help | Walking in Light with Christ - Faith, Computing, Diary

Posts Tagged ‘help’

Why saint George is depicted on icons killing a Dragon (an ancient story of saint George killing the last dragon) – A Collection of 7 icons of Saint Martyr George

Friday, July 6th, 2012

Saint George is one of the most venerated Orthodox Christian saints in the Eastern Orthodox Church. My interest in saint George is cause of the reason, I myself bear the name Georgi (the Bulgarian equivalent of George). Saint George is mostly venerated in the Slavonic Christian-dome.In almost all Church icons depicting st. George in Orthodox and Roman Catholic christiandome saint George is piercing killing a dragon.
One of the reasons, st. George is depicted piercing the dragon is a reference of st. George victory over satan, through his martyrdom.

The Beast (Dragon) on the iconi is a straight reference to the Holy Bible; Chapter Revelation also known under the name Apocalypse.

In revelation, we read humanity and our saviour Jesus Christ will finally once and for all will kill the "ancient beast" = (satan)

In same logic, as Saint Martyr George has been victorious over Satan by his unshakable confession of faith in Jesus Christ in early 5th century A.D. , we believe in the Orthodox Church he is given the crown of (eternal) life as a prize for bearing un-human tortures in the name of the of Christ.
To illustrate visually the victory of saint George over Satan through his immesurable faith confession with which he become, there is a an early tradition in iconography in the Church to depict st. George killing a dragon.

The other reason why saint George is depicted to kill a Dragon is due to a Lebanon / Palestinian ancient story saying; There was a huge Dragon living somewhere in nowdays Lebanon / Palestinian lands.
The beast created a huge havoc killing many people and systematically torturing people in the area.

As the Eastern Orthodox Christian tradition continues …. the Dragon is said to have inhabited one of the caves near some village.
Interesting, the story tells these very same dragon was the last Dragon crawling the earth before the final disappearance of dragons.

Many brave local people tried to kill the beast but many died as the beast was unbeatable.
Being unable to beat-up the dragon with a physical (human) force the local population turnted to God for help – saying continously prayers to Saint George to help them defeat their dragon mischief.

Soon after, Saint George appeared on a white horse and pierced the "old dragon / snake". The dragon liberation miracle is said to be evidenced by local people and according to Orthodox monk books is one of the many great miracles occuring in past times.
The report of the miracle has quickly spread around all Lebanon / Palestinian lands and soon, being confirmed as real spread along all Russia as well as the rest of the Slavonic and Orthodox Christian world (Bulgaria, Serbia), Greece, Egypt (Alexandria) etc..
To illustrate saint George's appearance miracle, monastic iconographers started depicting saint George as we see him until this very day – Riding a horse and slaughtering a monstrous beast.

Below are seven 12-th century early icons of saint Saint Great-Martyr George killing the dragon;;
I've collected the icons from various website online. Hope this collection will be blessing for all Christ brother and sisters and generally anyone reading this post:

12-th century mosaic icon of st. George the Great Martyr Xenophontos Monastery

Orthodox Christian icon saint George dated to 1130 - 1150 A.D.

Orthodox Christian icon saint George dated to 1130 – 1150 A.D.

Saint Georgius the Dragon Slayer icon XII century orth icon

Saint Georgius the Dragon Slayer icon XII century orth icon

St. George Enamel icon Georgia 12th century

St. George Enamel icon Georgia 12th century

saint George Christian icon Yuriev Monastery Novgorod 12th century

st. George Staraya Ladoga Orthodox Christian icon

st. George Staraya Ladoga Orthodox Christian icon

sv. Georgius 12th century Aios

sv. Georgius 12th century Aios

Nowdays saint George Holy Relics particles are kept for veneration in many Orthodox Christian countries monasteries. Here in Bulgaria saint George Holy Relics are kept in a Monastery nearby the seacoast in Pomorie. Any Christian visiting Bulgaria have the opportunity to venerate the Holy in (Pomorie's Monastery – St. Great Martyr Georgi.

Share this on

Tags: ancient beast, Auto, beast, bible chapter, Catholic, cause, christiandome, church icons, confession of faith, Draft, drago, dragon, eastern orthodox church, eternal life, faith confession, georgi, Georgius, havoc, help, holy bible, interest, last dragon, martyr george, martyrdom, Monastery, monk, nowdays, orthodox christian saints, orthodox christian tradition, palestinian lands, pomorie, quot, reason, relics, report, revelation, Roman, satan, saviour, saviour jesus christ, st george, story, tortures, victory, village
Posted in Christianity | 2 Comments »

How to solve “Incorrect key file for table ‘/tmp/#sql_9315.MYI’; try to repair it” mysql start up error

Saturday, April 28th, 2012

When a server hard disk scape gets filled its common that Apache returns empty (no content) pages…
This just happened in one server I administer. To restore the normal server operation I freed some space by deleting old obsolete backups.
Actually the whole reasons for this mess was an enormous backup files, which on the last monthly backup overfilled the disk empty space.

Though, I freed about 400GB of space on the the root filesystem and on a first glimpse the system had plenty of free hard drive space, still restarting the MySQL server refused to start up properly and spit error:

Incorrect key file for table '/tmp/#sql_9315.MYI'; try to repair it" mysql start up error

Besides that there have been corrupted (crashed) tables, which reported next to above error.
Checking in /tmp/#sql_9315.MYI, I couldn't see any MYI – (MyISAM) format file. A quick google look up revealed that this error is caused by not enough disk space. This was puzzling as I can see both /var and / partitions had plenty of space so this shouldn't be a problem. Also manally creating the file /tmp/#sql_9315.MYI with:

server:~# touch /tmp/#sql_9315.MYI

Didn't help it, though the file created fine. Anyways a bit of a closer examination I've noticed a /tmp filesystem mounted besides with the other file system mounts ????
You can guess my great amazement to find this 1 Megabyte only /tmp filesystem hanging on the server mounted on the server.

