Chloe's questions

When I test Apache while logged in to the machine, it works

[root@mydomain conf]# telnet mydomain.org 80
Trying ::1...
Connected to mydomain.org.
Escape character is '^]'.
get /
HTTP/1.1 400 Bad Request

But when I try to connect from another computer, it fails

$ telnet 99.99.99.99 80
Trying 99.99.99.99...
telnet: Unable to connect to remote host: Connection timed out

I'm sure the IP is correct because I can log in via SSH and the nslookup works.

I turned on ping requests with http://superuser.com/questions/1114065/ddg#1114151 and I can't ping the server either.

$ ping mydomain.org

Pinging mydomain.org [99.99.99.99] with 32 bytes of data:
Request timed out.
Request timed out.

[root@mydomain conf]# ping mydomain.org
PING mydomain (127.0.0.1) 56(84) bytes of data.
64 bytes from mydomain (127.0.0.1): icmp_seq=1 ttl=64 time=0.050 ms

I don't have a firewall set up with the VPS provider. I do have fail2ban for ssh only. My IP is not in the DENY list.

I don't bind to any specific IP in httpd.conf

Listen 80

My instance was running for years and suddenly stopped responding Jun 1st. I tried to reboot it, but it would not boot. It gave errors in the system log: https://pastebin.com/rSxr1kLs

Linux version 2.6.32-642.11.1.el6.x86_64 ([email protected]) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC) ) #1 SMP Fri Nov 18 19:25:05 UTC 2016
Kernel command line: root=/dev/xvde ro LANG=en_US.UTF-8 KEYTABLE=us
VFS: Cannot open root device "xvde" or unknown-block(0,0)
Please append a correct "root=" boot option; here are the available partitions:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

I tried to detach the EBS volume and re-attach it as /dev/sda1 according to the documentation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstances.html#FilesystemKernel

However, it gave an error Error attaching volume: Invalid value '/dev/sda1' for unixDevice. Attachment point /dev/sda1 is already in use and I was unable to attach it. I re-attached it as /dev/sda but it still won't boot and it still gives the error in the system log.

I was able to launch a new instance into the exact same availability zone and attached my EBS volume as /dev/sdf. It shows up inside the instance as /dev/xvdj. I mounted it with mount /dev/xvdj /xvdj. I can see the grub.conf file:

[root@ip-172-31-4-249 grub]# cat /xvdj/boot/grub/grub.conf
default=0
timeout=1

title CentOS (2.6.32-642.11.1.el6.x86_64)
        root (hd0)
        kernel /boot/vmlinuz-2.6.32-642.11.1.el6.x86_64 root=/dev/xvde ro crashkernel=auto LANG=en_US.UTF-8 KEYTABLE=us
title CentOS (2.6.32-504.30.3.el6.x86_64)
        root (hd0)
        kernel /boot/vmlinuz-2.6.32-504.30.3.el6.x86_64 root=/dev/xvde ro crashkernel=auto LANG=en_US.UTF-8 KEYTABLE=us
        initrd /boot/initramfs-2.6.32-504.30.3.el6.x86_64.img
title CentOS (2.6.32-504.3.3.el6.x86_64)
        root (hd0)
        kernel /boot/vmlinuz-2.6.32-504.3.3.el6.x86_64 root=/dev/xvde ro crashkernel=auto LANG=en_US.UTF-8 KEYTABLE=us
        initrd /boot/initramfs-2.6.32-504.3.3.el6.x86_64.img
title CentOS (2.6.32-504.el6.x86_64)
        root (hd0)
        kernel /boot/vmlinuz-2.6.32-504.el6.x86_64 root=/dev/xvde ro crashkernel=auto LANG=en_US.UTF-8 KEYTABLE=us
        initrd /boot/initramfs-2.6.32-504.el6.x86_64.img
title CentOS (2.6.32-431.29.2.el6.x86_64)
        root (hd0)
        kernel /boot/vmlinuz-2.6.32-431.29.2.el6.x86_64 root=/dev/xvde ro crashkernel=auto LANG=en_US.UTF-8 KEYTABLE=us
        initrd /boot/initramfs-2.6.32-431.29.2.el6.x86_64.img
title CentOS (2.6.32-431.23.3.el6.x86_64)
        root (hd0)
        kernel /boot/vmlinuz-2.6.32-431.23.3.el6.x86_64 root=/dev/xvde ro crashkernel=auto LANG=en_US.UTF-8 KEYTABLE=us
        initrd /boot/initramfs-2.6.32-431.23.3.el6.x86_64.img

This compares to the grub.conf of the running instance:

[root@ip-172-31-4-249 grub]# cat /boot/grub/grub.conf
default=0
timeout=1

title CentOS-6-x86_64-20130527-03 2.6.32-358.6.2.el6.x86_64
        root (hd0)
        kernel /boot/vmlinuz-2.6.32-358.6.2.el6.x86_64 root=/dev/xvde ro
        initrd /boot/initramfs-2.6.32-358.6.2.el6.x86_64.img

Does it matter that it doesn't have initrd line in the first option?

I tried to mount the EBS volume to the new instance with /dev/sda, but it still wouldn't boot with the same error Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0).

