Walking in Light With Christ - hip0's personal blog on System Administration, Free Software, Computer Security and Religion

I'm about to chage the good old computeres until this very moment this blog and few other website were running on. Right now, I'm installing the brand new machine Lenovo ThinkCentre Edge great and hopefully powerful enough machine to take care for the periodic occuring high traffic loads which break up webserver or SQL server. Well anyways, I just installed latest Debian GNU / Linux on this brand new piece of iron. During install I couldn't connect the PC to network so Debian install was unable to determine, the nearest Debian package repository, hence after completing install and anually configuring Debian network . Because during install the system had no connection with the Internet, no proper package repository definitions were present in /etc/apt/sources.list, hence I had to find the nearest package software repository. Normally one can check in Debian official WorldWide Mirror sites full address list and determine by some rationalization with ping or / and a manual package download which repo is quickest. There is thanksfully a better automated way one can determine the closest deb Debian / Ubuntu located repository with netselect-apt.

Here is apt-cache description:

debian:~# apt-cache search netselect-apt
netselect-apt - speed tester for choosing a fast Debian mirror


Using the tool is trivial, just install, run it and it does all 4 u :)

1. Install netselect-apt

debian:~# apt-get install --yes netselect-apt


2. Run it

debian:~# netselect-apt
....
130/debian/); keeping only under first name.
netselect: 2 (2 active) nameserver request(s)...

Duplicate address 200.236.31.3 (http://debian.c3sl.ufpr.br/debian/, http://ftp.br.debian.org/debian/); keeping only under first name.
netselect: 1 (1 active) nameserver request(s)...
Running netselect to choose 1 out of 383 addresses.
.............................................
The fastest server seems to be:
http://debian.telecoms.bg/debian/

Writing sources.list.
sources.list exists, moving to sources.list.1346964774
Done.


As you can see from output, the tool finds the quickest download deb repository and generate /etc/apt/sources.list file in current directory, where it is run in, in this exact case it creates it in root user home dir - e.g. in /root/ directory. Once the repo address is found you can copy paste it with some text editor to /etc/apt/sources.list or move it over /etc/apt/sources.list;

debian:~# cp -rpf /etc/apt/sources.list /etc/apt/sources.list.$(date +%d_%m_%Y|sed -e 's/^ *//')
debian:~# mv /root/sources.list /etc/apt/sources.list


Just in case as I always make first copy of original sources.list, this is not necessery but IMHO a generally good sysadmin habit :)

Besides netselect-apt, which automatically choose between all available list of software repo servers, there is also netselect tool. netselect does basically the same the only difference is one has to manually pass by as arguments deb package repositories and the tool then does tests and returns which is the overall quickest deb download source.

netselect is definitely useful if you have started few own mirror of repositories and want to determine which is the best among them.

Here is how netselect is used:

# netselect -vv ftp.fceia.unr.edu.ar ftp.kulnet.kuleuven.ac.be \
ftp.cdrom.com ftp.debian.org ftp.de.debian.org
ftp.fceia.unr.edu.ar 2792 ms 23 hops 100% ok ( 1/ 1) [ 9213]
ftp.kulnet.kuleuven.ac.be 9999 ms 30 hops 0% ok
ftp.cdrom.com 94 ms 8 hops 100% ok (10/10) [ 169]
ftp.debian.org 46 ms 15 hops 100% ok (10/10) [ 115]
ftp.de.debian.org 9999 ms 30 hops 0% ok


According to above output, the "best reachable" (quickest) repository is the one to which are the least miliseconds - ftp.debian.org

If you have to do it on a PC with 3 Windows existing directories on C drive for instance (Windows, Windows, Windows3) it is good idea to first find out which is the exact directory from whom present working reads fonts.

