source 192.168.25.15<br /> COMMIT<br /> *mangle<br /> :PREROUTING ACCEPT [0:0]<br /> :INPUT ACCEPT [0:0]<br /> :FORWARD ACCEPT [0:0]<br /> :OUTPUT ACCEPT [0:0]<br /> :POSTROUTING ACCEPT [0:0]<br /> -A POSTROUTING -m conntrack --ctstate INVALID -j DROP<br /> COMMIT<br /> *raw<br /> :PREROUTING ACCEPT [0:0]<br /> :OUTPUT ACCEPT [0:0]<br /> COMMIT<br /> *filter<br /> :INPUT DROP [0:0]<br /> :FORWARD DROP [0:0]<br /> :OUTPUT DROP [0:0]<br /> -A INPUT -i lo -j ACCEPT<br /> -A INPUT -s 127.0.0.0/8 ! -i lo -j LOG --log-prefix INPUTlo<br /> -A INPUT -s 127.0.0.0/8 ! -i lo -j DROP<br /> -A INPUT -d 255.255.255.255/32 -j ACCEPT<br /> -A INPUT -d 224.0.0.0/4 -i eth1 ! -p tcp -j ACCEPT<br /> -A INPUT -d 192.168.25.15/32 -i eth0 -j ACCEPT<br /> -A INPUT -d 192.168.25.255/32 -i eth0 -j ACCEPT<br /> -A INPUT -s 192.168.26.0/24 -i eth1 -j ACCEPT<br /> -A INPUT -s 192.168.26.0/24 ! -i eth1 -j LOG --log-prefix INPUT1<br /> -A INPUT -s 192.168.26.0/24 ! -i eth1 -j DROP<br /> -A INPUT -j LOG --log-prefix INPUT<br /> -A INPUT -j DROP<br /> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT<br /> -A FORWARD -s 192.168.26.0/24 -i eth1 -o eth0 -j ACCEPT<br /> -A FORWARD -j LOG --log-prefix FORWARD<br /> -A FORWARD -j DROP<br /> -A OUTPUT -o lo -j ACCEPT<br /> -A OUTPUT -d 127.0.0.0/8 ! -o lo -j LOG --log-prefix OUTPUTlo<br /> -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP<br /> -A OUTPUT -d 255.255.255.255/32 -j ACCEPT<br /> -A OUTPUT -d 224.0.0.0/4 -o eth1 ! -p tcp -j ACCEPT<br /> -A OUTPUT -d 224.0.0.0/4 -o eth2 ! -p tcp -j ACCEPT<br /> -A OUTPUT -s 192.168.25.15/32 -o eth0 -j ACCEPT<br /> -A OUTPUT -s 192.168.25.255/32 -o eth0 -j ACCEPT<br /> -A OUTPUT -d 192.168.26.0/24 -o eth1 -j ACCEPT<br /> -A OUTPUT -d 192.168.26.0/24 ! -o eth1 -j LOG --log-prefix OUTPUT1<br /> -A OUTPUT -d 192.168.26.0/24 ! -o eth1 -j DROP<br /> -A OUTPUT -j LOG --log-prefix OUTPUT<br /> -A OUTPUT -j DROP<br /> COMMIT<br /> &lt;/pre&gt;<br /> <br /> ==Completed==<br /> &lt;pre&gt;<br /> # Generated by iptables-save v1.4.20 on Thu Aug 29 20:35:34 2013<br /> *nat<br /> :PREROUTING ACCEPT [16208:2924135]<br /> :INPUT ACCEPT [12634:2681037]<br /> :OUTPUT ACCEPT [5147:372035]<br /> :POSTROUTING ACCEPT [5147:372035]<br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.26.10:25 <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.26.10:80 <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.26.10:443<br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 587 -j DNAT --to-destination 192.168.26.10:587<br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 993 -j DNAT --to-destination 192.168.26.10:993 <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 995 -j DNAT --to-destination 192.168.26.10:995<br /> -A POSTROUTING ! -d 10.25.0.0/24 -s 192.168.26.0/24 -o eth0 -j SNAT --to-source 192.168.25.15<br /> -A POSTROUTING -s 192.168.27.0/24 -o eth0 -j SNAT --to-source 