Saturday, September 24, 2016

Replicating Emails between two mail servers by Dovecot dsync

If you're running mail server for large ISP, sometimes we may need to think of replicating your emails in two servers for redundancy, this is very possible if your are running Linux mail server with postfix, dovecot and mysql, and this is archived by using Devocot dsync.

dsync is Dovecot's mailbox synchronization utility. It can be used for several different use cases: Two-way synchronization of mailboxes, creating backups of mails, and convert mailboxes from/to different mailbox formats. All of these can be used within the same server or between different servers (via ssh(1) or tcp connections). Remote mailboxes can be accessed also via IMAP protocol, which allows using dsync for mailbox migration purposes.

Below is configuration on how to sync emails between two servers, Server A is fully configured original server and server B is new server which you will sync emails from Server A, make sure Server B is fully configured also, then follow the steps below to sync emails between server A and B.

Server A
Backup/export the email database from original server

mysqldump -u [username] -p [database name] > [database name].sql

eg. if my database is mail and user is postfix the command will be,

mysqldump -u postfix -p mail > emailbackup.sql

Server B
Restore/import email database to second server.

mysql -u [username] -p newdatabase < [database name].sql


The following configuration should be done on both servers

a.  Enable notify and replication plugins
Open the file,

/etc/dovecot/conf.d/10-mail.conf

and add the following,

# Enable globally the notify and replication plugins
# This will then apply to all protocols dovecot supports
mail_plugins = notify replication

b. Enable iterative _query
Open the file
/etc/dovecot/dovecot-sql.conf.ext or /etc/dovecot/dovecot-sql.conf , according to your settings and add the following or just un-commenting the existing one.

iterate_query = SELECT username AS user FROM mailbox WHERE active = '1';

c. Create the dsync configuration file 

 # vi  /etc/dovecot/conf.d/30-dsync.conf

and add the following:

# From here
# This sets globally the port needed to connect # Configure the aggregator service for notifications
service aggregator {
    fifo_listener replication-notify-fifo {
        # Your mail user that's managing files generally is used here
        user = vmail
        mode = 0666
    }
    unix_listener replication-notify {
        user = vmail
        mode = 0666
    }
}


# Configure the replicator service
service replicator {
    process_min_avail = 1
    unix_listener replicator-doveadm {
        mode = 0666
    }
}
service doveadm {
     user = vmail
    inet_listener {
        # port to listen on
        port = 12345
        # enable SSL
        #ssl = yes
    }
}

doveadm_port = 12345
doveadm_password = dovecot password
# Configure target hosts for replication
# tcps can be tcp if you don't want to connect with SSL
# :port can be omitted if it's the default set globally for doveadm

plugin {

    mail_replica = tcp:replica_server_IP
}

service config {
  unix_listener config {
    user = vmail
  }
}

# Up to here.

d. Restart dovecot

service dovecot restart

f. If configuration is done well, run the following to check the status of syncing,

doveadm replicator status '*'

You should see the syncing is on progress.


Note,

The doveadm_password should be the same on both servers, mail_replica = tcp:replica_server_IP, for ServerA replica_server_IP is ip address of ServerB, and for ServerB replica_server_IP is ip address of ServerA.

Some usefully commands,

i. To check the replication on each server:

doveadm replicator status '*'

ii. Replicate a given email account manually

doveadm replicator replicate <email>

iii.  Replicate a given email account manually IN FULL

doveadm replicator replicate -f <email> 

iv. Check replication status. Also works without the email parameter.

doveadm replicator status <email>
Hope it helps someone, drop comments if you face any issues.





Saturday, June 18, 2016

Installing lastest version (1.4.6) of GNS3 in Ubuntu/Debian

GNS3 is a Graphical Network Simulator that allows emulation of
complex networks. In this lab am going to show you how to install the lasted version of it on Ubuntu/Debian distributions.
This lab was full tested in Debian 8 and Deepin 15. If you face any issue please drop me a comment.

1. Install dependencies

a. GNS3 dependencies

sudo apt-get install gcc
sudo apt-get install python3-setuptools
sudo apt-get install python3-dev
sudo apt-get install python3-netifaces
sudo apt-get install python3-pyqt4
sudo apt-get install python3-ws4py
sudo apt-get install python3-tornado
sudo apt-get install python3-zmq

b. Dyamips dependencies
The dynamips hypervisor is a program that emulates Cisco MIPS based router hardware, allowing you to run select IOS image files in GNS3. Using dynamips you can run IOS images for Cisco c1700, c2600, c3600, 3700, and 7200 series routers.

sudo apt-get install cmake
sudo apt-get install libelf-dev
sudo apt-get install uuid-dev
sudo apt-get install libpcap-dev

2. Install GNS3 from source

a. Download it

Check the latest release from here,
https://github.com/GNS3/gns3-gui/releases

As on time of compiling this howto the lasted release was version 1.4.6

On download section, download the file with .source.zip extension.