CentOS 6

If I use service stop postgrey, then I get errors in my maillog

Mar 17 18:49:10 ip-172-31-15-65 postfix/smtpd[23543]: warning: problem talking to server postgrey/socket: No such file or directory
Mar 17 18:49:10 ip-172-31-15-65 postfix/smtpd[23543]: NOQUEUE: reject: RCPT from unknown[192.163.199.86]: 451 4.3.5 Server configuration problem; from=<[email protected]> to=<> proto=ESMTP helo=<mail.goforgummies.com>

How do I pause postgrey to accept everything temporarily? I'm getting emails from AmazonSES which are violating RFC (I believe) by using random from addresses and random servers.

[root@kizbit ~]# cat /var/log/maillog | postgreyreport | awk '{print $3}' | sort | uniq -c | sort -nr | grep amazon | head -n20
     12 0100015ad3a1bd19-3a06e9aa-d72c-4c2d-af61-0aa8f8172e9c-#@amazonses.com
     10 0100015ad7e29a84-f4bb8c77-ff56-476c-aefd-c07989ea672f-#@amazonses.com
      7 0100015acfbd9001-5216a5fc-ffd8-4c42-9d22-5f66b8462154-#@amazonses.com

postgrey 1.34

I have a cron set up to update certbot. It mails a deprecation warning every day. How do I stop the deprecation warning?

Cron <root@ip-99-99-99-99> /root/certbot-auto renew --quiet

/root/.local/share/letsencrypt/lib/python2.6/site-packages/cryptography/__init__.py:26: DeprecationWarning: Python 2.6 is no longer supported by the Python core team, please upgrade your Python. A future version of cryptography will drop support for Python 2.6
  DeprecationWarning

I tried to file a bug report, but they closed it. https://github.com/certbot/certbot/issues/3984

I tried to install Python2.7 but I can't get certbot to run with Python2.7.

[root@kizbit ~]# scl enable python27 "python --version"
Python 2.7.8

[root@kizbit ~]# scl enable python27 "/root/certbot-auto renew"
/root/.local/share/letsencrypt/lib/python2.6/site-packages/cryptography/__init__.py:26: DeprecationWarning: Python 2.6 is no longer supported by the Python core team, please upgrade your Python. A future version of cryptography will drop support for Python 2.6
  DeprecationWarning

It still uses Python 2.6 and still produces a warning. I also tried:

[root@kizbit ~]# scl enable python27 "python /root/certbot-auto renew"
  File "/root/certbot-auto", line 18
    if [ -z "$XDG_DATA_HOME" ]; then
                           ^
SyntaxError: invalid syntax

WITH 2.6 IT WORKS BUT GIVES DEPRECATION:

[root@kizbit ~]# /root/certbot-auto renew
/root/.local/share/letsencrypt/lib/python2.6/site-packages/cryptography/__init__.py:26: DeprecationWarning: Python 2.6 is no longer supported by the Python core team, please upgrade your Python. A future version of cryptography will drop support for Python 2.6
  DeprecationWarning

Centos 6.8, certbot 0.12.0

# cpan install GD
...
GD-2.56/lib/GD/Polyline.pm
CPAN: YAML loaded ok (v0.90)
CPAN: CPAN::Meta::Requirements loaded ok (v2.131)
CPAN: Parse::CPAN::Meta loaded ok (v1.4414)
CPAN: CPAN::Meta loaded ok (v2.143240)
CPAN: Module::CoreList loaded ok (v3.09)
CPAN: Module::Build loaded ok (v0.4205)
Configuring L/LD/LDS/GD-2.56.tar.gz with Build.PL
Configuring for libgd version 2.0.34.
Checking for stray libgd header files...none found.

Unknown option: installdirs
Usage: perl Build.PL [options]

Configure GD module.

 Options:
     -options       "JPEG,FT,PNG,GIF,XPM,ANIMGIF"   feature options, separated by commas
     -lib_gd_path   path            path to libgd
     -lib_ft_path   path            path to Freetype library
     -lib_png_path  path            path to libpng
     -lib_jpeg_path path            path to libjpeg
     -lib_xpm_path  path            path to libxpm
     -lib_zlib_path path            path to libpng
     -ignore_missing_gd             Ignore missing or old libgd installations and try to compile anyway

If no options are passed on the command line.  The program will
attempt to autoconfigure itself with the gdlib-config program (present
in GD versions 2.0.27 or later).  Otherwise it will prompt for these
values interactively.
Warning: No success on command[/usr/bin/perl Build.PL --installdirs site]
  LDS/GD-2.56.tar.gz
  /usr/bin/perl Build.PL --installdirs site -- NOT OK

CentOS 6.8, Perl 5.10.1

I tried but it gave an error.

