Linux.conf.au 2022 – Avoiding DNS Pain
Once again, I was extremely fortunate to be speaking at Linux.conf.au. This year, I spoke on avoiding common DNS pain points by following a “DNS as code approach” with DNSControl.
This is a topic that I really enjoy speaking on, DNS is often overlooked when we move to a DevOps/DevSecOps operating model, but I am glad to say that we can make things better. I appreciated all the wonderful questions during the session. The Linux.conf.au crowd are always a great community to be part of.
You can check out the video here:
WebDav on Apache
Sounds simple enough, but this is just an intro post for some other cool PowerShell related posts.
One thing I needed was a WebDav server, and well, why not use my handy little Qube server.
If you want to set up the Apache WebDav module (in this case on NetBSD) simply:
- Ensure you have the apache DAV module installed
- We need a folder for the DavLock database, i did the following:
- Once you have the folders, add the following lines to your http.conf. Note this will assume that the folder webdav is stored wherever the rest of your htdocs are, so you need to make the folder or create a symbolic link from there to where you want WebDav files to be stored.
- Restart/Reload the Apache Service
- DONE!
Notes:
I should probably explain the lines we are entering in the httpd.conf file, as they will cause you some confusion if I don't.
The first line is specifying where we want the DavLockDB, in this case, we want the files to be called DavLock, in the folder we created earlier.
We then have the usual Apache location tags, in this case we want the location to be /webdav. Change this to suit your needs. You could also use Directory tags.
The next three lines are to do with authentication and authorisation. I only ever perform authentication with HTTP Digest (the first line), and I always where possible create a new authentication realm which Apache calls the AuthName. Finally we need to have a list of usernames and passwords, AuthUserFile will point to where we have a file of usernames and passwords setup in the correct method for Apache.
The file section, is something that was covered in the Apache documentation, and to be frank, I don't fully understand as the Apache configuration layout is still perplexing to me. What I know is that this line is limiting who can access the webdav location, in this case, valid-user means anyone who authenticates successfully and isn't a guest will have access. I am sorry I couldn't be any more helpful.
So now we have all of this sorted, I will be able to show you all soon, some of the cool PowerShell stuff I have been investigating. As a teaser, I have been looking at the various was PowerShell can integrate with web applications, as well as new methods for PowerShell to copy and save data that it creates.
I have also been working on some updates to my standard template, minor tweaks in formatting really, as well as some fun stuff around making the copy script I use every day an even more powerful and flexible tool.
MailScanner on Centos
This is a simple guide to building an email gateway which will perform anti-spam and anti-virus filtering prior to delievering email to its intended destination.
I also make use of a sendmail milter to verify the recpients of email messages are valid, and drop the messages if the recpient is found to be invalid. Recipient filtering not only reduces the amount of work that the gateway has to do (as it doesn't perform any anti-spam analyasis etc on the message) but reduces the load on the destination server(s) and protects them.
The milter works by simply connecting to the destination server and testing if it accepts the recipient address prior to accepting the rest of the email body from the machine which is connected to it. If you use Exchange as your destination server, make sure it doesn't accept invalid recipients and returns an NDR which is the default. If the recipient isn't valid, the miltor returns to the SMTP server which is attempting to send email to it that the mail box is full or invalid.
- Install Centos
Just follow normal install - Install Updates
yum update - Install Webmin
If you like to install and update Webmin via RPM, create the /etc/yum.repos.d/webmin.repo file containing:
[Webmin]
name=Webmin Distribution Neutral
baseurl=http://download.webmin.com/download/yum
enabled=1 - You should also fetch and install my GPG key with which the packages are signed, with the command:
rpm --import http://www.webmin.com/jcameron-key.asc
You will now be able to install with the command :
yum install webmin
All dependencies should be resolved automatically. - Install Mailscanner
export MAILSCANNER_CREATE_TMPFS=1
wget http://yum.fslupdate.com/fsl-beta/fsl-beta.repo -O /etc/yum.repos.d/fsl-beta.repo
yum -y groupinstall MailScannerGold
export PERL5LIB=/opt/fsl/lib/perl5
chkconfig MailScanner on
yum update - Configure Mailscanner
vi /etc/MailScanner/MailScanner.conf - Install Sender/Recipient verification sendmail milter
yum install sendmail-devel
yum install sendmail-cf
yum install libmilter
tar xzvf smf-sav-1.4.0.tar.gz
cd smf-sav-1.4.0
make
make install - Configire address verification milter
- Configure Sendmail
Do what ever forwarding and routing you need to configure.
