My Web Tool

Switching Mail Transfer Agent (MTA) on Plesk

2011-07-01T23:22:00.000-07:00

You can switch your Mail Transfer Agent (MTA) on Plesk Panel. Either, Qmail to Postfix OR Postfix to Qmail (vice versa).

1.) First, you have to check the current Mail Transfer Agent (MTA) which is installed on your Plesk server using Plesk utility mailmng:

In the command line just type the following command:

#/usr/local/psa/admin/bin/mailmng --features | grep SMTP_Server

$features['SMTP_Server'] = "QMail";
$features['SMTP_Server_package'] = "psa-qmail";

#/usr/local/psa/admin/bin/mailmng --features | grep SMTP_Server

$features['SMTP_Server'] = "Postfix";
$features['SMTP_Server_package'] = "postfix";

2.)Switching MTA to Postfix using the following command:

#/usr/local/psa/admin/sbin/autoinstaller --select-release-current --install-component postfix

3.) Switching MTA to Qmail using the following command:

#/usr/local/psa/admin/sbin/autoinstaller --select-release-current --install-component qmail

That's all!

Automatic Amazon Web Simple Storage Service (AWS3) Backups

2011-06-27T09:54:00.000-07:00

1.) First, you have to set up encryption by using the gpg (GNU Privacy Guard) tool. GPG works by creating two key files:

Public key (pubring.gpg) – Used to encrypt your data. It doesn’t matter who sees this.
Private key (secring.gpg) – Used to decrypt your data. This file must be kept safe and only seen by you.

The two files it creates are essentially a pair. Files encrypted by a public key can only be decrypted by the corresponding private key. If you lose your private key, you will not get your files back, ever. So, let’s get to it!

In your command line, type the following:

sudo gpg --gen-key

You’ll be walked through a few options for your key, select the following:

Key type – DSA and Elgamal (Default)
Key size – 2048 bits (Again, the default)
Expiration – Do not expire (Not necessary for what we’re doing as you won’t be sharing the public key with anyone).
Name, Comment and Email – You can enter whatever you like here, but do take a note of them

somewhere. They’ll help you remember which key is which if you create multiple keys later. In here, the following values were used:

Name: Branz Balugo
Comment: domain.com
Email: myemailaddress@gmail.com

Password (gpg passphrase) – Make sure you remember whatever you type, there’s no way to get it back if you forget! The password (gpg passphrase) used here was: s3cr3t
When it talks about “generating entropy” to make the key, it means that the server needs to be in use in order for it to get some random numbers. Just go refresh a webpage on the server a few times, or run some commands in another terminal window.

When your key is made, you’ll see a few lines about it. The important one looks like this:

pub 1024D/2A72DARB 2010-09-16

The 2A72DARB is the part you need. That’s your gpg key ID, and you’ll need it later!
If you do end up forgetting your gpg key ID though, it’s easy enough to get that back. Just type:

sudo gpg --list-keys

That’s our encryption set up and is now ready to use!

NOTE: The keys generated will be stored in your home directory, under the .gnupg sub-directory.

2.) Sign up for AWS3 (which is already done).
You should have the following:

username: P!N4K4GWAPONG4T4W0
password: batiUUkagXv2UEndagwayXWqYc2WS8CVaXpangitK0n6+wm
bucket_name: com.sym.backups.domain

3.) Install Duplicity (if it's not installed)
Enter the following command (yum is specific to Red Hat and its derivatives, like Fedora):

sudo yum install duplicity

Now with it installed, we just have to create a script that tells it how to run.

4.) Our Duplicity backup script (backup_aws3)

Here is how we want to set it up:

Encrypt with our GPG key.
Backup to an Amazon s3 “bucket” (a bucket on s3 is like a folder).
Make an incremental backup every day.
Make a full backup if it’s been more than 2 weeks since our last full backup.
Remove backups older than one month.

