Local only postfix

I often need to configure postfix to accept email but never forward it anywhere.  E.g., when configuring a backup or test instance of alfresco and I want to see email notifications being sent but I don't want that email to go to real email addresses (a common issue when restoring a production alfresco backup onto a test or dev machine).

A simple way to do all this is:

# if it's already installed.  remove it.  make sure you mean to do this. or back up your configuration

sudo apt-get purge postfix

sudo apt-get install postfix

(and tell it it's an internet server)

 edit /etc/postfix/main.cf and set

virtual_alias_maps = hash:/etc/postfix/virtual
default_transport = error:outside mail is not deliverable
unknown_local_recipient_reject_code = 450

and edit /etc/postfix/virtual, entering any necessary aliases there, e.g.,

@gmail.com tiger
bopolissimus@gmail.com bopolissimus
gerald@catalyst.net.nz gerald

generate the hash:

   postmap /etc/postfix/virtual

and restart postfix:

   sudo service postfix restart

and postfix will now accept email from localhost and forward them to the locally aliased users or to root (if no aliases match)

Because I'm paranoid, I also do the following:

   iptables -A OUTPUT -p tcp --dport 25 -d 127.0.0.1 -j ACCEPT
   iptables -A OUTPUT -p tcp --dport 25 -j DROP
   iptables -A OUTPUT -p tcp --dport 587 -j DROP
   iptables -A OUTPUT -p tcp --dport 465 -j DROP

buntangle

I often work with kannel logs and always get a severe headache when working with bearerbox logs.

I'll need this project in future, when I need to work with bearerbox logs again.

https://github.com/bopolissimus/buntangle

It reads a bearerbox log file, organizes the entries by the third field in the log file (I should read the kannel source so I'll know what that field is called, I just call it the key :-).  It then finds the PDUs in the per_key array (untangled already), and writes out the PDUs in order.

PDUs are written out with newlines before and after so they're much easier to read.

I'll also add a filter program later that will remove PDU types we don't need (generally enquire_link/enquire_link_resp, but possibly also bind_receiver* and bind_transmitter* PDUs, maybe some others).

Find and restore a single document from alfresco backup

I haven't tested this, but it looks good. Must test soon. Preferably before I need to do it against someone's production setup :-) Find and restore a single document from alfresco backup Highlights: Given the filename ${fname}

1. load the database dump into a scratch db
2. sql selects to identify which file on disk corresponds to the file you want (including which version)
3. grab the file from the backup

bandwidth limiting apt-get

I'm doing dist-upgrades to Mint Olivia from Mint-Nadia at home on a weekend. That's not such a great time since on the weekend Timmy likes to view youtube videos. And I think my sister-in-law streams tagalog movies. I could do it at night (and I did, for my first guinea pig laptop last night) but I'd rather get some of that done in the daytime too. Fortunately it's google and commandlinefu.com to the rescue. The magic command line arguments to apt-get are:

-o Acquire::http::Dl-Limit=20 -o Acquire::https::Dl-Limit=20

I could set the limit to 100 or 150 and there wouldn't be much complaint, but I'm setting it to 75 since I don't mind if it takes a while. I do have squid in front, so some of the packages will be in the cache. I'm only going to save about half the bandwidth though since two laptops are i386 and the other two are x64. Ah, but for now, I think even better is rsyncing /var/cache/apt from the other i386 machine to this one.

Ubuntu self-signed SSL cert

cd /etc/ssl/private # or wherever the certs go sudo make-ssl-cert /usr/share/ssl-cert/ssleay.cnf [hostname].crt

Creating a quantal lxc instance

For a while I tried to create a quantal lxc instance by first installing precise and then doing a distribution upgrade. After some documentation reading and reading of the lxc-ubuntu template, it turns out that's not necessary :-).

Instead, I should just:

lxc-create -t ubuntu -n quantal -- --release quantal

Next, to create a wheezy instance :-)

alfresco 4.2.x solr OverlappingFileLockException

In Alfresco 4.2.c (likely also in 4.2.b and 4.2.a), solr comes with

  alfresco.enableMultiThreadedTracking=true

 In the default setup I get:

    14:02:31,502 ERROR [org.alfresco.solr.tracker.CoreTracker] Tracking failed java.nio.channels.OverlappingFileLockException at sun.nio.ch.SharedFileLockTable.checkList(FileLockTable.java:255) at sun.nio.ch.SharedFileLockTable.add(FileLockTable.java:152) at sun.nio.ch.FileChannelImpl.tryLock(FileChannelImpl.java:1017) at java.nio.channels.FileChannel.tryLock(FileChannel.java:1154) ... 