# ls -l opendkim.pp
-rw-r--r--. 1 root root 1569 Jan  8 01:20 opendkim.pp

# ls -l /etc/selinux/targeted/modules/active/modules/opendkim.pp
-rw-r--r--. 1 root root 344 Jan  8 01:33 /etc/selinux/targeted/modules/active/modules/opendkim.pp

# semodule -r opendkim.pp
SELinux:  Could not load policy file /etc/selinux/targeted/policy/policy.24:  Invalid argument
/sbin/load_policy:  Can't load policy:  Invalid argument
libsemanage.semanage_reload_policy: load_policy returned error code 2.
SELinux:  Could not load policy file /etc/selinux/targeted/policy/policy.24:  Invalid argument
/sbin/load_policy:  Can't load policy:  Invalid argument
libsemanage.semanage_reload_policy: load_policy returned error code 2.
semodule:  Failed!

# ls -lZ /etc/selinux/targeted/policy/policy.24
-rw-r--r--. root root unconfined_u:object_r:semanage_store_t:s0 /etc/selinux/targeted/policy/policy.24

And why does it take 5m+ to fail?

CentOS release 6.8 (Final)

I'm trying to follow this tutorial

https://www.rosehosting.com/blog/how-to-install-and-integrate-spamassassin-with-postfix-on-a-centos-6-vps/

But Spamassassin is giving an error

[root@ip-172-99-99-99 ~]# service spamassassin restart
Stopping spamd:                                            [  OK  ]
Starting spamd: Jan  4 21:17:10.569 [22463] warn: logger: failed to open file /usr/local/spamassassin/spamfilter.log: Permission denied
Jan  4 21:17:10.587 [22463] warn: logger: failed to add file method: logger: file initialization failed
                                                           [  OK  ]

Even though it has permissions!

[root@ip-172-99-99-99 ~]# ls -ld /usr/local/spamassassin /usr/local/spamassassin/*
drwx------. 2 spam spam 4096 Jan  3 20:02 /usr/local/spamassassin
-rw-r--r--. 1 spam spam    0 Jan  3 20:02 /usr/local/spamassassin/spamfilter.log


# sudo -u spam ls /usr/local/spamassassin/spamfilter.log
/usr/local/spamassassin/spamfilter.log
# sudo -u spam touch /usr/local/spamassassin/spamfilter.log

Here is sysconfig file

[root@ip-172-99-99-99 ~]# cat /etc/sysconfig/spamassassin
# Options to spamd
SAHOME=/usr/local/spamassassin
SPID_DIR=/var/run/spamassassin
SUSER=spam
SPAMDOPTIONS="-d -c -m5 --username ${SUSER} -H ${SAHOME} -s ${SAHOME}/spamfilter.log"

I have SELinux enabled.

# sestatus
SELinux status:                 enabled

# ls -Z /usr/local/spamassassin/
-rw-r--r--. spam spam unconfined_u:object_r:usr_t:s0   spamfilter.log

I tried to change the context of the directory, but it failed, even though I'm root.

# grep spamd_t /var/log/audit/audit.log
type=AVC msg=audit(1483587389.449:354941): avc:  denied  { append } for  pid=31588 comm="spamd" name="spamfilter.log" dev=xvde ino=24109 scontext=unconfined_u:system_r:spamd_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file
type=SYSCALL msg=audit(1483587389.449:354941): arch=c000003e syscall=2 success=no exit=-13 a0=3463960 a1=441 a2=1b6 a3=7ff745c00d50 items=0 ppid=31587 pid=31588 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=4038 comm="spamd" exe="/usr/bin/perl" subj=unconfined_u:system_r:spamd_t:s0 key=(null)

# chcon -v --type=spamd_t /usr/local/spamassassin
changing security context of `/usr/local/spamassassin'
chcon: failed to change context of `/usr/local/spamassassin' to `system_u:object_r:spamd_t:s0': Permission denied
# sudo chcon -v --type=spamd_t /usr/local/spamassassin
changing security context of `/usr/local/spamassassin'
chcon: failed to change context of `/usr/local/spamassassin' to `system_u:object_r:spamd_t:s0': Permission denied

CentOS release 6.8 (Final)

I have a master.cf file located here: http://pastebin.com/8rwN69X7

I have a feeling that I do not need both smtp and smtps. I also think I can delete the #465 line. I don't think I need the submission lines either as they seem to be duplicates of stuff in main.cf, but I'm not sure and don't know what they do. I also wanted to make sure there is no backscatter from spam checks.

Why does this online tool fail the SPF check

http://www.dnsstuff.com/tools#spf|type=ipv4&&value=155.133.82.39&&[email protected]

But an installed Perl SPF check softfails the SPF check?

May 9 00:48:49 ip-172-31-15-65 postfix/policy-spf[5905]: Policy action=PREPEND Received-SPF: softfail (gmail.com ... _spf.google.com: Sender is not authorized by default to use '[email protected]' in 'mfrom' identity, however domain is not currently prepared for false failures (mechanism '~all' matched)) receiver=ip-172-31-15-99.us-west-2.compute.internal; identity=mailfrom; envelope-from="[email protected]"; helo=gmail.com; client-ip=155.133.82.39

This is the SPF record for gmail: http://mxtoolbox.com/SuperTool.aspx?action=spf%3agmail.com&run=toolpage#

I followed this guide (http://www.thenoccave.com/2013/05/08/centos-6-postfix-spf-checking/) but I'm getting the following errors in maillog:

May  8 22:15:13 ip-172-31-15-65 postfix/smtpd[1999]: warning: premature end-of-input on private/policy while reading input attribute name
May  8 22:15:14 ip-172-31-15-65 postfix/spawn[2037]: warning: command /usr/bin/perl exit status 2
May  8 22:15:14 ip-172-31-15-65 postfix/smtpd[1999]: warning: premature end-of-input on private/policy while reading input attribute name
May  8 22:15:14 ip-172-31-15-65 postfix/smtpd[1999]: warning: problem talking to server private/policy: Connection reset by peer

Here is part of main.cf

smtpd_recipient_restrictions = reject_non_fqdn_sender,
  reject_non_fqdn_recipient,
  reject_unknown_recipient_domain,
  permit_sasl_authenticated,
  reject_unauth_destination,
  permit_inet_interfaces,
  check_policy_service unix:postgrey/socket,
  check_policy_service unix:private/policy policy_time_limit = 3600s

Here is part of master.cf

policy  unix  -       n       n       -       -       spawn user=nobody argv=/usr/bin/perl /usr/lib/postfix-policyd-spf-perl

I also tried

  check_policy_service unix:postgrey/socket,
  check_policy_service unix:private/policy,
  policy_time_limit = 3600s

Here is the full master.cf.

postfix check doesn't report any errors.

There was a similar question, but it was for Debian and Python.

CentOS 6.6, postfix-policyd-spf-perl 2.01.

I have

# For blog
LoadModule proxy_html_module libexec/mod_proxy_html.so
LoadModule ssl_module libexec/mod_ssl.so
LoadModule xml2enc_module libexec/mod_xml2enc.so
SSLProxyEngine on
ProxyRequests off
ProxyPass /blog https://xxxx.wordpress.com
ProxyPassReverse /blog https://xxxx.wordpress.com
ProxyHTMLEnable On
ProxyHTMLURLMap https://xxxx.wordpress.com /blog
<Location /blog>
  ProxyPassReverse /
  ProxyHTMLEnable On
  ProxyHTMLURLMap / /blog
  RequestHeader    unset  Accept-Encoding
  #LogLevel proxy:debug
</Location>

Following these guides:

https://devcenter.heroku.com/articles/custom-php-settings#using-a-custom-application-level-apache-configuration

http://www.apachetutor.org/admin/reverseproxies

https://httpd.apache.org/docs/trunk/mod/mod_proxy.html

When I visit the URL http://www.xxxx.com/blog/ it doesn't substitute anchor links https://xxxx.wordpress.com/2015/09/16/hello-world/ with /blog.

It works locally, but not in production.

Here is an example of the HTML that goes through the proxy and appears in the browser:

<h1 class="entry-title">
  <a href="https://xxxx.wordpress.com/2015/09/16/hello-world/" rel="bookmark">Hello world!</a></h1>

I also used a different blog host (HostGator) instead of Wordpress.com but it still doesn't work. (Not that this should matter.)

Apache 2.4.16, production: 2.4.10 (?)

I'm getting these SELinux errors in /var/log/audit/audit.log for dovecot.

type=USER_AUTH msg=audit(1404794536.249:100679): user pid=28375 uid=0 auid=0 ses=2700 subj=unconfined_u:system_r:dovecot_auth_t:s0 msg='op=PAM:authentication acct="starrychloe" exe="/usr/libexec/dovecot/auth" hostname=99.99.99.99 addr=99.99.99.99 terminal=dovecot res=success'
type=USER_ACCT msg=audit(1404794536.260:100680): user pid=28375 uid=0 auid=0 ses=2700 subj=unconfined_u:system_r:dovecot_auth_t:s0 msg='op=PAM:accounting acct="starrychloe" exe="/usr/libexec/dovecot/auth" hostname=99.99.99.99 addr=99.99.99.99 terminal=dovecot res=success'
type=AVC msg=audit(1404794537.473:100681): avc:  denied  { read } for  pid=30020 comm="imap" name="starrychloe" dev=xvde ino=152404 scontext=unconfined_u:system_r:dovecot_t:s0 tcontext=unconfined_u:object_r:home_root_t:s0 tclass=dir
type=SYSCALL msg=audit(1404794537.473:100681): arch=c000003e syscall=2 success=no exit=-13 a0=7fc64f910eb0 a1=0 a2=0 a3=0 items=0 ppid=20321 pid=30020 auid=0 uid=502 gid=501 euid=502 suid=502 fsuid=502 egid=501 sgid=12 fsgid=501 tty=(none) ses=2700 comm="imap" exe="/usr/libexec/dovecot/imap" subj=unconfined_u:system_r:dovecot_t:s0 key=(null)
type=USER_AUTH msg=audit(1404794537.925:100682): user pid=28375 uid=0 auid=0 ses=2700 subj=unconfined_u:system_r:dovecot_auth_t:s0 msg='op=PAM:authentication acct="starrychloe" exe="/usr/libexec/dovecot/auth" hostname=99.99.99.99 addr=99.99.99.99 terminal=dovecot res=success'
type=USER_ACCT msg=audit(1404794537.935:100683): user pid=28375 uid=0 auid=0 ses=2700 subj=unconfined_u:system_r:dovecot_auth_t:s0 msg='op=PAM:accounting acct="starrychloe" exe="/usr/libexec/dovecot/auth" hostname=99.99.99.99 addr=99.99.99.99 terminal=dovecot res=success'
type=USER_AUTH msg=audit(1404794553.944:100684): user pid=28375 uid=0 auid=0 ses=2700 subj=unconfined_u:system_r:dovecot_auth_t:s0 msg='op=PAM:authentication acct="starrychloe" exe="/usr/libexec/dovecot/auth" hostname=99.99.99.99 addr=99.99.99.99 terminal=dovecot res=success'
type=USER_ACCT msg=audit(1404794553.954:100685): user pid=28375 uid=0 auid=0 ses=2700 subj=unconfined_u:system_r:dovecot_auth_t:s0 msg='op=PAM:accounting acct="starrychloe" exe="/usr/libexec/dovecot/auth" hostname=99.99.99.99 addr=99.99.99.99 terminal=dovecot res=success'

