Shorewall firewall on UBUNTU LTS 8.04 server doesn’t start on boot

I have in one of my machines a pretty annoying situation related to the fact if the UBUNTU based firewall reboot’s, the firewall doesn’t start automatically…

This is pretty annoying because it means that after a power failure, there is a need for manual intervention to restore exterior access trough the firewall to internal servers.

The solution?

Well I’ve made a bash script, named resetfw.sh that checks the server uptime and if it falls bellow a threshold of 10 minutes, it restarts the firewall:

DAYS=`uptime | cut -d ‘ ‘  -f   4`
HOURS=`uptime | cut -d ‘ ‘  -f   6`
HOUR=`echo $HOURS | cut -d ‘:’ -f   1`
MIN_NP=`echo $HOURS | cut -d ‘:’ -f   2`
MIN=`echo $MIN_NP | cut -c 1-2`

if [ $DAYS = "0" ]; then

if [ $HOUR = "0" ]; then

if [ $MIN -lt "10" ]; then

/etc/init.d/shorewall stop
/etc/init.d/shorewall start
/etc/init.d/shorewall stop
/etc/init.d/shorewall restart

logger “Firewall reset due to reboot: Uptime on action: $DAYS days, $HOUR:$MIN”
fi
fi

fi

Then all we have to due is to run this script periodically through the crontab:

*/5 * * * * /root/resetfw.sh

[K]Ubuntu kernel upgrade breaks vmware

When after a kernel update from the repositories or pushed by the adepter updater, vmware refuses to start, you have to run the vmware-config.pl script again.

[K]Ubuntu and Netbeans 6.1 with Firefox 3.0

One annoying things that took some time to solve was that on the Start page of Netbeans there are URL’s to several articles, blog posts and so one, but every time I’ve pressed one of the it say’s that it could not execute Firefox.

I’ve checked the path, permissions, and so on but with no solution.

Well the issue is quite simple:

Goto Netbeans Tools menu and select the last option Options. It should start on the general tab where you select the browser you which to use.

Select Edit and on the arguments for Firefox remove whats there: -remote “openURL({URL})” and just keep the {URL} nothing else.

Save, close and it should work.

Now back to work…

Ubuntu 8.04 LTS server HAVP problems

I’m using Ubuntu 8.04 LTS server as a proxy/mail gateway,  and I had a problem with apt-ge and havp.

It seems that every time I used apt-get it complained about some problem with havp:

Starting havp: Starting HAVP Version: 0.86
Could not create server (already running?)
Exiting..
invoke-rc.d: initscript havp, action “start” failed.
dpkg: error processing havp (–configure):
subprocess post-installation script returned error exit status 1
Errors were encountered while processing:
havp
E: Sub-process /usr/bin/dpkg returned an error code (1)

So what I’ve done was:

sudo bash

cd /etc/init.d

mv havp havp.old

apt-get upgrade

mv havp.old havp

and this cleared my apt-get errors.

Now it works.

Ubuntu: The perfect mail gateway server

I’m setting up a new firewall, email gateway server using Ubuntu 8.04LTS. As in a previous post, I’m following (not always by the book) the Howtoforge to setting up a email/spam gateway Ubuntu mail gateway.

Three things didn’t go quite as expected, and so here they are engraved for ever in the internet stone:

1st) General: In the Webmin Others->Server and System Status, the Apache server monitoring reports apache as always down. The solution is to go to Servers->Apache Webserver and select on the top the link Module Config. At the bottom the option Path to Apache PID file is set to Automatic. Change it to point to /var/run/apache2.pid and save. The webmin monitor now for apache should show the apache status as OK.

2nd) Mail: I really like Mailscanner and it’s partner Mailwatch. One of the issues that I was having was that the messages that where in quarantine, Mailwatch didn’t show any option to delete or release the messages for them. The issue was lack of folder permissions. Mailwatch couldn’t access the quarantine directory. So executing the command chown -R postfix:www-data /var/spool/MailScanner and chown -R postfix:www-data /var/lib/MailScanner/ did the trick, and I can now delete and release quarantine messages.

3rd) Mail relay: After setting up postfix, all incoming messages where refused on the external interface because postfix denied relaying. Please note that I’m using this server to receive mail from the internet, to see if a mail is safe, no virus, no spam, no phishing, and so on, and then forward it to our internal mail servers. So I have a relay_domains file that describes our domains, and a transport file that specifies where are the “real” mail servers, but even with this, postfix was always refusing the mails.

The solution for this issue is on the empty mydestinations option. Setting up this option with mydestination = hash:/etc/postfix/relay_domains and stoping and restarting postfix, did the trick.

Regarding the howtoforge manual, I skiped some of the things, like fuzzyocr, and removed Bind9 from the server.

As I progress in setting up and configuring the the server, if anything worth mention, I’ll post it here.

Linux mail gateway

I’ve run where I work for 4 years a Mandrake based firewall with Postfix and Mailscanner. I really, really liked mailscanner, but for my colleagues the setup was “too complicated”. So I moved to EFW, Endian Firewall comunity edition. What it brings in ease of use it lacks in flexibility.

Finally my prayers where listen, and I’m going to move again to a custom build full fledged mail gateway with Mailscanner. Check out: this howto.

(K)Ubuntu and Visio Clone (Part II)

I’ve tried DIA http://live.gnome.org/Dia to make some network/deployment architectures graphics.

My impressions:

- I took me a while to understand how I add elements (in my case network elements) to the canvas.

- DIA works with the concept of layers, so if you want to put something in front of other object you must create a new layer, cut the object, change the layer and paste it.

- Linking objects works ok, but only on the same layer.

- After the drawing is made you can’t copy it and paste it on an OpenOffice document.

SO, as a standalone product, it’s good, despite the issue of layers depicted above. It means you must think your drawings a bit ahead, and if you want to make changes it can get quite complicated.

X-Windows access on your Windows PC

Sometimes you need to run graphical Unix/Linux applications on your Windows client PC. Text access is easy, there are several ssh clients available, and windows has a telnet client. What about X-Windows?

The solution is XLiveCD: http://xlivecd.indiana.edu/

This is a CD that just makes your Windows PC into a X-Windows client (Correct terminology would be Server… ). With this you can just start a ssh session into your remote Unix/Linux box, and from there just run any graphical application that you need. The application will display along your other Windows applications.

By the way if you have Nero Image or something similar, you even don’t need to burn a CD…

Also as a bonus the CD has a complete CYGWin set of commands, and so you also get tail, grep, uniq…

Linux (K)Ubuntu and OpenOffice Visio clone…

THAT’s what I’m missing…

A good application for network diagrams on Linux, something like the Detailed Network stencil on Visio. (Edit: I do mean the detailed network base diagram that has several stencils for drawing detailed networks).

Kivio is ok, for flowcharting, but the available (to be bought) stencils… humm, I think not.

(K)Ubuntu and Slow Grub Startup

After upgrading my Kubuntu version from CD, Grub started to behave strangely: After rebooting the machine it stopped for around 30s on the Phase 1.5 until the operating systems menu showed up. After selecting the operating system, another 30s until startup.

It took me a while to solve it. I followed some of the instructions that are on this post: http://forums.fedoraforum.org/archive/index.php/t-950.html

It’s not Ubuntu related, but Grub is Grub…

Anyhow, after booting and logged in, I opened a Konsole, and did the following:

1) sudo bash <- to get a administrator shell

2) Started up Grub: grub

3) And checked what is my boot disk (just to make sure): find /boot/grub/stage1

4) It looked ok, so I’ve ran: setup (hd0) (That’s a zero)

5) Quit Grub, and rebooted.

Problem solved…