To check %WINDIR% in Command Prompt (Start -> Run -> cmd.exe) type:

echo %WINDIR%




Next open Windows Explorer and copy all files to wherever %WINPATH%\fontsis located. During copying Windows will automatically invoke some font installer program and show tiny progress dialog like in down screenshot:



Afterwards fonts load system wide and appear in MS Windows Word and others installed programs with no need of PC restart :)

Yesterday for few hours on our way back from Shipchenski Monastery, we went through Kabile Monastery (a nun monastery located 6 kilometers from Yambol Bulgaria and just 1 km away from the nearest village Kabile. According to Church tradition in V-th century during the reign of Byzantine emperor Constantine on the same place used to a huge early Christian cloister

Also according to local Church tradition, st. Helena (Elena) - the Mother of Emperor Constantine regularly sent her servents to take Holy Water from the Monastic Holy Spring. Even in the ancient times of existence the monastery is very probably the monastery was inhabited by nuns.
It is known the monastery continued its existence until the falling of Bulgaria under Ottoman Turkish 5 centuries (yoke) Slavery.

According to some annalist saint Bulgarian patriarch Evtimiy of Tarnovo (the last bulgarian Church autonomous patriarch before the fall of Bulgaria under the Turkish yoke) passed through Kabile cloister during his exile by Turkish sultan in Bachkovo Monastery. Tradition says Turkish soldiers believed there is a hidden treasure somewhere in the monastery(the monasteries at 12th, 13th century was rich and often contained many treasures). Because invaders couldn't find any precious stones or hidden gold inside monastery Turkish soldiers decided to burn down the monastery to the ground and buried the holy (healing water) spring.

Onwards for many centuries the monastic holy land was deserted, but locals from generation to generation kept the memory of the once great monatery alive. The consequential story on how the monatery was restored is quite long. A short version of the history goes like this. />
In year 1919, God appeared in a vision to old village lady Maria and told her where she has to dig to find the centuries "hidden" holy spring. In the vision the lady was told the monastic holy spring will be for restoration and healing of multitudes of people suffering from all kind of diseases.
The news about the re-finding of the Holy Spring, spread in the whole region and people started coming to drink from the Holy Spring to cure themselves from all kind of incurable diseases. The field where the monastery nowdays is was donated soon after by its owner Stoian Ganev

By God's providence in period 1919 - 1945, the monastery was rebuilt. The monastery was restored thanks to big efforts of Georgi Nikolov (a humble Christian) who travelled continously for years from village to village in Yambol and Sliven region collecting donations for rebuilding.



Kabile Monastic Yard

The monastery official name is Birth (Nativity) of Holy Theotokos Virgin Marry (Rojdestvo Bogorodichno) and currently is inhabited by 7 nuns. In the monastery there is a regular everyday morning and evening prayer service, a holy liturgy is served every Sunday. Similar to ancient times, the monastery has a special baptizmal chamber. Many people choose to baptize there children as a blessing in there. Abbot of the Monastery in present times is the lady Minodora.



The little "spiritual desert" of The Nativity of Theotokos is great place for anyone looking for a silent place for pilgrimage to spend some time in solitude and prayer to the Lord God.

Here are few pictures from the monastery, I didn't bring a camera with me hence I hold no copyright over pictures (copyright belong to there respective authors):



Kabile Nun Monastery (Bulgaria) - Healing Spring water photo



Inside the little Church of Kabile Monastery



Thanks be to God for all his kindness in showing me this nice spiritual place :)

For a short pilgrimage journey I went to Shipka. Shipchenski Monastery is a mountaint monastery near Yambol, Bulgaria. The monastery monks cells buildings are new and doesn't hold a hundred or thousand of years of history but still the place is very unique, surrounded by multitude of hundred year old pine trees just 3 minutes of climbing of an Orthodox Church building build in 1902 in memoriam of the great battles that occured for liberation of Bulgarian from Ottoman Turkish empire in Shipka Peak in years 1876-1877.

