Francis's questions

I unlock my drive with clevis/tang on an Ubuntu server (NBDE). It works fine, but even if my server is configured to use a static ip in /etc/netplan/01-netcfg.yaml, my network interface also listen on two dhcp ip attributed on the boot process. How to drop it after boot is completed?

I enabled clevis with the following commands:

sudo apt install clevis clevis-systemd clevis-initramfs clevis-luks
sudo clevis luks bind -d /dev/sda3 sss '{"t": 1, "pins": {"tang": [{"url": "http://10.1.1.1:8888"},{"url": "http://10.2.2.2:8888"}]}}' 
sudo update-initramfs -u -k 'all'

After rebooting my server, the network interface got 3 ips! My static ip configured in /etc/netplan and two dhcp ips. One of the dhcp ip is used by the clevis process (I see a trace on my tang server). The other seem to be assigned after the clevis process is completed.

I was able to make clevis to drop the dhcp ip it use. I noticed that the script at /usr/share/initramfs-tools/scripts/local-bottom/clevis was different than the one in the clevis git repository. I added the line iface=$(basename "$iface") after if [ -e "$iface" ]; then.

But I'm still stuck with one useless dhcp ip on my interface. When I do a netplan apply, systemd-networkd even refresh the dhcp lease as you can the in the following log extract:

Oct 22 12:04:56 testserver systemd[1]: Reloading.
Oct 22 12:04:56 testserver systemd[1]: /lib/systemd/system/dbus.socket:5: ListenStream= references a path below legacy directory /var/run/, updating /var/run/dbus/system_bus_socket → /run/dbus/system_bus_socket; please update the unit file accordingly.
Oct 22 12:04:56 testserver systemd[1]: systemd-networkd-wait-online.service: Succeeded.
Oct 22 12:04:56 testserver systemd[1]: Stopped Wait for Network to be Configured.
Oct 22 12:04:56 testserver systemd[1]: Stopping Network Service...
Oct 22 12:04:57 testserver systemd[1]: systemd-networkd.service: Succeeded.
Oct 22 12:04:57 testserver systemd[1]: Stopped Network Service.
Oct 22 12:04:57 testserver systemd[1]: Condition check resulted in OpenVSwitch configuration for cleanup being skipped.
Oct 22 12:04:57 testserver systemd[1]: Starting Network Service...
Oct 22 12:04:57 testserver systemd[1]: Condition check resulted in OpenVSwitch configuration for cleanup being skipped.
Oct 22 12:04:57 testserver systemd-networkd[1711]: eno3: Gained IPv6LL
Oct 22 12:04:57 testserver systemd-networkd[1711]: Enumeration completed
Oct 22 12:04:57 testserver systemd[1]: Started Network Service.
Oct 22 12:04:57 testserver systemd-networkd[1711]: eno3: IPv6 successfully enabled
Oct 22 12:04:57 testserver systemd-networkd[1711]: eno3: DHCPv4 address 10.1.1.71/21 via 10.1.0.1

But I don't use dhcp at all in my netplan configuration!

# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
  version: 2
  #renderer: networkd
  ethernets:
    eno3:
      dhcp4: no
      addresses:
      - 10.1.0.99/21
      gateway4: 10.1.0.1
      nameservers:
        addresses:
        - 10.1.0.3
        - 10.1.0.33

When I launch netplan --debug apply, I see that dhcp4 become enabled when the config is merged!? But merged with what? Can be from /run/netplan/eno3.yaml? In that file, I see a dynamic network configuration with dhcp enabled. What does generate that file?

My OpenVPN server is unable to execute a python script configured as --learn-address when the daemon is launched as a systemd service. It works fine when launched manually as root. I found that it also work as a systemd service if I comment the following line in /etc/systemd/system/[email protected]:

CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE

So, I guess my problem is related to a missing Capability. How can I debug that to find out what's missing? OpenVPN log just say WARNING: Failed running command (--learn-address): external program exited with error status: 1. I find nothing related to this in the syslog either.

The learn-address script is used to apply custom firewall rules based on who is connecting. The script does group membership lookups (using /usr/bin/id command) and add rules/chain with the iptable command (with sudo). After further debugging, I think it may fails when trying to call iptables. The command exits with code 3.

It already worked for a while, I wonder if it doesn't stopped to work after a system update.