I didn't mounted this 1 Megabyte filesystem, so it was either an intruder or some kind of "weird" bug…
I digged in Googling to see, if I can find more on the error and found actually the whole mess with this 1 mb mounted /tmp partition is caused by, just recently introduced Debian init script /etc/init.d/mountoverflowtmp.
It seems this script was introduced in Debian newer releases. mountoverflowtmp is some kind of emergency script, which is triggered in case if the root filesystem/ space gets filled.
The script has only two options:

# /etc/init.d/mountoverflowtmp Usage: mountoverflowtmp [start|stop]

Once started what it does it remounts the /tmp to be 1 megabyte in size and stops its execution like it never run. Well maybe, the developers had something in mind with introducing this script I will not argue. What I should complain though is the script design is completely broken. Once the script gets "activated" and does its job. This 1MB mount stays like this, even if hard disk space is freed on the root partition – / ….

Hence to cope with this unhandy situation, once I had freed disk space on the root partition for some reason mountoverflowtmp stop option was not working,
So I had to initiate "hard" unmount:

server:~# mount -l /tmp

Also as I had a bunch of crashed tables and to fix them, also issued on each of the broken tables reported on /etc/init.d/mysql start start-up.

server:~# mysql -u root -p mysql> use Database_Name; mysql> repair table Table_Name extended; ....

Then to finally solve the stupid Incorrect key file for table '/tmp/#sql_XXYYZZ33444.MYI'; try to repair it error, I had to restart once again the SQL server:

Stopping MySQL database server: mysqld. Starting MySQL database server: mysqld. Checking for corrupt, not cleanly closed and upgrade needing tables.. root@server:/etc/init.d#

Tadadadadam!, SQL now loads and works back as before!

Share this on

Tags: amazement, apache, Auto, backup files, backups, Disk, disk space, Draft, drive, emergency, empty space, file, file tmp, first glimpse, format, free hard drive, free hard drive space, google, googling, hard disk, help, Incorrect, init, intruder, key file, mess, MYI, MyISAM, mysql server, mysqld, operation, partition, quot, root, root filesystem, script, server operation, shouldn, size, something, TABLE, tmp, weird bug
Posted in MySQL, System Administration, Web and CMS | 1 Comment »

How to convert UTF-8 encoding files to Windows CP1251 on GNU / Linux

Friday, October 21st, 2011

I needed to convert a file which had a Bulgarian text written in UTF-8 encoding to Windows CP1251 in order to fix a website encoding problems after a move of the website from one physical server to another.

I tried first with enca – ( detects and convert encoding of text files from one encoding to another).

The exact way I tried to convert was:

linux:~# enca -L bg /home/site/www/includes/utf8_encoded_file.php ...Unfortunately this attempt to conver was unsucesfully, and the second logical guess was to use iconv – Convert encoding of given files from one encoding to another to do the utf8 to cp1251 conversion.
I reached for some help in irc.freenode.net, #varnalab channel and Alex Kuklin helped me, giving me an example command line to do the conversion.
iconv winedows to cp1251 conversion line, he pointed to me was:

linux:~# iconv -f utf8 -t cp1251 < in > out

Further on I adapted Alex's example to convert my utf8_encoded_file.php encoded Bulgarian characted to CP1251 and used the following commands to convert and create backups of my original UTF8 file:

linux:~# cd /home/site/www/includes linux:/home/site/www/includes# iconv -f utf8 -t cp1251 < utf8_encoded_file.php in > utf8_encoded_file.php.cp1251 linux:/home/site/www/includes# mv utf8_encoded_file.php utf8_encoded_file.php.bak linux:/home/site/www/includes# mv utf8_encoded_file.php.cp1251 utf8_encoded_file.php

Share this on

Tags: alex, attempt, bg, bulgarian text, cd home, command, conver, conversion, Convert, enca, file, file linux, freenode, gnu linux, guess, help, home, iconv, includeslinux, line, Linux, lt, move, mv, order, outFurther, php, physical server, UTF, varnalab, way, www
Posted in Linux, System Administration, Various, Web and CMS | No Comments »

How to change MySQL server root password

Friday, July 29th, 2011

MySQL pass dialog Debian

I had to change my mysql root password for one of the servers since during the install I mispasted the password in the MySQL password prompt I needed the pwd to be changed.

Here is how I changed it to my desired one:

linux:~# /usr/bin/mysqladmin -u root -p'OLD_PASSWORD_STRING' password NEW_PASSWORD_STRING linux:~#

The password gets changed immediately

If a new password has to be set to a passwordless mysql server, the command to be issued is:

linux:~# /usr/bin/mysqladmin -u root password PASSWORD_STRING

Changing the MySQL password is also possible with mysql cli, after connecting to the sql server, though this method is a bit more time consuming. Here is how to do it from mysql console:

linux:~# mysql -u root -p Server version: 5.1.49-3 (Debian)


	Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.