Yesterday night we spend the night in the monastery guest building. The monks there accepted us quite lukewarm and we were quickly accomodated in (a large room with 6 beds inside). The abbot of Shipka's Monastery is Archimandrite Januarij (January) - an early Christian great martyr saint. The archimandrite was very hospitable to us, arranged quickly a fasting dinner for us as well as later we had a small chat where he treated us with some of his self-brew Liquor.

As of time of writting in Shipka Monastery lives 6 monks and 2 novice monks. Its worthy to mention the Abbot's sharp sense of humour, fr. January was making nice jokes every few minutes.

The monastery had 2 dining rooms one for guests and one for monks. We had the chance to eat in both during the less 1 day stay in the monastery.

Getting out of the "monastic walls", there are stone stairs leading to the monastic Church building.
The Church building is majesticly beautiful with "underground" crypt containing graves of Russian and Bulgarian soldiers, people who sacrificed heroic there lives in the bloody battle that occured between Bulgarian guerillas and Russians soldiers in The Battle of Shipka Pass
The Russian Church built in 1902 is dedicated as eternal memoriam of the heroic battle for the sake of Christ and restoration of Bulgarian Christian country, after we Bulgarians lived under the yoke of Islam for V centuries.

The Church is build fully in the tradition of Russian Orthodox Church buildings (probably by Russian Architects). The wall-painting (icons) are magnificient and painted in 19th century Russian renessance style.

In the Church it is pure joy for pilgrils as there are holy relics of many saints including the holy relics of Saint Alexander Nevski. Here it is maybe good to say today in Bulgarian Orthodox Church, we celebrate the "transferring" (carrying away) of st. Alexander Nevrski's Holy Relics. The Church is called The Birth of Christ in veneration of our Saviour's Birth. it is huge cathedral building with 4 Alters, where on of the alters is dedicated to saint Alexander Nevski.
Especially for the feast of St. Aleksander Nevski the Metropolitan of Stara Zagora - his beautitude Galaktion came and served the Holy Liturgy service. There were also about 12 of priests and monks who came and co-served the holy liturgy in order to venerate the great Russian saint.
Going out of the Church the mountain view from is absolutely "breath taking" and something worthy to see if you come in Bulgaria.
Something interesting is the big Church bells, one of the Church bells is currently the biggest existing bell on the Balkans. As you can guess the bell ding is super loud :)
Here are some pictures from Rozhdestvo Hristovo (The Birth of Christ) Church from Shipka to enjoy:



The Crypt of Soldiers who gave their life for nowdays Bulgarian freedom in Shipka Memoriam Church



Very near to Shipka's monastery, there is a pathway leading to exact place where severe bloody battles between Russian, Bulgarian liberators and Turkish army occured. Nowdays on Shipka Peak is a huge beautiful monument in ever-remembrance of the brave Bulgarian Russian soldiers who loose their lives for the sake of Bulgaria.

Every time I had to modify something in productive QMAIL server install, I end up with some kind unexplainable problems which create huge issues for clients. For one more time I end up with errors after minor "innocent" modifications of a working for more than year time QMAIL ....

After last changes I made to combined qmail install of Thibs, QmailRocks in Daemontools qmail start up files:

/var/qmail/supervise/qmail-smtpd/run
/var/qmail/supervise/qmail-smtpdssl/run


In both files I set variable:

SSL=0 to SSL=1:

After making the change I restarted qmail tested sending emails and all looked well. Therefore I thought all works as usual, e.g. e-mail are properly sent and respectively received to the mail server....

