Free vServer during beta phase

I just stumbled accross this website: https://ssl.euserv.de/produkte/vserver/betatest.php where you can order a vServer for free during the beta phase. The beta phase is planned to last till the end of 2009. For more details, have a look at the link (there are a few thing not allowed to use the server for, mainly high traffic and illegal stuff).

An order key is required, just have a look at the tags of this posting …. one of them is a bit “strange” 😉

Moving Exim/Spamassassin/Cyrus -> Debian config

I’ve been putting off moving my mail system to the new server for a few weeks now since the old system was configured from scratch using the original config files and not the debian style config files. The differences in the Exim config are extreme. Debian splits the one large config file into lots of smaller files. This is great if: you never worked with exim before, you aren’t trying to migrate an existing configuration that is in one large file, and you don’t have all kinds of custom stuff like imap, spamassassin, greylisting mixed in. Yeah, not me. Even though I find the “one large file” a whole lot faster and easier to read, the Debian way has one big advantage: it is way easier for external scripts and packages to drop their custom config into exim. They just add a file to the right directory and thats it.

So I decided to go for it and merge my custom stuff into the Debain config. Greylisting worked out-of-the-box, spamassassin needed some minor tweaks, exim was (more or less) easy. The p.i.t.a. with exim is when you know exactly what is missing and where it would be configured, but because of “smart debian scripts” you have to find some config in an unrelated script and put the value there so it gets put in the right placeholder.

Here is a little summary in case I ever do this again and need to see if I forgot something:
– cyrus: copy /var/spool/cyrus/mail/ , /var/lib/cyrus/user/ , use cyradm to add the user.blargh account and /usr/sbin/cyrreconstruct -rf user (don’t forget the sieve filters)
– getmail: nothing special here, just copy config and add cronjob
– spamassassin: alter exim acl to set noscan for auth’d connections and have spamassassin scan everything not “noscan” (because per default local mail isn’t scanned, that includes everything we pick up via getmail)
– exim: check update-exim4.conf.conf for stupid entries, remember to turn on TLS (imap can use the same certificates), since we are using sasl for imap, have smtp auth use the same database (plain_saslauthd_server), turn on TLS by creating a file conf.d/main/00_exim4-config_localmacros with “MAIN_TLS_ENABLE = true” in it

Now that I’m done I found a pretty detailed German website with steps to set up such a system E-Mail-Server mit Debian, Exim und Cyrus. I did the exim router/transports a bit differently to have a bit more control over what goes where when. Still, defiantly worth reading if you are thinking about building such a system.

vmware is odd

I installed the final release of vmware server 2.0 on a server today. Not much has changed since the RC version I had been using. I found some quick fixes and tips in this blog: http://digital.blogsite.org/index.php/2008/10/04/review-vmware-sever-2
The authorization.xml problem was a REAL pain, so I was grateful to find a fix for that. And the tip about the VI Client laying around on the server was priceless (duh, the least they could have done could have been a link in the webinterface). Using the client to access the vmware host is finally not painful anymore. The webinterface is still Ok if I’m not at a computer of mine, or am under linux.

There are still some oddities about vmware that bug me, like the missing option to turn off the DHCP server if you set up networking to use a virtual switch (HostOnly). The VI Client allows me to do some stuff that isn’t possible with the webinterface (like priority for RAM and CPU, or CPU affinity), but it doesn’t allow me to ad virtual machines that are on the server ?!?

The Software is free, so I’m not complaining here. But theese would be a real pain in the rear end if I was using the software in a production environment.

save the forest (or something like that …)

I can’t be the only person who finds it bothersome burning a cd just to install linux. What a waste (it’s not like you use the cd all to often afterwards, except as a coaster). So here are the quick and dirty instructions for making a debian linux install usb stick (adjust /dev/sdb accordingly, failure to do so can pretty must kill any data on a harddisk):

  • wget ftp://ftp2.de.debian.org/debian/dists/etch/main/installer-i386/current/images/hd-media/boot.img.gz
  • wget http://cdimage.debian.org/debian-cd/4.0_r5/i386/iso-cd/debian-40r5-i386-netinst.iso
  • zcat boot.img.gz > /dev/sdb
  • mount /dev/sdb /mnt
  • cp debian-40r5-i386-netinst.iso /mnt
  • umount /mnt

Basic Server Hardening

Ok, here is a list of a few programs I’d advise anyone to use who is running a server on the internet (or thinking of doing so).

  • aide or tripwire (they can check and report if files on your system get changed, configurable levels). If you use tripwire, don’t forget a “tripwire –check -I” after you do any updates.
  • logcheck will check your system logs, and report anything out of the ordinary (“ordinary” is defined by a list of ‘normal’ rules, and anything you add)
  • tiger goes farther than logcheck, it actively checks your system and reports anything strange (files not belonging to packages, users or groups that got added, …)
  • grsecurity adds more security features to your kernel (at least use the basic features and the possibility to turn off module loading after boot)
  • rkhunter, chkrootkit scan the system for signs of rootkits or other malware. just install, make sure they are executed daily by cron, possibly tweak rkhunters config a bit (I had problems with unhide and current kernel versions)

I’m not saying that setting up and tweaking all this software and actually reading the emails they generate will make your server super-duper secure, but they will reduce the risk of running a server open to the internet and alarm you if somthing strange is happening. It is important to read and understand what theese programs mail you. Yes, you will get false positives from time to time. And yes, you will have to adjust the config now and then due to package updates; but I get about 3-4 mails a week, and that is definatly ok considering the amount of data that gets checked.