How to set up keyword block in Exim on Debian

Exim can be configured to block emails containing key words, as a method to fight spam. Obviously this is not a comprehensive solution, but can assist in stopping persistent spammers and decreasing the load on SpamAssassin processing when running in parallel.

These instructions are for Debian 8 Jessie, but should apply similarly to Stretch(9) and Buster(10), which use the Exim split configuration.

Edit the config template file: /etc/exim4/exim4.conf.template

We are using the DATA access list (ACL) so scroll down to the section:

### acl/40_exim4-config_check_data
#################################

There may be a number of existing rules in this section, we'll insert our rules after this entry:

# require that there is a verifiable sender address in at least
# one of the "Sender:", "Reply-To:", or "From:" header lines.
.ifdef CHECK_DATA_VERIFY_HEADER_SENDER
deny
  message = No verifiable sender address in message headers
  !acl = acl_local_deny_exceptions
  !verify = header_sender
.endif

 Insert the following text:

# Deny keywords using regex before using Spamassassin:
# Ref: https://www.exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html
  deny
    message = Message rejected as spam or Unroutable address
    regex = Keyword1|Keyword2|Keyword3|...

Change keywords to match words you would like to block. Note this is a case sensitive, regex expression - customise the regex line as required. The message is logged and also sent back to the offending sender.

Update the Exim configution:

update-exim4.conf

Restart the Exim service:

service exim4 restart

Send a test email containing one of the keywords to test.

Upgrading Macbook to High Sierra

Trying to upgrade a Macbook Pro 7.1 (mid-2010) from Sierra to High Sierra failed with several cryptic error messages. This laptop had been upgraded with a Crucial SSD and non-Apple RAM modules, and is configured to dual-boot Linux with rEFInd boot loader.

TLDR: The EFI system boot partition (ESP) should be of type EF (aka 0xEF, EF00), not 07 (Fat).

We recieved the following errors:

macOS could not be installed on your computer

The installer resources were not found

...

You may not install this volume because the computer is missing a firmware partition

...

Somewhere along the line after Bootcamp was initiated, maybe when the Hybrid MBR was altered with gdisk, or partitions adjusted using Gparted, the partition type for the EFI boot partition was changed from type EFI system (EF) to Fat (07).  The format for EF and 07 types is the same, EF is used to identify it specifically as the EFI partition.  Note: this partition is not required to be of type HFS+ as claimed on some sites.

If you have an old High Sierra Upgrade installer from an old previous attempt it may also help to Trash that installer and re-download from the App Store so that you get the updated messages.

The final partition tables on this Macbook are something like:
Hybrid MBR:
 EE: 1 -> 2148 (Protective MBR indicator)
  (128MB space)
 EF: 2149 -> ... (EFI partition, 200MB)
  (128MB space)
 AF: ... -> ... (macOS, 120GB)
  (128MB space)
 83: ... -> ... (Linux, 80GB)

GPT:
 EE
  (128MB space)
 EF (EFI Boot)
  (128MB space)
 AF (macOS)
  (128MB space)
 AF (Recovery 10.11)
 AF (Recovery 10.12)
 83 (Ubuntu)
 83 (Debian)
 82 (Linux swap)
 07 (Fat32 Shared Data)

(*128MB spaces between partitions is an Apple recommendation)

Configure Exim on Debian Wheezy

apt-get install exim4

To support recent IOS devices you need to generate a 2048-bit SSL certificate.

Add TCP port 587 to the listening ports by editing /etc/default/exim4.