So far so good until just today, when I received urgent phone call in which my employer reported about severe problems with receiving emails.
Trying to send from Gmail or Yahoo to our mail server were unable to be received with some delivery failure errors ...
First I was a bit sceptical, hoping that maybe the errors reporting are not caused by the mail server but after giving a try to send email to the mail server in question the reported problem prooved true.
As always when errors with QMail, I checked what the logs says about the problem just to find in /var/log/qmail-smtpd/current log following err:

@4000000050374a0e1a5dc374 sslserver: warning: dropping connection, unable to SSL accept:protocol error


I've dig over almost all primary forums, threads and blog posts online but nowhere I couldn't find anymeaningful as explanation to the error, so was forced to look for solution myself.
Obviously, there was error with SSL, so my first thought was to check if all is fine with permissions of servercert.pem and clientcert.pem. The permissions of two files were as follows:

ls -al /var/qmail/control/clientcert.pem
-rw-r----- 1 root qmail 2136 2011-10-10 13:23 /var/qmail/control/clientcert.pem
ls -al /var/qmail/control/servercert.pem
-rw-r--r-- 1 qmaild qmail 2311 2011-10-12 13:21 /var/qmail/control/servercert.pem


At first glimpse I was suspicious concerning permissions of /var/qmail/control/clientcert.pem but after checking on other Qmail servers which worked just fine I was sure the problem did not root in clientcert.pem permissions.

As you can guess another failure point I suspected was the previous day change of SSL=0 to SSL=1 in /var/qmail/supervise/qmail-smtpd/run and /var/qmail/supervise/qmail-smtpdssl/run. On that account, I immediately reversed back the yesterday setting of SSL=0 and then restart QMAIL.

The usual QMAIL to restart qmail is via qmailctl, but since so often qmailctl does not reload qmail current settings I had to also refresh current working qmail binaries via both stopping qmail with qmailctl stop and through /etc/inittab by commenting out in it line dealing with daemontools svscanboot:

Hence I first stopped all running qmail processes via init script:

# /usr/bin/qmailctl stop


Then commented line:

SV:123456:respawn:/usr/bin/svscanboot


to:

#SV:123456:respawn:/usr/bin/svscanboot


Onwards did reload of initab with command:

# /sbin/init q


Right onwards I uncommented the commented line:

#SV:123456:respawn:/usr/bin/svscanboot


to:

SV:123456:respawn:/usr/bin/svscanboot


And load up daemontools (svscanboot) via inittab issuing:

# /sbin/init q


Finally I had to start QMAIL processes:

# qmailctl restart
...


Change of SSL svscanboot daemontools service script SSL=0 to SSL=1 however created other problems for clients cause any present clients which used crypted connections to SMTP server viaSSL encryption rendered unable to send mails anymore with error messages like:

Cannot establish SSL with SMTP server xx.xxx.xxx.xxx:465, SSL_connect error 336031996.

To work around this issue I had to once again start SSL (set SSL=1) in /var/qmail/supervise/qmail-smtpssl/run and leave SSL switched off for /var/qmail/supervise/qmail-smtp/run.

Even doing this changes for about 20 minutes though I restarted QMAIL multiple times, qmail continued having issues with mails received with the shitty:

@4000000050374a0e1a5dc374 sslserver: warning: dropping connection, unable to SSL accept:protocol error


After multiple restarts "magically" the stupid server figured out it should load my changed setting in qmail-smtpdssl/run (before it finally worked I probably had to restart 20 times using qmailctl stop; qmailctl start ....

I've figured out as a good practice to put delay between qmailctl stop and qmailctl start cmds so in restarts I used a little 3 secs sleep in between like so:

# qmailctl stop; killall -9 multilog; sleep 3; qmailctl start


Also killing multilog (killall -9 multilog) is good practice cause often nevertheless restarts server logging is not refreshed ...

