How to set up keyword block in Exim on Debian

Exim can be configured to block emails containing key words, as a method to fight spam. Obviously this is not a comprehensive solution, but can assist in stopping persistent spammers and decreasing the load on SpamAssassin processing when running in parallel.

These instructions are for Debian 8 Jessie, but should apply similarly to Stretch(9) and Buster(10), which use the Exim split configuration.

Edit the config template file: /etc/exim4/exim4.conf.template

We are using the DATA access list (ACL) so scroll down to the section:

### acl/40_exim4-config_check_data
#################################

There may be a number of existing rules in this section, we'll insert our rules after this entry:

# require that there is a verifiable sender address in at least
# one of the "Sender:", "Reply-To:", or "From:" header lines.
.ifdef CHECK_DATA_VERIFY_HEADER_SENDER
deny
  message = No verifiable sender address in message headers
  !acl = acl_local_deny_exceptions
  !verify = header_sender
.endif

 Insert the following text:

# Deny keywords using regex before using Spamassassin:
# Ref: https://www.exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html
  deny
    message = Message rejected as spam or Unroutable address
    regex = Keyword1|Keyword2|Keyword3|...

Change keywords to match words you would like to block. Note this is a case sensitive, regex expression - customise the regex line as required. The message is logged and also sent back to the offending sender.

Update the Exim configution:

update-exim4.conf

Restart the Exim service:

service exim4 restart

Send a test email containing one of the keywords to test.

Upgrading Macbook to High Sierra

Trying to upgrade a Macbook Pro 7.1 (mid-2010) from Sierra to High Sierra failed with several cryptic error messages. This laptop had been upgraded with a Crucial SSD and non-Apple RAM modules, and is configured to dual-boot Linux with rEFInd boot loader.

TLDR: The EFI system boot partition (ESP) should be of type EF (aka 0xEF, EF00), not 07 (Fat).

We recieved the following errors:

macOS could not be installed on your computer

The installer resources were not found

...

You may not install this volume because the computer is missing a firmware partition

...

Somewhere along the line after Bootcamp was initiated, maybe when the Hybrid MBR was altered with gdisk, or partitions adjusted using Gparted, the partition type for the EFI boot partition was changed from type EFI system (EF) to Fat (07).  The format for EF and 07 types is the same, EF is used to identify it specifically as the EFI partition.  Note: this partition is not required to be of type HFS+ as claimed on some sites.

If you have an old High Sierra Upgrade installer from an old previous attempt it may also help to Trash that installer and re-download from the App Store so that you get the updated messages.

The final partition tables on this Macbook are something like:
Hybrid MBR:
 EE: 1 -> 2148 (Protective MBR indicator)
  (128MB space)
 EF: 2149 -> ... (EFI partition, 200MB)
  (128MB space)
 AF: ... -> ... (macOS, 120GB)
  (128MB space)
 83: ... -> ... (Linux, 80GB)

GPT:
 EE
  (128MB space)
 EF (EFI Boot)
  (128MB space)
 AF (macOS)
  (128MB space)
 AF (Recovery 10.11)
 AF (Recovery 10.12)
 83 (Ubuntu)
 83 (Debian)
 82 (Linux swap)
 07 (Fat32 Shared Data)

(*128MB spaces between partitions is an Apple recommendation)

Macbook Pro No Entry symbol

Getting a No Entry symbol when starting macOS on a Macbook Pro (7.1; mid 2010). The Macbook was initially configured to dual boot using OS X Boot Camp Assistant, but later used Refind boot manager to load multiple Linux installations.

Somewhere along the line, the Hybrid MBR had lost the Apple HFS+ file system (AF). Since an MBR can only have 4 primary partitions there is not enough locations to store more than the essential:
1 x Protective Partition (type EE)
1 x EFI System Partition (EF)
1 x Apple Partition (AF)
1 x Linux Partition (83)

Re-creating the hybrid MBR, using Linux utility gdisk (recovery menu), to include the Apple (AF) partition allowed macOS Sierra to boot again. Once corrected, the Recovery partition is bootable also but does not need to be included in the MBR.

A Hybrid MBR is required in order to get the BIOS Compatibility Module (CMS) to initialise hardware (video & wifi) so they work with Linux/Windows.

GRUB can be installed to the Linux partition to enable booting the other distros, although ongoing maintenance of Kernels may be an issue.

