Topics

1

Installation and Upgrades / Zentyal 3.0-1 broken right after installing

« on: February 18, 2013, 04:17:01 am »

I've had this problem recently with Zentyal 3.0-1 (and previously with Zentyal 3.0) where it breaks right out of the box, so to speak.  It's fairly reproducible.  I can follow a process like this:

• Install from CD
• Don't install any modules up front
• Install all applicable Ubuntu and Zentyal updates
• Reboot
• Install some modules

... and end up with a broken system.  Specifically a laundry list of dpkg errors and Zentyal telling me I have to go fix them by hand.  Here is a case where I did this very process yesterday and ended up with a mess.  It says this on the dashboard:

The following packages are not properly installed: zentyal-virt zentyal-samba zentyal-ntp zentyal-squid zentyal-printers zentyal-firewall zentyal-openvpn zentyal-users zentyal-antivirus zentyal-dhcp zentyal-ftp zentyal-trafficshaping zentyal-webserver zentyal-dns zentyal-l7-protocols. Go to Software Management for more information.

And this in software management:

To solve this situation, please try to execute the following command in the console:

sudo dpkg --configure -a

After the above command is finished you can reload this page. If the problem persists, you can ask for help in the community forum or file a ticket in the Zentyal trac.

And this after dpkg --configure -a:

Code: [Select]

Setting up zentyal-firewall (3.0.1) ...
DBI connect('eboxlogs','ebox',...) failed: Access denied for user 'ebox'@'localhost' (using password: YES) at /usr/share/perl5/EBox/MyDBEngine.pm line 122
(in cleanup) There wasn't a database connection, check if database exists\n at /usr/share/perl/5.14/Carp.pm line 79.
dpkg: error processing zentyal-firewall (--configure):
 subprocess installed post-installation script returned error exit status 255
dpkg: dependency problems prevent configuration of zentyal-dhcp:
 zentyal-dhcp depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
dpkg: error processing zentyal-dhcp (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-openvpn:
 zentyal-openvpn depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
dpkg: error processing zentyal-openvpn (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-ftp:
 zentyal-ftp depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
dpkg: error processing zentyal-ftp (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-squid:
 zentyal-squid depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
dpkg: error processing zentyal-squid (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-antivirus:
 zentyal-antivirus depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
dpkg: error processing zentyal-antivirus (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-virt:
 zentyal-virt depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
dpkg: error processing zentyal-virt (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-ntp:
 zentyal-ntp depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
dpkg: error processing zentyal-ntp (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-samba:
 zentyal-samba depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
dpkg: error processing zentyal-samba (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-trafficshaping:
 zentyal-trafficshaping depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
dpkg: error processing zentyal-trafficshaping (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-users:
 zentyal-users depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
 zentyal-users depends on zentyal-ntp; however:
  Package zentyal-ntp is not configured yet.
dpkg: error processing zentyal-users (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-dns:
 zentyal-dns depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
dpkg: error processing zentyal-dns (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-webserver:
 zentyal-webserver depends on zentyal-firewall; however:
  Package zentyal-firewall is not configured yet.
dpkg: error processing zentyal-webserver (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-l7-protocols:
 zentyal-l7-protocols depends on zentyal-trafficshaping; however:
  Package zentyal-trafficshaping is not configured yet.
dpkg: error processing zentyal-l7-protocols (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of zentyal-printers:
 zentyal-printers depends on zentyal-samba; however:
  Package zentyal-samba is not configured yet.
dpkg: error processing zentyal-printers (--configure):
 dependency problems - leaving unconfigured
Errors were encountered while processing:
 zentyal-firewall
 zentyal-dhcp
 zentyal-openvpn
 zentyal-ftp
 zentyal-squid
 zentyal-antivirus
 zentyal-virt
 zentyal-ntp
 zentyal-samba
 zentyal-trafficshaping
 zentyal-users
 zentyal-dns
 zentyal-webserver
 zentyal-l7-protocols
 zentyal-printers

Keep in mind now, this is not a customized system or anything... this is fresh off the disc I'm getting these errors.  That shouldn't happen.  Just installing a bunch of modules shouldn't cause a breakdown, but is that what it is?  Do I need to install and enable them a certain way?  How can I avoid problems like this?

