Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - socceroos

Pages: [1]
1
Hi there, I have tried this with both the latest version of z-push and v2.0.0-1346.  Every time I get this error:

FatalMisconfigurationException

Not possible to write to the configured state directory.

even if I set the permissions to 777 on the /usr/share/z-push directory.

Any suggestions?

Thanks

Hi Barry, did you use the following command: sudo chmod -R 777 /usr/share/z-push/

The "-R" makes sure that all subdirectories and files are also changed. Please note that this is VERY INSECURE and should not be done in a production environment. It would be safer to change the ownership of the directory so that apache can write to it. Before going into production with this, I would suggest hunting down the particular permissions issue and modifying the access accordingly.

2
Installation and Upgrades / Re: Mail passthrough not working
« on: June 30, 2010, 04:29:35 am »
Never mind. =)

With the help of Kamilion I was able to figure this out myself. I've documented what I did over at this thread in the 'Tips and Tricks' forum:

http://forum.ebox-platform.com/index.php?topic=4172

Hope this helps someone! ;D

3
Installation and Upgrades / HOW-TO: eBox 1.5 Mail Filter Gateway
« on: June 30, 2010, 04:24:53 am »
eBox 1.5 SPAM Filter Gateway:
=========================


DISCLAIMER: I didn't know much about Postfix, Amavis, Spamassasin or ClamAV integration before having to do this. I don't assume I've got everthing right or that these settings are optimal. However, it does work very well for me and my company of 40+ employees. Emails are our bread and butter. =)

On that note, I would really appreciate any improvements people could suggest, or even showing me how this could have all been done through the eBox GUI! (if possible)

Intro:

To understand what we were trying to achieve, first I have to explain our situation and what we require. Our current setup is something like this:

Code: [Select]
                        |---->Exchange_2003_Server
Internet---->eBox_Gateway|
                         |---->Local_Network
                       

Basically, we want eBox to filter all emails for SPAM and viruses before it passes them on to the Exchange server. The Exchange server will still be in control of all email processing. This means we do not want the eBox gateway to store mail locally, or require replication of the Exchange user list before it can accept emails.

I'm using eBox 1.5 on Ubuntu 10.04. Reasons for this are two-fold. Firstly, Ubuntu 8.04 (Hardy Heron) did not work with the hardware we have for our firewall. And secondly, we didn't want to be in the situation where we needed to upgrade the entire OS under our perimiter firewall in the near future because Hardy Heron's support ended.

So, eBox 1.5 and Ubuntu 10.04 it is. Be aware that some updates to the eBox unstable branch (1.5) can overwrite our configuration changes - so it is important for us to properly backup our modified config files.

Maybe its just me, but I tried every settings combination under the sun to try and get eBox to run as just a mail filtering gateway through the eBox GUI. I could not get it to work for the life of me. With the help of Kamilion (thanks a million, Kamilion =D), I was directed to start editing eBox stub files.
These files are located here:

Code: [Select]
/usr/share/ebox/stubs/

Alrighty, lets get down to business. Firstly, lets make a backup of the original eBox configuration:

Code: [Select]
sudo cp /usr/share/ebox/stubs/mail/main.cf.mas /root/main.cf.mas.orig
sudo cp /usr/share/ebox/stubs/mail/master.cf.mas /root/master.cf.mas.orig

Now edit the main Postfix configuration file to tell it to basically accept emails and forward them on to Exchange. Open the relevant stubs file (I use vi because I like it):

Code: [Select]
sudo vi /usr/share/ebox/stubs/mail/main.cf.mas

Firstly, comment out the 38th line regarding reject_unknown_recipient_domain like this:

Code: [Select]
#$smtpRecipientRestrictions .=  'reject_unknown_recipient_domain, ';

Change the mydestination and local_recipient_maps variables to be empty like so:

Code: [Select]
mydestination =
local_recipient_maps =

This is so that Postfix does not assume it is the final destination for delivery of the email. For me, 'mydestination' was on line 84 and 'local_recipient_maps' was on line 89.