Use the terminal to change to directory containing the dowloand file and extract it.

unzip GNS3-1.4.6.source.zip -d GNS3-1.4.6.source
cd GNS3-1.4.6.source

The GNS3 software is made up of two main components; a server application, and a GUI application. This provides a great amount of flexibility by allowing you to run multiple servers on different PCs. Leveraging this feature, you can create large GNS3 networks.

b. Install GNS3 server

unzip gns3-server-1.4.6.zip
cd gns3-server-1.4.6/
sudo python3 setup.py install
cd ..

During installation it will download some packages online, make sure it finishes, below is expected final output
.
.
Using /usr/lib/python3/dist-packages
Finished processing dependencies for gns3-server==1.4.6

c. Install GNS3 gui

unzip gns3-gui-1.4.6.zip
cd gns3-gui-1.4.6
sudo python3 setup.py install
cd ..

During installation it will download some packages online, make sure it finishes, below is expected final output
.
.

Using /usr/lib/python3/dist-packages
Finished processing dependencies for gns3-gui==1.4.6

d. Install Dynamips Hypervisor

unzip dynamips-0.2.16.zip
cd dynamips-0.2.16/
mkdir build
cd build
cmake ..
make
sudo make install
sudo setcap cap_net_admin,cap_net_raw=ep /usr/local/bin/dynamips
cd .././..

Make sure everything finishes without any error.

d. Install IOU prerequisites

sudo apt-get install libssl1.0.0:i386
sudo ln -s /lib/i386-linux-gnu/libcrypto.so.1.0.0 /lib/libcrypto.so.4
sudo apt-get install bison
sudo apt-get install flex
sudo apt-get install git
git clone http://github.com/ndevilla/iniparser.git
cd iniparser
make
sudo cp libiniparser.* /usr/lib/
sudo cp src/iniparser.h /usr/local/include
sudo cp src/dictionary.h /usr/local/include
cd ..

e. Install GNS3 IOUYAP

unzip iouyap-0.97.zip
cd iouyap-0.97/
sudo make install
sudo cp iouyap /usr/local/bin
cd ..

f. Install VPCS

unzip vpcs-0.6.1.zip
cd vpcs-0.6.1/src
./mk.sh
sudo cp vpcs /usr/local/bin/
cd ../..

g. Install Ubridge
unzip ubridge-0.9.4.zip
cd ubridge-0.9.4/
make
sudo make install
cd ..

3. Install other supporting software Cpulimit, Virtualbox, QEMU and Wireshart

The cpulimit application allows GNS3 to reduce CPU usage when running Cisco ASA devices in GNS3. With VirtualBox installed you can link emulated VirtualBox devices with other GNS3 devices. QEMU (Quick Emulator) is another PC hypervisor, and it is used to create and run Cisco ASA and other devices in GNS3. Wireshark is a powerful packet analyzer; using Wireshark you can sniff packets from your virtual GNS3 networks and analyze them, just as you can in the real world. Enter the following commands to complete your installation.

sudo apt-get install cpulimit
sudo apt-get install virtualbox
sudo apt-get install qemu
sudo apt-get install wireshark

4. Start GNS3
gns3

Note:
If you get below message:

Please install the PyQt5.QtSvg module

Install the module using the command:

sudo apt-get install PyQt5.QtSvg


After installation of the module you will be able to run gns3 on command line without problem.

Tuesday, May 24, 2016

Dropbox LAN sync - Save bandwidth and time with local dropbox LAN sync

If you are working in organization which uses Dropbox at the daily bases, you might came across with bandwidth issue especially when syncing large file across different computers. At normal the file should be uploaded to Dropbox servers and then downloaded to each individual computers where the file is shared and this is considerable large use of bandwidth and takes time especially if the file is large enough, but with Dropbox LAN syncing feature bandwidth can be saved and syncing time can be minimized.

What is Dropbox LAN sync?

Dropbox LAN Sync is a feature that allows you to download files from other computers on your network, saving time and bandwidth compared to downloading them from Dropbox servers.

The LAN Sync feature can speed up the syncing of files that exist on your local area network (shared folders and computers connected to the network). It allows Dropbox to check for new versions of a file on your network without having to download the copy of the latter from Dropbox servers.