Stopping solr and setting that false for both archive and workspace (archive|workspace)-SpacesStore/conf/solrcore.properties isn't sufficient. There will be other problems with the solr indexes.

So I just blow away the indexes and have them rebuild.

1. stop solr (and/or alfresco)
2. rm -rf archive/SpacesStore/* workspace/SpacesStore/*
3. rm -rf archive-SpacesStore/alfrescoModels workspace/SpacesStore/alfrescoModels
4. start solr (and/or alfresco).

Blowing away the models like that can lead to solr trying to index items for which the models haven't been indexed yet (leading to more solr related log entries). After everything is indexed though, those error logs should not appear anymore and solr will be stable moving forward.

Windows configurations for kerberos (supported encryption types)

Windows configurations for kerberos (supported encryption types)

Alfresco 4.2.c manager/html fix

I've had problems with Alfresco 4.2.c (bundle) because I couldn't get to the tomcat manager.

After editing tomcat-users.conf to add the manager-gui role and a user with the manager-gui role, I still couldn't get to the manager. The browser would jump straight to the Unauthorized page instead of first showing a dialog box for basic auth.

 Thanks to sujaypillai's fix it turns out that the default tomcat configuration in the bundle is broken. Sujay Pillai pointed out the solution. In tomcat/conf/context.xml, comment out the whole securePagesWithPragma valve block.

I thought setting securePagesWithPragma="true" would do the same thing, but it doesn't. Just comment it out then. Then restart, of course.

Quick fix for debian locales error

Thanks for the fix Below is as given in the link except changed country for easy copy-paste when I need this again :-).

export LANGUAGE=en_NZ.UTF-8
export LANG=en_NZ.UTF-8
export LC_ALL=en_NZ.UTF-8

locale-gen en_NZ.UTF-8
dpkg-reconfigure locales

Alfresco 4.2.c, OpenLDAP modifyTimestamp format and timezone

I had a problem with alfresco 4.2.c correctly syncing LDAP users if modifyTimestamp was of the form 20130220195623Z but not syncing them if the format was 20130221233702.687769 It turns out that a large part of the issue was just that the new format (from openLDAP in Lenny, previous was openLDAP in etch) didn't specify Zulu, so it was being interpreted as the local timezone. That's always a problem when you're 12 or 13 hours ahead of GMT (as we are in NZ). And it seems there was a separate bug so that if the timezones didn't match the modifyTimestamp code that alfresco was using was just consistently failing to compare correctly. Even if the modifyTimestamp was weeks before it didn't think it needed to do an LDAP sync. Solution was to specify the timezone offset (although numeric offsets suck since I'll still need to switch them around and restart alfresco twice a year). ldap.synchronization.personDifferentialQuery&(objectclass\=inetOrgPerson)(!(modifyTimestamp<\={0}+1300))) http://forums.alfresco.com/comment/131475#comment-131475

Multiuser pulseaudio in Mint Nadia (and maybe Ubuntu Quantal too)

I upgraded my several home computers to Mint Nadia recently and the audio stopped working the way I wanted.

I run chrome as several different users (a reasonably secure user, an insecure user and myself) and if (in the insecure or reasonably secure browser) a page had audio, I'd have to copy the URL, and paste it into firefox running as myself to hear the audio.

It turns out, Ubuntu Quantal (I'm guessing it's their fault) had changed how to do system mode in pulseaudio. To begin with, we don't even configure pulseaudio in /etc/default/pulseaudio anymore, now it's /etc/init/pulseaudio.conf.

The new way to enable system mode is:

  1. sudo vi /etc/init/pulseaudio.conf
  2. find the "#start on rulevel [2345]" line
  3. uncomment it (remove the #).
  4. restart pulseaudio.

tcpdump between apache and tomcat

I needed to monitor http traffic between apache and tomcat (apache was reverse proxying).

I usually use wireshark so I don't actually know tcpdump parameters or filter format :-).