Below these two variables, I placed this code:

Code: [Select]
local_transport = error:no local mail delivery
relay_recipient_maps = hash:/etc/postfix/relay_recipients
transport_maps = hash:/etc/postfix/transport
relay_domains = mydomain.com

relay_domains should be the domain of your email server (not the FQDN, just the base domain name).

After that, from line 121 (virtual_alias_maps) onwards, I commented out what eBox had there - except for the settings inside the 'if' statements. All in all, my /usr/share/ebox/stubs/mail/main.cf.mas file looks like this:

Code: [Select]
# Generated by eBox                                                            
# See /usr/share/postfix/main.cf.dist for a commented, more complete version  
<%args>                                                                        
        $hostname                                                              
        $mailname                                                              
        $ldapport                                                              

        $relay
        $relayAuth

        $allowed
        $maxmsgsize
        $aliasDN  
        $vmaildir  
        $usersDN  
        $uidvmail  
        $gidvmail  
        $sasl      
        $smtptls  
        $ldap      
        $filter    
        $ipfilter  
        $portfilter

        $bccMaps

        $greylist
        $greylistAddr
        $greylistPort
</%args>            
<%init>              
use EBox::Gettext;  

my $smtpRecipientRestrictions ;
$smtpRecipientRestrictions .= 'reject_non_fqdn_sender, ';
$smtpRecipientRestrictions .= 'reject_unknown_sender_domain, ';
$smtpRecipientRestrictions .= 'reject_non_fqdn_recipient, ';  
#$smtpRecipientRestrictions .=  'reject_unknown_recipient_domain, ';

if ($sasl) {
    $smtpRecipientRestrictions = 'permit_sasl_authenticated, ';
}                                                              
$smtpRecipientRestrictions .=  'permit_mynetworks, ';          

$smtpRecipientRestrictions .= 'reject_unauth_destination';
# at his point all mail for whom the server isn't the final point or the
# forwarder has been rejected so the next restrictions only applies in this two cases


$smtpRecipientRestrictions .= ', reject_invalid_helo_hostname';
$smtpRecipientRestrictions .= ', reject_non_fqdn_helo_hostname';
$smtpRecipientRestrictions .= ', check_helo_access pcre:/etc/postfix/helo_checks.pcre';

if ($greylist) {
    my $greylistRecipientRestriction = "check_policy_service inet:" .
                                        $greylistAddr . ':' .        
                                        $greylistPort ;              
    $smtpRecipientRestrictions .= ", $greylistRecipientRestriction";
}                                                                    


my $certFile = '/etc/postfix/sasl/postfix.pem';
my $keyFile  = '/etc/postfix/sasl/postfix.pem';
</%init>                                      

# require helo
smtpd_delay_reject  = yes
smtpd_helo_required = yes

strict_rfc821_envelopes = yes
disable_vrfy_command = yes  

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no                                          

# appending .domain is the MUA's job.
append_dot_mydomain = no            

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h                                    

myorigin = /etc/mailname
myhostname = <% $hostname %>
mydestination =            
smtp_helo_name = <% $mailname %>
alias_maps = hash:/etc/aliases  

alias_database = hash:/etc/aliases
local_recipient_maps =            

relayhost = <% $relay %>

% if ($relay) {
smtp_tls_security_level = may
smtp_tls_key_file  = <% $keyFile  %>
smtp_tls_cert_file = <% $certFile %>
% }

% if ($relayAuth) {
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous              

% }

mynetworks = <% $allowed %>

message_size_limit = <% $maxmsgsize %>
mailbox_size_limit = 0                
virtual_mailbox_limit = 0            
recipient_delimiter = +              
inet_interfaces = all                