I'm trying to migrate IMAP mails from dovecot 1.1.20apple0.5 (osx) to dovecot 2.2.33.2 (ubuntu). I'm using "doveadm backup" to migrate my data. It works fine for all subfolders, but the root INBOX stay empty on the new server. I suspect a problem related with hierarchy separator ("." on previous server, "/" on new) or with the namespace prefix (set to "INBOX/" on new server). Any hint?

show there is no messages in INBOX:

# doveadm mailbox status -u (myuser) all INBOX
INBOX messages=0 recent=0 uidnext=1 uidvalidity=1553630060 unseen=0 highestmodseq=1 vsize=0 guid=d54cd42849739b5cb5790000ed87e144 firstsaved=18446744073709551615

show there is messages in subdirectory:

# doveadm mailbox status -u (myuser) all INBOX/Sent
INBOX/Sent messages=253 recent=0 uidnext=8721 uidvalidity=1263328366 unseen=0 highestmodseq=256 vsize=16335358 guid=bfb2e03fdce327671e82bf173b1ccb8b firstsaved=1553634631

The command I'm runnning on the new server to migrate data:

# doveadm -o mail_fsync=never backup -R -u (myuser) imapc:

My config on the new server:

# doveadm -n
# 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.21 (92477967)
# OS: Linux 4.15.0-46-generic x86_64 Ubuntu 18.04.2 LTS 
auth_default_realm = example.com
doveadm_password =  # hidden, use -P to show it
doveadm_port = 53683
first_valid_uid = 200
imapc_features = rfc822.size fetch-headers
imapc_host = oldmail.example.com
imapc_master_user = (removed)
imapc_password =  # hidden, use -P to show it
imapc_user = %n
last_valid_uid = 200
mail_location = mbox:~/mail:INBOX=/var/mail/%u
mail_plugins = " notify replication zlib quota"
mail_prefetch_count = 20
mail_privileged_group = mail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext
mdbox_rotate_size = 10 M
namespace inbox {
  inbox = yes
  location = 
  mailbox "Éléments envoyés" {
    special_use = \Sent
  }
  mailbox "Éléments supprimés" {
    special_use = \Trash
  }
  mailbox Brouillon {
    special_use = \Drafts
  }
  mailbox "Courrier indésirable" {
    special_use = \Junk
  }
  mailbox Drafts {
    auto = subscribe
    special_use = \Drafts
  }
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  }
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  }
  prefix = INBOX/
  separator = /
}
passdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
}
plugin {
  mail_replica = tcps:mail2.example.com:53683
  quota = count:User quota
  quota_grace = 10%%
  quota_rule = *:storage=10G
  quota_rule2 = INBOX/Trash:storage=+100M
  quota_vsizes = yes
  quota_warning = storage=100%% quota-warning 100 %u
  quota_warning2 = storage=95%% quota-warning 95 %u
  quota_warning3 = storage=90%% quota-warning 90 %u
  quota_warning4 = storage=85%% quota-warning 85 %u
  quota_warning5 = storage=75%% quota-warning 75 %u
  quota_warning6 = -storage=80%% quota-warning '-80' %u
  quota_warning7 = -storage=100%% quota-warning '-100' %u
  sieve = /var/vmail/domains/%Ld/%Ln/.dovecot.sieve
  sieve_before = /var/vmail/sieve/before.sieve
  sieve_default = /var/vmail/sieve/default.sieve
  sieve_global = /var/vmail/sieve/global
  zlib_save = lz4
}
protocols = " imap lmtp sieve"
service aggregator {
  fifo_listener replication-notify-fifo {
    user = vmail
  }
  unix_listener replication-notify {
    user = vmail
  }
}
service auth {
  inet_listener {
    address = (removed)
    port = 55123
  }
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
  }
}
service doveadm {
  inet_listener {
    port = 53683
    ssl = yes
  }
}
service imap-login {
  inet_listener imap {
    port = 0
  }
  process_min_avail = 10
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0660
    user = postfix
  }
}
service quota-warning {
  executable = script /usr/local/bin/quota-warning.sh
  unix_listener quota-warning {
    user = vmail
  }
}
service replicator {
  process_min_avail = 1
  unix_listener replicator-doveadm {
    mode = 0600
    user = vmail
  }
}
ssl = required
ssl_cert = </etc/ssl/example/example.com.crtbundle
ssl_client_ca_dir = /etc/ssl/certs
ssl_key =  # hidden, use -P to show it
userdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
}
verbose_proctitle = yes
protocol lmtp {
  mail_plugins = " notify replication zlib quota sieve"
  postmaster_address = [email protected]
}
protocol imap {
  mail_plugins = " notify replication zlib quota imap_zlib imap_quota"
}