Add the following lines to sendmail.mc above the MAILER(smtp)dnl like
INPUT_MAIL_FILTER(`smf-sav', `S=unix:/var/run/smfs/smf-sav.sock, T=S:30s;R:4m')dnl - Configure Startup scripts to include milter
We need to modify the MailScanner init script at \etc\inif.d\MailScanner to ensure that the process that performs the address verification is started before sendmail and mailscanner.
start)
...
daemon /usr/local/sbin/smf-sav
...
stop)
if test "x`pidof smf-sav`" != x; then
echo -n $"Stopping $prog: "
killproc smf-sav
echo
...
Snort on Ubuntu 11.04
Previously I had been running insta-snorby, but after the 100th time of either ruby, ruby on rails, snorby's job or some other failure, it was decided to build a new system, this time where all the parts were easily supported and UP-TO-DATE!
The final result was Ubuntu Server 11.04, with the latest versions of Snort, Barnyard2, PulledPork and SnortReport.
I tried very, very, very hard to also add in Snorby to the mix, and I managed to get its cache jobs to run for a few hours, then they would die with no useful error messages. It doesn't help that some of the official documentation points you to an old repository, it also does help that the GEMs it makes use of are highly unstable.
I also looked at Sguil and its framework, its nice but i dislike the need to install a client, and massively change the effiency of this Snort deployment.
It should also be added that both Snorby and Sguil fail at one thing, having documentation. You need accurate documentation, and also need documentation that isn't 5 years old. SnortReport is old, but the documentation was perfect, not that i needed it.
Anyway, here is how I did it.
1) Follow the Installing Snort on Ubuntu 10.04 guide at http://www.snort.org/docs.
I didn't install Snort to /usr/local/snort, I instead put everything in the default paths, its just a lot less work.
2) Installed PulledPork according to the documentation
3) To start snort and barnyard2:
sudo ifconfig eth1 up
sudo snort -D -u snort -g snort -c /etc/snort/snort.conf -i eth1 --pid-path /var/run/snort
sudo barnyard2 -c /etc/snort/barnyard2.conf -G /etc/snort/gen-msg.map -S /etc/snort/sid-msg.map -d /var/log/snort -f snort.u2 -w /var/log/snort/barnyard2.wald -D --pid-path /var/run/barnyard2
4) To update rules:
sudo perl /usr/local/pulledpork/pulledpork.pl -c /etc/snort/pulledpork.conf
There really isn't anything else you need to do.
I have included various config files in the brain samples section:
Windows Server 2008 R2 + LVS with Direct Routing and Windows Firewall
For those of you who are in the need for an IP LoadBalanacer, and do not want to pay for an F5, check out the LVS project.
We recently set up a number of LVS balanced pages, and quickly came into difficulty in selecting thr routing method used. We struggled to find documentation, and were told to use the NAT technique, something that we were not happy with. The lack of documentation was also not helped due to the fact we wanted to load balanced Windows 2008 R2 servers running IIS 7.5.
We managed to work out how to set up both the Linux side of the fence (the machines running LVS) and then what to do on the Windows Servers being balanced. We also managed to leave the Windows Firewall on!
Once you have your LVS setup running. Perform the following steps to
1. Perform the standard configuration using what ever method you like (Piranha the web interface is brilliant for this) and ensure you select "Direct Route"
2. Restart Pulse service
3. Add the Loop back adapter to each Windows machine as specified at DR and LV Tun Clusters
4. You do not need to disable the Windows Firewall
5. Setup weak host send and recieve as specified at the loadbalancer blog.