PUBG Crashing

Recently I resolved 2 types of crashes occurring in PUBG:

1. Crashing display driver caused by PSU

No Signal message appears on the black screen of the monitor when the NVIDIA display driver crashes and the system reverts/recovers to the Microsoft Basic Display driver. This would happen within a few minutes of starting the game, sometimes while still in the lobby, sometimes a few minutes into a game. It would not occur if connecting to the onboard DVI connector (accelerated graphics are still available as long as a monitor is detected on the GPU card). System Event Log reported the following warning from source Display:

"Display driver nvlddmkm stopped responding and has successfully recovered"

The cause was because the power supply only provided 11A on the 12v yellow power rail, which is insufficient to properly power the 6-pin connector on the GTX 1060 from Asus. Upgrading to a power supply with 18A available on the 12v connector fixed the problem. The 6-pin connector is expected to deliver up to 75W, see here for details: https://graphicscardhub.com/graphics-card-pcie-power-connectors/

This problem was only affecting me in PUBG - it must push the graphics card harder than most titles. After upgrading the power supply I have got through many games without a single crash.

2. Corrupted Data - OK

The second problem was getting disconnected with a "Corrupted Data" message in the middle of games. This occurred after having some bad sectors on my disk, even after verifying files in Steam. Backed up the game within Steam, then deleted the game. I didn't want to download another 17GB so I restored from the backup. Problem solved!

Our new tech blog launched

New articles on tech can be read here: http://www.digitalfoundations.com.au/blog

Macbook Pro with Nvidia 320M black screen after sleeping

After a recent update some time around March 2016, a Macbook Pro with Nvidia 320M GPU running Ubuntu 15.10 would stop waking from sleep - the keyboard would light up but the screen remained off.

It is running Linux 4.2.0-35-generic with Nvidia 340.96 binary driver installed.  Trying to modprobe the nvidia module produces the error:

modprobe: ERROR: ../libkmod/libkmod-module.c:816 kmod_module_insert_module() could not find module by name='nvidia_340'
modprobe: ERROR: could not insert 'nvidia_340': Function not implemented

Trying earlier recent kernel & nvidia versions did not yield any success.

The Workaround

Install gcc-4.9 and adjust links to use 4.9 versions for:

/usr/bin/gcc

/usr/bin/gpp 

Ref:
https://devtalk.nvidia.com/default/topic/902950/linux/-solved-faulty-340-9x-drivers-with-kernels-4-2-x-and-4-3-x/

EF Falcon specifications

Engine oil: ESE M2C 153E API CLASS SG/CD,SG/CE Grade: 15W/40 (preferred),  15W/50, 20W/40, 20W/50, 25W/50 (Motorcraft R1 300-5L)
 6cyl: 5.5L
 8cyl: 5L

Manual transmission: 1.9L
 ESR M2C 163A (Dexron II) - ATF (Motorcraft R1-36)

Auto trans fluid: 4.0L
 Castrol TQ-95 (recommended)
  (TQ 95 is also suitable for power steering systems where General Motors or Ford type fluids are recommended)
 Shell ATF XTR
 Valvoline ATF Type 95LE
 Mobil ATF 95LE

Power steering fluid: 0.95L
 ESR M2C 163A (Dexron II) (Motorcraft R1-36)
 or  DEX III or Type F or TQ-95

Sintron 3D Printer Kossel Mini Reprap review

**DO NOT BUY this printer **

• No assembly instructions are provided with the components
• The instructions are only provided when you email the seller
• The instructions provided are for a different kit that has many different components
• The instructions provided are incomplete
• Does not show how to mount the printing bed
• Does not detail the connections correctly
• Does not detail the process of setting up the firmware
• The photo shown on the Ebay listing is not a working printer - the top platform is not mounted with the tensioning screws and there are a lot more wires!
• The design of the "auto-levelling probe" is unworkable - again configuration is not detailed in the instructions, but the main problem is that is simply too flimsy and grabs in the slot provided.
• Some of the nuts on the extruder holder cannot fit due to misshaped parts.
• The tie-rod ends bind and cause the extruder to jump.
• The aluminium arms do not tighten firmly against the plastic unless some of the plastic is filed off.
• Several of the nuts & bolts bind and are defective. The screws are obviously cheap and don't fit common drivers well.  Not enough washers were supplied.
• My unit was supplied with a faulty PTC fuse for the heat bed.

I am very dissatisfied with this printer.  Getting to the point of testing the printer has taken weeks, far longer than it should have.  The screws holding the tie-rod ends are not a neat fit and the binding on the tie-rods at the outer reaches of the printer causes the print head to jump and jerk the whole machine. The heating of the heat-bed has caused the stepper motors to get very hot and distort the corner pieces - now the stepper motors are angled which is distorting the drive belt.

The printer parts seem to be assembled in China and the design is of poor quality.
What a piece of crap!