Now, create a file (that will contain the backup script) in your home directory as,

nano backup_aws3

where backup_aws3 is the script's filename and then enter the following lines:

#!/bin/sh

config_file=$1 # Config file specified at command prompt
if [ -e "$config_file" ]
then
echo "--- Reading config file ($config_file) ---"
username=`grep username $config_file | awk '{ print $2 }'`
password=`grep password $config_file | awk '{ print $2 }'`
bucket_name=`grep bucket_name $config_file | awk '{ print $2 }'`
gpg_passphrase=`grep gpg_passphrase $config_file | awk '{ print $2 }'`
gpg_key=`grep gpg_key $config_file | awk '{ print $2 }'`
backup_folder=`grep backup_folder $config_file | awk '{ print $2 }'`
echo "--- done ---"
echo "--- Exporting environment variables ---"
export PASSPHRASE=$gpg_passphrase
export AWS_ACCESS_KEY_ID=$username
export AWS_SECRET_ACCESS_KEY=$password
echo "--- done ---"
echo "--- Looking for backup files older than 1 month for
deletion ---"
# Delete any file older than 1 month
duplicity remove-older-than 1M --encrypt-key=$gpg_key --sign-key=$gpg_keys3+http://$bucket_name
echo "--- done ---"
echo "--- Doing a regular backup (will do a full backup if past 14 days) ---"
# Make the regular backup
# Will be a full backup if past the older-than parameter
duplicity --full-if-older-than 14D --encrypt-key=$gpg_key --sign-key=$gpg_key $backup_folder/ s3+http://$bucket_name
echo "--- done ---"
export PASSPHRASE=
export AWS_ACCESS_KEY_ID=
export AWS_SECRET_ACCESS_KEY=
else
echo "Configuration file does not exist!"
echo "Usage: $0 <configuration file>"
fi

and then save it. Now, you need to change its file permission mode so that it becomes
executable, by typing the following command:

chmod a+x backup_aws3

NOTE: This script has to be specified with a configuration file (say, backup_aws3.cfg) as its parameter when invoked. So create the configuration file as follows:

nano backup_aws3.cfg

where backup_aws3.cfg is the name of the configuration file, and then enter the following lines:

username: P!N4K4GWAPONG4T4W0
password: batiUUkagXv2UEndagwayXWqYc2WS8CVaXpangitK0n6+wm
bucket_name: com.sym.backups.domain
gpg_passphrase: s3cr3t
gpg_key: 2A72DARB
backup_folder: /home/admin/backups
restore_folder: /home/admin/restore

where 2A72DARB is your gpg key ID generated above and then save it. To run the script on the command line, simply type the following:

./backup_aws3 backup_aws3.cfg

5.) Finally, run the script via crontab to automate backups.

To do a backup every 3:30AM of every day, just run the script via crontab like this:

export EDITOR=nano
crontab -e

and once the nano text editor comes up, enter the following on one line:

30 3 * * * /home/admin/backup_aws3 /home/admin/backup_aws3.cfg > /home/admin/backup_aws3.log 2>&1

and then save it. The backup script /home/admin/backup_aws3 will now be run by crontab every 3:30AM of everyday.

RESTORING THE BACKUP FILES

To restore the backup files stored at AWS3 to a specified restore_folder (see its set value in
backup_aws3.cfg) directory, create the following script as,

nano restore_aws3

and then enter the following lines:

#!/bin/sh

config_file=$1 # Config file specified at command prompt
if [ -e "$config_file" ]
then
echo "--- Reading config file ($config_file) ---"
username=`grep username $config_file | awk '{ print $2 }'`
password=`grep password $config_file | awk '{ print $2 }'`
bucket_name=`grep bucket_name $config_file | awk '{ print $2 }'`
gpg_passphrase=`grep gpg_passphrase $config_file | awk '{ print $2 }'`
gpg_key=`grep gpg_key $config_file | awk '{ print $2 }'`
restore_folder=`grep restore_folder $config_file | awk '{ print $2 }'`
echo "--- done ---"
echo "--- Exporting environment variables ---"
export PASSPHRASE=$gpg_passphrase
export AWS_ACCESS_KEY_ID=$username
export AWS_SECRET_ACCESS_KEY=$password
echo "--- done ---"
echo "--- Restoring backup files to $restore_folder directory ---"
duplicity s3+http://$bucket_name $restore_folder/ --encrypt-key=$gpg_key --signkey=$
gpg_key
echo "--- done ---"
export PASSPHRASE=
export AWS_ACCESS_KEY_ID=
export AWS_SECRET_ACCESS_KEY=
else
echo "Configuration file does not exist!"
echo "Usage: $0 <configuration file>"
fi