	This software comes with ABSOLUTELY NO WARRANTY. This is free software,

	and you are welcome to modify and redistribute it under the GPL v2 license

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql> use mysql; mysql> update user set password=PASSWORD("NEW_PASSWORD") where User='root';mysql> flush privileges;

Of course it's possible to do change the root pass via phpmyadmin
Cheers

Share this on

Tags: ABSOLUTELY, Cheers, cli, command, consuming, Copyright, course, free software, gpl v2, help, input statement, licenseType, Linux, mysqladmin, Old, oracle, password, password string, phpmyadmin, Privileges, pwd, root, root password, server root, servers, software, sql server, string password, time, time consuming, type, use, usr, usr bin, version, warranty
Posted in Linux, MySQL, System Administration | No Comments »

How to reset a forgotten WORDPRESS blog admin password (via MySQL)

Sunday, July 24th, 2011

Wordpress lost your password prompt screen My sister has forgotten the administrator account for her wordpress blog as she did not blogged for a while.
I decided to help her and reset the WORDPRESS blog password to another one.
The easiest way of course in normal circumstances is to use wordpress's Lost your password password reset via email.

However with this blog it seems I used an email address which I forgot so I couldn't really use this as a mean to reset the blog password.

Therefore as I'm addicted to command line I decided to do it straight via connecting to mysql server with mysql cli and change the encrypted password value directly there. Here is how I did it:

1. First I logged in to the mysql server with my root user/pass

pcfreak# mysql -u root -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 39263 Server version: 5.0.83-log FreeBSD port: mysql-server-5.0.83

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

2. Then I checked current set user and password for the wp-admin admin user

3. Used a query to reset the current encrypted password you see below shown under the user_pass column

mysql> UPDATE wp_users SET user_pass= MD5('my_new_wordpress_password_to_reset') where ID = '1';

4. I've changed the email set for user_email to which mail is sent, in case of forgotten password again

I've done this to prevent my sister to bother me again, if she forgets her password once again

mysql> UPDATE wp_users SET user_email='invoke_@abv.bg' where ID = '1';

One important note here is that in step 3
I've used the MD5(); mysql embedded function to generate the MD5 crypted password which is inserted in above's sql query, however the MD5 function is only available in MySQL servers version 5.x, therefore in older releases of MySQL e.g. ver 4.x, one will have to first generate the md5 password with let's say md5sum linux command or bsd's md5 cmd like so:

a. On Linux
hipo@noah:~$ echo 'my_new_wordpress_password_to_reset' | md5sum f0ed1489e6d9e7eae8b363b1b5e4a864 -

b. On FreeBSD

pcfreak# echo 'my_new_wordpress_password_to_reset' | md5 f0ed1489e6d9e7eae8b363b1b5e4a864

Afterwards the SQL query that can be used with the above generated string to issue on the MySQL 4.x server or earlier versions would be:

mysql> UPDATE wp_users SET user_pass='f0ed1489e6d9e7eae8b363b1b5e4a864' where ID = '1';

That's all now the password is set to the newly generated my_new_wordpress_password_to_reset pass string.
Cheers

Share this on

Tags: abv, administrator account, circumstances, cli, com, Commands, connection, connection id, course, Display, eae, email address, encrypted password, function, help, input statement, login, monitor, mysql connection, password, pcfreak, reset, root, root user, row, server version, status, update, url, value, wordpress blog, wp, ztywLp
Posted in FreeBSD, Linux, MySQL, System Administration, Wordpress | 6 Comments »

How to make a mysql root user to login interactive with mysql cli passwordless

Wednesday, June 29th, 2011

MySQL Logo Passwordless root login .my.cnf

I'm using access to the mysql servers via localhost with mysql cli on daily basis.
With time I've figured out that it's pretty unahandy to always login with my root mysql password, I mean each time to enter it, e.g.:

root@mysql-server:~# mysql -u root Enter password: ...

Thus to make my life a way easier I decided to store my mysql root password in order to allow my root admin user to be able to login to my mysql server without asking for password. This saves time and nerves, as I'm not supposed to look up for the password file I store my server mysql root pass.

To allow my mysql cli interface, to login passwordless to the SQL server I had to create the file /root/.my.cnf readable only for my root user and store my MySQL username and password there.

Here is a sample /root/.my.cnf file:

root@mysql-server:~# cat /root/.my.cnf [client] user="root" pass="mysecretMySQLPasswordgoeshere"

Now next time I use the mysql console interface to access my mysql server I don't have to supply the password, here is how easier is the mysql login afterwards:

root@mysql-server:~# mysql -u root Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 3520 Server version: 5.0.77 Source distribution


	Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>

The only downside of using .my.cnf to store permanently the mysql server root and password is from security standpoint.
If for instance somebody roots my servers, where I have stored my root user/pwds in .my.cnf , he will be able immediately to get access to the MySQL server.

Another possible security flaw with using the mysql passwordless login "trick" is if somebody forgets to set proper file permissions to, .my.cnf

Once again the file should possess the permissons of:

root@mysql-server:~# ls -al /root/.my.cnf -rw------- 1 root root 90 Apr 2 00:05 /root/.my.cnf

Any other permissons might allow non-privileged users to read the file and gain unathorized admin access to the SQL server.

Share this on

Tags: Auto, basis, buffer, cat, cli, client, cnf, connection id, daily basis, distribution type, downside, Draft, file, file permissions, help, life, localhost, mysql connection, mysql servers, order, password, password file, root, root admin, root password, root root, root user, security, security flaw, security standpoint, server mysql, server root, server version, source distribution, standpoint, time, type, username, version, way
Posted in FreeBSD, Linux, MySQL, System Administration | No Comments »

How to enable Domain Keys (DKIM) in Qmail toaster based mail server install on Debian Linux

Wednesday, May 25th, 2011

Recently the Emails sent by one of the Qmail mail servers running on a Debian host started suddenly delivering in Spam folder in both Gmail.com and yahoo.com public mail services.