Something else that might be important is the AUTH settings in qmail-smtpd/run and qmail-smtpdssl/run in thisfinally working qmail they are:

AUTH=1
REQUIRE_AUTH=0
ALLOW_INSECURE_AUTH=0


Hope this post helps someone to solve same crazy error ...
Cheers

In case you need to DELete Windows temporary files directory to save some free space on an old PC or (group of PCs) in a raw you might prefer to use this CLI command lines:

DEL /F /S /Q %TEMP%
DEL /f /q /s "%SYSTEMDRIVE%\Documents and Settings\LocalService\Cookies\*.*"
DEL /f /q /s "%SYSTEMDRIVE%%HOMEPATH%\Cookies\*.*"
DEL /f /q /s "%SYSTEMDRIVE%\Documents and Settings\LocalService\Local Settings\Temp\*.*"
DEL /f /q /s "%SYSTEMDRIVE%\Documents and Settings\NetworkService\Local Settings\Temp\*.*"
DEL /f /q /s "%SYSTEMDRIVE%\Documents and Settings\Default User\Local Settings\Temp*.*"
DEL /f /q /s "%SYSTEMDRIVE%%HOMEPATH%\Local Settings\Temp\*.*"
DEL /f /q /s "%WINDIR%\Temp\*.*"
DEL /f /q /s "%TEMP%\*.*"
DEL /f /q /s "%SYSTEMDRIVE%\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\*.*"
DEL /f /q /s "%SYSTEMDRIVE%%HOMEPATH%\Local Settings\Temporary Internet Files\*.*"
RD /q /s %TEMP%
RD /q /s %WINDIR%\Temp
RD /q /s "%SYSTEMDRIVE%\Documents and Settings\Default User\Local Settings\Temp"
RD /q /s "%SYSTEMDRIVE%\Documents and Settings\LocalService\Local Settings\Temp"
RD /q /s "%SYSTEMDRIVE%\Documents and Settings\Default User\Local Settings\Temp"
RD /q /s "%SYSTEMDRIVE%%HOMEPATH%\Local Settings\Temp"


Another helpful thing for MS Windows users is cleaning up Windows Tempory Files on every system restart (reboot); doing so is possible by setting below's short batch script to exec on every system boot:

@ECHO OFF
IF NOT %temp% == %tmp% GOTO both_
GOTO single
:both
DEL %temp%\*.* /F /S /Q
DEL %tmp%\*.* /F /S /Q
CLS
ECHO Deleted all files in the TEMP folder: %temp%
ECHO Deleted all files in the TMP folder: %tmp%
GOTO end
:single
DEL %temp%\*.* /F /S /Q
CLS
ECHO Deleted all files in the TEMP folder: %temp%
:end


You can download the script clean_windows_temp_files_on_win_start.com here . The script is great tool for Windows administrators of Win Domain Controllers or University / educational M$ Windows based networks, where PC security is at high risk. Setting the script to run on even "non-critical" home PCs is a great idea as it can save you a lot of troubles with SpyWare, Malware Viruses and other Windows targetted "Bad-Wares" :)

Cheers :)

Some clients of one of the qmail servers mail domain complained that there are problems sending e-mails with Thunderbird (pop / imap) client.

The exact Thunderbird sending error is:

Unable to establish a secure link with SMTP server smtp.examplehost.com using STARTTLS since it doesn't advertise that feature.
Switch off STARTTLS for that server or contact your service provider.


For for almost half an hour I pondered why the heck this odd error happens in sending mails with a fresh new Thunderbird (auto) configured mail address.
Few months back some clients were experiencing similar STARTTLS errors so I went back to check my previous post to get an idea what was wrong then in order to determine if the current reported error had to do with the previous one. My previous post is here - How to work around STARTTLS Qmail Thunderbird / Outlook mail sending (error) issues

After reading on the previous error and some assumptions I found out the whole problem lays in incorrectly set DNS records.
By default Thunderbird (and probably other mail clients) are configuring automatically as SMTP server (smtp.examplehost.com) if the DNS record for smtp.examplehost.com points to an IP address / host which belongs to another mail server, everytime thunderbird tries to send email the incorrect smtp.examplehost.com is used, hence the mail sending fails with the err:

Unable to establish a secure link with SMTP server smtp.examplehost.com using STARTTLS since it doesn't advertise that feature.
Switch off STARTTLS for that server or contact your service provider.