Config LDAP

# cat /etc/dovecot/dovecot-ldap.conf.ext | grep -v "^#" | grep -v "^$"
uris = ldaps://dc1.ad.example.com ldaps://dc2.ad.example.com
dn = (removed)
dnpass = (removed)
auth_bind = yes
base = (removed)
scope = subtree
deref = never
user_filter = (&(mail=%u)(memberOf:1.2.840.113556.1.4.1941:=CN=acces_courriels,(removed))(&(|(objectclass=person))(!(UserAccountControl:1.2.840.113556.1.4.803:=2))))
pass_filter = (&(mail=%u)(memberOf:1.2.840.113556.1.4.1941:=CN=acces_courriels,(removed))(&(|(objectclass=person))(!(UserAccountControl:1.2.840.113556.1.4.803:=2))))
iterate_filter = (&(mail=*)(memberOf:1.2.840.113556.1.4.1941:=CN=acces_courriels,(removed))(&(|(objectclass=person))(!(UserAccountControl:1.2.840.113556.1.4.803:=2))))
iterate_attrs = mail=user
user_attrs = \
  =quota_rule=*:storage=%{ldap:division:10G}, \
  =home=/var/vmail/domains/%Ld/%Ln, \
  =mail=mdbox:/var/vmail/domains/%Ld/%Ln/mdbox, \
  =uid=200, \
  =gid=200

TL;DR: I'm trying to force postfix to route mail sent from local user to another local user to be routed to another server (relayhost). This should not apply to incoming mail from external to local.

I'm planning a mail server stack migration (new imap and new smtp on new hardware). For a limited time, some users will be routed to the current server while others will me gradually migrated to the new mail server.

The current server will be the one that does all the routing (also the one registered in DNS as MX). When an incoming mail is coming, the mail will be forwarded or not on the new server based on the recipient mail address. This is working fine.

I'm having problem with local outgoing email routing (migrated colleague trying to send mail to non-migrated colleague). If I do nothing, a migrated colleague sending an email to a non-migrated user would seen his mail to the future inbox of non-migrated user. So the non-migrated user would not receive this mail until I migrated him.

I would like new Postfix to route outgoing emails to relayhost even if the mail is "local". The relayhost is the server listed in DNS as MX, so the routing would be the same as the one I use for incoming mail.

I played with the transport_maps, but this cause incoming mail to loop between the old and the new server. This is because transport_maps apply for all emails (including incoming from external), not just the one local user send. The routing should only apply to outgoing mail from local users, not for all mail.

main.cf:

transport_maps = hash:/etc/postfix/transport

transport:

domain.tld          smtp:[old-smtp.domain.tld]

I'm trying to configure quotas. I want to set a default quota (say 10GB) and allow +100MB for the trash. I also need to be able to set a custom quota for an user. My users come from LDAP/AD.

I'm able to set the default quota and defining a custom one for an user. This work great.

Now, I'm trying to allow 100MB more for the trash.

To test that, I sent a couples emails to my test account and defined a low quota (10MB) for this account. I made my quota over 140%. I then moved all my mails to the trash folder.

I'm still over quota because I didn't emptied the trash, but because I have a quota_rule2 that say allow 100MB more for the trash, I expect to be able to still receive mail for this account.

When the account receive a new mail, it bounces because the account is over quota, but it shouldn't because all mails are in the trash and all the others folders are empty.

