Frerich Raabe's questions

I maintain an IMAP server running Dovecot which uses Maildir as the storage format for the user mailboxes. Every night, an rsync process runs to create a backup of the mailboxes. Recently, I noticed that rsync occasionally prints messages like

file has vanished: "/home/vmail/lists/archive/Maildir/.sales/dovecot-uidlist.lock" rsync warning: some files vanished before they could be transferred (code 24) at main.c(1655) [generator=3.1.1]

My understanding based on the Locking section in the Dovecot wiki is that this lock file is a custom extension of Dovecot which is held while the dovecot-uidlist file is being written to. Hence, if a file is being delivered while the backup is running, it may happen that the .lock file gets removed during the backup - triggering above warning message.

It would be easy to exclude this lock file from the backup, but I wonder: should we maybe rather lock the mailbox (such that no modifications to it take place) during the rsync backup? If so, how can one do this using Dovecot?

I'm running Proxmox 3.3.1 to host a virtual machine running Linux (64bit, kernel version 3.2.0). The virtual machine uses a 512GB HDD which was unfortunately configured to use the ide driver when creating the VM.

How can I reconfigure the virtual machine such that the hard disk is accessed using the virtio driver?

I found this forum entry on the topic, but the proposed solutions seem to be about doing this for a Windows guest, which requires adding a small dummy HDD in order to driver installation of drivers inside a guest. I suppose this is not needed for Linux.

Another answer on this topic (though purely about KVM, not about Proxmox in particular) mentions that

[..] you'd need to change the drive's label inside of the guest's /etc/fstab file, replacing all /dev/sdX with /dev/vdX [..]

However, I noticed that the Proxmox guest doesn't use /dev/hdX at all but rather /dev/mapper/<vmname>-root instead. So I'm not sure that answer is really applicable, since Proxmox appears to have it's own way of doing things.

If computers were much simpler, there would be less points of failure which in turn might improve stability and simplify maintenance.

This got me thinking - for a smallish team of about 25 people, does anybody have experience with running certain lightweight services straight off a Raspberry Pi 2? I'm thinking of things like

1. IRC servers
2. Webmail (e.g. Roundcube)
3. VPN servers
4. DNS servers
5. Maybe LDAP?

These little machines require no moving parts (and no cooling whatsoever, they can happily operate in an air-tight casing) and they require very little power (about 2W). They are also very cheap - having one Pi per service would be no problem at all.

Consider a simple FreeBSD machine running an SMTP server - how can I automatically verify that it's doing the right thing (e.g. accept incoming SMTP connections for certain recipients, and drop the mail in some Maildir)?

We already use server monitoring software (in this cas, Nagios) and of course we do manual tests, but I was wondering: is there some common way to run automatic functional tests on server services?

An example of what I'm thinking of: when reconfiguring our server (which usually happens inside a VM for testing purposes), I'm considering to

1. Pipe a few manually crafted SMTP sessions into netcat, which connects to the SMTP port of our server and then
2. Run some sort of 'verfication' script on the server which makes sure that expected assertions hold (such as: new files with expected contents appeared on the server, log entries were created, etc.).

I imagine being able to execute a series of such tests for other services (e.g. testing that backups can be created, testing that the IMAP server accepts connections for certain users and that it lists the right mail) might be useful for testing configuration changes, or for verifying that restored system backups work as expected.

I have a central backup server running Debian which holds backups of various other hosts in the network, stored in a structure like

/media/backup/imap
/media/backup/wiki

With imap and wiki being hosts on our network. Right now, all files beneath /media/backup are owned by root:backup with 0750 permissions. What's annoying about this is that

1. Every member of the backup user group can read all backups, including those of sensitive data (say: mails).
2. Right now one of the administrator accounts (jim@backup) is used for restoring the backups. It's annoying that this functionality is bound to a particular user.

Does this setup make sense? If it doesn't, what's a better approach for organizing backups? One solution I've been considering is to have different system users per host, so there's e.g. imap@backup and wiki@backup. The files beneath /media/backup/imap would then be owned by imap:imap with 0700 permissions.

I have an rarely used /etc/aliases entry

vmailusers: :include:/usr/local/etc/vmailusers

The /usr/local/etc/vmailusers file is generated by a cronjob executing

ls /home/vmail | grep -v lists > /usr/locale/etc/vmailusers
chmod 0640 /usr/local/etc/vmailusers
chmod mailnull:mail /usr/local/etc/vmailusers

Is there a way to avoid having to run a cron job but rather execute the ls command in the very moment the vmailusers alias is used?

We have have reasonably good documentation for our environment (in AsciiDoc format) which recently allowed another person to recreate the entire setup from scratch in less than 30 minutes.
However, I noticed that after the initial setup, it easily happens that small changes done to the system (say: inetd gets disabbled, my IMAP server listens on an additional port for ManageSieve connections, a new router is added to the exim configuration) don't end up in the documentation immediately (if at all).

My idea was to avoid this problem by (partially?) generating the documentation out of the configuration files and the comments therein - one way to implement this may be to put /etc and /usr/local/etc into some source code management system (say - git) and then run a script which regenerates the documentation on every commit. However, I'm not sure whether that would be overkill and/or too difficult to get right (after all, I don't want complete copies of the source files in my documentation but rather just the diffs).

How do other people avoid that the server documentation gets outdated - is there a good way to keep them in sync automatically, or do you just have the discipline to update the documentation the same time you modify the system?

I'm maintaining an IMAP server running FreeBSD which uses exim 4.80 as its MTA. Right now I try to create an email alias so that I can address all users of the system for informing them about scheduled downtimes and the like. The idea is that a mail to [email protected] should get forwarded to all users on the system.

I initially considered having a simple simple /etc/aliases entry but noticed that it's not what I want since users of the system may have Sieve filters in place which drop all incoming mails except a few whitelisted ones.

I did notice that exim can be made to deliver to a local Maildir directory straight away (by-passing any other MDA and thus bypassing Sieve filters) using the appendfile transport - but how can I make a single incoming mail to vmailusers get redirected to multiple local maildirs?

I'm running a FreeBSD 9.0 setup as a virtual machine in a KVM setup. In previous versions of FreeBSD it was common to force the kern.hz setting to a lower value so that the virtual machine does not keep the host busy because it's handling timer interrupts without having any work to do - the FreeBSD Handbook explains:

The most important step is to reduce the kern.hz tunable to reduce the CPU utilization of FreeBSD under the Parallels environment. This is accomplished by adding the following line to

/boot/loader.conf: kern.hz=100

Without this setting, an idle FreeBSD Parallels guest OS will use roughly 15% of the CPU of a single processor iMac®. After this change the usage will be closer to a mere 5%.

However, in FreeBSD 9, the "dynamic tick mode" (aka "tickless mode") is the default, controlled by the kern.eventtimer.periodic setting which defaults to 0 (read: tickless mode).

This makes me wonder - does the tip of lowering kern.hz still have any relevance for making FreeBSD 9 play nicely in a virtual machine setup?