In my case the DNS for examplehost.com which is the mail server host was managed by Godaddy's DNS-es:

ns49.domaincontrol.com
ns50.domaincontrol.com


The A record for our domain smtp.examplehost.com was by default set in GoDaddy to point to incorrect IP, so the fix was simply to change the Domain alias of smtp.examplehost.com to the proper mail host.

Another thing I had to do is change variables in /var/qmail/supervise/qmail-smtpd/run and /var/qmail/supervise/qmail-smtpdssl/run

In both files I changed variables:

SSL=0
ALLOW_INSECURE_AUTH=0


to

SSL=1
ALLOW_INSECURE_AUTH=1


Also variables FORCE_TLS and DENY_TLS in /var/qmail/supervise/{qmail-smtpd,qmail-smtpdssl}/runshould be:

FORCE_TLS=0
DENY_TLS=1


Though the problem was occuring in Mozilla Thunderbird, i'm sure same email sending problem will be present if Microsoft Outlook Express or any other desktop pop3 client is used.
After this changes I had to restart qmail server through qmailctl:

# qmailctl stop; sleep 5; qmailctl start


This fixed clients mail sending issues ... hope this will help to others looking for way to remove STARTTLS, TLS, SSL qmail support ...


On 19-th of August 1903 happened the Indensko Preobrajensko Vyzstanie - (Ilinden Transfiguration liberation revolt). This revolt is important moment for Bulgarian restoration modern history. At this time South Eastern part of Bulgaria was still under Ottoman Turkish Empire rule and there was huge internal tension between local population striving to liberate and unite with rest of bulgarian lands.

The revolt was planned to raise some publicity in western world and show that the lands of Strandzha mountain are belonging to the newly established Russian liberated restored Bulgaria. Ilindensko Preobrazhenski Uprising was preceded by another revolt which happened in nowdays Macedonian lands near the city of Ohrid. The revolt is named under Ilindensko Preobrajensko Vyzstanie name because actually, the 2 revolts were perceived as one common effort to liberate and unite ex-Bulgarian empire territories with mainly Bulgarian and Serbian population to the newly re-establed Bulgarian land. Ilinden is important day for Bulgarian culture in english it means (Saint Elijah's day) as the people of the early 20th century had strong faith the 2 revolts received a common name after the two Church feasts Ilinden (st. Elijah's day) and Preobrazhenie (The day of Christ transfiguration). The revolt was organized and planned by the even to this day existing Bulgarian organizatoin VMRO - Vytreshno Makedonska Revolicionna Organizatia - (Internal Macedonian Revolutionary Organization).
VMRO asks on a few times the then Bulgarian army to join them in the uprising efforts, but the then Bulgarian king refuses foreseeing that this could cause another war between the newly re-established 5 centuries unexistent Bulgaria with the still large and powerful Ottoman empire.


Though uprising was quickly brutally extinguished by Turkish as planned the revolt was able to raise a huge dispute about the so called "Bulgarian problem" and in 1913 part of Strandzha mountain was united with Bulgarian country. The Bulgarian population of the parts of Strandja mountain which remained in territory of Turish empire was forcefully chased to central Bulgaria.



The total number of "guerillas" who participated in two revolts was 26 000. This 26 000 bravehearts faced enormous 350 000 people Turkish army! Of course the outcomes of this uniqeual powers were clear. Still some members of the uprising held hopes thta maybe Russia or some of the western countries would help them with provisions and people "reinforcements". 994 "guerillas" died in the uprising.



The turkish army demolished 201 peaceful people villages (12 440 houses!) and killed brutally 4 694 (peaceful inhabitants in this number kids and woman) by slaughtering and burning them alive. 30 000 of people from the ravaged villages escaped from their homelands and become refugees in Bulgaria. As one can guess whole Civillized Europe was in shock that in 20th century such a blood bath could happen in Europe ....