# doveconf -n
# 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.21 (92477967)
# OS: Linux 4.15.0-43-generic x86_64 Ubuntu 18.04.1 LTS 
auth_default_realm = example.com
doveadm_password =  # hidden, use -P to show it
doveadm_port = 53683
first_valid_uid = 200
last_valid_uid = 200
mail_attachment_dir = /var/vmail/attachments
mail_attachment_hash = %{sha1}.%{size}
mail_location = mbox:~/mail:INBOX=/var/mail/%u
mail_plugins = " notify replication zlib quota"
mail_privileged_group = mail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext
mdbox_rotate_interval = 1 days
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix = 
}
passdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
}
plugin {
  mail_replica = tcp:mail2.example.com:53683
  quota = count:User quota
  quota_grace = 10%%
  quota_rule = *:storage=10G
  quota_rule2 = Trash:storage=+100M
  quota_vsizes = yes
  quota_warning = storage=95%% quota-warning 95 %u
  quota_warning2 = storage=80%% quota-warning 80 %u
  sieve = /var/vmail/%d/%n/.dovecot.sieve
  sieve_before = /var/vmail/sieve/before.sieve
  sieve_default = /var/vmail/sieve/default.sieve
  sieve_global = /var/vmail/sieve/global
  zlib_save = lz4
}
protocols = " imap lmtp sieve"
service aggregator {
  fifo_listener replication-notify-fifo {
    user = vmail
  }
  unix_listener replication-notify {
    user = vmail
  }
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
  }
}
service doveadm {
  inet_listener {
    port = 53683
    ssl = no
  }
}
service imap-login {
  inet_listener imap {
    port = 0
  }
  process_min_avail = 10
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0660
    user = postfix
  }
}
service quota-warning {
  executable = script /usr/local/bin/quota-warning.sh
  unix_listener quota-warning {
    user = vmail
  }
  user = dovecot
}
service replicator {
  process_min_avail = 1
}
ssl = required
ssl_cert = </etc/ssl/example.com.crtbundle
ssl_client_ca_dir = /etc/ssl/certs
ssl_key =  # hidden, use -P to show it
userdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
}
protocol lda {
  mail_plugins = " notify replication zlib quota sieve"
  postmaster_address = [email protected]
}
protocol imap {
  mail_plugins = " notify replication zlib quota imap_quota"
}
protocol lmtp {
  mail_plugins = " notify replication zlib quota sieve"
  postmaster_address = [email protected]

}

# cat dovecot-ldap.conf.ext
uris = (redacted)
dn = (redacted)
dnpass = (redacted)
auth_bind = yes
base = (redacted)
scope = subtree
deref = never
user_filter = (&(mail=%u)(&(|(objectclass=person))(!(UserAccountControl:1.2.840.113556.1.4.803:=2))))
pass_filter = (&(mail=%u)(&(|(objectclass=person))(!(UserAccountControl:1.2.840.113556.1.4.803:=2))))
iterate_attrs = mail=user # Used primarily by "doveadm" needed to users
iterate_filter = (objectclass=person)
user_attrs = \
  =quota_rule=*:storage=%{ldap:division:10G}, \
  =quota_rule2=Trash:storage=+100M, \
  =home=/var/vmail/%d/%{ldap:sAMAccountName}, \
  =mail=mdbox:/var/vmail/%d/%{ldap:sAMAccountName}/mdbox, \
  =uid=200, \
  =gid=200

Users are sharing their password. As you know, this is bad! The big reason why they do that is to allow a colleague to access theirs files when they are away. Yes, they can plan this in advance, but this is not always doable.

I'm looking to find a way I could give access to theses files to a team leader with no need of password sharing and no need to ask IT to reset user's password. All files are locally stored. User's directory are not stored on network share.

I tried to create a GPO to add a read access permission to the team leader on C:\Users, but the permission doesn't propagate to the user's directory.

I'm more a Linux admin than a Windows one. In the Linux world, I would just use sudo, but I don't think something like that exist for Windows.

Do you see another way to achieve what I'm trying to do?

I'm currently porting my Ansible playbooks from version 2.1 to 2.7. Ansible now prints a warning if I use jinja templating delmiters such as {{ .. }} in a when clause.

[WARNING]: when statements should not include jinja2 templating delimiters such as {{ }} or {% %}

I had no problems to change it on simple conditionals statements, but I wonder how to fix this one:

- shell: pg_lsclusters -h | awk '{print $2 " " $6}'
  register: postgresql_lsclusters
  changed_when: false
  check_mode: no

- fail: 
    msg="test"
  when: postgresql_lsclusters.stdout.find("{{ postgresql_cluster }} {{ postgresql_data_dir }}/{{ postgresql_version }}/{{ postgresql_cluster }}") == -1

I tried to replace the when statement with the following, without success:

when: postgresql_lsclusters.stdout.find(postgresql_cluster ~ ' ' ~ postgresql_data_dir ~ '/' ~ postgresql_version ~ '/' ~ postgresql_cluster") == -1`

I configured my openvpn server to authenticate clients with user/pass (ldap) and OTP/2FA (google authenticator). It works fine!

I have osx clients that use Tunnelblick as openvpn client and it doesn't support OTP/2FA. So I would need to use TLS private/public key authentication for them.

