aPugLife's questions

I want to poweroff my NAS and ESXI when there is a power failure. Both of the system run on a Eaton UPS. I only run Linux systems and therefore I can not use the Eaton Manager, Windows only.

Since I use Nagios for other tasks, I would like to create a plugin that, using ssh-public-key, can connect to the above systems and power them off.

The public key of the Nagios user is already installed on the root user of the ESXI (the NAS will come later). When I change user to Nagios (on Nagios server) and manually run the script, this connects to the ESXI and (for the moment) it writes a "testfile" on /tmp. It works.

When the script is ran by Nagios itself, it doesn't. This script runs as a handler:

define host {
    name                            home-monitoring
    use                             generic-host
    check_period                    24x7
    check_interval                  5
    contact_groups                  admins
    event_handler                   poweroff_host
    register                        0
}

cat /usr/lib64/nagios/plugins/poweroff_host.sh

#!/bin/bash
/usr/bin/ssh root@esxi -i /var/spool/nagios/.ssh/id_rsa "touch /tmp/testfile"

cat /etc/nagios/objects/commands.cfg

define command{
        command_name    poweroff_host
        command_line    sudo /usr/lib64/nagios/plugins/poweroff_host.sh
}

visudo

(at the bottom of the file)
nagios ALL = (root) NOPASSWD:/usr/lib64/nagios/plugins/poweroff_host.sh

I have also added nagios user to the wheel group (using usermod)

# grep wheel /etc/group
wheel:x:10:nagios

And last, I've been hitting my head here for the last 4 days and keep getting errors in the log. The last error is:

journalctl -xef

stderr line 01: /usr/lib64/nagios/plugins/poweroff_host.sh: line 2: /usr/bin/ssh: Permission denied

Before visudo, the error was no ssh in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin), at least now I managed to change the kind of error.

Can I please have some help and fix the issue?

UPDATE 1:

[root@nagios ~]# audit2allow -i /var/log/audit/audit.log


#============= nagios_t ==============
allow nagios_t ldconfig_exec_t:file { execute getattr };
allow nagios_t nagios_spool_t:dir create;
allow nagios_t pam_var_run_t:dir write;
allow nagios_t ssh_exec_t:file { execute getattr };
allow nagios_t tmpfs_t:dir write;

Fast forward to semodule command but stderr line 01: /usr/lib64/nagios/plugins/poweroff_host.sh: line 2: /usr/bin/ssh: Permission denied is still there :/

I will try disabling Selinux at all :/

While I was searching related questions, I saw this: https://superuser.com/questions/109213/how-do-i-list-the-ssl-tls-cipher-suites-a-particular-website-offers

I tried working on the solutions provided but I haven't found my solution.

I have 2 server, the test and the production server.

Both of them host an application, test and prod. This application requires a reverse proxy so I set up Apache for this.

I was asked to improve the cipher suite used for the HTTPS.

The PROD server uses, in apache, this:

SSLProtocol All -SSLv2 -SSLv3
SSLCipherSuite DES-CBC-SHA:HIGH:!aNULL:!MD5:!EXP
SSLHonorCipherOrder on

The TEST server, which I'm currently working on, was updated for using this:

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
SSLHonorCipherOrder on
SSLCompression      off
SSLSessionTickets   off

It is time to test if the new configuration works (well, it already should, but you know...).

From a 3rd TEST machine I ran:

curl https://test.servertest.com/test1
against the TEST server
and
curl https://prodserver.com/accept
to the PROD one.

Reading the APACHE error log from both the TEST and PROD servers, I do not see differences.

TEST:
[Tue Oct 23 13:57:10.846249 2018] [ssl:trace3] [pid 13130] ssl_engine_kernel.c(1795): [remote 1.1.1.1:5555] OpenSSL: Handshake: done
[Tue Oct 23 13:57:10.846257 2018] [ssl:debug] [pid 13130] ssl_engine_kernel.c(1844): [remote 1.1.1.1:5555] AH02041: Protocol: TLSv1, Cipher: ECDHE-RSA-AES256-SHA (256/256 bits)

PROD:
[Tue Oct 23 13:58:04.192403 2018] [ssl:trace3] [pid 6856] ssl_engine_kernel.c(1795): [remote 2.2.2.2:6666] OpenSSL: Handshake: done
[Tue Oct 23 13:58:04.192409 2018] [ssl:debug] [pid 6856] ssl_engine_kernel.c(1844): [remote 2.2.2.2:6666] AH02041: Protocol: TLSv1, Cipher: ECDHE-RSA-AES256-SHA (256/256 bits)

Probably CURL might not be the best way for testing the cipher suite (?) but my question is: How can I be sure that the changes I applied are correct (beside finding the ciphers suite themselves in the Apache manual) ?

