Core Dump

My life experiences. My Soapbox. My Blog.

Linux Malware Detect, Debian, and Plesk

By 4 Comments

Package installation

The easiest way to install Linux Malware Detect will be to use a package. Jan Wagner has put a lot of effort into debianising LMD so a big shout out to him (his Github repo). I merely built the package from the repo.

So without further ado, here is the download.

maldetect_1.4.2+dfsg-13_all.deb

Manual installation

Linux Malware Detect will not run out of the box in monitor mode (scan mode works fine) on a Debian system. There are a few things you need to do to get it working.

LMD comes with a 32-bit inotifywait binary and associated libinotifytools library. Debian Wheezy will not run 32-bit binaries out of the box. We can make it run 32-bit binaries but there’s a whole lot of additional packages you need to install, which we won’t do in order to keep things tidy.
We’ll first need to install the inotify-tools and libinotifytools0 packages which will put 64-bit versions of inotify on the system.

apt-get install inotify-tools libinotifytools0

In internals.conf, change the location of the inotifywait path to /usr/bin/inotifywait

sed -i -e"s/\$inspath\/inotify\/inotifywait/\/usr\/bin\/inotifywait/" /usr/local/maldetect/internals.conf

You may need to tweak inotify_base_watches if you have lots of paths/files.

Scanning the docroots

Now if you’re working with Plesk, you’ll only want LMD to monitor the docroots. Run the following to create a file with a list of all the docroots:

mysql -ss -uadmin -p`cat /etc/psa/.psa.shadow` psa -e "select www_root from hosting;" > /usr/local/maldetect/maldetfilelist

You can then start LMD with:

maldet -m /usr/local/maldetect/maldetfilelist

Fixing problems with the new v2 OpsGenie iOS app

By Leave a Comment

The new version 2.x of the OpsGenie mobile app (iOS) is a sweet sweet upgrade for those coming from version 1.x.

screen322x572screen322x572-1

For most users who were not part of the beta program the upgrade should have happened seamlessly. For those of us that were, you may have had problems during the upgrade with the app throwing errors like “device push token cannot be empty”, and sound selection not working.

To fix the problem, log out of both the beta and final versions of the apps. Uninstall the beta version then go to into Settings -> Notifications -> OpsGenie. Untick everything, go back a screen, then go and tick them all again. I think iOS is getting confused over which app, the final version vs the beta, owns the OpsGenie notification. Now log back into the app and everything should work as it should.

Graphing Postfix with Cacti

By 49 Comments

[Updated 2015-03-09]

There are a bunch of articles and information on this topic out there, but most of them either don’t work, are outdated, or are scattered across multiple pages on the Cacti forums.

I’ve worked out the kinks for you, so here’s what you need to do to graph Postfix with Cacti.
This was performed on Debian 6 with Cacti 0.8.7g from the apt repository but should work on other distros too.
Note that this article tackles graphing the sent, received, rejected, bounced, spam, and virus statistics. It does not graph mail queues.

You need two files, the first is mailgraph.pl which you’ll need to put on your mail server. It’s a modified version of David Schweikert’s mailgraph which writes mail statistics into /var/tmp instead of generating rrds. The second is the xml template file which you’ll import into Cacti. You’ll find both files in the link below.

[Download required files]

  1. Copy mailgraph.pl to your mail server and place in a suitable location, eg /usr/local/bin
  2. Run mailgraph in daemon mode with “mailgraph.pl -d”. Mailgraph will write its statistic files to /var/tmp.
  3. Configure your snmpd.conf file on your mail server by adding the following:
    extend .1.3.6.1.4.1.2021.50 mailcount_sent /bin/cat /var/tmp/mailsent
    extend .1.3.6.1.4.1.2021.51 mailcount_recv /bin/cat /var/tmp/mailrecv
    extend .1.3.6.1.4.1.2021.52 mailcount_reject /bin/cat /var/tmp/mailrejected
    extend .1.3.6.1.4.1.2021.53 mailcount_bounced /bin/cat /var/tmp/mailbounced
    extend .1.3.6.1.4.1.2021.54 mailcount_spam /bin/cat /var/tmp/mailspam
    extend .1.3.6.1.4.1.2021.55 mailcount_virus /bin/cat /var/tmp/mailvirus
  4. Restart snmpd
  5. Import the xml template into Cacti
  6. Create graphs for the mail server