To support local account authentication for SMTP over SSL submission port 587 uncomment out the sslauthd section, ref: https://wiki.debian.org/Exim%C2%A0

Exim defaults to IPv6 before IPv4. To ensure you can send mail to Gmail accounts and other systems review Google's identification guidelines: https://support.google.com/mail/answer/81126?p=ipv6_authentication_error&rd=1#authentication

To disable IPv6:

nano /etc/exim4/exim4.conf.template

   disable_ipv6 = true

update-exim4.conf

/etc/init.d/exim4 restart

Alternatively, you can disable just IPv6 DNS by only using the IPv4 DNS:

    dns_ipv4_lookup = *

If receiving email from the Internet, greylisting is a fairly effective anti-spam technique. Install greylistd and adjust the RetryMin to 60 (to minimise delays) and use greylistd-setup-exim4 to change the netmask to 16 to minimize issues with mail from large organisations such as Google, Yahoo and ISP's who use multiple servers for sending.

To use SpamAssassin with Exim, the easiest way is to install exim4-daemon-heavy and spamassassin.  The daemon-heavy package is required because it provides the exiscan-acl feature which allows the data content to be scanned during receival. Copy the applicable block from here into exim4.conf.template: https://wiki.bitlair.nl/Pages/Projects/Mailserver_with_Debian,_Exim,_spamassassin,_greylistd,_DKIM,_SRS,_SPF,_DMARC,_forwarding,_LDAP,_dovecot,_LMTP,_disk_crypto#Exim_spamd_integration

If setting up a Backup MX, you will probably want to create a file containing a list of email addresses to accept mail for since they are not local users. Be aware there is a bug in the exim4.conf.template if you use CHECK_RCPT_LOCAL_ACL_FILE because update-exim.conf will insist you use a ACL name in the file, but that will cause the acl_check_rcpt to return an implicit deny, stopping all incoming emails since it no longer reaches the accept that is at the end of that ACL. Just add the deny line into the template near that section. E.g:

deny
 message That user is not in my list.
 !recipients = /etc/exim4/recipients_whitelist

Run your own DynDNS server on Debian Linux

This outline assumes you own your own domain and manage the DNS servers running Debian Wheezy or Jessie with:

• bind9 for DNS
• lighttp for webserver
• php5

apt-get install bind9

 - configure your zone.

apt-get install lighttp php5-cgi

Configure SSL:

 lighty-enable-mod ssl

 openssl ...

Configure authentication:

 lighty-enable-mod auth

 echo username:realm:`md5sum password | cut -b -32` >> /etc/lighttpd/.htpasswd/htdigest.user

Enable PHP:

 lighty-enable-mod fastcgi

 lighty-enable-mod fastcgi-php

Configure Virtual Hosting:

 lighty-enable-mod simple-vhost

 mkdir -p /srv/yourdomain.com/htdocs/update

Copy nsupdate.php from:

 https://github.com/chip-rosenthal/web-nsupdate

Modify the nsupdate.php:

 nsupdate -l

Allow www-data to read the session key to perform updates:

 chgrp www-data /var/run/named/session.key

 chmod g+r /var/run/named/session.key

Installing Horde on Debian Jessie

Starting with base system installed.
Install the Email server (MTA):
We need a working mail system, here we use sendmail with dovecot providing IMAP:
 apt-get install sendmail

Configure domain & SMTP settings:
 nano /etc/mail/local-host-names
   mydomain.com
 nano /etc/sendmail.mc
   MASQUERADE_DOMAIN(mydomain.com)
 make -C /etc/mail
 /etc/init.d/sendmail reload

Install an IMAP provider:
 apt-get install dovecot-imapd
Allow plaintext authentication temporarily (or configure TLS certificate?):
 nano /etc/mail/...
Test a local user authentication:
 telnet 143
 a login
 b select inbox

Install the web server:
 apt-get install apache2

Install the database server:
There are no instructions or guides explaining how to use sqlite, so we will use postgresql since it has fewer dependencies than mysql. We need to create a user and a blank database that will be used by Horde.
 apt-get install postgresql
  su - postgres
  psql
  ALTER USER horde PASSWORD 'new-password';
  CREATE horde
  \q
Test the new postgresql user:

psql -U horde -W 

Install Horde:
 apt-get install php-horde-webmail
 apt-get install php5-postgres
 webmail-install
 cd /etc/horde/imp
 cp backends.php backends.local.php
 nano backends.local.php
  (remove unnecessary lines)
  (change the imap 'secure' setting from 'tls' to 'no security')
 /etc/init.d/apache2 restart

Try to log in via web interface, using a local user account:
 http://server/horde/

Create an Administrator:
 ???
*Debian php-horde includes a script at /usr/share/php/data/horde/scripts/sql
that sets an Administrator user, but it's use is not documented.