If you have bought this printer....:

Here is how I mounted the top corners so that you can tension the belts - take care to install the corner pieces the right way up (nut hole towards the bottom):

You will need to cut the belts (this isn't explained in the instructions).  I think this uses washers that were supposed to be used for mounting the heat bed... need to find some more for there.  

Try to mount the heat bed away from the stepper motors (i.e. somehow lift it ~10mm).

Measure the heights from the bottom corners to the tops - these should all be the same to indicate the aluminium poles are inserted all the way in the bottom pieces. This is required to ensure a flat base platform which is essential to get the printing started.

Download the latest (1.6) Arduino software from www.arduino.cc - the 1.0.5 version gave me unresolvable G++ errors on my Linux system.  Use the Arduino software to compile & upload the Marlin firmware over USB - you will need to correct a few code errors - adding spaces or commenting out some lines.

Install Printrun, which provides Pronterface which can be used to send G-codes to control the printer. When you have Printrun working execute some commands to put the head near the plate like:

G28 ; find the home position (top)

G1 X0 Y0 Z50 ; go to 50mm above the bed

 - then step down towards zero - you will need to modify MANUAL_Z_HOME_POS in Configuration.h firmware file to calibrate the correct height of your printer.  Carefully send the printer to various positions to check your platform is level.

Install Slic3r which can be used to "slice" a STL file into G-code.

Configure Exim on Debian Wheezy

apt-get install exim4

To support recent IOS devices you need to generate a 2048-bit SSL certificate.

Add TCP port 587 to the listening ports by editing /etc/default/exim4.

To support local account authentication for SMTP over SSL submission port 587 uncomment out the sslauthd section, ref: https://wiki.debian.org/Exim%C2%A0

Exim defaults to IPv6 before IPv4. To ensure you can send mail to Gmail accounts and other systems review Google's identification guidelines: https://support.google.com/mail/answer/81126?p=ipv6_authentication_error&rd=1#authentication

To disable IPv6:

nano /etc/exim4/exim4.conf.template

   disable_ipv6 = true

update-exim4.conf

/etc/init.d/exim4 restart

Alternatively, you can disable just IPv6 DNS by only using the IPv4 DNS:

    dns_ipv4_lookup = *

If receiving email from the Internet, greylisting is a fairly effective anti-spam technique. Install greylistd and adjust the RetryMin to 60 (to minimise delays) and use greylistd-setup-exim4 to change the netmask to 16 to minimize issues with mail from large organisations such as Google, Yahoo and ISP's who use multiple servers for sending.

To use SpamAssassin with Exim, the easiest way is to install exim4-daemon-heavy and spamassassin.  The daemon-heavy package is required because it provides the exiscan-acl feature which allows the data content to be scanned during receival. Copy the applicable block from here into exim4.conf.template: https://wiki.bitlair.nl/Pages/Projects/Mailserver_with_Debian,_Exim,_spamassassin,_greylistd,_DKIM,_SRS,_SPF,_DMARC,_forwarding,_LDAP,_dovecot,_LMTP,_disk_crypto#Exim_spamd_integration

If setting up a Backup MX, you will probably want to create a file containing a list of email addresses to accept mail for since they are not local users. Be aware there is a bug in the exim4.conf.template if you use CHECK_RCPT_LOCAL_ACL_FILE because update-exim.conf will insist you use a ACL name in the file, but that will cause the acl_check_rcpt to return an implicit deny, stopping all incoming emails since it no longer reaches the accept that is at the end of that ACL. Just add the deny line into the template near that section. E.g:

deny
 message That user is not in my list.
 !recipients = /etc/exim4/recipients_whitelist

Run your own DynDNS server on Debian Linux

This outline assumes you own your own domain and manage the DNS servers running Debian Wheezy or Jessie with:

• bind9 for DNS
• lighttp for webserver
• php5

apt-get install bind9

 - configure your zone.

apt-get install lighttp php5-cgi

Configure SSL:

 lighty-enable-mod ssl

 openssl ...

