frl1nuX

Today I played a bit with SMTP/s for the sole purpose of getting encrypted communications across the board between 2 or more hosts. I have done a fair few setups before but this one comprises of 2 CentOS hosts, tic on 5.8 and tac on 6.2. In this setup, tac will be the master SMTP/s server. I am using standard CentOS repos with no added sugar. The difference between my usual setups and this one is that you never send unencrypted emails between the two servers.

Firstly, install the 2 servers, then install postfix and the tools to generate the certs yum install postfix crypto-utils mod_ssl. You can then generate the cert on the servers (i would recommend using 2048 rather than 1024 but this is your choice):

genkey --days 365 tac.frlinux.net

Then edit /etc/postfix/main.cf and add the following to your master smtp server (tac in this example), then restart the service:

smtp_tls_security_level = encrypt
smtp_sasl_security_options = noanonymous
smtpd_tls_key_file = /etc/pki/tls/private/tac.frlinux.net.key
smtpd_tls_cert_file = /etc/pki/tls/certs/tac.frlinux.net.crt
smtpd_tls_loglevel = 3
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_tls_auth_only = yes
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

For some reason, CentOS 5.8 seems to be behaving differently, so I had to adjust the config to work properly:

smtp_tls_security_level = encrypt
smtp_sasl_security_options = noanonymous
smtpd_tls_key_file = /etc/pki/tls/private/tic.frlinux.net.key
smtpd_tls_cert_file = /etc/pki/tls/certs/tic.frlinux.net.cert
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_use_tls=yes
smtpd_tls_auth_only = yes

So one thing to keep in mind is that using encrypt is definitely NOT recommended for internet setups, in which case may is what you want.

Time to test this, I suggest good old telnet to see what is returned. Seeing STARTTLS is a good sign.

[root@tic ~]# telnet tac 25
Trying ...
Connected to tac.
Escape character is '^]'.
220 tac.frlinux.net ESMTP Postfix
EHLO lucifer
250-tac.localdomain
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
quit
221 2.0.0 Bye
Connection closed by foreign host.

Now we can try a full mail and see what the master says. I used logwatch reports directed to root account on the master SMTP:

: initializing the server-side TLS engine
/tlsmgr[3931]: open smtpd TLS cache btree:/var/lib/postfix_scache
/tlsmgr[3931]: tlsmgr_cache_run_event: start TLS smtpd session cache cleanup
: connect from unknown[10.66.66.66]
: setting up TLS connection from unknown[10.66.66.66]
: unknown[10.66.66.66]: TLS cipher list "ALL:+RC4:@STRENGTH"
: SSL_accept:before/accept initialization
: SSL_accept:SSLv3 write server hello A
: SSL_accept:SSLv3 write key exchange A
: SSL_accept:SSLv3 write server done A
: SSL_accept:SSLv3 flush data
: SSL_accept:SSLv3 read client key exchange A
: SSL_accept:SSLv3 read finished A
: SSL_accept:SSLv3 write change cipher spec A
: SSL_accept:SSLv3 write finished A
: SSL_accept:SSLv3 flush data
: Anonymous TLS connection established : TLSv1 with cipher ADH-AES256-SHA (256/256 bits)
: D1A3C1BD9: client=unknown[10.66.66.66]
/cleanup[3934]: D1A3C1BD9: message-id=<20120521223615.4D2398DDE5@tic.frlinux.net>
/qmgr[3927]: D1A3C1BD9: from=<root@tic.frlinux.net>, size=3840, nrcpt=1 (queue active)
: disconnect from unknown[10.66.66.66]
/local[3935]: D1A3C1BD9: to=<root@tac.frlinux.net>, status=sent (delivered to mailbox)
/qmgr[3927]: D1A3C1BD9: removed

And there you are, full encrypted SMTP/S communications between two postfix hosts.

Wow, amazed. I wrote a new entry yesterday about Cyanogenmod 9 and not later than this evening, I had 17 comments in moderation, all spams with useless sentences and web links to spamming sites. So fuck you spammers.

Here we go, another year passed. So a Happy New Year to you all, I thought It was time for some stats so here goes:

– 41 entries posted
– most popular articles were about my Samsung Galaxy SII and secret codes and cyanogen
– visits steadily increased from 2000 to 10000 every month throughout the year
– The top 3 visitors respectively are US, UK then France

So thanks for your support and I’ll try to post more and intersting stuff this year 🙂

I have been working on Graphite for a while and the one thing I didn’t like much was having to use Apache. It took some time to get it right, but I have eventually set it up to use supervisor, uwsgi and nginx. I have installed graphite 0.9.9 from sources. This setup is on a Debian stable system. First things first, a few packages to install: apt-get install python-dev libxml2-dev build-essential python-django-tagging. Then unpack carbon, whisper and graphite-web in that order and install them (default directory is /opt/graphite).

Then you need to grab uwsgi and unpack it and cd into the directory, you are now required to run this:

wget http://projects.unbit.it/downloads/uwsgi-0.9.9.2.tar.gz
tar xf uwsgi-0.9.9.2.tar.gz 
cd uwsgi-0.9.9.2
make -f Makefile.Py26 
cp uwsgi /usr/local/bin/
cp nginx/uwsgi_params /etc/nginx/

All is well in the universe, it is time to configure supervisor (apt-get install supervisor). Then create a file called /etc/supervisor/conf.d/uwsgi.conf and put that in. To restart supervisor, make sure you do a stop/start. Restart is flaky for me.