Try to access the admin site:
 http://server/horde/admin/config

Enable SMTP
Set up the receive domain:
 nano /etc/mail/local-host-names
   mydomain.com

Set up the email address aliases:
 nano /etc/mail/aliases
  aliasname: username

Enable SMTP daemon to listen on all IP addresses:
 nano /etc/mail/sendmail.mc
   DAEMON_OPTIONS(`Family=inet,  Name=MTA-v4, Port=smtp, Addr=0.0.0.0')dnl

 /etc/init.d/sendmail restart

LXDE lxpolkit no session for pid

301 - This page has moved permanently to http://www.digitalfoundations.com.au/blog/lxde-lxpolkit-no-session-for-pid

Monitor fans on HP Proliant ML150 G3 running Debian Lenny Linux

(This blog is in reference to a Debian Lenny AMD64 system)
hp-health is the package that is supposed to provide access to the fan status on HP Proliant servers.  It is not easy to install hp-health on Debian Lenny.  The ISO can be located by searching the HP website.

On my system the existence of 2 files for UPS monitoring software Winpower causes ldconfig error messages:

• /usr/lib/libjspTru64Alpha.so
• /usr/lib/libjspAixPpc.so

 - you can try to temporarily move the files during installation/removal of hp-health, but this didn't help due to the following errors.

Having VMware Server 2 installed confuses the hp-health init script (/etc/init.d/hp-health), which is designed to have different behaviour for ESX servers.  Applying an exit workaround in the procedure causes the script to appear to behave correctly, but the daemon fails to start.

Uninstallation of hp-health is also fraught with difficulty. It is necessary to alter the exit code on the init script just to get the script to continue with removal.  The script will fail to remove /opt/hp/hp-health (and will attempt to remove /opt !).  If you need to manually change the installation status you will need to edit /var/lib/dpkg/status to remove the hp-health section.


After doing all the work above it was found that ipmitool could easily be installed:

apt-get install ipmitool
modprobe ipmi_msghandler
modprobe ipmi_devintf
modprobe ipmi_si

 And the fan RPM's are shown with:

ipmitool sdr type fan

(it takes a few seconds to probe).

Private Debian secure apt repository

Secure apt was introduced in Debian 3 (Sarge) in 2005.  Secure apt requires crypto signing (PGP) of the Release file, not the deb packages.  Without secure apt installation of packages will prompt for verification before installation.

Trivial apt repositories use a simple flat file structure, but do not support "secure apt".  Hence, in order to set up an apt repository that does not prompt for verification of package updates such as a Personal Package Archive (PPA) it is necessary to configure a non-trivial apt repository.

The non-trivial repository file structure must contain:
debian
 + dists
     + { archive, e.g. stable } /Release, Release.gpg(package release info)
         + { component, e.g. main }
             + { architecture, e.g binary-amd64 } /Packages, Packages.gz, Release(architecture release info)
             + source / (if empty, source packages will not be available)
 + pool /*.deb (Packages)


To set up crypto ability on the server install and run gpg. RSA key required, 4096 bytes recommended, if a blank password is used you will not be prompted for a password to sign the Release file.