This is pretty nasty as many of the websites which used the local qmail server to deliver emails concerning subscriptions and other kind of services provided by the websites started ending in Span and thus many of the users who used their Yahoo Mail account and Google Mail – gmail accounts was unable to read emails mailed by the various websites forms and scripts which were sending emails.
You can imagine the negative effect all this “minor” mail issues had on website visitors count and the overall websites functionality.
To come up with some kind of solution to this mail issues, I did quite a lot of research to understand if Yahoo and Google Mail services has some kind of mail server delist form or some reporting service where one can delist a specific mail server as a spammer one or get some kind of help, but unfortunately it seems neither google nor yahoo has any kind of web based way to remove hosts or ip addresses of legit mail servers who has mistakenly been recognized as spam servers.

During my efforts to find a solution to the situation I red a lot of posts and forums online as well as Google’s Bulk Sender Guidelines, none if it was too helpful though.

The QMAIL server had a proper:
1. MX Record 2. TXT SPF records 3. PTR Record 4. There are proper correct mail message headers 5. Proper mails charset and encoding 6. The mail server IP is not listed anywhere in any mail blacklists (e.g. www.mxtoolbox.com/blacklists.aspx / spamhaus.org) 7. A correct SMTP greeting which matched the mail server domain name

The only thing which was missing on the mail server (checked against Google’s Bulk Sender Guidelines) was a properly configured DKIM and Domainkeys.

Thus in order to get around the situation I went the way and configured the qmail server to include and send in the mail header also Domain Keys

In this article I will briefly explain step by step how I configured Domain keys (DKIM) signing of my mails:

There are few ways domain keys signing can be implemented with Qmail.

1. By patching qmail binaries to support domain keys signing

I wanted to omit any interventions concerning the well running qmail install so I decided not to go this way.
Plus there are plenty of add-ons for qmail and as I have no time to test them the idea not to temper the existing qmail installation looked wise to me.
2. Use a wrapprer script around qmail-remote that invokes externally domainkeys binaries

This kind of solution was fitting me better and therefore I took this route to enable my qmail DKIM signing.

There are few approaches one can take described online:

http://manuel.mausz.at/coding/qmail-dkim/

I tried using the qmail-dkim-0.2.pl wrapper script following the exact steps described to be fulfilled to enable my outgoing mails dkim signature, however for some reason after substituting the qmail-remote with qmail-dkim.pl and setting the proper permissions, my outgoing mails failed completely and each mail I sent was returned back by the qmail MAILER-DAEMON

libdomainkeys

Mail-DKIM-0.39

I gave a try to this approach and thanksfully it worked after a bit of struggle to tune it up.

Here is what exactly I had to do to in order to have the domain keys signing to work using the above described qmail-remote.sh shell script wrapper

1. Install openssl related required debian packages

debian:~# apt-get install openssl libcrypt-openssl-rsa-perl libcrypt-openssl-bignum-perl \ libmail-dkim-perl ...

2. Create necessery directories and RSA key pairs for DomainKeys

debian:~# mkdir -p /etc/domainkeys/mydomain.com debian:~# cd /etc/domainkeys/mydomain.com debian:/etc/domainkeys/mydomain.com# openssl genrsa -out rsa.private_default 768 debian:/etc/domainkeys/mydomain.com# openssl rsa -in rsa.private_default \ -out rsa.public_default -pubout -outform PEM debian:/etc/domainkeys/mydomain.com# ln -sf rsa.private_default default debian:/etc/domainkeys/mydomain.com# touch selector debian:/etc/domainkeys/mydomain.com# echo 'default' >> selector

Where mydomain.com is the mail domain I need the DKIM signatures for.

I have written a small shell script which automates the task of adding new domainkeys directories and generating the RSA keys with openssl, you can download my generate_qmail_domainkey_rsa automator script here

3. Set proper permissions and owner to /etc/domainkeys directory

debian:~# chmod -R 0600 /etc/domainkeys debian:~# chown -R qmailr:qmail /etc/domainkeys

4. Generate public domain key for DNS TXT records

debian:/etc/domainkeys/mydomain.com# grep -v ^- rsa.public_default | perl -e 'while(<>){chop;$l.=$_;}print "k=rsa; t=y; p=$l;\n";'

"k=rsa; t=y; p=MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMlDcYMrpWP9ouQOlFVtCHcFY +gxrSQ6SegYeP4eeG7NECT/3jBqDtxANIVhaS9ASkEO4yNisGu4yX/DRclTm nPWknoDtCDiD7IFEzT37qn1JLzcuknTncmFBFMDRUJq6wIDAQAB;"

The above key is used in next step 5 to set it as a TXT DNS record.

5. Create the DNS records in Name server

With BIND DNS server you need to place a records like:

_domainkey.example.com. IN TXT "k=rsa; t=y; o=-;" default._domainkey.example.com. IN TXT " p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2RkvFHbhqM/bVbb kBtZ1cZUSYcjC4q+PWjd1tFopT+HXXR9Ctx7FZ1guX5fGboiwYmhCYdVroI KRM3I48/YyQoXxtn3iYZ086v8BHaNtkcBMY+68JeEQ3K0WQkbqQXp/tsnLY SQW1yXiEo9CywxVdpwH+OY94HxK4fAbw6V11cwIDAQAB"

! The above p= key specified is the one generated in step 5.