I tried

# sealert -a /tmp/dovecot5.log
100% donefound 1 alerts in /tmp/dovecot5.log
--------------------------------------------------------------------------------

SELinux is preventing /usr/libexec/dovecot/imap from read access on the directory starrychloe.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that imap should be allowed read access on the starrychloe directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep imap /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Then

# cat /tmp/dovecot5.log | audit2allow -M dovecot
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i dovecot.pp

Which generated

# cat dovecot.te

module dovecot 1.0;

require {
        type dovecot_t;
        type home_root_t;
        class dir read;
}

#============= dovecot_t ==============
allow dovecot_t home_root_t:dir read;

However I got this error

# semodule -i dovecot.pp
libsepol.print_missing_requirements: dovecot's global requirements were not met: type/attribute dovecot_t (No such file or directory).
libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory).
semodule:  Failed!

These are the permissions on the directory

# ls -dZ /home/starrychloe
drwxr-xr-x. starrychloe starrychloe unconfined_u:object_r:home_root_t:s0 /home/starrychloe

I'm using CentOS 6.5.

I set up Dovecot IMAP to use PAM as suggested here:

http://wiki2.dovecot.org/PasswordDatabase/PAM

PAM/dovecot

[root@ip-172-31-15-65 pam.d]# cat dovecot
#%PAM-1.0
auth    required        pam_unix.so nullok
account required        pam_unix.so

/etc/dovecot/conf.d/auth-system.conf.ext

passdb {
  driver = pam
  args = failure_show_msg=yes

userdb {
  driver = passwd

When I try to test and debug as recommended here http://www.courier-mta.org/authlib/README.authdebug.html

[root@ip-172-31-15-65 pam.d]# telnet localhost 143
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
a login starrychloe vzcnfZVGW995G9nfuJWp
a NO [ALERT] Password:

/var/log/dovecot-info.log

Apr 06 05:12:28 auth: Debug: auth client connected (pid=5395)
Apr 06 05:12:41 auth: Debug: client in: AUTH    1       PLAIN   service=imap    secured lip=127.0.0.1   rip=127.0.0.1   lport=143  rport=56956      resp=<hidden>
Apr 06 05:12:41 auth: Debug: Loading modules from directory: /usr/lib64/dovecot/auth
Apr 06 05:12:41 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libauthdb_ldap.so
Apr 06 05:12:41 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so
Apr 06 05:12:41 auth: Debug: Module loaded: /usr/lib64/dovecot/auth/libmech_gssapi.so
Apr 06 05:12:41 auth: Debug: pam(starrychloe,127.0.0.1): lookup service=dovecot
Apr 06 05:12:41 auth: Debug: pam(starrychloe,127.0.0.1): #1/1 style=1 msg=Password:
Apr 06 05:12:43 auth: Info: pam(starrychloe,127.0.0.1): pam_authenticate() failed: Authentication failure (password mismatch?)
Apr 06 05:12:45 auth: Debug: client out: FAIL   1       user=starrychloe        reason=Password:
Apr 06 05:13:03 imap-login: Info: Disconnected (auth failed, 1 attempts): user=<starrychloe>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured

Yet I can log in via SSH

[root@ip-172-31-15-65 conf.d]# ssh starrychloe@localhost
starrychloe@localhost's password:
Last login: Sun Apr  6 04:18:05 2014 from xxxxxxx.cable.mindspring.com
[starrychloe@ip-172-31-15-65 ~]$

I did restart Dovecot.

I've already changed the password.

I'm getting this error when trying to install. How can I install it? Webmin depends on it.