What is Dropbox LAN sync prerequisites?

 If you want to force a LAN Sync, you’ll need two computers on the network with either the same account or a shared folder in common. Add a file to one of the computers, and the other computer should attempt a LAN Sync. The computers should be in the same LAN.

How to configure and enable LAN sync?

a. Install the Dropbox client on your PC: www.dropbox.com.

b. Allow Dropbox.exe in your firewall's settings: The LAN Sync feature requires access to port 17500 (TCP). Go to the Control Panel > Firewall > Allow app or feature through Windows Firewall.

c. Click on the Dropbox tray icon > Preferences. Go to the Bandwidth tab and tick the Enable LAN sync checkbox: Click on Apply > OK.


Enjoy!



Friday, May 13, 2016

How to enable remote desktop in Window Server 2012 R2 Core

Server Core is a minimal server installation option for Windows Server that provides a low-maintenance server environment with limited functionality.After installing window server core there greater possibility you won't have direct access to server so remote desktop is the best option for you, follow the below steps to enable remote desktop on window server core.

a. Login to the server
After login below is the screen your going to see,


Use the seen command line interface to enable remote desktop.

b. Migrate to system32 directory
cd \Windows\system32
c. Run the script below found in system directory which will show you the current state of remote desktop
cscript scregedit.wsf /AR /v
If it returns 1, that means the remote desktop is not enabled you need to enable it by running the following command
cscript scregedit.wsf /AR 0
As seen below:



d.  Check if remote desktop is enabled on firewall, by running the following command.

Get-NetFirewallRule -DisplayGroup "Remote Desktop" | format-table Name,enabled -autosize

If it return false, enable it by running the following

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

As seen below:



Now you're good you can manage your server any ware by using remote desktop client.
Don't forget to allow tcp/udp port 3389 on the router via port forwarding when the server is inside local area network.

Wednesday, May 4, 2016

CSF firewall installation and configuration for VOIP/PBX systems-Part 2

After installation of csf firewall and webmin done on part 1 of this document, part 2 will concentrate on only configuration of the firewall, configuration to be done is described in steps below.

a. Allowing IP/IP blocks with fully access to the server.
You may start the configuration by adding you own block which should have fully access to pbx/voip system,fully access means the ip's should have fully access to all ports on the server these IP's should be your private LAN ip or ISP ip's if your configuring service providers voip/pbx system, to do so logon to your system via https://serverip:1000, then go to System > ConfigServer Security & Firewall, then csf - ConfigServer Firewall section, add your ip/ip blocks to Quick Allow and Quick Ignore,as seen on example below:

Don't forget to click on Quick Allow and Quick Ignore to save it to configuration file.
You should also add you Voip provider IP, if your system is connecting to online voip provider, otherwise you might experience issue when calls are routed to voip provider.

b. Allowing specific ports for IP/IP blocks without fully access.
Now go Firewall Configuration, to add ports which should be accessible for anyone without fully access to the server, if your voip system is accessible from the Internet, these are ports will be seen directly from the Internet.
You may allow as many ports as you can  for ports going out, but you should restrict ports which are coming to your server as minimum as you can, as far as my research below ports working fine for PBX/VOIP systems,

   i. Incoming
Only allow voip/pbx pors 5060:5061 and 10001:20000 which are used as media ports for some pbx systems, so the setup may look as below.
       a. TCP
           5060:5061

         b. UDP
           5060:5061,10001:20000

   ii. Outgoing
As i said you may allow as outgoing ports as you can, no problem on this.

       a. TCP
           20,21,22,25,53,80,110,113,443
       b. UDP
           20,21,53,113,123,1000:65000

So the setting will look as below,

c. Blocking ping from outside
You may also need to block ping from outside as means of security, to do search for Allow incoming PING and change it from ON(1) to OFF(0).



d. Enabling the firewall
When all configuration is done, you should enable the firewall for it to be operation on your server, go back to the beginning of configuration file and look for TESTING part and turn it off, as seen below:

e. Testing the firewall
After enabling the configuration you should now test the firewall to make sure it works as intended, below are hints for testing.

-Test if all pbx users are able to call via the pbx, also monitor if they can hear the voice with required quality.
-Test if the users coming from restricted IP are able to access the admin interface of PBX/VOIP, i mean any traffic going to port 80/443, they should not as the access to only be available to allowed IP's.

There a lot of settings which can be done on CSF firewall, but above is minimum which can be used to lock down your VOIP/PBX systems,drop down comments if you face any problem implementing the settings.