The broken disk is a SSD, it is the only disk in this system. Suddenly it started throwing an error at the POST, see image:

I researched for solution but it looks like, that as I said, the disk is broken (or better, the controller might be). Still, I wanted to try to at least recover my file.

1. I enabled the Hot Plug on the bios
2. Booted Gparted Live
3. Attached the disk and "Rescan the disks" on Gparted

I thought that perhaps this way I could get access to its content. The result is that it loads forever and never show anything.

I don't have many other ideas on how I can "fix it" or backup those file I wanted to rescue.

In such situations is there anything one can do?

Ubuntu server 14.04.

I must connect to an application outside of my network, through https. I'm using apache2 to build a communication on the https layer.

On the other side it is requested a client certificate authentication. I installed in my Ubuntu all the certificate chain. The CA, intermediate and also their public certificate.

A practical example:

curl -lv https://this-application/receiving-link

* Hostname was NOT found in DNS cache
*   Trying 111.222.333.444...
* Connected to application-something (111.222.333.444) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

I expect exactly this result.

I loaded all the certificate chain + public (pem format and hashed, softlinked) here: /etc/apache2/mytrustedclientcerts

curl -lvvvvv --capath "/etc/apache2/mytrustedclientcerts/" https://this-application/receiving-link

* Hostname was NOT found in DNS cache
*   Trying 111.222.333.444...
* Connected to application-something (111.222.333.444) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/apache2/mytrustedclientcerts/
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Request CERT (13):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
*        information about the certificate here
*        ...
*        ...
*        ...
*        ...
*        SSL certificate verify ok.
> GET /b2b/httpReceiver HTTP/1.1
> User-Agent: curl/7.35.0
> Host: application-something.com
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Mon, 04 Jun 2018 13:16:20 GMT
* Server Server is not blacklisted
< Server: Server
< Content-Length: 155
< test: some_thing
< test: 0:1
< Content-Type: text/html; charset=ISO-8859-1
< 
<html><head><title>Server</title></head>
<body><h1>Hello</h1>
Ready.
</body></html>
* Connection #0 to host application-something.com left intact

Perfection. This is how I see if I'm able to connect, and I do.

Now it's Apache2 turn.

I added to my sites-enabled configuration.conf:

SSLCACertificatePath  "/etc/apache2/mytrustedclientcerts/"
SSLVerifyDepth 10
SSLVerifyClient optional #this must be optional because of many reasons

Just like I did in the test server, where the connection worked right after the change. In this prod server (both of them Ubuntu 14.04) just does not work.

I read in my application log:

06/04/18 11:42:31 SenderModule: Connecting to: https://this-application/receiving-link [message-for-sending-hash]
06/04/18 11:42:32 SenderModule: Failed to connect to partner using SSL certificate. Please run the SSL certificate checker utility to identify the issue: https://this-application/receiving-link [message-for-sending-hash]

I tried to verify the certificate too:

openssl verify -verbose -x509_strict -CApath /etc/apache2/mytrustedclientcerts/ /etc/apache2/mytrustedclientcerts/4.https_public.pem

Which says:

/etc/apache2/mytrustedclientcerts/4.https_public.pem: OK

I restarted Apache2 for applying the changes - I do not want to use the '-k' option on CURL because that is not the point.

I'm asking if someone knows why Apache2 is not able to get these certificate and using them. Probably I missed something from the documentation: https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcacertificatepath but honestly I don't think so.. Any help is appreciated!

Preface: I am very familiar with gParted, parted, fdisk; Windows system.

I wanted to increase the size on a Ubuntu 14.04 disk, virtualized through ESXi 5.5 and disk connected as "Independent, Persistent".