192.168.25.15<br /> COMMIT<br /> # Completed on Thu Aug 29 20:35:34 2013<br /> # Generated by iptables-save v1.4.20 on Thu Aug 29 20:35:34 2013<br /> *mangle<br /> :PREROUTING ACCEPT [154883:126645061]<br /> :INPUT ACCEPT [133756:117641671]<br /> :FORWARD ACCEPT [20465:8966111]<br /> :OUTPUT ACCEPT [86452:6816891]<br /> :POSTROUTING ACCEPT [106905:15782402]<br /> -A POSTROUTING -m conntrack --ctstate INVALID -j DROP<br /> -A POSTROUTING -j ACCOUNT --addr 0/0 --tname wan<br /> -A FORWARD -j ACCOUNT --addr 192.168.26.0/24 --tname computerisms<br /> -A FORWARD -j ACCOUNT --addr 192.168.27.0/24 --tname pubaccess<br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 25 -j MARK --set-xmark 0x1/0xffffffff <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x1/0xffffffff <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 443 -j MARK --set-xmark 0x1/0xffffffff<br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 587 -j MARK --set-xmark 0x1/0xffffffff <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 993 -j MARK --set-xmark 0x1/0xffffffff <br /> -A PREROUTING -d 192.168.25.15/32 -i eth0 -p tcp -m tcp --dport 995 -j MARK --set-xmark 0x1/0xffffffff <br /> COMMIT<br /> # Completed on Thu Aug 29 20:35:34 2013<br /> # Generated by iptables-save v1.4.20 on Thu Aug 29 20:35:34 2013<br /> *raw<br /> :PREROUTING ACCEPT [154883:126645061]<br /> :OUTPUT ACCEPT [86452:6816891]<br /> COMMIT<br /> # Completed on Thu Aug 29 20:35:34 2013<br /> # Generated by iptables-save v1.4.20 on Thu Aug 29 20:35:34 2013<br /> *filter<br /> :INPUT DROP [0:0]<br /> :FORWARD DROP [0:0]<br /> :OUTPUT DROP [0:0]<br /> -A INPUT -m mark --mark 0x1 -j ACCEPT <br /> -A INPUT -i lo -j ACCEPT<br /> -A INPUT -s 127.0.0.0/8 ! -i lo -j LOG --log-prefix INPUTlo<br /> -A INPUT -s 127.0.0.0/8 ! -i lo -j DROP<br /> -A INPUT -d 255.255.255.255/32 -j ACCEPT<br /> -A INPUT -d 224.0.0.0/4 -i eth1 ! -p tcp -j ACCEPT<br /> -A INPUT -d 224.0.0.0/4 -i eth2 ! -p tcp -j ACCEPT<br /> -A INPUT -d 192.168.25.15/32 -i eth0 -j ACCEPT<br /> -A INPUT -d 192.168.25.255/32 -i eth0 -j ACCEPT<br /> -A INPUT -s 192.168.26.0/24 -i eth1 -j ACCEPT<br /> -A INPUT -s 192.168.26.0/24 ! -i eth1 -j LOG --log-prefix INPUT1<br /> -A INPUT -s 192.168.26.0/24 ! -i eth1 -j DROP<br /> -A INPUT -s 192.168.27.0/24 -i eth2 -j ACCEPT<br /> -A INPUT -s 192.168.27.0/24 ! -i eth2 -j LOG --log-prefix INPUT2<br /> -A INPUT -s 192.168.27.0/24 ! -i eth2 -j DROP<br /> -A INPUT -j LOG --log-prefix INPUT<br /> -A INPUT -j DROP<br /> -A FORWARD -m mark --mark 0x1 -j ACCEPT <br /> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT<br /> -A FORWARD -s 192.168.26.0/24 -d 192.168.27.0/24 -j LOG --log-prefix FORWARD1<br /> -A FORWARD -s 192.168.26.0/24 -d 192.168.27.0/24 -j DROP<br /> -A FORWARD -s 192.168.27.0/24 -d 192.168.26.0/24 -j LOG --log-prefix FORWARD2<br /> -A FORWARD -s 192.168.27.0/24 -d 192.168.26.0/24 -j DROP<br /> -A FORWARD -s 192.168.26.0/24 -d 10.25.0.0/24 -j ACCEPT<br /> -A FORWARD -d 192.168.26.0/24 -s 10.25.0.0/24 -j ACCEPT<br /> -A FORWARD -s 192.168.26.0/24 -i eth1 -o eth0 -j ACCEPT<br /> -A FORWARD -s 192.168.27.0/24 -i eth2 -o eth0 -j ACCEPT<br /> -A FORWARD -j LOG --log-prefix FORWARD<br /> -A FORWARD -j DROP<br /> -A OUTPUT -o lo -j ACCEPT<br /> -A OUTPUT -d 127.0.0.0/8 ! -o lo -j LOG --log-prefix OUTPUTlo<br /> -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP<br /> -A OUTPUT -d 255.255.255.255/32 -j ACCEPT<br /> -A OUTPUT -d 224.0.0.0/4 -o eth1 ! -p tcp -j ACCEPT<br /> -A OUTPUT -d 224.0.0.0/4 -o eth2 ! -p tcp -j ACCEPT<br /> -A OUTPUT -s 192.168.25.15/32 -o eth0 -j ACCEPT<br /> -A OUTPUT -s 192.168.25.255/32 -o eth0 -j ACCEPT<br /> -A OUTPUT -d 192.168.26.0/24 -o eth1 -j ACCEPT<br /> -A OUTPUT -d 192.168.26.0/24 ! -o eth1 -j LOG --log-prefix OUTPUT1<br /> -A OUTPUT -d 192.168.26.0/24 ! -o eth1 -j DROP<br /> -A OUTPUT -d 192.168.27.0/24 -o eth2 -j ACCEPT<br /> -A OUTPUT -d 192.168.27.0/24 ! -o eth2 -j LOG --log-prefix OUTPUT2<br /> -A OUTPUT -d 192.168.27.0/24 ! -o eth2 -j DROP<br /> -A OUTPUT -j LOG --log-prefix OUTPUT<br /> -A OUTPUT -j DROP<br /> COMMIT<br /> # Completed on Thu Aug 29 20:35:34 2013<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=421 User Creation Script 2014-08-18T04:03:41Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 539 -g pad -r pad<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=User_Creation_Script&diff=420 User Creation Script 2014-08-18T04:03:13Z <p>Bob: </p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/sh<br /> groupadd -g 500 qmail <br /> groupadd -g 501 nofiles <br /> groupadd -g 509 vmail<br /> groupadd -g 510 dovecot<br /> groupadd -g 511 dovenull<br /> groupadd -g 512 clamav<br /> groupadd -g 513 simscan<br /> groupadd -g 514 spamd<br /> groupadd -g 520 asterisk<br /> groupadd -g 521 phnmngr<br /> groupadd -g 522 ups<br /> groupadd -g 530 davical<br /> groupadd -g 531 roundcube<br /> groupadd -g 532 fetch<br /> groupadd -g 533 rt<br /> groupadd -g 534 ob<br /> groupadd -g 535 wiki<br /> groupadd -g 536 files<br /> groupadd -g 537 ledger<br /> groupadd -g 538 nagios<br /> groupadd -g 539 pad<br /> <br /> useradd -u 502 -g nofiles -d /var/qmail/alias alias <br /> useradd -u 503 -g nofiles -d /var/qmail qmaild <br /> useradd -u 504 -g nofiles -d /var/qmail qmaill <br /> useradd -u 505 -g nofiles -d /var/qmail qmailp <br /> useradd -u 506 -g qmail -d /var/qmail qmailq <br /> useradd -u 507 -g qmail -d /var/qmail qmailr <br /> useradd -u 508 -g qmail -d /var/qmail qmails <br /> useradd -u 509 -g vmail -d /home/mail -r vmail<br /> useradd -u 510 -g dovecot -r dovecot<br /> useradd -u 511 -g dovenull -r dovenull<br /> useradd -u 512 -g clamav -s /bin/false -d /tmp/clamav -G simscan clamav<br /> useradd -u 513 -g simscan -r simscan<br /> useradd -u 514 -g spamd -r -d /etc/mail/spamassassin spamd<br /> useradd -u 515 -N -g nogroup -d /usr/local/home/razor -s /bin/sh -c razor-agent razor<br /> useradd -u 521 -g phnmngr -d /IPPhones phnmngr<br /> useradd -u 522 -g ups --no-create-home ups <br /> useradd -u 520 -g asterisk --no-create-home -G phnmngr asterisk <br /> useradd -u 530 -g davical -r davical<br /> useradd -u 531 -g roundcube -r roundcube<br /> useradd -u 532 -g fetch -r fetch<br /> useradd -u 533 -g rt -r rt<br /> useradd -u 534 -g ob -r ob<br /> useradd -u 535 -g wiki -r wiki<br /> useradd -u 536 -g files -r files<br /> useradd -u 537 -g ledger -r ledger<br /> useradd -u 538 -g nagios -r nagios -d /usr/local/nagios<br /> useradd -u 538 -g pad -r pad<br /> <br /> mkdir -p /usr/local/home/razor<br /> mkdir /home/mail<br /> mkdir /home/data<br /> mkdir /IPPhones<br /> mkdir /home/webDAV<br /> <br /> chown -R razor:nogroup /usr/local/home/razor<br /> chown -R vmail:vmail /home/mail<br /> chown -R asterisk:phnmngr /IPPhones/<br /> chown -R files:files /home/webDAV<br /> <br /> chmod -R 2770 /IPPhones/<br /> chmod -R 2770 /home/webDAV<br /> &lt;/pre&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=Main_Page&diff=419 Main Page 2014-08-18T04:01:45Z <p>Bob: </p> <hr /> <div>__NOTOC__<br /> &lt;p style=&quot;font-weight:bold;font-size:3.5em;color:#3f5bb0;text-align:center;&quot;&gt;Computerisms Open Corporate Networking Model&lt;/p&gt;<br /> &lt;h2 style=&quot;margin:0; background:#3fbba0; font-size:120%; font-weight:bold; border:1px solid #3f5bb0; text-align:center; color:#000; padding:0.2em 0.4em;&quot;&gt;Introduction&lt;/h2&gt;<br /> <br /> &lt;p style=&quot;text-align:center; font-size:120%;&quot;&gt;&lt;b&gt;This site provides instructions to build an open source corporate/business network model using centralized Active Directory/LDAP Authentication.&lt;br&gt;It provides all the basic functionality of a Microsoft Exchange Server and more to a cross-platform environment.&lt;br&gt;key protocols and services supported include: IPSec/L2TP VPN, SSL secured web applications, VoIP, Cal/Card/WebDAV, IMAP, SMTP, Sieve, large file transfer, Job Tracking, Network Monitoring/Alerting, Backups, Domain Security, Digital Signage&lt;/b&gt;&lt;/p&gt;<br /> <br /> &lt;p style=&quot;text-align:center;font-size:2em;&quot;&gt;&lt;b&gt;[[What You Need to Know Before Using This Wiki]]&lt;/b&gt;&lt;/p&gt;<br /> <br /> {| style=&quot;vertical-align:top; width: 100%; border-spacing:15px;border-collapse:separate&quot;<br /> |-<br /> | style=&quot;vertical-align:top; width: 30%;&quot; |<br /> &lt;h2 style=&quot;margin:0; background:#3fbba0; font-size:120%; font-weight:bold; border:1px solid #3f5bb0; text-align:center; color:#000; padding:0.2em 0.4em;&quot;&gt;Order of Construction&lt;/h2&gt;<br /> <br /> #[[Organize Hardware]]<br /> #[[Set up Basic Firewall Functions]] - porchlian<br /> #[[Create a Certificate