[root@ip-172-31-15-65 home]# cpan Authen::Libwrap
CPAN: Storable loaded ok (v2.20)
Going to read '/root/.cpan/Metadata'
  Database was generated on Sat, 05 Apr 2014 04:41:02 GMT
Running install for module 'Authen::Libwrap'
CPAN: YAML loaded ok (v0.90)
Running make for D/DM/DMUEY/Authen-Libwrap-0.22.tar.gz
CPAN: Digest::SHA loaded ok (v5.47)
CPAN: Compress::Zlib loaded ok (v2.064)
Checksum for /root/.cpan/sources/authors/id/D/DM/DMUEY/Authen-Libwrap-0.22.tar.gz ok
Authen-Libwrap-0.22
Authen-Libwrap-0.22/Build.PL
Authen-Libwrap-0.22/ChangeLog
Authen-Libwrap-0.22/example.pl
Authen-Libwrap-0.22/Makefile.PL
Authen-Libwrap-0.22/MANIFEST
Authen-Libwrap-0.22/META.yml
Authen-Libwrap-0.22/ppport.h
Authen-Libwrap-0.22/README
Authen-Libwrap-0.22/lib
Authen-Libwrap-0.22/lib/Authen
Authen-Libwrap-0.22/lib/Authen/Libwrap.pm
Authen-Libwrap-0.22/lib/Authen/Libwrap.xs
Authen-Libwrap-0.22/t
Authen-Libwrap-0.22/t/01_inline.t
Authen-Libwrap-0.22/t/02_maintainer.t
Authen-Libwrap-0.22/t/03_pod.t
Authen-Libwrap-0.22/t/hosts.allow
CPAN: File::Temp loaded ok (v0.22)
CPAN: Module::Build loaded ok (v0.4205)

  CPAN.pm: Going to build D/DM/DMUEY/Authen-Libwrap-0.22.tar.gz

enter include directory to use: [/usr/include ]
/usr/include
enter library directory to use: [/usr/lib ]
/usr/lib
Created MYMETA.yml and MYMETA.json
Creating new 'Build' script for 'Authen-Libwrap' version '0.22'
Building Authen-Libwrap
Error: Function definition too short '/ * EOF * /' in Libwrap.xs, line 32
gcc -I/usr/lib64/perl5/CORE -DXS_VERSION="0.22" -DVERSION="0.22" -fPIC -I/usr/include -c -D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -o lib/Authen/Libwrap.o lib/Authen/Libwrap.c
lib/Authen/Libwrap.xs:9:18: error: tcpd.h: No such file or directory
lib/Authen/Libwrap.xs: In function ‘XS_Authen__Libwrap__hosts_ctl’:
lib/Authen/Libwrap.xs:24: warning: implicit declaration of function ‘hosts_ctl’
error building lib/Authen/Libwrap.o from 'lib/Authen/Libwrap.c' at /usr/local/share/perl5/ExtUtils/CBuilder/Base.pm line 175.
  DMUEY/Authen-Libwrap-0.22.tar.gz
  ./Build -- NOT OK
Running Build test
  Can't test without successful make
Running Build install
  Make had returned bad status, install seems impossible
[root@ip-172-31-15-65 home]#


[root@ip-172-31-15-65 home]# yum search libwrap
Loaded plugins: fastestmirror, presto
Loading mirror speeds from cached hostfile
 * Webmin: download.webmin.com
 * base: mirrors.syringanetworks.net
 * extras: mirror.spro.net
 * updates: mirror.hmc.edu
Warning: No matches found for: libwrap
No Matches found
[root@ip-172-31-15-65 home]#

How can I migrate from one VPS to another, while keeping the configurations?

I saw this question Best way to migrate data between two linux VPS

But that was only to migrate the data.

I have set up an email server (Dovecot/Postfix) which is a pain to set up, Tomcat, PHP, Apache, Webmin, etc. and would like to copy the configurations for them without having to set everything up again.

I'm afraid if I copy the root directories, there will be special files like /dev that should not be copied.

I can't log into my VPS. SSH gives the following error. All the web servers are down. They connect, but do not serve content. However, the email server is still working. The server responds to ping as well. Burst.net support is worthless and unresponsive. Burst.net has a button for 'serial console', but it throws a Java applet ClassNotFound exception. They also have a button for 'reboot', but that didn't help.

$ ssh  -v 308321.oliveyou.net
OpenSSH_6.2p2, OpenSSL 1.0.1e 11 Feb 2013
debug1: Reading configuration data /etc/ssh_config
debug1: Connecting to 308321.oliveyou.net [184.82.92.84] port 22.
debug1: Connection established.
debug1: identity file /home/Chloe/.ssh/id_rsa type 1
debug1: identity file /home/Chloe/.ssh/id_rsa-cert type -1
debug1: identity file /home/Chloe/.ssh/id_dsa type 2
debug1: identity file /home/Chloe/.ssh/id_dsa-cert type -1
debug1: identity file /home/Chloe/.ssh/id_ecdsa type -1
debug1: identity file /home/Chloe/.ssh/id_ecdsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH_5*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
Read from socket failed: Connection reset by peer


$ telnet 308321.oliveyou.net 25
Trying 184.82.92.84...
Connected to 308321.oliveyou.net.
Escape character is '^]'.
220 mail.kizbit.com ESMTP Postfix
HELO kizbit.com
250 mail.kizbit.com

How do I grant permissions in Postgres? I followed the documentation, however it is not working.