I resized->increased in the past this disk already, using gParted Live, easy.

Now I wish to keep the Server ON while proceeding to resize it, this is a backup disk and it is only used during the week-end. I can easily unmount it from the system.

I know already how to proceed but I searched for tutorials and explicit commands in order for me to not forget anything.

The question: After Googling it and read several pages of how-to, I discovered that everybody tells that the partition must be deleted first, before resizing it.

I can not understand why one must delete the partition, in CLI, before resizing it. Windows too allows a partition to be resized without previous deleting it.

Sources: https://geekpeek.net/resize-filesystem-fdisk-resize2fs/ - How to extend a non-root partition of a Ubuntu VM by command line (and without GParted) - https://access.redhat.com/articles/1190213

..And the I read this: https://unix.stackexchange.com/questions/169395/how-do-i-resize-partitions-and-filesystems-on-them And I do not understand why this answer doesn't say about deleting the partition first.

For me, this last answer is right: there is not need to delete the partition:

$ sudo parted /dev/sdb resizepart 1 400M
$ sudo resize2fs /dev/sdb1 400M

Can someone tell me more about why some say of deleting the partition?

In all honesty, I don't feel comfortable at all using systemd. I just can't understand it.

I was using a version of fail2ban that was behaving strangely in my Ubuntu 16.04. I removed it:

apt remove fail2ban

and installed the last one:

wget https://github.com/fail2ban/fail2ban/archive/0.11.zip
unzip 0.11.zip
cd fail2ban-0.11
python setup.py install

At the end of its installation it said I had to enable its service.

I thought that

systemctl enable fail2ban.service

was enough, but it seemed like the service was "masked". I used this link: https://askubuntu.com/questions/710420/why-are-some-systemd-services-in-the-masked-state to understand what masked is.

I tried to unmask it: systemctl unmask fail2ban.service

and to enable it:

systemctl enable fail2ban.service

And now the classical command:

service fail2ban status | start | stop

is working.

The problem is, I read I should be able to get info of the service from systemctl too:

systemctl fail2ban status
Unknown operation fail2ban.

So I started googling results ... I found this command (and I added | sort for a better output):

systemctl list-units | sort

That shows:

fail2ban.service  loaded active exited  LSB: Start/stop fail2ban

I don't know what "exited" meant so I searched: https://unix.stackexchange.com/questions/241970/what-does-status-active-exited-mean-for-a-custom-service

State active (exited) means that systemd has successfully run the commands but that it does not know there is a daemon to monitor.

MY request:

All I wish to do is being able to start and stop and control if it's working, the fail2ban service. I don't know (almost) anything of systemd because I always skipped it (reason why I moved to Ubuntu 14 after being comfortable with CentOS 5 and previous for years) but it seems I am forced now.

Can someone tell me how I should "add" fail2ban service to systemctl in the proper way?

No it is not a duplicate answer.

This Windows 8 pc was recovered after something happened to the boot sector and Windows itself couldn't boot up.

I was reinstalling openvpn 2.2, same and working version it had before. Wasn't working. I had to upgrade to openvpn 2.3. Worked.

Now I am not able to access the shared folders, which are Samba folders on a Linux Server.

I cleared the password with:

 1. net use * /delete
 2. restarted explorer service
 3. opened credential manager from windows and check if credentials are still there (empty).
 4. Rebooted the pc
 5. repeated all the steps 3 times already
 6. search on google other ways to clear windows password cache.

 99. The first time I cleared the cache, there was a entry and it got cleared. The other times it is just empty and the commenad `net use * /delete` returns me nothing.

Also tried, of course:

net session \\server-ip /delete
net use \server-ip /delete

/del
/d

I tried all, but I am stil able to open the root of the shared folder (which I should not) and when I try accessing the folders where the user have permission to enter, it displays the login window, I type the password (i'm the administrator, I created the password) and windows just reports that the credentials entered are not working.

Just in this pc, another laptop, now disconnected, is working with this account.

Thanks anybody who can help me!

Been weeks, even months, that after a logrotate, my Apache2 server suddenly stops and can't restart, mainly because of the password on the cert. but I do not want to remove it.