Can I make a single openvpn instance to authenticate users with TLS when the client send a certificate and with user/pass+OTP when the client doesn't send certificate?

Plan B is to setup two instances but if possible I would like to avoid that.

I'm currently implementing Software Restriction Policy rules. While I was doing that, I noticed that I couldn't do a right click on directories in the Windows file explorer and selecting "Properties". I don't get the properties windows. Windows just does nothing. I found that this bug reproduced on my two computers that were configured with this GPO. I don't know if this problem hide something more disturbing.

I disabled the GPO that implement SRP. The bug stopped to occurs. This confirmed that was something from my SRP policy that cause this problem.

I created my policy from scratch again, step by step to find what rule caused the issue. After many gpupdate and reboots, I found that the problem was caused by a single hash rule.

This is the rule in question:

The default policy is to deny everything and allow only whitelisted entries (paths and hashes). The hashed DLL come with CrashPlan PROe. Crashplan put this DLL in %APPDATA%\Local\Temp\.cpswt. You can find the DLL here.

I have others hash rules that are not causing any issues.

Is there any known bugs about hash rules that interact with Windows File Explorer? Any way to avoid that?

I'm implementing Software Restriction Policy on our workstations. The policy is to block everything except a list of white listed paths.

I'm trying to white list a directory inside Thunderbird user's profile to allow Lightning extension to work. The path is %APPDATA%\Roaming\Thunderbird\Profiles\*\extensions\{e2fda1a4-762b-4020-b5ad-a41df1933103}\components\calbasecomps.dll.

The user's profile name is randomly generated, so I need a wildcard.

Unfortunately, this doesn't seem to work because of the wildcard. The DLL continues to be blocked by SRP.

I also tried to white list the certificate (the DLL is signed by Mozilla certificate), but this doesn't work. Maybe this apply only to signed .exe?

I white listed the hash for the moment, but this will require maintenance after each release of Thunderbird, so I would prefer to white list the path instead.

Applocker is not an option, we are using Windows 10 Pro.

Any idea?

I'm still using Dovecot v1 (1.1.20) on an osx server. I'm trying to disable SSLv2. Seem like the default config already disabled it:

ssl_cipher_list = ALL:!LOW:!SSLv2:!aNULL:!ADH:!eNULL

But when I test my web server with ssllabs, it complaints my mail server (pop, imap) is vulnerable because of the use of SSLv2 (same key). I also tried:

ssl_cipher_list = ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:!RC4+RSA:+HIGH:+MEDIUM:!SSLv2

With no more success.

I know, this server need major software update.

I'm trying to add users to my servers using Ansible. Each user have a different encrypted password.

I have something like that:

vars:
  users:
    - myuser1
    - myuser2
  password: encryptedpasswordhere

tasks:
  - name: Creating users
    user: name={{ item }} password={{ password }} groups=sudo,adm shell=/bin/bash
    with_items: users

This work great, but all users have the same password.

I'm looking to make an associative array. In PHP I would do that:

$users = array('user'=>'myuser1', 'password'=>'encryptedpass1',
               'user'=>'myuser2', 'password'=>'encryptedpass2',
               );

There is a way to do that in an Ansible playbook?

I'm trying to add a scheduled task to start every day at a fixed hour even if the computer is in sleep mode. In the Windows Scheduled Tasks Manager UI, there is a check-box labeled "Wake the computer to run this task".

How can I set this option with schtasks in cli?

The OS is Windows XP Pro.

My command right now is: schtasks /create /tn "asdf" /tr asdf.cmd /sc DAILY /st 23:00:00 /ru System

I have created a script I want to deploy on my XP workstations as a shutdown script. I know I can add my script as a shutdown script with the UI (gpedit.msc), but I want to automate the deployment of my script. My workstations are not part of a Windows domain. I will deploy with OCS Inventory.

I tried to add entries to the Windows registry, but this doesn't work. I don't see what I added when I run gpedit.msc. If I add something with gpedit.msc, this seem to overwrite what I added manually into the registry.

I presently use "md5" authentication for access from the lan:

host all all 192.168.1.0/24 md5

I want to add ldap authentication method, so I added this line before:

host all all 192.168.1.0/24 ldap "ldap://192.168.1.2/basedn;uid=;,cn=xx,dc=yy,dc=zz,dc=ca"

This work great with ldap accounts, but if I try to login with an account not present on the LDAP server, the login fails (postgresql doesn't try the md5 authentication).

There is a way to support more than one authentication method with postgresql?