[program:uwsgi]
command=/usr/local/bin/uwsgi
  --module 'django.core.handlers.wsgi:WSGIHandler()'
  --socket 127.0.0.1:3031
  --chdir /opt/graphite/webapp
  --processes 1
  --master
  --harakiri 120
  --max-requests 5000
  --pythonpath "['/opt/graphite/webapp'] + sys.path"
directory=/opt/graphite/webapp
environment=DJANGO_SETTINGS_MODULE='graphite.settings'
user=www-data
autostart=true
autorestart=true
stdout_logfile=/var/log/nginx/uwsgi.log
redirect_stderr=true
stopsignal=QUIT

Next is to get your nginx config right, keep in mind that i use a directory within a vhost for graphite, so your config will differ if you use graphite as /, here is my full config:

server {
        listen 80;
        listen [::]:80; # use this only if using IPv6
        client_max_body_size    4M;
        server_name  graphite.frlinux.net;
        root   /var/www/stats;
        access_log  /var/log/nginx/stats.access.log;
        error_log  /var/log/nginx/stats.error.log;

        location / {
        }
       location /graphite/ {
                gzip off;
                include uwsgi_params;
                uwsgi_pass      127.0.0.1:3031;
        }
       location /content {
                alias /opt/graphite/webapp/graphite/content;
                gzip off;
                include uwsgi_params;
                uwsgi_pass      127.0.0.1:3031;
        }
       location /metrics {
                alias /opt/graphite/webapp/graphite/metrics;
                gzip off;
                include uwsgi_params;
                uwsgi_pass      127.0.0.1:3031;
        }
       location /dashboard {
                alias /opt/graphite/webapp/graphite/dashboard;
                gzip off;
                include uwsgi_params;
                uwsgi_pass      127.0.0.1:3031;
        }
       location /render {
                alias /opt/graphite/webapp/graphite/render;
                gzip off;
                include uwsgi_params;
                uwsgi_pass      127.0.0.1:3031;
        }
       location /browser {
                alias /opt/graphite/webapp/graphite/browser;
                gzip off;
                include uwsgi_params;
                uwsgi_pass      127.0.0.1:3031;
        }
       location /composer {
                alias /opt/graphite/webapp/graphite/composer;
                gzip off;
                include uwsgi_params;
                uwsgi_pass      127.0.0.1:3031;
        }
}

That’s it, point your browsers to your site like: http://site.example.com/graphite and it should be ready to show you data. Keep in mind that you have to take care of security which I am not covering in this article.

A friend of mine made me aware of a nicer web interface for git than gitweb called cgit. You will need to grab the source and compile it. I am assuming that you use /var/www/ as the root of your web server and fcgiwrap which should be configured right already. This is the missing bits for my config:

       location /cgit/ {
		index cgit.cgi;
		include fastcgi_params;
                gzip off;

               if ($uri ~ "/cgit/cgit.cgi") {
                        fastcgi_pass unix:/var/run/fcgiwrap.socket;
                }

        }

You then need to create a folder called /var/www/cgit in which you copy the cgit binary but also cgit.css and cgit.png. You then need to create a /etc/cgitrc configuration file which you will edit for your local configuration and projects. Mine looks like this:

root=/var/cache/git
repo.url=tripwire
repo.desc=Tripwire
repo.path=/var/cache/git/tripwire/.git

Restart/reload your nginx and you are ready to roll.

I have toyed with this yesterday and thought I would share the experiment. I wanted to try out the OpenVPN software built-in Cyanogen for my Samsung Galaxy S2, for this I used a Debian on the other side (which uses a public IP). The first step is obviously installing OpenVPN on the server, then configuring it. Once this is installed, you can do the following steps, this will take care of symlinking the easy-rsa directory, create the server CA and create its certificates.

ln -s /usr/share/doc/openvpn/examples/easy-rsa/1.0 easy-rsa
cd easy-rsa
source ./vars 
./clean-all 
./build-ca 
./build-dh 
./build-key-server yourserver

Once this is done and you have checked there was no error in all the commands you typed, you can create your first client, still within the same directory do: ./build-key-pkcs12 cm7. In this example, cm7 is your client name.

This is the working config for my OpenVPN server, edit /etc/openvpn/server.conf. I chose TCP as a more reliable way to have my client keep the vpn connection over crappy GPRS.

proto tcp
port 8443
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/yourserver.crt
key /etc/openvpn/easy-rsa/keys/yourserver.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server 192.168.6.0 255.255.255.0 
keepalive 10 120
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
mssfix 1200 
tun-mtu 1200

Now comes the interesting bit, Cyanogen has a page on OpenVPN but they don’t really explain how to install the p12 cert you generated. You will need to copy that to the root of your sdcard, then go to Settings/Location and Security/Storage Credentials/Install from SD Card. Once you have selected the file, it will ask for the same password as used during the client cert generation, then you can select a storage password to keep it safe.

You can now set up your OpenVPN, go to Settings/Wireless & Networks/VPN Settings/Add VPN, then define the IP, name and certs, select the same cert for CA and user. Then go to advanced and make sure you change the IP Port and switch to TCP. Now the interesting part, it failed to connect until i rebooted the device. Has to be the shittiest fix ever but here goes…

Make sure you have started your OpenVPN server and check the logs for errors.