Category Archives: administration

Spending a weekend re-installing my firewall appliance was not my plan

So recently while trouble shooting that mail log in problem from my phone, I started going through the web interface on my pfSense box. While in the LAN interface, and it being 4am, I was like why is block RFC1918 for the Wan (which is on every interface tab), and block Bogons, not checked.

So I did what anyone half sleep deprived would do, I checked the boxes and hit apply.  Then I couldn’t get back in to the silly thing. Console wouldn’t work. I just got a blank screen, rebooting while consoled  in would go through the post and loading of BSD but after pfSense started, I didn’t get a menu.

Hey I know, I’m a Nix person, I’ll boot from the live image, go in to recovery find and turn off that setting, sync to the hard drive and reboot.

Continue reading

Oh look HTTPS

Testing out Let’s Encrypt public beta. My thoughts so far:

90 days for the SSL certificate. Does that mean we’ll be seeing spammers setting these up to make their sites look more legit?

Mainly made for HTTPS on web servers. There is a walk through on making it work with email, using links, and some other dark Unix magic (what not everyone is running a linux mail server?). I saw a file for exchange but that’s not my cup of tea. It also brings up that whole 90 days thing again. So for now my mail server has something else.

So while the SSL Cert is good for 90 days, they tell you to update it every 60. Can’t wait to try that in 2 months. (that was sarcasm).

To be honest though, I do like the idea of Let’s Encrypt. I like that it has Debian love and script to make magic happen in the background. Less fiddling under the hood. I like that you can set up either Secure only (all HTTPS all the time) or HTTP and HTTPS. This site used to use a self signed cert for Administration, but now it’s all SSL.

Hopefully in the future we can get at least 365 day certs, more services covered, and most importantly MORE PEOPLE ENCRYPTING their web traffic.

Why is useful documentation hard to find?

I just finished reading The Linux Journal’s “Geek’s Guide to Enterprise Monitoring Success“. It was good, talking about how to leverage the monitoring to work for the IT department in an organization. This also talked about some business problems you can face, which I’ve seen first hand. I’ve been in the “metrics from another group’s monitoring tools” meeting before. Trust me, you need to be sure of yourself and what you’re doing for the company before that happens. I’ve also seen monitoring systems destroyed because the wrong people had too much access and trying to  tune the system for their needs only.

For what it was, this was a good guide. From the title though, I expected something different.

Continue reading

Yet more with Fail2Ban

So yesterday, I thought I was all good on Fail2Ban today’s logcheck emails show there were still problems with Dovecot.

Continue reading

More Fail2Ban fun with Debian Stretch

Yesterday, going through email yesterday, mostly logcheck emails, I found that Apache wasn’t blocking the attackers. It was seeing them, but not adding the ip address to iptables block list.

The fix was setting up the maxretry it was set rather high, I moved it down to 1 like I had it in the past. I also adjusted the search time to 1 hour and the ban time to 7 days. I thought I was good, and didn’t give it a second thought.

Today, looking at the logcheck emails (really it’s a great IDS for system admins to get a view into their box), there are a lot of automated attacks on the mail server NOT BEING BLOCKED!!! It worked yesterday, there were even banned ip addresses in the chain.

After lots of digging, and several changes that didn’t work, I decided to go for the bad option.

Really the real reason was that Fail2Ban had been around for a while. Things changed, and I had a weird mishmash of configuration files. After the install I removed the files in the package that were not debian related, not sure why bsd; osx; or fedora are in the Debian package to start with.

Followed the local customization file directions creating jail.d/server-defaults.conf with apache-auth and dovecot in them. ssh is handled by defaults-debian.conf. Why the new file, in case the Debian one gets over-written by new stuff later.

Restart the service and…

Still not working for dovecot.!? (tailing the log and watching iptables).

Turns out, it’s where Fail2Ban was set for default to watch for login errors for Dovecot (also noted through the logs). It’s looking in /var/log/mail.warn. I don’t know if I changed it, or it’s legacy left over, or what, but my box it’s /var/log/auth.log where Dovecot login failures go. So I added the logpath to jail.d/server-defaults.conf, restarted Fail2Ban and it worked.

Fail2Ban problems with Debian Stretch

This week The Debian project released “Jessie” (Debian 8.0) as stable. I like to keep my servers a little more ahead of the curve than that, so I upgraded to the new testing branch “Stretch”.

While going through my logs from yesterday and this morning, log checker is awesome, I saw someone hitting my mail server. Normally you only get 1 chance to log in as a non-existent account before Fail2ban kicks in and adds the ip address to my Netfilter iptables jail. This address kept showing up, hour after hour in the logs, and multiple user names.

Looking, I found out that while running, it wasn’t catching all the rules for Fail2ban. I checked the configuration files, and things checked out OK. So I fell back on the old restart the service and see what errors pop.

Continue reading

Home Lab – Changes

I’ve made changes to the layout of my home lab. This is the current plan, because I can’t afford the Cisco switch I want right now. I also don’t think it’s worth getting a second line to the house, since I plan on moving by October.

The new design is to have my home network and the lab network mixed. I do have one more wireless router I could put in place to isolate the lab, but not going to for right now. If I need to limit things for something, I can always change. It’s also split between 2 floors, which is why there are 2 switches.

Lab Design v2

 

 

 

 

 

 

 

The Single Board Farm is 6 Raspberry Pi B, 4 Raspberry Pi B+, 2 Raspberry Pi 2, and once I can get them, Odroid C1 (probably 2).

apt-get upgrade spamassassin error

I’m sure I’ll forget about this again. Trying to upgrade spamassassin, I kept getting the following error. I fixed this a couple of months ago, but forgot what the

dpkg: error processing package spamassassin (–configure):
subprocess installed post-installation script returned error exit status 1
dpkg: dependency problems prevent configuration of sa-compile:
sa-compile depends on spamassassin (>= 3.3.2-8); however:
Package spamassassin is not configured yet.

dpkg: error processing package sa-compile (–configure):
dependency problems – leaving unconfigured
Errors were encountered while processing:
spamassassin
sa-compile
E: Sub-process /usr/bin/dpkg returned an error code (1)

The cause has to do with the hardening I’ve done on my linux box. If the entry in /etc/password is a service account, the shell gets set to /bin/false. To fix the errors above, I need to change it to /bin/bash, and then change it again after the upgrade.

However I’m sure I’ll forget about this again, and forget that I wrote a blog entry for it.