For this very common use case though:

tcpdump -vv  -A -s 1500 -i lo 'port 8080'

sudoers for secure and insecure

I run browsers as different users.  Previously I didn't need to customize /etc/sudoers since my user had NOPASSWD:ALL.  I'm stepping away from that insecure (but convenient) practice now, so just doing

  sudo -H -u insecure chromium-browser

won't work anymore since it'll require a password, I won't type one in, and it'll fail.

Now I need to add some entries to /etc/sudoers (sudo visudo)

  tiger ALL=(secure,insecure) NOPASSWD: /usr/bin/chromium-browser

and all works again.

RALink wifi drivers

Our new laptop (an HP Pavilion G6-2119TU) has been prone to crashing once or twice a day (four times today) because the wifi driver for it is unstable.  I'm hoping that the driver from RALink is more stable. 

http://michael-peeters.blogspot.co.nz/2011/06/fixing-rt2860-wifi-chipset-under-ubuntu.html

Had to recompile from source, so posting the link here so I can find it again for when I need to rebuild the module on kernel upgrades or whenever I upgrade Mint.

multi user pulse audio

Because I run browsers as different users I need all three different users to be able to play sound and by default pulse will only allow the currently logged in user to play sound.

To let all three users play sound (usually when I click on a flash video or stream play music from Pandora) it's sufficient to edit /etc/default/pulseaudio, set  PULSEAUDIO_SYSTEM_START=1, and then restart pulse (with a logout/login or an X restart).

On Mint that port isn't accessible to the network by default.  if it is though, then add appropriate iptables rules so that network access is disabled.

Any local users will now be able to access pulse, so only do this if you trust your local users.

UPDATE:
In 2016, the way to do this is now via paprefs.  Install the paprefs package and run paprefs as the main user (i.e., I'd run it as tiger and allow localhost only access to sound).

Do this only if you trust all users on the machine.

xhost for specific local user only

On Linux (Mint, lately, but also Ubuntu and others) I run my browsers as three different users.

• When browsing sites that need high security (online banking, etc) I use the browser when logged in as myself, 
• For regular browsing of important but not financial sites (gmail, facebook, etc) I run a browser as a user named "secure" (could be any other name).  
• For likely insecure browsing (reddit, etc) I run a browser as a user named "insecure"

Previously I would have a shell script that did:

  ssh -X secure@localhost

with public key auth.  Lately I'd switched to a script that did:

  xhost +

instead so I could just

  sudo -H -u secure chromium-browser

but that's not too secure.  I finally broke down and read the xhost manual and am now doing it the right way with:

  xhost +si:localuser:secure

  xhost +si:localuser:insecure

which at least limits the xhost permission to just those two users.

Linux Mint/Mate Panel on second monitor

Not obvious. I flailed around for a bit until I found this forum post on how to move a mate panel to the second monitor.

Copying the text from that link:

1. Right-click the panel you wish to move and select “Properties”.
2. Uncheck the “Expand” option under the “General” tab.
3. Grab one of the edges of the panel by clicking on the left or right end (top or bottom end for vertical panels).
4. Drag the bar to the desired screen and position.
5. Check the “Expand” option in the “Panel Properties” window and click “Close”.

mDesktop is a winner!

As I mentioned in the preceding post on disabling windows screen flipping, I'm working on a Windows 7 machine at a client site for a few months. I've half heartedly looked for multi-workspace software for Windows. Must be free as in beer (since this isn't *my* computer and it's not important enough to get the company to pay for the software). mDesktop does a great job. I'd love to have some customization features, but it works great as-is.

Disable Windows screen flip

I'm working at a client site for a few months and they use Windows computers there. For a while I'd get confused because when I'd type Ctrl-Alt-Left or Ctrl-Alt-Right, the display would flip to portrait (with the "top" at the left or the right depending on which key combination I'd typed). It turns out this is easy to fix (well, on *this* machine, exactly where it needs to be fixed may depend on video card/driver). And the path to fix it varies too depending on version of Windows. For Windows 7 and for this Intel Q45/Q43 Express chipset: Control Panel > All ControlPanelItems > Display > Change display settings > Advanced Settings Intel(R) Graphics Media Accelerator Driver > Graphics Properties > Display Settings uncheck "Enable Rotation" > Apply and accept the change.