Notes:

*The package Release file *must* contain a line for "Suite: "

**Create the Packages files *before* creating the package Release file.

To create a package list Release file use an application like apt-ftparchive. Note that the files listed in the Release file must be relative to the debian/dists/{archive} directory. E.g.:
 cd /var/www/debian/dists/stable
 echo "Suite: stable" > Release
 apt-ftparchive release . >> Release

One example method of how to sign the Release file:
 cd /var/www/debian/stable
 gpg --default-key "My key name" -abs -o Release.gpg Release  

To use the repository on a client add a line to /etc/apt/sources.list.d/custom.list:
 deb http://{server}/debian/  {archive}  {component}

To remove the verification prompt on the client export the key from the server, transfer to the client and install to apt:
Server: gpg --armor --export "My key name" > myserver.gpg.key
Client: apt-key add myserver.gpg.key

LXDE Default Browser shortcut link for panel

LXDE includes the "Preferred Applications" (libfm-pref-apps) program to set the preferred web browser. It works by changing the following entry:

~/.local/share/applications/mimeapps.list

[Default Applications]
x-scheme-handler/http=iceweasel.desktop

The problem with this is if you have a shortcut on the LXPanel, or Desktop, then the link is not updated automatically.  Exo-open is designed for XFCE and is ineffective to fix this issue, xdg-open cannot be used in a shortcut unless a parameter is passed - which is no good if you just want to open the browser.

A workaround is to create a new script that uses xdg-mime to query for the default http handler and create a .desktop file that runs this new script:

 sudo nano /usr/local/bin/x-www-mime-browser

#!/bin/sh

# This script uses xdg-mime to check the default browser
# and executes the .desktop from ~/.local/share/applications
# or /usr/share/applications.

URL="$1"
HANDLER=`xdg-mime query default x-scheme-handler/http`
# If handler is customized, extract from .local/... and execute
if [ -f ~/.local/share/applications/$HANDLER ]; then
    `grep Exec ~/.local/share/applications/$HANDLER \\
    | awk -F= '{ print $2 }' \\
    | awk '{ print $1 }';`
else
    `xdg-mime query default x-scheme-handler/http | awk -F. '{ print $1 }'`
fi

 sudo chmod +x /usr/local/bin/x-www-mime-browser
 sudo nano /usr/share/applications/x-www-mime-browser.desktop

[Desktop Entry]
Name=Web Browser (default)
Exec=x-www-mime-browser %u
MimeType=application/x-xdg-web-browser
Terminal=false
Type=Application
Categories=WebBrowser;Other
Icon=web-browser
NoDisplay=false

When using the LXDE Application Launch Bar Settings the "Web Browser (default)" selection will be tucked away under the "Other" category - this will prevent an extra copy visible in the "Internet" category.

Wordpress on Debian Wheezy

1. apt-get install wordpress
2. apt-get install mysql
3. apt-get install sendmail
4. ln -s /usr/share/wordpress /var/www
5. ln -s /usr/share/wordpress /srv/www
6. Create & Run script:
1. cp /usr/.../wordpress/examples/mysql-setup /usr/share/doc/wordpress/examples/mysql-setup2
2. chmod o+x /usr/.../examples/mysql-setup2
3. /usr/.../examples/mysql-setup2
7. Fix permissions: 
1. chown -R /usr/share/wordpress www-data
2. chown -R /var/lib/wordpress www-data
8. Edit /etc/apache2/sites-enabled/000-default
1. RewriteRule ^/wp-content/plugins/var/lib/(.*)$ /var/lib/$1
2. RewriteRule ^/wp-content/(.*)$ /var/www/wordpress/wp-content/%{HTTP_HOST}/$1
9. http://mydomain.name/...
10. Install recommended plugins:
1. Clean and simple contact form
2. Custom meta widget
3. Easy table
4. Lightbox gallery
5. Twenty Eleven Theme Extensions

If plugins don't work check the source from loaded pages to identify incorrect URL's, adjust rewrite rules to fix.