and then save it. Now, you need to change its file permission mode so that it becomes executable, by typing the following command:

chmod a+x restore_aws3

NOTE: This script has to be specified with a configuration file (say, backup_aws3.cfg) as its
parameter when invoked. To restore your backup files from AWS3 to restore_folder directory,
run the following command:

./restore_aws3 backup_aws3.cfg

IMPORTANT: Since your backup script will be run by your admin account via crontab and
your restore script will be run manually via command line, make sure that the .gnupg sub-directory,
which contains the keys, is present in admin's home directory. Also, the backup/restore script and its configuration file must be referred to using full path specification as
/home/admin/backup_aws3 (or /home/admin/restore_aws3) and
/home/admin/backup_aws3.cfg.

MOST IMPORTANT: BACKUP YOUR KEYS!!!

The duplicity-encrypted backups that you store will NOT be usable unless you have your gpg secret
key. Therefore it is important that you keep a copy of that key somewhere besides the system on
which your original data resides on. To export your public and private (secret) keys, run these
commands:

For the Public Key, enter:

gpg -ao public-key-domain.com --export 2A72DARB

For the Private (Secret) Key, enter:

gpg -ao secret-key-domain.com --export-secret-keys 2A72DARB

where 2A72DARB is your gpg key ID.

and then store the "public-key-domain.com" and "secret-key-domain.com" files that
you created somewhere safe, like a CD-ROM in a safe deposit box, etc.

References:

Configuring Apache HTTPD Web Server

2011-06-26T23:12:00.000-07:00

This configuration used Apache Mongrel Proxy to redirect the TWO subdomains:

team.domain.com to https://www.domain.com/myteam/Team.html
and
teamadmin.domain.com to https://www.domain.com/myteam/TeamAdmin.html

1.) First you need to edit /etc/httpd/conf/httpd.conf file (i.e., sudo nano /etc/httpd/conf/httpd.conf) and enter the following lines just before the line, ”# UserDir: The name of the directory that is appended onto a user's home...”:

<Directory "/var/www/vhosts/team.domain.com">
Options FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>

<Directory "/var/www/vhosts/teamadmin.domain.com">
Options FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>

and right after the line, “include /etc/httpd/conf/test/*.conf,” (Note that the TEST directory in /etc/httpd/conf/test/*.conf file is the directory which your DOMAIN configuration file is located).

Then add the following lines:

<VirtualHost *:80>
ServerAdmin myemailaddress@gmail.com
DocumentRoot /var/www/vhosts/team.domain.com
ServerName team.domain.com
ErrorLog logs/team.domain.com-error_log
CustomLog logs/team.domain.com-access_log common
</VirtualHost>

<VirtualHost *:80>
ServerAdmin myemailaddress@gmail.com
DocumentRoot /var/www/vhosts/teamadmin.domain.com
ServerName teamadmin.domain.com
ErrorLog logs/teamadmin.domain.com-error_log
CustomLog logs/teamadmin.domain.com-access_log common
</VirtualHost>

2.) Create the directories /var/www/vhosts/team.domain.com (i.e., mkdir -p
/var/www/vhosts/team.domain.com) and /var/www/vhosts/teamadmin.domain.com (i.e., mkdir -p /var/www/vhosts/teamadmin.domain.com).

3.) Create the files /var/www/vhosts/team.domain.com/.htaccess (i.e., sudo nano
/var/www/vhosts/team.domain.com/.htaccess) with the following entry:

RewriteEngine on
RewriteRule ^(.*)$ https://www.domain.com/myteam/Team.html

and /var/www/vhosts/teamadmin.domain.com/.htaccess (i.e., sudo nano
/var/www/vhosts/teamadmin.domain.com/.htaccess) with the following entry:

RewriteEngine on
RewriteRule ^(.*)$ https://www.domain.com/myteam/TeamAdmin.html

(Note that the https://www.domain.com/myteam/Team.html and https://www.domain.com/myteam/TeamAdmin.html, is just an example for this tutorials).