#### STUFF SAM HAS ADDED ########
local_transport = error:no local mail delivery
relay_recipient_maps = hash:/etc/postfix/relay_recipients
transport_maps = hash:/etc/postfix/transport            
relay_domains = mydomain.com                    

# Virtual Aliases
#virtual_alias_maps = ldap:valiases
#valiases_server_host = 127.0.0.1  
#valiases_search_base = <% $aliasDN %>
#valiases_query_filter = (&(mail=%s)(objectClass=CourierMailAlias))
#valiases_result_attribute = maildrop                              
#aliases_bind = no                                                

# Virtual Domains
dovecot_destination_recipient_limit = 1
virtual_transport = dovecot            
#virtual_transport = virtual          
#virtual_mailbox_base = <% $vmaildir %>
#virtual_mailbox_maps= ldap:ldapvirtualmap

#ldapvirtualmap_server_host = 127.0.0.1:<% $ldapport %>
#ldapvirtualmap_bind = no                              
#ldapvirtualmap_search_base = <% $usersDN %>          
#ldapvirtualmap_query_filter = (&(mail=%s)(!(quota=-1))(objectClass=CourierMailAccount))
#ldapvirtualmap_result_attribute = mailbox                                              

#virtual_mailbox_domains = ldap:vmaildomains
#vmaildomains_server_host = 127.0.0.1      
#vmaildomains_bind = no                    
#vmaildomains_search_base =  ou=postfix,<% $ldap->{'dn'} %>
#vmaildomains_query_filter = (|(&(objectclass=domain)(domainComponent=%s))(&(objectclass=CourierMailAlias)(mail=@%s)))
#vmaildomains_result_attribute = dc, maildrop


#virtual_minimum_uid = 100
#virtual_uid_maps = static:<% $uidvmail %>
#virtual_gid_maps = static:<% $gidvmail %>


% if (($smtptls) or ($sasl)){
## TLS/SSL
#smtpd_use_tls = no
#smtpd_tls_note_starttls = yes
#smtpd_tls_key_file  = <% $keyFile  %>
#smtpd_tls_cert_file = <% $certFile %>
#smtpd_tls_loglevel = 1
% }


smtpd_recipient_restrictions = <% $smtpRecipientRestrictions %>


% if ($sasl) {
#SASL authentication
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
broken_sasl_auth_clients = yes
smtpd_tls_auth_only = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_local_domain =  $myorigin
% }

% if ($filter) {
content_filter=smtp-amavis:<% $ipfilter %>:<% $portfilter %>
% }

% if ($bccMaps) {
sender_bcc_maps = <% $bccMaps %>
recipient_bcc_maps = <% $bccMaps %>
% }

Next we need to modify the file located at /usr/share/ebox/stubs/mail/master.cf.mas:

Add the following lines directly under the line starting with the word 'pickup':

Code: [Select]
   -o content_filter=
    -o receive_override_options=no_header_body_checks

Once you have modified both of these files, you should create a backup of them just in case eBox overwrites them with an update:

Code: [Select]
sudo cp /usr/share/ebox/stubs/mail/main.cf.mas /root/main.cf.mas
sudo cp /usr/share/ebox/stubs/mail/master.cf.mas /root/master.cf.mas

Now create and edit a file in /etc/postfix/ called relay_recipients:

Code: [Select]
sudo vi /etc/postfix/relay_recipients

Again, I'm using vi because it is teh win. Add this line to the file:

Code: [Select]
@mydomain.com OK

Once you have saved that, create the hash out of this file for Postfix to use with the following command:

Code: [Select]
sudo postmap /etc/postfix/relay_recipients

Now create and edit a file in /etc/postfix/ called transport:

Code: [Select]
sudo vi /etc/postfix/transport

Add this line to the file:

Code: [Select]
mydomain.com relay:[my.exchange.ip.address]

Obviously, where I've put 'my.exchange.ip.address' you need to substitute it with the IP Address of your Exchange/Mail server. Once you have saved that, create the hash out of this file for Postfix to use with the following command:

Code: [Select]
sudo postmap /etc/postfix/transport

Lastly, we need to change some settings in the eBox GUI.