6. Download and compile & install Mail-DKIM-0.39 ‘s perl extension

As of time of writting latest Mail-DKIM is ver. 0.39, however it’s a good idea to check and install the latest available version available on http://www.cpan.org

a) Download Mail-DKIM

debian:~# cd /usr/local/src debian:/usr/local/src# wget http://www.pc-freak.net/files/Mail-DKIM-0.39.tar.gz ... 2011-05-25 15:09:37 (264 KB/s) - `Mail-DKIM-0.39.tar.gz' saved [87375/87375] ...b) Compile & Install Mail-DKIM

debian:/usr/local/src# chown -R hipo:hipo Mail-DKIM-0.39 debian:/usr/local/src# cd Mail-DKIM-0.39

debian:/usr/local/src/Mail-DKIM-0.39# su hipo debian:/usr/local/src/Mail-DKIM-0.39$ perl Makefile.PL debian:/usr/local/src/Mail-DKIM-0.39$ make ... debian:/usr/local/src/Mail-DKIM-0.39$ exit debian:/usr/local/src/Mail-DKIM-0.39# make install debian:/usr/local/src/Mail-DKIM-0.39# cd script debian:/usr/local/src/Mail-DKIM-0.39/script# cp -rpf * /usr/local/bin; cd /usr/local/src

Note that the dkimsign.pl which is in the Mail-DKIM-0.39 is a very important tool used later by the qmail-remote wrapper script. This perl script is copied in the last command issued in above chunk of code.
In the up-command lines I use my unprivileged username hipo to compile, here use any non-root user is appropriate.
For instance it’s possible that the cpan user is used as a compile time user, I was lazy to configure CPAN thus I choose to use my normal unprivileged user.

c) configure rsa domain key paths in dkimsing.pl

Another thing to do here is to make sure the /usr/local/bin/dkimsign.pl which was just recently installed has a correct set location for it’s KeyFile variable.
This vailable is in the script is located online 64, I changed it to include my rsa domain key file, after I changed it, now it looks like so:

KeyFile => "/etc/domainkeys/mydomain.com/default"

7. Download and install libdomainkeys

a) Download libdomainkeys
For latest version of libdomainkeys make sure you check on http://domainkeys.sourceforge.net/

debian:/usr/local/src# wget http://www.pc-freak.net/files/libdomainkeys-0.69.tar.gz debian:/usr/local/src# tar -zxvvf libdomainkeys-0.69.tar.gz ... debian:/usr/local/src# chown -R hipo:hipo libdomainkeys-0.69 debian:/usr/local/src# cd libdomainkeys-0.69; su hipo

b) Compile and install libdomainkeys binaries

debian:/usr/local/src/libdomainkeys-0.69$ echo '-lresolv' > dns.lib debian:/usr/local/src/libdomainkeys-0.69$ make clean & & make debian:/usr/local/src/libdomainkeys-0.69$ exit debian:/usr/local/src/libdomainkeys-0.69# cp -rpf dktest dknewkey expected makeheader /usr/local/bin/

There is a note to make here, one of the programs part of libdomainkeys called dnstest is not compiled while doing make for unknown reasons?!
I was not able to compile manually dnstest either using gcc like so:

debian:/usr/local/src/libdomainkeys-0.69$ gcc -o dnstest dnstest.c dnstest.c: In function 'main': dnstest.c:11: warning: incompatible implicit declaration of built-in function 'strle' /tmp/ccH78KZ1.o: In function 'main': dnstest.c:(.text+0x2b): undefined reference to 'dns_text' collect2: ld returned 1 exit status

I have absolutely no clue why it fails o_O, but it doesn’t matter since I figured out that domainkeys header signature is properly set even without dnstest.

Let me mark here that echo ‘-lresolv’ > dns.lib you see in above code chunk is absolutely necessery in order to be able to compile libdomainkeys on Debian based distributions. If the ‘-lresolv > dns.lib’ is omitted the libdomainkeys build fails with error:

gcc -DBIND_8_COMPAT -O2 -o dktest dktest.o -L. -ldomainkeys -lcrypto `cat dns.lib` `cat socket.lib` ./libdomainkeys.a(dns_txt.o): In function `dns_text': dns_txt.c:(.text+0x2d): undefined reference to `__res_query' dns_txt.c:(.text+0xc4): undefined reference to `__dn_expand' dns_txt.c:(.text+0x184): undefined reference to `__dn_expand' collect2: ld returned 1 exit status make: *** [dktest] Error 1

8. Install libdkim (source of the libdkimtest binary later used by qmail-remote wrapper script)

debian:/usr/local/src# su hipo debian:/usr/local/src$ wget http://www.pc-freak.net/files/qmail/libdkim-1.0.19.zip debian:/usr/local/src$ wget http://www.pc-freak.net/files/qmail/libdkim-1.0.19-linux.patch debian:/usr/local/src$ wget http://www.pc-freak.net/files/qmail/libdkim-1.0.19-extra-options.patch debian:/usr/local/src$ unzip libdkim-1.0.19.zip debian:/usr/local/src$ cd libdkim/src debian:/usr/local/src/libdkim/src$ patch -p2 < ../../libdkim-1.0.19-linux.patch debian:/usr/local/src/libdkim/src$ patch -p2 < ../../libdkim-1.0.19-extra-options.patch debian:/usr/local/src/libdkim/src$ make && exit debian:/usr/local/src/libdkim/src# make install

The above install will install libdkimtest binary, used by the wrapper script to do the actual DKIM-Signature, the binary gets installed in /usr/local/bin/libdkimtest.
Here is a link to patched version of libdkim 1.0.19 , to use it instead of patching as described above download the archive untar and do a make clean && make && install