4.) Since I used Apache Mongrel Proxy, then we have to edit /etc/httpd/conf/team/mongrel_proxy.conf file (i.e., sudo nano
/etc/httpd/conf/team/mongrel_proxy.conf) and enter the following lines right after the
line, “RewriteRule . /system/maintenance.html [L]”:

RewriteCond %{HTTPS} off
RewriteRule . https://%{HTTP_HOST}%{REQUEST_URI}

The above lines insure that everything will be accessed via https (forcibly)!

5. For the installation of SSL certificates obtained from your domain registrar like GoDaddy, refer to the following documents:

6. Finally, restart the Apache httpd web server (i.e., sudo /etc/rc.d/init.d/httpd restart).

Configuring the BIND Name Server

2011-06-23T04:27:00.000-07:00

1.) First you need to edit /etc/named.conf file (e.g. sudo nano -w /etc/named.conf) and enter the following:

options {
directory "/var/named";
pid-file "/var/run/named/named.pid";
dump-file "data/cache_dump.db";
statistics-file "data/named_stats.txt";
memstatistics-file "data/named_mem_stats.txt";

forwarders {
4.2.2.1;
4.2.2.2;
};

listen-on port 53 { 127.0.0.1; 1.2.3.4; 5.6.7.8; };
listen-on-v6 port 53 { ::1; };
  allow-query { 127.0.0.1; 64.6.231.1; 64.6.231.2; };
allow-recursion { 127.0.0.1; 64.6.231.1; 64.6.231.2; };
  auth-nxdomain yes;
check-names master ignore;
};

logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
  channel log_zone_transfers {
file "/var/log/named/axfr.log";
print-time yes;
print-category yes;
print-severity yes;
};

category xfer-out { log_zone_transfers; };
category lame-servers { null; };
};

zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";

zone "domain.com" {
type master;
file "/var/named/.com.db";
allow-query { any; };
allow-update { key "rndckey"; };
};

key "rndckey" {
algorithm hmac-md5;
secret "+z2YW71pGwapo6A2Ko5/xQ==";
};

controls {
inet 127.0.0.1 allow { localhost; } keys { "rndckey"; };
};

Where;

1.2.3.4 and 5.6.7.8 are the IP addresses of the network interfaces of the server (issue the command ifconfig at the prompt to see them);
domain.com is the name of the domain (replace it with your domain).
the rndckey entry was generated using the command rndc-confgen (you should also create the file /etc/rndc.conf with entries specified in the rndc-confgen command output); and
4.2.2.1 and 4.2.2.2 are publicly available name servers we used as forwarders (i.e., if our name server cannot answer a DNS query, it will be forwarded to these name servers.

2.) Now, create the file /var/named/domain.com.db (e.g. sudo nano -w
/var/named/domain.com.db) and enter the following:

$TTL 86400
domain.com. 86400 IN SOA ns1.domain.com. me.domain.com. (
2010091401 ;Serial Number
7200 ;refresh
1800 ;retry
2419200 ;expire
86400 ;minimum
)

$TTL 259200
domain.com. 259200 IN NS ns1.domain.com.
domain.com. 259200 IN NS ns2.domain.com.

$TTL 86400
domain.com. 86400 IN A 1.2.3.4
domain.com. 86400 IN MX 0 mail.domain.com.

$TTL 86400
mail 86400 IN A 1.2.3.4
ns1 86400 IN A 1.2.3.4
ns2 86400 IN A 5.6.7.8
www 86400 IN A 1.2.3.4

3.) Finally, restart the BIND name server (i.e., sudo /etc/rc.d/init.d/named restart). At this point, you should have set the name servers (ns1.domain.com and ns2.domain.com) for your domain (domain.com) at your domain registrar.