Libre Office won't start on Debian Wheezy

LibreOffice closes after splash screen on Debian Wheezy - if started from a terminal window the following message is visible:

terminate called after throwing an instance of 'com::sun::star::uno::RuntimeException'

To solve this quickly rename the ~/.config/libreoffice directory:

mv ~/.config/libreoffice ~/.config/libreoffice.bad1

Rename Logout on LXDE lxpanel

Edit ~/.config/lxpanel/LXDE/panels/panel

Comment the existing lines and add 3 new lines:

# image=gnome-logout
# command=logout
image=boot
name=Exit
action=lxde-logout

 Reload lxpanel for the change to take effect:

lxpanelctl restart

Debian Wheezy boot splash screens

Grub wallpaper and resolution can be changed by editing
  /etc/default/grub
and running:
 update-grub

The boot splash screen can be enabled by editing
  /etc/default/grub
and adding "splash" to the Grub command line:
  GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"
and running:
  update-grub

The splash will not appear unless a splash package is installed.
The only package available in standard repositories is plymouth:
  apt-get install plymouth-x11

Other external packages:
 Bootsplash - original kernel space implementation
 Usplash - designed to replace Bootsplash, implemented in User space
 Xsplash - used in Ubuntu Karmic to take over from Usplash
 Plymouth - designed to replace Usplash+Xsplash
 Splashy - a Debian project, last updated in 2008, implements splash using framebuffers in user space, not  compatible with startup system in Wheezy.
 Fbsplash - a Gentoo splash implementation, not available for Debian


Once installed, the plymouth splash theme is updated using:
  plymouth-set-default-theme

*When plymouth is removed, it still leaves the theme embedded in initrd.  To complete the removal of plymouth boot splash, update the initrd image:
  update-initramfs

**Wheezy contains a package called "startupmanager" which is described as providing an easy to use interface to update some settings for grub & splash screens - but it does not give correct resolutions and only  has a tick-box to enable or disable splash screen.  startupmanager corrupts /etc/grub.d/00_header by hard-coding a resolution that will prevent GRUB_GFXMODE from working in /etc/default/grub.

***Screen corruption occurs if using Slim display manager when Plymouth is installed.

Debian Touchpad Tap-to-Click

To enable tap-to-click for Synaptic touchpads (including BCM5974 in MacBook Pro) for Debian Wheezy:

su
mkdir /etc/X11/xorg.conf.d
cp /usr/share/X11/xorg.conf.d/50-synaptics.conf  /etc/X11/xorg.conf.d/
nano /etc/X11/xorg.conf.d/50-synaptics.conf

Section "InputClass"
 ...
 Driver "Synaptics"
 ...
 option "TapButton1" "1"
 ...

Restart X.

ifscheme issue in Debian Wheezy

ifscheme in Debian Wheezy appears to have startup issues.  The script may not remember the previous scheme following a reboot; the script may not even run at boot.

To work around the issue I had to change the line in /etc/init.d/ifscheme:

Start-Defaults:  1 2 3 4 5

and also add:

ifup wlan0

 within the top if statement.

Don't clear boot messages when booting Wheezy

By default Debian Wheezy clears the boot messages from the console when the login prompt is displayed.  This makes it more difficult to identify and fix system issues.

To prevent the login prompt from clearing the screen add the "--noclear" switch in /etc/inittab:

1:2345:respawn:/sbin/getty --noclear 38400 tty1

*The line also appears in /usr/share/sysvinit/inittab,
but I didn't need to change this on my system.

VirtualBox with phpvirtualbox on Debian Wheezy

A rough guide to using phpvirtualbox on Debian Wheezy:

Install VirtualBox:

apt-get install virtualbox

Create user vbox, member of group vboxusers:

adduser vbox vboxusers

If using the VirtualBox GUI change the VirtualBox menu item to run as vbox:
(suggest installing lxmenu)

 VirtualBox vbox

 In VirtualBox GUI change the location for VM's:

File -> Preferences -> General -> Default Machine Folder: /home/vbox

Download the Extension Pack from www.virtualbox.org
- this is required to enable remote desktop console access (VRDP/VRDE).
Install the Extension Pack in VirtualBox GUI:

File -> Preferences -> Extensions -> Add package

(Note: you may get an error if you previously installed the Extension Pack before running VirtualBox as user vbox.