9. Download qmail-remote.wrapper (qmail-remote wrapper shell script) and set it to wrap qmail-remote

a) Copy original qmail-remote to qmail-remote.orig

debian:~# cd /var/qmail/bin debian:/var/qmail/bin# cp -rpf qmail-remote qmail-remote.orig

b) Download qmail-remote.wrapper script

Here is the qmail-remote.sh wrapper script that worked for me
Originally the wrapper script is taken from http://www.memoryhole.net/qmail/, big thanks to Russ Nelson for writting the awesome wrapper script.

debian:~# cd /var/qmail/bin/ debian:/var/qmail/bin# wget http://www.pc-freak.net/files/qmail-remote.wrapper Saving to: `qmail-remote.wrapper'


100%[============================>] 1,164       --.-K/s   in 0s

2011-05-25 15:46:54 (142 MB/s) - `qmail-remote.wrapper' saved [1164/1164]

c) Set proper permissions to the qmail-remote.wrapper script

The permissions of qmail-remote should look like so:

-rwxr-xr-x 1 root qmail 1164 2011-05-25 11:05 /var/qmail/bin/qmail-remote*

To set this permissions I used:

debian:/var/qmail/bin# chmod 755 qmail-remote.wrapper debian:/var/qmail/bin# chown qmailq:qmail qmail-remote.wrapper

d) Create /var/domainkeys directory (necessery for proper qmail remote wrapper script operations)

debian:~# mkdir /var/domainkeys debian:~# chown -R qmailr:qmail /var/domainkeys debian:~# chmod 700 -R /var/domainkeys

e) Substitute original qmail-remote binary with the wrapper script:

debian:~# qmailctl stop Stopping qmail... qmail-send qmail-smtpd debian:/var/qmail/bin# cp -rpf qmail-remote.wrapper qmail-remote debian:/var/qmail/bin# qmailctl start Starting qmail

10. Send test email to @gmail.com or @yahoo.com to test if DKIM-Signature is included in the mail header

I used my installed webmail interface squirrelmail and send a test email to my home mail server and as well as to yahoo.com

The headers of the email looked fine, here is how my DKIM signed mail headers looked like:

From - Thu May 26 15:31:37 2011 X-Account-Key: account11 X-UIDL: 1306413169.97071.pcfreak,S=1244 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-Path: <root@mail.mydomain.com> Delivered-To: hipo@pc-freak.net Received: (qmail 97068 invoked by uid 1048); 26 May 2011 12:32:49 -0000 Received: from mail.mydomain.com (83.170.100.100) by mail.pc-freak.net with SMTP; 26 May 2011 12:32:49 -0000 Comment: DomainKeys? See http://domainkeys.sourceforge.net/ DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=mydomain.com;


b=ZnTDdUexnt8fmuHbVNXIC+JDvNLYO1zjzlI3PODe3e1oMS5dRHzVGujrS1

Yk0qqs2oW7DseZg/iHE9KOLZBeInksOnsmLsDBq1Lvzfv2xejikR52LBg6a/uK

ewECJy4jQA4cwMJ/qUxmK8EDwbgj7jqCVB95FK3Z5EdR4HoaqGQ=;


h=Received:Date:Message-ID:From:To:Subject;

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=mydomain.com; h=date

	:message-id:from:to:subject; s=default; q=

	/etc/domainkeys/mydomain.com/default; 
bh=G32d6y8oiLehRzcuIWr9s

	S+Jy+g=; 
b=TPW5VXq3vlOUf1T7lfxQC00MN0kPJxaASE/gq7LbHyV1Gj/Xj+GLF

	UN6hYVeKnsoKKeV108JVGcfvfTaLogsxGyS9XzUXKlLtESBj4wr/DAOQy
OcHCj75

	bEOOd9nv+RehOYinXGmx0JUZpCNHGndNZ1AEabbVEiX/NQAL7iKDnE
=

Received: (qmail 28771 invoked by uid 0); 26 May 2011 12:31:30 -0000

Date: 26 May 2011 12:31:30 -0000

Message-ID: <20110526123130.28770.qmail@mail.mydomain.com>

From: root@mail.mydomain.com

To: hipo@pc-freak.net

Subject: testing 123

baklavavav tatta

Notice the two lines in the above pasted header:

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=mydomain.com; h=date

This clearly shows that now both Domainkeys and DKIM are being applied to outgoing mail messages

However to be completely 100% sure the domainkeys and DKIM signing is correct, you should check the online websites which offer a mail domainkey check and DKIM signature check, an example for such a website that I used in order to test that my SSL RSA Domainkeys and DKIM correspond correctly to the ones specified in the DNS server is:
here

The idea for writting this small guide on configuring Domainkeys with Qmail and Linux is seriously inspired by Mariuz’s Blog post dkim wrapper that works using dk Hope this is helpful to somebody, it took me quite a while until I come up with the exact steps of a workable install of Domain Keys, there are so many tutorials and ways to implement this that at a certain point it’s a hell.
Like always with Qmail, even simple things are so complex, the only good thing about qmail is once you make it work well, it works forever … until the next time you will have to spend few days trying to figure it out

I’m very much looking to hear if people followed the tutorial succesfully.

Any feedback concerning the article is mostly welcome!
Cheers!