Go to Mail->General and make sure the FQDN of your mail server (ie. mail.mydomain.com) is in the 'Smarthost to send mail' box.

In the Mail->General->'Mail filter Options' tab, make sure 'Filter in use' is set to 'eBox internal mail filter'.

In 'Mail Filter'->'SMTP Mail Filter'->General make sure all three boxes are ticked. Leave the services port as the default.

In 'Mail Filter'->'SMTP Mail Filter'->'Filter Policies' you may want to change the way Amavis deals with SPAM and Viruses. This is up to you. I am discarding viruses and SPAM, bouncing banned files and passing bad headers. I've actually set up Amavis to quarantine discarded SPAM for me so I can go through it for false-positives. Let me know if you want a HOW-TO on that.

Lastly (really), go to the Dashboard and restart both the Mail and 'Mail Filter' services. After this, your eBox gateway should be now filtering all incoming emails for SPAM and viruses before it goes on to your internal mail server (Exchange in my case).

Please let me know if you see any glaring errors, omissions or better ways to do things!

4
Installation and Upgrades / Re: HTTP Proxy and Youtube
« on: June 25, 2010, 05:21:55 am »
Hey, I had *exactly* the same problem yesterday when I set up my own eBox gateway.

From the web gui, if you go to HTTP Proxy->General and then add in the 'Cache Exemptions' section a new exemption with a domain of youtube.com and make sure the 'Exempt from cache' box is ticked, then save the changes - you should be set!

Basically, the Squid cache proxy is downloading the youtube flash movies first before it then forwards it on to the client behind the firewall. =)

Let me know how that goes.

5
Installation and Upgrades / [SOLVED] Mail passthrough not working
« on: June 25, 2010, 03:46:34 am »
I've set up eBox as a gateway firewall and also a SPAM filter. It is supposed to pass through all filtered emails to our internal Exchange server.

In the eBox interface Mail->General, I have the IP address of our internal mail server in the smarthost box. I have unticked all the other boxes on that Mail->General page as I just want eBox to filter the emails for SPAM and then forward them on to the internal mail server. But, when I enable this, this is what is reported in /var/log/mail.log:

Code: [Select]
Jun 23 13:17:47 firewall postfix/smtpd[23016]: connect from mail-yw0-f186.google.com[209.85.211.186]
Jun 23 13:17:48 firewall postfix/smtpd[23016]: NOQUEUE: reject: RCPT from mail-yw0-f186.google.com[209.85.211.186]: 450 4.1.2 <user@internal.network>: Recipient address rejected: Domain not found; from=<user@gmail.com> to=<user@internal.network> proto=ESMTP h
elo=<mail-yw0-f186.google.com>
Jun 23 13:17:48 firewall postfix/smtpd[23016]: disconnect from mail-yw0-f186.google.com[209.85.211.186]
Jun 23 13:18:40 firewall postfix/smtpd[23016]: connect from ozhmr1.ozhosting.com[203.30.164.75]
Jun 23 13:18:40 firewall postfix/smtpd[23016]: NOQUEUE: reject: RCPT from ozhmr1.ozhosting.com[203.30.164.75]: 450 4.1.2 <user2@internal.network>: Recipient address rejected: Domain not found; from=<dad@marinedieseldirect.com> to=<user2@internal.network> proto=
ESMTP helo=<ozhmr1.ozhosting.com>
Jun 23 13:18:40 firewall postfix/smtpd[23016]: disconnect from ozhmr1.ozhosting.com[203.30.164.75]

I tried adding our domain name to 'Virtual Domains' in Mail->Virtual Mail Domains - but that didn't help.