At the beginning I thought it was due to Logrotate. But then, I monitored it better and made some tests and this was not the cause.

I searched logs everywhere until this morning, when it crashed again, and I found this:

error.log

[Wed Aug 03 06:34:41.322231 2016] [mpm_prefork:notice] [pid 2726] AH00169: caught SIGTERM, shutting down
[Wed Aug 03 06:34:42.301179 2016] [ssl:info] [pid 18371] AH02200: Loading certificate & private key of SSL-aware server 'aa.bb.cc:443'

syslog

Aug  3 06:34:40 myserver php5-common: php5_invoke pdo: already enabled for apache2 SAPI
Aug  3 06:34:40 myserver php5-common: php5_invoke pdo: already enabled for cli SAPI
Aug  3 06:34:40 myserver php5-common: php5_invoke opcache: already enabled for apache2 SAPI
Aug  3 06:34:40 myserver php5-common: php5_invoke opcache: already enabled for cli SAPI
Aug  3 06:34:40 myserver php5-cli: php5_invoke opcache: already enabled for cli SAPI
Aug  3 06:34:40 myserver php5-cli: php5_invoke pdo_pgsql: already enabled for cli SAPI
Aug  3 06:34:40 myserver php5-cli: php5_invoke json: already enabled for cli SAPI
Aug  3 06:34:40 myserver php5-cli: php5_invoke pdo: already enabled for cli SAPI
Aug  3 06:34:40 myserver php5-cli: php5_invoke pgsql: already enabled for cli SAPI
Aug  3 06:34:40 myserver php5-cli: php5_invoke readline: already enabled for cli SAPI
Aug  3 06:34:40 myserver php5-readline: php5_invoke readline: already enabled for apache2 SAPI
Aug  3 06:34:40 myserver php5-readline: php5_invoke readline: already enabled for cli SAPI
Aug  3 06:34:41 myserver libapache2-mod-php5: php5_invoke opcache: already enabled for apache2 SAPI
Aug  3 06:34:41 myserver libapache2-mod-php5: php5_invoke pdo_pgsql: already enabled for apache2 SAPI
Aug  3 06:34:41 myserver libapache2-mod-php5: php5_invoke json: already enabled for apache2 SAPI
Aug  3 06:34:41 myserver libapache2-mod-php5: php5_invoke pdo: already enabled for apache2 SAPI
Aug  3 06:34:41 myserver libapache2-mod-php5: php5_invoke pgsql: already enabled for apache2 SAPI
Aug  3 06:34:41 myserver libapache2-mod-php5: php5_invoke readline: already enabled for apache2 SAPI
Aug  3 06:34:41 myserver libapache2-mod-php5: apache2_invoke php5: already enabled
Aug  3 06:34:42 myserver apache2: No way to ask user for passphrase

alternatives.log.1

update-alternatives 2016-08-03 06:34:40: run with --install /usr/bin/php php /usr/bin/php5 50 --slave /usr/share/man/man1/php.1.gz php.1.gz /usr/share/man/man1/php5.1.gz

I guess I finally found why my server suddenly stops working. But I do not know what update-alternatives is for, I have never heard of it and would need advices on how to move, to solve my problem. It can be both updating php or stopping this program from running at 6.34 AM, or stopping at all.

Any advice is greatly appreciated!

EDIT: Best answer (and only one) marked as accepted because I found out my system was installing updates, among these, the php. Which let the system both having updated version of php and improper shut down of the apache service, due to the certificate. I want the password on the certificate, so disabling the updates with

dpkg-reconfigure -plow unattended-upgrades

seemed that resolved my problem. But I can not be sure.. Have to wait the next SIGTERM, if there will ever be.