Install Apache2 with PHP5:

apt-get install apache2 php5

Download latest phpvirtualbox from http://code.google.com/p/phpvirtualbox/downloads/list
Unzip the file, move phpvirtualbox directory to /var/www/
(using the default Apache folder here - modify as required)
Copy config.php-example to config.php
Edit /var/www/phpvirtualbox/config.php
 - set the lines for $username & $password to match the account 'vbox' created ealier.

Create an init script to start the vboxwebsrv daemon:

cp /etc/init.d/skeleton /etc/init.d/vboxweb
nano /etc/init.d/vboxweb
...
start) ...

/usr/bin/vboxwebsrv -b

 stop) ...

killall vboxwebsrv

Now start the new script:

/etc/init.d/vboxweb start

You should now be able to log in to phpvirtualbox:

http://hostname/phpvirtualbox
Username = admin
Password = admin

File -> Preferences -> Default Machine Folder: /home/Virtualbox VMs
 /home/vbox
OK

 Create a new Virtual Machine.  This configuration currently fails at the point of creating the virtual disk image - to avoid this issue create the virtual machine without a startup disk, then add the disk afterwards.

To enable the remote console, edit the VM settings:
(Extension Pack must be installed under the vbox user - see above)

Settings -> Display -> Remote Display -> Enable Server; Server Port: 3391

(*Recommend not using 3389, in case xrdp is installed on the host).

Note: to use the Remote Desktop console provided through Oracle Extension Pack, the client must have Flash installed.  Screen corruption in the form of unreadable dots may occur if the resolution you connect at is too low.

Note that /etc/init.d/virtualbox runs as root, hence all files will be owned by root.  This may cause problems if you try to locate files in another users home folder (e.g. /home/vbox). To avoid issues with this (even root has limited write access to another users home folder[?TBC]), it may be better to change the default home machine folder to "shared" folder, e.g. "/home/VirtualBox VMs"

To start machines automatically at boot, add lines to /etc/rc.local:

# Start Virtualbox guests:
/usr/bin/VBoxHeadless -startvm Guest1 &
/usr/bin/VBoxHeadless -startvm Guest2 &

Mount error 1: Operation not permitted

The above error was occurring when trying to mount CIFS share on Debian Squeeze with OpenVZ kernel 2.6.32-5.  Another problem that occurs is AutoFS will show top-level shares, but will not allow the shares to be browsed.

This error still occurs 18 months after being reported.  Container virtualization is focused on LXC in Linux - my solution is to abandon OpenVZ.

Changing the kernel back to the non-openvz image fixes the issues.

Samba DC and Windows 7

An incident occurred where Windows 7 clients were giving the error:
"There are currently no logon servers available to service the logon request"
when trying to connect to a Samba 3.4.4 domain controller (eBox). 
The setup had been working fine for approximately 6 months. 
After 1 reboot and many investigations to samba, ldap, DNS configs, IPv6, etc. it was discovered that the nmbd (BIOS name services - WINS) was not stopping when /etc/init.d/samba stop was executed.

Manually killed the service using:
 killall -SIGTERM nmbd
Then everything started working properly again!

Some packet traces revealed the following when trying to re-join a Windows 7 workstation to the domain:
A DNS query is made first.
Followed by NETBIOS-DN name lookups. (UDP port 137)
Followed by the LDAP query.

The server was initialy responding with "ICMP-No response on port 137".
So it looks like in this setup, Samba relies more on WINS(nmbd) than DNS(proper).

Also, we had to comment out the VFS lines in samba.conf,
as described in this post:
http://forum.zentyal.org/index.php?topic=3298.0

Vmware resolution in Linux guest

Add a "Virtual WIDTH HEIGHT" line after the appropriate DEPTH line in /etc/X11/xorg.conf