Share this on

Tags: briefly, Bulk, charset, com, correct mail, Date, DKIM-Signature, dnstest, domain, Domainkeys, Emails, exit, exitdebian, form, function, Gmail, google, header, help, host, ip addresses, libdkimtest, Linux, lot, mail issues, mail message, mail server, mail servers, mail services, message headers, mx record, mxtoolbox, nameThe, none, ptr, public mail, qmailctl, reporting service, root, script, server domain, server ip, signing, soccerfame, spamhaus, spammer, SPF, test, text, toaster, TXT, website visitors, wget, wrapper, yahoo mail account
Posted in Linux, System Administration | 19 Comments »

Getting around “Secure Connection Failed Peer’s, Certificate has been revoked., (Error code: sec_error_revoked_certificate)

Friday, April 8th, 2011

One of the SSL secured websites (https://) which I have recently accessed couldn’t be opened with an error message showing up:

Secure Connection Failed


An error occurred during a connection to www.domain.com.
Peer's Certificate has been revoked.
(Error code: sec_error_revoked_certificate)
    *   The page you are trying to view can not be shown because the authenticity of the received data could not be verified.
    *   Please contact the web site owners to inform them of this problem. Alternatively, use the command found in the help menu to report this broken site.

That error catched my attention so I digged further in what the message means. Here is what I found as an explanation to what is certificate revocation online

What is a SSL Certificate revocation

Revocation of a certificate means that the Certificate Authority (CA) that issuer of the certificate for a website have decided that the certificate is no longer valid, even if it has not expired.

The information about revocation can be distributed in two ways: Certificate Revocation Lists (CRLs), or by using the Online Certificate Status Protocol (OCSP).

CRLs are (usually) large files that contain a list with information about all the currentely active (unexpired) certificates that are no longer valid. This file has to be downloaded from the CA by the client at regular intervals (usually at least a week apart), and may be quite large.

OCSP, on the other hand, means that the client asks the CA “Is this particular certificate still valid?”, and the server responds “Yes” or “No”. This method can usually be fairly well up to date, meaning the information is at most a few days old, as opposed to at least a week for CRLs.

All the major browsers support OCSP, but some (like Opera) does not currently support CRLs.

By this time most of the modern browsers (Firefox, Chrome, Opera and Internet explorer does support revocation lists and all of the aforementioned hsa enabled at least OCSP by default.

Why SSL revocation error might occur:

A CA can revoke a certificate due to a number of reasons:

- A new certificate has been issued to the website, meaning the old one is not going to be used anymore.
- The website with the certificate is being used for purposes that are not accepted by the CA.
- The certificate was issued based on incorrect information.
- The owner is no longer able to use the private key associated with the certificate, for example the password is lost, the key storage was destroyed somehow, etc.
- The private key has been compromised or stolen, which means traffic to the site is no longer secure.
- The certificate and key have been stolen and is actually being used for fraud while posing as a legitimate website …

Now after all above being said the error:

Secure Connection Failed Peer's, Certificate has been revoked., (Error code: sec_error_revoked_certificate)

is a sure indicator that the website which had the certificate problem as a one you could not trust to make money transactions or do any operation that has a direct relation to your personal private date.

However as there are still websites which use an SSL encryption and are entertainment websites or just a news websites, sometimes getting around the ssl revocation issue to check this website is a necessity.

Therefore to enable your Firefox 3.5 / Iceweasel browser with a website which has ssl certificate revocation issue you need to do the following:

Edit -> Preferences -> Advanced -> Encryption -> Validation

After you see the Certificate Validation screen remove the tick set on:

Use the Online Certificate Status Protocol (OCSP) to confirm the current validity of certificates

Now refresh the website and you will skip the certificate revocation issue error and the webpage will open up.
Note that even though this will work, it’s not recommended to use this work around!

Share this on

Tags: authenticity, browsers support, certificate authority, certificate revocation, certificate status, Chrome, client, code, com, crls, default, encryption, error message, explanation, explorer, few days, file, Firefox, help, help menu, information, internet explorer, intervals, Lists, menu, modern browsers, number, ocsp, opera, page, Protocol, secure connection, ssl certificate, support, time, two ways, unexpired certificates
Posted in Various, Web and CMS | No Comments »

Enabling Active FTP connections on CentOS 5.5

Tuesday, January 4th, 2011

If you experience problems with making your CentoOS 5.5 work with active ftp connections , e.g. every connection you make to the FTP needs to be in a passive mode or the file transfer or FTP directory listing doesn't initialize at all, here is how you can solve it:

Edit the file /etc/sysconfig/iptables-config and change their the line:

IPTABLES_MODULES="ip_conntrack_netbios_ns"

to look like:

IPTABLES_MODULES="ip_conntrack_netbios_ns ip_nat_ftp ip_conntrack_ftp"

Adding the two modules ip_nat_ftp and ip_conntrack_ftp will instruct the CentOS's /etc/init.d/iptables firewall rules to initialize the kernel modules ip_nat_ftp and ip_conntrack_ftp

This modules solves problems with Active FTP not working caused by a host running behind a firewall router or behind a NAT.

This will hopefully resolve your issues with Active FTP not working on CentOS.

If loading this two kernel modules doesn't solve the issues and you're running vsftpd FTP server, then it's likely that the Active FTP non-working problems are caused by your VSFTPD configuration.