Notes:
RBL spam rejections will show up under the rejected mailcount.
If you’re still having problems getting Cacti to graph, try adding this to snmpd.conf “view systemonly included .1.3.6.1.4.1”.

If you can’t get this to work or have any questions, i’d be happy to help.

Fixing and removing corrupted Apache configs in Plesk

By Leave a Comment

Today I ran into an interesting problem with Plesk. It had gotten it’s Apache configuration so messed up that when you ran httpdmng reconfigure for any domain, it would throw errors about not being able to find include files. For example:

apache2: Syntax error on line 227 of /etc/apache2/apache2.conf: Syntax error on line 7 of /etc/apache2/conf.d/zz010_psa_httpd.conf: Syntax error on line 15 of /opt/psa/admin/conf/generated/14099869670.15839100_horde.include: Syntax error on line 56 of /opt/psa/admin/conf/webmail_horde_bootstrap.conf: Could not open configuration file /opt/psa/admin/conf/generated/14099802590.70236400_domain_com_webmail.include: No such file or directory

The fix for this involves some MySQL work. Go into the “psa” database in MySQL. You’ll see a “Configuration” table there. Take note of the numbered sequence in the config file name in amongst the errors thrown when running httpdmng. It will look like 14099859010.42476800. Now look for rows whose “version” column matches the number sequences and delete them.
Go back into /opt/psa/admin/conf/ and remove all references to the config files in vhosts_bootstrap.conf, webmail_*_bootstrap.conf, and in the generated/ directory.
After that you should be able to run /opt/psa/admin/sbin/httpdmng –reconfigure-all without problems.

Iterators iterators iterators!

By Leave a Comment

Managing lots of CloudFormation stacks can be a pain through the AWS Console. Stacks are paginated so you’ll need to keep clicking that “View more stacks” button until you get to the stack you want.

Performing tasks through the AWS PHP SDK makes it a little easier, but you’ll still need to deal with tokens.

Take the following code snippet for example:

[code lang=php]
$client = \Aws\CloudFormation\CloudFormationClient::factory($config);
$stackstatus = array('CREATE_COMPLETE');

// First run
$result = $client->listStacks(array(
'StackStatusFilter' => $stackstatus,
));
$stacks = $result['StackSummaries'];
$token = $result['NextToken'];
foreach ($stacks as $stack) {
echo "$stack[StackName] – $stack[StackStatus]\n";
}

// Subsequent runs
while ($token != '') {
$result = $client->listStacks(array(
'NextToken' => "$token",
'StackStatusFilter' => $stackstatus,
));
$stacks = $result['StackSummaries'];
$token = $result['NextToken'];
foreach ($stacks as $stack) {
echo "$stack[StackName] – $stack[StackStatus]\n";
}
}
[/code]

Just like in the AWS Console, you’ll need to paginate through the entire list through the use of Tokens. The results on the first page will give you a Token, which you reference on a subsequent request to obtain page 2 and so on and so on.

But there is a better way! And that’s through the use of Iterators.

[code lang=php]
$client = \Aws\CloudFormation\CloudFormationClient::factory($config);
$stackstatus = array('CREATE_COMPLETE');

$iterator = $client->getIterator('ListStacks', array(
'StackStatusFilter' => $stackstatus,
));
$stacks = $iterator->toArray();
foreach ($stacks as $stack) {
echo "$stack[StackName]\n";
}
[/code]

Now that’s better! No pagination and no need to deal with tokens.

Iterators work for listing CF stacks, describing instances, pulling stuff out of DynamoDB, and lots of other things.