Sorry for doubling the questions about this topic but there are so many and some are very confusing, some are still "old" format and some others does not match my case.

smtpd_restriction_classes = allowed
allowed = permit

smtpd_sender_restrictions =
        check_sender_access hash:/etc/postfix/restricted_senders,
        reject

smtpd_recipient_restrictions = 
        permit_mynetworks,
        reject_unauth_destination,
        permit_sasl_authenticated,
        check_recipient_access hash:/etc/postfix/recipient_domains,
        reject_rbl_client zen.spamhaus.org,
        reject_rhsbl_helo dbl.spamhaus.org,
        reject_rhsbl_sender dbl.spamhaus.org

I have this code working but I can still send mails to [email protected] (some random users)

Apr  4 13:40:46 mail-server postfix/local[22937]: 0C1C5160030: to=<[email protected]>, relay=local, delay=0.23, delays=0.23/0/0/0, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail)

And "[email protected]"

Apr  4 13:41:42 mail-server postfix/smtpd[22931]: NOQUEUE: reject: RCPT from mail-vk0-f52.google.com[209.85.213.52]: 550 5.1.1 <[email protected]>: Recipient address rejected: User unknown in local recipient table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-vk0-f52.google.com>
Apr  4 13:41:42 mail-server postfix/smtpd[22931]: disconnect from mail-vk0-f52.google.com[209.85.213.52]

What I would like to achieve is that only 1 user of this email server ([email protected]) is able to send and receive emails, any other must be rejected almost instantly. And this user can only receive mails from a few users and "recipient_domains"

restricted_senders:

[email protected] allowed

recipient_domains:

[email protected] allowed
[email protected] allowed
thisserveronly.net allowed

Please can anybody advice if my configuration's got errors or if I just miss something?

Fail2ban is installed on one of the servers, I'm able to ban every IP that try to log in.

I'm using the check_log plugin of Nagios to capture the last line of the fail2ban.log, it compares to the fail2ban.log.old and report the Warning state when detects the word "ban".

It works, thing is I can't let it do one check only and reset to OK state after. It keeps sending me email (and showing me warning) about the same banned IP, (which now is not banned anymore).

I created on Nagios server a service called log-service just for this, where

passive_checks_enabled 0
is_volatile 1
max_check_attempts 1
retry_check_interval 2

It does check the service every 2 minutes, but it's always reporting a warning state (and I collected 19 emails for now).

Can somebody tell me what is wrong? Or a better method if mine is not the best? I don't think there is need to post any log but if you ask I'll just post it.

EDIT: The service definition (re-Edited)

define service{
        name                            log-service
        active_checks_enabled           1       ; Active service checks are enabled
        passive_checks_enabled          0       ; Passive service checks are enabled/accepted
        parallelize_check               1       ; Active service checks should be parallelized (disabling this can lead to major performance problems)
        obsess_over_service             1       ; We should obsess over this service (if necessary)
        check_freshness                 0       ; Default is to NOT check service 'freshness'
        notifications_enabled           1       ; Service notifications are enabled
        event_handler_enabled           1       ; Service event handler is enabled
        flap_detection_enabled          0       ; Flap detection is enabled
        process_perf_data               1       ; Process performance data
        retain_status_information       1       ; Retain status information across program restarts
        retain_nonstatus_information    1       ; Retain non-status information across program restarts
        is_volatile                     1       ; The service is not volatile
        check_period                    24x7    ; The service can be checked at any time of the day
        max_check_attempts              1       ; Re-check the service up to 1 time in order to determine its final (hard) state
        check_interval           2      ; Check the service every 2 minutes under normal conditions
        retry_interval            2     ; Re-check the service every two minutes until a hard state can be determined
        contact_groups                  admins  ; Notifications get sent out to everyone in the 'admins' group
        notification_options            w,u,c,r ; Send notifications about warning, unknown, critical, and recovery events
        notification_interval           0       ; Re-notify about service problems every hour
        notification_period             24x7    ; Notifications can be sent out at any time
        register                        0
        }

I don't use Ubuntu so much and I hate it when things change at every version. Now The procedure I always used to install vmtools on an ESX seems old and pushes you to install the Open-vmtools.

..Which I am not able to find anywhere.

I'm using an ESX 5.5 and Ubuntu 14.04.03 lts.

The link to download the package seems not updated, I mean.. I can not find the package for "Trusty Tahr" Link: Packages for esx

And this doesn't help at all: Instructions

For packages.ubuntu.com/trusty/admin/open-vm-tools, just like the others.. I need an Internet connection: useless for my case..

Anybody who was able to install the Open vm tools? Are these ones really better or I'm good to go with the classical that come with ESX?