If that's the case something that might help is setting in /etc/vsftpd/vsftpd.conf the following variables:

pasv_enable=NO pasv_promiscuous=YES

Of course as a final step you will need to restart the iptables firewall:

[root@centos: ~]# /etc/init.d/iptables restart Flushing firewall rules: [ OK ] Setting chains to policy ACCEPT: filter [ OK ] Unloading iptables modules: [ OK ] Applying iptables firewall rules: [ OK ] Loading additional iptables modules: ip_conntrack_netbios_ns ip_nat_ftp ip_conntrack_ftp [ OK ]

As you can see the two modules ip_nat_ftp and ip_conntrack_ftp are now loaded as additional modules.
Moreover if you have also modified your vsftpd.conf you need to restart the vsftpd via the init script:

[root@centos: ~]# /etc/init.d/vsftpd restart Shutting down vsftpd: [ OK ] Starting vsftpd for vsftpd: [ OK ]

If adding this two modules and adding this two extra variables in vsftpd configuration doesn't help with making your FTP server to work in Active FTP mode , it's very likely that the whole troubles comes from the firewall configuration, so an edit of /etc/sysconfig/iptables would be necessary;

To find out if the firewall is the source of the FTP not able to enter active mode, stop your firewall for a while by issuing the cmd:

[root@centos:~]# /etc/init.d/iptables stop

If iptables is the source of thepassive ftp troubles, an iptables rules similar to this should make your firewall allow active ftp connections;

*filter :INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT
[0:0] -A INPUT -i lo -j ACCEPT -A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -j REJECT –reject-with icmp-port-unreachable
-A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp –dport 80 -j ACCEPT
-A INPUT -p tcp -m state –state NEW -m tcp –dport 44444 -j ACCEPT
-A INPUT -p tcp -m state –state NEW -m tcp –dport 21 -j ACCEPT -A INPUT -p icmp -m icmp –icmp-type 8 -j ACCEPT
-A INPUT -j REJECT –reject-with icmp-port-unreachable -A FORWARD -j REJECT –reject-with icmp-port-unreachable
-A OUTPUT -j ACCEPT -A OUTPUT -p tcp -m tcp –dport 21 -m state –state ESTABLISHED,RELATED -j ACCEPT

Share this on

Tags: CentoOS, CentOS, chains, connection, course, directory listing, doesn, dport, Enabling Active FTP connections on CentOS 5.5, ESTABLISHED, file, file transfer, firewall router, firewall rules, Forward, ftp ip, help, ICMP, init script, Initialize, INPUT, ip nat, iptables firewall, kernel modules, nbsp, netbios, passive mode, promiscuous, quot, RELATED, root, something, variables, work, YES
Posted in Linux, System Administration | No Comments »

A Sunday in the Netherlands

Monday, September 1st, 2008

I woke up, washed my teeth, did my regular morning excersises then Ina came my room and we went out shopping. In Sunday all shopsare closed in the netherlands thus the near food store we usually shop from Alberheim is closed too. That's why we moved to the center.We first ate in a place called "Subway", the vegetarenian sort of hamburger costed 2 EU, then we walked through the shops in the center andresearched where is what and how the prices vary in the different stores. Ina bought sunglasses, a blouse and ear-rings. We were also happyto find 24 hours opened shop right in the center. It seems that usually in Sunday the only place where the shops are opened is the center.We took some beer and went and stood along a little lake enjoying the swan and the ducks and crows which moved and flewer aroud. Then we catched the way for home looking around for unlocked bikes which we may take (it's common here in the Netherlands to just take unlocked bikes and make them yours even I heard a lot of people leave the old unusused bikes on the street unlocked so you can just take it and use it.On our way home Ina saw left old Zanussi fridge next to a trash bin with a note on it saying something in Dutch containing the Dutch word "wekrt" which literally translated means works. So we hoped the fridge is a working one. We called Koko and Sali to come end help us with the fridge. Then Koko and Sali came and helped us move the fridge to the Honigkamp 2 which is the building of the dormitory I live in. LaterI collected the dry laundry and went to take a shower, then I moved to the 5th floor's kitchen (My room is in the 1st floor). Wherewe gather with Ina for breakfasts, lunch or dinner. It's a common thing the last few days that all the Bulgarians that we live in Honigkamp just gather together with the laptops and listen to a different kinds of music and talking about stuff. Although is's so nice in the Netherlands I'm homesick a little. I also feel like going in no concrete direction. It's a common thing temptations come that tempt me to smoke again. Also a really terrible temptation I face is a one I faced a dozen of times. You know there are some girls that really are my type of girls unfortunately every time I look at that girls I start falling in love. This is just fine the bad thing is that I'm usually too "different", unconventional etc. to fit nice with the girls I like. Day by day I search for truths and I'm not sure I'm able to reach them .. the poor man I'm ehh…END—–

Share this on

Tags: Alberheim, aroud, Beer, bikes, blouse, bulgarians, center, crows, different kinds of music, dormitory, ducks, dutch word, ear rings, few days, flewer, food store, hamburger, help, kinds of music, Koko, laptops, laundry, lunch, netherlands, place, quot, right, Sali, shop, something, store, street, subway, sunglasses, swan, temptation, time, trash bin, type, wekrt
Posted in Everyday Life | No Comments »

Walking in Light with Christ – Faith, Computing, Diary

Posts Tagged ‘help’

Why saint George is depicted on icons killing a Dragon (an ancient story of saint George killing the last dragon) – A Collection of 7 icons of Saint Martyr George

How to solve “Incorrect key file for table ‘/tmp/#sql_9315.MYI’; try to repair it” mysql start up error

Getting around “Secure Connection Failed Peer’s, Certificate has been revoked., (Error code: sec_error_revoked_certificate)

A Sunday in the Netherlands

GET ARTICLE UPDATES

Daily Bible quote

Recent Posts

Useful blog? Help it:

Similar Posts

Categories

Links to Other Places

About Myself

Recent Comments

Ads

Top Post Views

blogtopsites