$ psql tmadev
psql (9.2.4)
Type "help" for help.

tmadev=# grant all privileges on database tmadev to tma;
GRANT
tmadev=# \z sample
                           Access privileges
 Schema |  Name  | Type  | Access privileges | Column access privileges
--------+--------+-------+-------------------+--------------------------
 public | sample | table |                   |
(1 row)

tmadev=# \q

Chloe@xps /srv/www/htdocs
$ psql -U tma tmadev
psql (9.2.4)
Type "help" for help.

tmadev=> select * from sample limit 2;
ERROR:  permission denied for relation sample
STATEMENT:  select * from sample limit 2;
ERROR:  permission denied for relation sample
tmadev=>
tmadev=> \du
                             List of roles
 Role name |                   Attributes                   | Member of
-----------+------------------------------------------------+-----------
 Chloe     | Superuser, Create role, Create DB, Replication | {}
 tma       |                                                | {}

I installed xmlsec and it keeps giving me an error when I try to verify an XML document.

yum install xmlsec1
yum install xmlsec1-openssl


[vagrant@localhost SSO-ROR-development]$ xmlsec1 --verify ../tmp_SAML_Sample.xml
func=xmlSecCryptoDLLibraryCreate:file=dl.c:line=146:obj=lt_dlopenext:subj=unknown:error=7:io function failed:filename=libxmlsec1-openssl
func=xmlSecCryptoDLGetLibraryFunctions:file=dl.c:line=498:obj=unknown:subj=xmlSecCryptoDLLibraryCreate:error=1:xmlsec library function failed:crypto=openssl
func=xmlSecCryptoDLLoadLibrary:file=dl.c:line=449:obj=unknown:subj=xmlSecCryptoDLGetLibraryFunctions:error=1:xmlsec library function failed:
Error: unable to load xmlsec-openssl library. Make sure that you have
this it installed, check shared libraries path (LD_LIBRARY_PATH)
envornment variable or use "--crypto" option to specify different
crypto engine.
Error: initialization failed
Usage: xmlsec <command> [<options>] [<files>]

Report bugs to http://www.aleksey.com/xmlsec/bugs.html
Written by Aleksey Sanin <[email protected]>.
Copyright (C) 2002-2003 Aleksey Sanin.
This is free software: see the source for copying information.

func=xmlSecCryptoShutdown:file=app.c:line=69:obj=unknown:subj=cryptoShutdown:error=9:feature is not implemented:
func=xmlSecAppCryptoShutdown:file=crypto.c:line=48:obj=unknown:subj=xmlSecCryptoShutdown:error=1:xmlsec library function failed:
Error: xmlsec crypto shutdown failed.


[vagrant@localhost SSO-ROR-development]$ ls $LD_LIBRARY_PATH/*xmlsec*
/usr/lib64/libxmlsec1-openssl.so.1  /usr/lib64/libxmlsec1-openssl.so.1.2.16  /usr/lib64/libxmlsec1.so.1  /usr/lib64/libxmlsec1.so.1.2.16


[root@localhost SSO-ROR-development]# uname -a
Linux localhost.localdomain 2.6.32-279.14.1.el6.x86_64 #1 SMP Tue Nov 6 23:43:09 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

I'm trying to synchronize two directories using Unison, however if it encounters a file with an error, then it skips the entire directory! I don't believe it should skip the whole directory, and instead should just skip that file. I'm OK with that. How do I tell it to ignore the error and continue to copy the rest of the files?

The Unison is a Windows executable, not Cygwin. I can read the file with Cygwin. Unison does in fact encounter an error on the file, and I'm OK with skipping them.

Version 2.32 works better than 2.40. Version 2.40 won't even start.

I've tried adding -ignore, but that doesn't help. Here is what I tried:

$ unison 'c:\cygwin' 'socket://xps:4321/c:/cygwin'
UNISON 2.32.52 started propagating changes at 02:53:35 on 27 Feb 2013
[ERROR] Skipping etc
  [root 1]: Error in digesting c:/cygwin/etc/ssh_host_dsa_key:
c:/cygwin/etc/ssh_host_dsa_key: Permission denied
[ERROR] Skipping home
  [root 1]: Error in digesting c:/cygwin/home/SYSTEM/.bash_history:
c:/cygwin/home/SYSTEM/.bash_history: Permission denied
...
Saving synchronizer state
Synchronization complete at 02:53:39  (3 items transferred, 2 skipped, 0 failed)
  skipped: etc
  skipped: home




$ unison 'c:\cygwin' 'socket://xps:4321/c:/cygwin' -ignore 'Path etc\ssh_host_dsa_key' -ignore 'Path home\SYSTEM\.bash_history'
Contacting server...
Connected [//dumbopc/c:/cygwin -> //xps/c:/cygwin]
Looking for changes
  Waiting for changes from server
Reconciling changes
local          xps
         error            etc
[root 1]: Error in digesting c:/cygwin/etc/ssh_host_dsa_key:
c:/cygwin/etc/ssh_host_dsa_key: Permission denied
         error            home
[root 1]: Error in digesting c:/cygwin/home/SYSTEM/.bash_history:
c:/cygwin/home/SYSTEM/.bash_history: Permission denied
...
Proceed with propagating updates? [] g
Propagating updates    
UNISON 2.32.52 started propagating changes at 04:11:26 on 27 Feb 2013
[ERROR] Skipping etc
  [root 1]: Error in digesting c:/cygwin/etc/ssh_host_dsa_key:
c:/cygwin/etc/ssh_host_dsa_key: Permission denied
[ERROR] Skipping home
  [root 1]: Error in digesting c:/cygwin/home/SYSTEM/.bash_history:
c:/cygwin/home/SYSTEM/.bash_history: Permission denied
...
UNISON 2.32.52 finished propagating changes at 04:11:28 on 27 Feb 2013
Saving synchronizer state
Synchronization complete at 04:11:30  (6 items transferred, 2 skipped, 0 failed)
  skipped: etc
  skipped: home