Then I added the same virtual domain into the Mail Filter->SMTP Mail Filter->Virtual Domains area and now I get the following error:

Code: [Select]
Jun 25 09:48:57 firewall postfix/smtpd[29131]: connect from ozhmr1.ozhosting.com[203.30.164.75]
Jun 25 09:48:57 firewall postfix/smtpd[29131]: NOQUEUE: reject: RCPT from ozhmr1.ozhosting.com[203.30.164.75]: 550 5.1.1 <user@internal.network>: Recipient address rejected: User unknown in virtual mailbox table; from=<gesdd@marinerslanding.com> to=<user@internal.network> proto=ESMTP helo=<ozhmr1.ozhosting.com>
Jun 25 09:48:57 firewall postfix/smtpd[29131]: disconnect from ozhmr1.ozhosting.com[203.30.164.75]

Can anyone shed some light on this?

6
Installation and Upgrades / Re: Squid didnt start ...
« on: June 25, 2010, 01:13:20 am »
I am having the very same problem that Squid doesn't start on boot properly. Also, when applying configuration changes, Squid reports that it gets the TERM signal, but then won't properly start up again until it is done manually 30 seconds after it has been terminated. If you try to start it manually at any time before this 30 seconds then it just gives you an error.

I'm doing this through the eBox web interface which is, I imagine, using DBus to stop and start the service?

Also, I can confirm that I'm having the same problems with Apache using heaps of the CPU and heaps of RAM.

7
I have also installed Ebox 1.5 on Ubuntu Server 10.04 64bit and can confirm that it does indeed run extremely slow!

I had the server set up as a gateway and found that while it did properly use my PPPoE connection, it turned my 20Mb/s connection into dial-up speeds. I was experiencing load-times on websites of up to 5 minutes, where it previously (previous firewall/gateway) would take less than a second to load. Also, the user interface of eBox would also take around 5 minutes to load certain pages (like the dashboard). Neither of the gigabit cards I had installed were showing any collisions or errors.

Syslog was only showing some connection_read errors for slapd (slapd[1781]: connection_read(29): no connection!), nothing of note for connection speeds though.

/var/log/ebox/error.log shows this - doesn't seem worthy of note though:

Code: [Select]
Use of uninitialized value in string eq at /usr/share/perl5/EBox/SysInfo.pm line 170.
Use of uninitialized value in subroutine entry at /usr/share/perl5/EBox/Gettext.pm line 49.
Use of uninitialized value in subroutine entry at /usr/share/perl5/EBox/Gettext.pm line 50.
Use of uninitialized value in string eq at /usr/share/perl5/EBox/SysInfo.pm line 170.
Use of uninitialized value in string eq at /usr/share/perl5/EBox/SysInfo.pm line 170.
read() on closed filehandle $fh at /usr/share/perl5/EBox/SysInfo.pm line 90.

ebox.log just shows some URI refer validations.

I don't really want to go to the 32bit version of Ubuntu Lucid as I need all the extra RAM installed in this server.   :-\

I would install the 1.4.2 official CD but how long is it going to be supported for? If its based off 8.04 or even 9.10 then I'm going to need to rebuild the box far too soon.  :P

8
Installation and Upgrades / eBox as a gateway with PPPoE?
« on: June 04, 2010, 03:02:40 am »
Hello all,

Firstly I'd just like to mention that I'm very impressed with the eBox platform. You guys are doing a stellar job! =)

Now to some questions I have:

I'm setting up eBox as a gateway, two NICs - green being a static IP and red being PPPoE. My ISP has given me some 'static' IP Addresses through the PPPoE connection. But, in eBox I can only see the "Virtual Interfaces" dialog when I select "static" as the method. Is it possible to use this "Virtual Interfaces" dialog with the PPPoE method so I can forward our static IP addresses properly through the firewall?

And also, another question =D, does eBox provide an easy way to filter emails as they pass through the firewall (SPAM and AV) and then forward them on to the mail server on the green interface?

Thanks!

Kind regards,

Socceroos

Pages: [1]