Configure authentication:

 lighty-enable-mod auth

 echo username:realm:`md5sum password | cut -b -32` >> /etc/lighttpd/.htpasswd/htdigest.user

Enable PHP:

 lighty-enable-mod fastcgi

 lighty-enable-mod fastcgi-php

Configure Virtual Hosting:

 lighty-enable-mod simple-vhost

 mkdir -p /srv/yourdomain.com/htdocs/update

Copy nsupdate.php from:

 https://github.com/chip-rosenthal/web-nsupdate

Modify the nsupdate.php:

 nsupdate -l

Allow www-data to read the session key to perform updates:

 chgrp www-data /var/run/named/session.key

 chmod g+r /var/run/named/session.key

Installing Horde on Debian Jessie

Starting with base system installed.
Install the Email server (MTA):
We need a working mail system, here we use sendmail with dovecot providing IMAP:
 apt-get install sendmail

Configure domain & SMTP settings:
 nano /etc/mail/local-host-names
   mydomain.com
 nano /etc/sendmail.mc
   MASQUERADE_DOMAIN(mydomain.com)
 make -C /etc/mail
 /etc/init.d/sendmail reload

Install an IMAP provider:
 apt-get install dovecot-imapd
Allow plaintext authentication temporarily (or configure TLS certificate?):
 nano /etc/mail/...
Test a local user authentication:
 telnet 143
 a login
 b select inbox

Install the web server:
 apt-get install apache2

Install the database server:
There are no instructions or guides explaining how to use sqlite, so we will use postgresql since it has fewer dependencies than mysql. We need to create a user and a blank database that will be used by Horde.
 apt-get install postgresql
  su - postgres
  psql
  ALTER USER horde PASSWORD 'new-password';
  CREATE horde
  \q
Test the new postgresql user:

psql -U horde -W 

Install Horde:
 apt-get install php-horde-webmail
 apt-get install php5-postgres
 webmail-install
 cd /etc/horde/imp
 cp backends.php backends.local.php
 nano backends.local.php
  (remove unnecessary lines)
  (change the imap 'secure' setting from 'tls' to 'no security')
 /etc/init.d/apache2 restart

Try to log in via web interface, using a local user account:
 http://server/horde/

Create an Administrator:
 ???
*Debian php-horde includes a script at /usr/share/php/data/horde/scripts/sql
that sets an Administrator user, but it's use is not documented.

Try to access the admin site:
 http://server/horde/admin/config

Enable SMTP
Set up the receive domain:
 nano /etc/mail/local-host-names
   mydomain.com

Set up the email address aliases:
 nano /etc/mail/aliases
  aliasname: username

Enable SMTP daemon to listen on all IP addresses:
 nano /etc/mail/sendmail.mc
   DAEMON_OPTIONS(`Family=inet,  Name=MTA-v4, Port=smtp, Addr=0.0.0.0')dnl

 /etc/init.d/sendmail restart

LXDE lxpolkit no session for pid

301 - This page has moved permanently to http://www.digitalfoundations.com.au/blog/lxde-lxpolkit-no-session-for-pid

CD-ROM won't mount, I/O error dev sr0 sector

Some CD's I have burnt myself do not mount in Sabayon Linux. dmesg shows the following errors:

end_request: I/O error, dev sr0, sector nnnnnnn

Buffer I/O error on device sr0, logical block nnnnnnn

 Specifying the type (iso9660) and uid & gid allows the CD's to mount:

sudo mount -t iso9660 /dev/sr0 /media/cd -o uid=`id -u`,gid=`id -g`

Not sure if this is a result of the media (Imation) or Linux/Windows burning - suspect it is the Gnome Disk Utility - Disk Image Writer.

Plymouth splash not correct in Sabayon

After a Sabayon 13 update in May 2015, new artwork is locked in the initrd file system.  Dracut builds of the initramfs kernal image file system are not used by the system.

To repair Plymouth functionality:

• Remove dracut
• Install updated gcc package
• Install genkernel-next
• Set the preferred theme in /etc/plymouth/plymouth.conf
• Backup the current initramfs file
• Run genkernel initramfs
• Reboot

xdg-su not decorated with theme

LXDE on OpenSuse 13.2 uses xdg-su ass the GUI frontend to run applications using sudo. If it can't load gnomesu or kdesu then it presents a bland undecorated xterm window. This can be neatened by simply installing libgnomesu which is small with only 1 dependancy (it doesn't need a full gnome desktop!).

Install Screengrab for screenshots on OpenSuse

LXDE doesn't have a default screenshot grabber. Here's how to install Screengrab from source on OpenSuse 13.2:

Download the source code from:

• http://screengrab.doomer.org/download/

Install dependencies to make the binaries:

• libqt4-devel
• gcc
• gcc-c++
• cmake

 Compile and install:

• cd ~/Downloads/Source/screengrab*
• mkdir build
• cd build
• cmake ../
• make
• sudo make install

The binaries are installed to /usr/local. 
A bug puts the libraries in the wrong location, we need to correct it:

• sudo mv /screengrab /usr/local/

The source package does not create a start menu shortcut, we need to create it manually:

•  leafpad ~/.local/share/applications/screengrab.desktop

[Desktop Entry]
Name=Screengrab
Comment=Capture screenshots
GenericName=Screengrab
Exec=screengrab
Icon=screengrab
Terminal=false
StartupNotify=true
Type=Application
Categories=Graphics;

Enjoy!