# Version 2.40
C:\Program Files\Unison>"Unison-2.40.102 Text.exe"  'c:\cygwin' 'socket://xps:4321/c:\cygwin'
Contacting server...
Fatal error: Wrong number of roots: 2 expected, but 4 provided ('c:\cygwin', 'socket://xps:4321/c:\cygwin', , )
(Maybe you specified roots both on the command line and in the profile?)


@REM DOS
C:\cygwin\etc>type ssh_host_dsa_key
Access is denied.

# Cygwin
$ ls -l /etc/ssh_host_dsa_key
-rw------- 1 SYSTEM None 668 Aug 30  2010 /etc/ssh_host_dsa_key

$ cat /etc/ssh_host_dsa_key
-----BEGIN DSA PRIVATE KEY-----

Command line reference:

http://www.cis.upenn.edu/~bcpierce/unison/download/releases/stable/unison-manual.html#prefs

Postfix version 2.6.6, Dovecot Version 2.0.9

I want to setup Postfix + Dovecot. Dovecot seems to be working. I can authenticate. However, the mailbox is empty! Nothing will get delivered! I followed many tutorials on Postfix + Dovecot but they seem to want to complicate things by using Dovecot LDA or MySQL. I just want it to be very simple and having Postfix deliver to the virtual mail boxes are fine. I don't need MySQL either. I already set up a custom password file that Dovecot uses for authentication and I can login to POP3 with SSL.

I can see from the logs that Postfix is delivering to the system user accounts (the catch-all), instead of the virtual users that I set up in Dovecot. The SMTP + SSL authentication seems to work also.

I can also see from the logs that Dovecot is checking the correct virtual mail folder.

I just need to figure out how to get Postfix to deliver to the virtual mail boxes. I have the following which I believe are relevant. Let me know what other settings you need to see:

alias_maps = hash:/etc/aliases
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mydomain = xxx.com
myhostname = mail.xxx.com
mynetworks = 99.99.99.99, 99.99.99.99
myorigin = $mydomain
relay_domains = $mydestination, xxx.com, domain2.net, domain3.com
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_recipient_restrictions = reject_non_fqdn_sender reject_non_fqdn_recipient reject_unknown_recipient_domain permit_sasl_authenticated check_relay_domains
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = check_sender_mx_access cidr:/etc/postfix/bogus_mx reject_invalid_hostname reject_unknown_sender_domain reject_non_fqdn_sender
virtual_mailbox_base = /var/spool/vmail
virtual_mailbox_domains = xxx.com, domain2.net, domain3.com
virtual_minimum_uid = 444

Postfix master.cf:

submission inet n       -       -       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
  -o smtpd_sasl_security_options=noanonymous
  -o smtpd_sasl_local_domain=$myhostname
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o smtpd_sender_login_maps=hash:/etc/postfix/virtual
  -o smtpd_sender_restrictions=reject_sender_login_mismatch
  -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject

Dovecot related:

mail_location = maildir:~/Maildir
passdb {
  args = /etc/dovecot/users.conf
  driver = passwd-file
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
  }
}

The virtual mail user:

vmail:x:444:99:virtual mail users:/var/spool/vmail:/sbin/nologin

Here is the /var/log/maillog when I try to send something to myself:

Oct 25 22:10:05 308321 postfix/smtpd[2200]: connect from user-999.cable.mindspring.com[99.99.99.99]
Oct 25 22:10:05 308321 postfix/smtpd[2200]: D224BD4753: client=user-999.cable.mindspring.com[99.99.99.99], sasl_method=LOGIN, [email protected]
Oct 25 22:10:06 308321 postfix/cleanup[2207]: D224BD4753: message-id=<7DC3C163CFFC483AB6226F8D3D9969D2@dumbopc>
Oct 25 22:10:06 308321 postfix/qmgr[2168]: D224BD4753: from=<[email protected]>, size=1385, nrcpt=1 (queue active)
Oct 25 22:10:06 308321 postfix/smtpd[2200]: disconnect from user-999.cable.mindspring.com[99.99.99.99]
Oct 25 22:10:06 308321 postfix/local[2208]: D224BD4753: to=<[email protected]>, orig_to=<[email protected]>, relay=local, delay=1.1, delays=0.53/0.02/0/0.51, dsn=2.0.0, status=sent (delivered to mailbox)
Oct 25 22:10:06 308321 postfix/qmgr[2168]: D224BD4753: removed