Authority]] - houselian<br /> #[[Install Daemontools]]<br /> #Run the [[User Creation Script]]<br /> #[[Install Samba Active Directory]]<br /> #[[Install Qmail-ldap, Dovecot, and Related Email Services]]<br /> #[[Install OpenUpload]]<br /> #[[Install Davical]]<br /> #[[Install RoundCube]]/Notes on groupware clients<br /> #[[Configure WebDAV]]<br /> #[[Install Request Tracker]]<br /> #[[Install Ledgersmb]]<br /> #[[Install MediaWiki]]<br /> #[[Install FreeRadius]]<br /> #[[Install OpenBroadcaster]] - No LDAP Auth<br /> #[[Install Asterisk]] - No LDAP Auth<br /> #[[Install Nagios]]<br /> #[[Install APCUPSD]]<br /> #[[Install DHCP and DNS]] - porchlian<br /> #[[Shape/Track Bandwidth - Finalize IPTables]]<br /> #[[Install LibreSWAN and Xl2tpd]]<br /> #[[Install Rsnapshot]] - shedlian<br /> <br /> ||<br /> {| style=&quot;width:100%&quot; border=&quot;0&quot;<br /> &lt;h2 style=&quot;margin:0; background:#3fbba0; font-size:120%; font-weight:bold; border:1px solid #3f5bb0; text-align:center; color:#000; padding:0.2em 0.4em;&quot;&gt;UID/GID Chart&lt;/h2&gt;<br /> &lt;center&gt;[[User Creation Script]]&lt;/center&gt;&lt;br&gt;<br /> {| style=&quot;width:100%&quot; border=&quot;1&quot;<br /> |+ System User UID<br /> !name!!UID!!GID||Additional Groups<br /> |-<br /> |qmail|| - ||500||<br /> |-<br /> |nofiles|| - ||501||<br /> |-<br /> |alias||502||501||<br /> |-<br /> |qmaild||503||501||<br /> |-<br /> |qmaill||504||501||<br /> |-<br /> |qmailp||505||501||<br /> |-<br /> |qmailq||506||500||<br /> |-<br /> |qmailr||507||500||<br /> |-<br /> |qmails||508||500||<br /> |-<br /> |vmail||509||509||<br /> |-<br /> |dovecot||510||510||<br /> |-<br /> |dovenull||511||511||<br /> |-<br /> |clamav||512||512||member of simscan group<br /> |-<br /> |simscan||513||513||<br /> |-<br /> |spamd||514||514||<br /> |-<br /> |razor||515|| - ||member of nogroup<br /> |-<br /> |asterisk||520||520||member of phnmngr group<br /> |-<br /> |phnmngr||521||521||<br /> |-<br /> |ups||522||522||<br /> |-<br /> |davical||530||530||<br /> |-<br /> |roundcube||531||531||<br /> |-<br /> |fetch||532||532||<br /> |-<br /> |rt||533||533||<br /> |-<br /> |ob||534||534||<br /> |-<br /> |wiki||535||535||<br /> |-<br /> |files||536||536||<br /> |-<br /> |ledger||537||537||<br /> |-<br /> |nagios||538||538||<br /> |-<br /> |pad||539||539<br /> |-<br /> |}<br /> <br /> |-<br /> |style=&quot;vertical-align:top; width: 30%;&quot; |<br /> &lt;h2 style=&quot;margin:0; background:#3fbba0; font-size:120%; font-weight:bold; border:1px solid #3f5bb0; text-align:center; color:#000; padding:0.2em 0.4em;&quot;&gt;Hosts/DNS A Records&lt;/h2&gt;<br /> {| style=&quot;width:100%&quot; border=&quot;1&quot;<br /> |+ DNS A Records<br /> !FQDN!!IP Address<br /> |-<br /> |colspan=&quot;2&quot; style=&quot;text-align: center&quot;| '''Physical Hosts'''<br /> |-<br /> |porchlian.computerisms.com||192.168.26.1<br /> |-<br /> |houselian.computerisms.com||192.168.26.10<br /> |-<br /> |shedlian.computerisms.com||192.168.26.11<br /> |-<br /> |colspan=&quot;2&quot; style=&quot;text-align: center&quot;| '''Network Services'''<br /> |-<br /> |pbx.computerisms.com||192.168.26.10<br /> |-<br /> |cal.computerisms.com||192.168.26.10<br /> |-<br /> |mail.computerisms.com||192.168.26.10<br /> |-<br /> |colspan=&quot;2&quot; style=&quot;text-align: center&quot;| '''Web Applications'''<br /> |-<br /> |listadmin.computerisms.com||192.168.26.10<br /> |-<br /> |listarchive.computerisms.com||192.168.26.10<br /> |-<br /> |webmail.computerisms.com||192.168.26.10<br /> |-<br /> |rt.computerisms.com||192.168.26.10<br /> |-<br /> |ledger.computerisms.com||192.168.26.10<br /> |-<br /> |help.computerisms.com||192.168.26.10<br /> |-<br /> |wiki.computerisms.com||192.168.26.10<br /> |-<br /> |media.computerisms.com||192.168.26.10<br /> |-<br /> |nagios.computerisms.com||192.168.26.10<br /> |-<br /> |colspan=&quot;2&quot; style=&quot;text-align: center&quot;| '''External to LAN'''<br /> |-<br /> |crl.computerisms.com||real.world.ip.address<br /> |-<br /> |}<br /> <br /> <br /> | style=&quot;vertical-align:top; width: 70%;&quot; |<br /> &lt;h2 style=&quot;margin:0; background:#3fbba0; font-size:120%; font-weight:bold; border:1px solid #3f5bb0; text-align:center; color:#000; padding:0.2em 0.4em;&quot;&gt;Volume Mounts&lt;/h2&gt;<br /> {| style=&quot;width:100%&quot; border=&quot;1&quot;<br /> |+ Volume Mounts<br /> !Data!!Path!!Drive Letter!!Notes<br /> |-<br /> |mail||/home/mail|| ||Personal Mail and Mailing Lists<br /> |-<br /> |peronsal files||/home/data/people||P:||(P:)ersonal Files - governed by user ownership<br /> |-<br /> |group files||/home/data/Departments||O:||(O:)rganization Files - governed by group ownership<br /> |-<br /> |WebDAV||/home/webDAV||W:||(W:)eb accessible file storage<br /> |}<br /> <br /> &lt;h2 style=&quot;margin:0; background:#3fbba0; font-size:120%; font-weight:bold; border:1px solid #3f5bb0; text-align:center; color:#000; padding:0.2em 0.4em;&quot;&gt;User Accounts/Passwords&lt;/h2&gt;<br /> {| style=&quot;width:100%&quot; border=&quot;1&quot;<br /> |+ User Accounts and Passwords<br /> !User!!Pass!!Notes<br /> |-<br /> |god||BobIssues||Local Computer Account - windows and linux<br /> |-<br /> |root||G0dIssues||root account on Linux boxes<br /> |-<br /> |Computerisms Certificate Authority||B0wB4Me!!||<br /> |-<br /> |Web/Mail Certificates||WeeMinion||<br /> |-<br /> |Host Certificates||ChiefMinion||<br /> |-<br /> |Administrator||The1TrueB0b||This account is the Network Administrator<br /> |-<br /> |authenticator||ThisDevilIkn0w||Used by 3rd party apps for authentication - avoid special characters<br /> |-<br /> |MySQL Root||Bobs(abacus)2||<br /> |-<br /> |Database User Accounts||DBMinion||all database user accounts for postgresql and mysql<br /> |-<br /> |Radius Secret||DeputyCherubJr||<br /> |-<br /> |OpenBroadcaster/PBX Admin||BobsMessenger||username is admin for both services<br /> |-<br /> |OpenBroadcaster Device||TheW0rd0fB0b||Password you will need to set up the digital signage computer<br /> |-<br /> |IPPhone Autoprovision||ConvertThem||this is the phnmngr username uid 521<br /> |-<br /> |NSS Database||B0bsGates||for Libreswan on porchlian<br /> |-<br /> |Personal Certificates||S0ns0fB0b||issued to end users for VPN<br /> |-<br /> |}<br /> <br /> |}<br /> |-<br /> |}</div> Bob http://cocnm.computerisms.ca/index.php?title=Shape/Track_Bandwidth_-_Finalize_IPTables&diff=418 Shape/Track Bandwidth - Finalize IPTables 2014-08-15T05:31:21Z <p>Bob: /* Install and Configure Bandwidth Accounting and Reporting */</p> <hr /> <div>==System Prep==<br /> *apt-get install tcng xtables-addons-source xtables-addons-common nbtscan linux-headers-$(uname -r) automake libtool libfile-tail-perl libtext-trim-perl libdatetime-format-mail-perl libnet-sslglue-perl<br /> *&lt;b&gt;Note: &lt;/b&gt;as of Apr2014, tcng must be installed from wheezy (update sources.list &amp;&amp; apt-get install tcng/wheezy)<br /> <br /> ==Configure Traffic Control==<br /> *vi [[/root/scripts/qos.tc]]<br /> *echo \#\!\/bin\/bash &gt; /root/scripts/qos.sh; tcng /root/scripts/qos.tc &gt;&gt; /root/scripts/qos.sh<br /> *vi [[/root/scripts/qos.reset.sh]]<br /> *bash /root/scripts/qos.reset.sh; bash /root/scripts/qos.sh<br /> <br /> ==Install and Configure Bandwidth Accounting and Reporting==<br /> *m-a a-i -t xtables-addons-source<br /> *echo xt_ACCOUNT &gt;&gt; /etc/modules<br /> *modprobe xt_ACCOUNT<br /> *depmod -a<br /> *vi [[/root/scripts/bwrpt.pl]]<br /> *crontab -e<br /> **9-59/10 * * * * PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; /usr/bin/perl /root/scripts/bwrpt.pl &lt;b&gt;&lt;= Note: on large networks this can take a few minutes to run, and it needs to complete it's data collection before 00:00, so you may need to set it to start at 58 or 57&lt;/b&gt;<br /> <br /> ==Finalize IPTables Configuration==<br /> *vi [[/root/scripts/iptables-restore#Completed|/root/scripts/iptables-restore]]<br /> *iptables-restore &lt; /root/scripts/iptables-restore<br /> *iptaccount -a &lt;b&gt;&lt;= Make sure these three lines show up:&lt;/b&gt;&lt;br&gt;Found table: wan&lt;br&gt;Found table: computerisms&lt;br&gt;Found table: pubaccess<br /> *From worklian:<br /> **telnet 192.168.25.15 25 &lt;b&gt;&lt;= Make sure you can telnet to ports 25, 80, 443, 587, 993, 995&lt;/b&gt;</div> Bob http://cocnm.computerisms.ca/index.php?title=/var/service/apcupsd/run&diff=417 /var/service/apcupsd/run 2014-07-28T02:17:36Z <p>Bob: Created page with &quot;&lt;pre&gt; #!/bin/bash exec apcupsd -b 2&amp;&gt;1 &lt;/pre&gt;&quot;</p> <hr /> <div>&lt;pre&gt;<br /> #!/bin/bash<br /> exec apcupsd -b 2&amp;&gt;1<br /> &lt;/pre&gt;</div> Bob