Remember screen brightness running Linux on MacBook

Running Sabayon Linux, with systemd, on a MacBook, the LCD backlight always resets to maximum brightness after reboot. This is an annoyance as it becomes necessary to adjust the brightness every time it is necessary to reboot the laptop.

To get the system to remember the brightness setting:

1. Create a script that can save or restore the setting when called with a parameter.
2. Create a (systemd) service that calls the script to save the setting on shutdown and restore the setting on startup.

Script: /usr/local/bin/my-settings.sh

#!/bin/sh
# Saves and restores settings for LCD and keyboard backlights.
if [ -z $1 ]; then
    echo "Usage: my-settings.sh [save|restore]"
fi
# Set variables:
export LCD_BRIGHTNESS="/sys/devices/virtual/backlight/apple_backlight/brightness"

# Save setting:
case $1 in
 "save")
    echo Saving settings...
    # if the settings folder does not exist, create it
    if [ ! -e /etc/my-settings ]; then
     mkdir /etc/my-settings
    fi
    # if the LCD_BRIGHTNESS file exists, then save a copy:
    if [ -e $LCD_BRIGHTNESS ]; then
     cat $LCD_BRIGHTNESS > /etc/my-settings/lcd
    fi
    ;;

 "restore")
    # if saved setting exists, if LCD_BRIGHTNESS exists, echo the contents into the system device:
    if [ -e /etc/my-settings/lcd ]; then
     if [ -e $LCD_BRIGHTNESS ]; then
      cat /etc/my-settings/lcd > $LCD_BRIGHTNESS
     fi
    fi
    ;;
esac

===============

Systemd service: /usr/lib/systemd/system/my-settings.service:

[Unit]
Description=Load/Save Keyboard & LCD backlight settings

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/sh -c "/usr/local/bin/my-settings.sh restore"
ExecStop=/bin/sh -c "/usr/local/bin/my-settings.sh save"

[Install]
WantedBy=multi-user.target

================

Enable the script and service:

chmod +x /usr/local/bin/my-settings.sh
systemctl enable my-settings.service
systemctl start my-settings

Monitor fans on HP Proliant ML150 G3 running Debian Lenny Linux

(This blog is in reference to a Debian Lenny AMD64 system)
hp-health is the package that is supposed to provide access to the fan status on HP Proliant servers.  It is not easy to install hp-health on Debian Lenny.  The ISO can be located by searching the HP website.

On my system the existence of 2 files for UPS monitoring software Winpower causes ldconfig error messages:

• /usr/lib/libjspTru64Alpha.so
• /usr/lib/libjspAixPpc.so

 - you can try to temporarily move the files during installation/removal of hp-health, but this didn't help due to the following errors.

Having VMware Server 2 installed confuses the hp-health init script (/etc/init.d/hp-health), which is designed to have different behaviour for ESX servers.  Applying an exit workaround in the procedure causes the script to appear to behave correctly, but the daemon fails to start.

Uninstallation of hp-health is also fraught with difficulty. It is necessary to alter the exit code on the init script just to get the script to continue with removal.  The script will fail to remove /opt/hp/hp-health (and will attempt to remove /opt !).  If you need to manually change the installation status you will need to edit /var/lib/dpkg/status to remove the hp-health section.


After doing all the work above it was found that ipmitool could easily be installed:

apt-get install ipmitool
modprobe ipmi_msghandler
modprobe ipmi_devintf
modprobe ipmi_si

 And the fan RPM's are shown with:

ipmitool sdr type fan

(it takes a few seconds to probe).

Automate PDF printing from batch file command line

Adobe Reader is not suitable for printing PDF files using a batch file because it remains open after the print is done and there is no simple, safe & reliable mechanism to close it.  Instead use Ghostscript commandline as shown below:

gswin32c -dPrinted -dBATCH -dNOPAUSE -dNOSAFER -q -dNumCopies=1 "C:\test.pdf"

*Must be a recent version of Ghostscript, e.g. 9.x

GParted does not start in LXQt

Symptom: Clicking on GParted launcher has no effect. Log /var/log/messages shows:

The value for environment variable TERM contains suscipious content ...

The cause was having set the TERM variable using LXQt Session Settings, Default Applications, Terminal Emulation to /usr/bin/lxterm.  Changing back to xterm and logging out-in fixed the issue.