2

Installation and Upgrades / Zentyal 3.0 as external mail filter for Exchange

« on: December 18, 2012, 10:25:13 pm »

I would like to look at the possibility of using Zentyal as a mail filter for MS Exchange.  I know this has been asked before, but what I found was all for the previous release.  There are some settings under SMTP Mail Filter > External connections that lead me to believe this function may have been added in Zentyal 3.0, however that tab is undocumented for some reason.

Basically with Zentyal acting as the firewall, I want it to receive mail on port 25, filter it for nasties, and then pass it along to the internal Exchange server.

Could someone look it over and tell me whether that's what I'm looking for?  Thanks.

Edit: Bonus points if it can also filter outgoing mail and alert an administrator of any problems.

3

Installation and Upgrades / Zentyal 3.0 and Xen Hypervisor 4.1

« on: November 21, 2012, 04:23:21 am »

How do Zentyal and Xen work together?  I'm exploring some possibilities and would like to get some community input on this.  I have not been pleased with Zentyal's hypervisor capability, but I am familiar with both ESXi and Hyper-V and would like to learn Xen.  My initial reaction to this was to say dom0 should be kept as lean as possible, but I'm concerned about its security since it will have an exposed interface.

If Zentyal is installed in dom0:

• Is this advisable?
• Does this negatively impact the hypervisor?
• Is there any conflict between Zentyal's NIC configuration and Xen's bridging?

And if Zentyal is installed in a domU:

• Can Zentyal still be used as a gateway by appropriately bridging the various interfaces?
• What are the potential security implications for the system as a whole?  Would special steps have to be taken to protect the dom0?
• Would the dom0's external interface be secure enough if simply left with both ipv4 and ipv6 disabled in sysctl and the interface left unconfigured?

4

Installation and Upgrades / Adding Linux user to Zentyal LDAP

« on: September 22, 2012, 05:34:53 pm »

Hello, I have an unforeseen issue with a duplicate user name.  When I installed Zentyal on my home server earlier this year, I installed Ubuntu Lucid initially, and then installed Zentyal from the PPA because I didn't want the GUI.  I run some non-Zentyal software on it using my Linux user (most notably a Minecraft server).  Currently I don't have any LDAP users.

I'm looking at having some LAN parties for things like Minecraft or Artemis at my house, and I'm rolling around the idea of restructuring my home network.  Specifically I'd like to try installing RADIUS on the main network and having a second, isolated guest VLAN using WPA2 with a regular passphrase and maybe also use content filtering and captive portal.  I live in a wirelessly congested area, so this will also help to increase my network security.  I work in IT and already have the knowledge and equipment to set all this up, so nevermind that part.

----------

The problem I've run into is that I can't add my existing Linux user to Zentyal 2.2.  It says the user already exists on the system.  I think it would be a lot of trouble to change my username since I've customized and scripted a number of things in the underlying Ubuntu system.  So I was wondering:

• If there's an easy fix for this that doesn't involve using a different username, and
• Whether Zentyal 3.0 also has this issue, since I'm planning to upgrade as soon as the tool is released.

I did notice in my Zentyal 3 test box that LDAP users can be added to PAM, which I think would be fine, but I'm not sure how to get there from here.

Thanks

----------

UPDATE: I spun up a Zentyal 3 VM installed via PPA, and I have observed it has the same problem.  It will not let a pre-existing user be added regardless of whether "Enable PAM" is checked.

UPDATE2: So, I thought I would try this on the test machine.  I deleted my user and moved my home folder.  Then I checked "Enable PAM" in Zentyal 3 and recreated my user.  And then I fixed ownership and put my stuff back.  I'm not sure whether that's an appropriate solution or not (would really like it if someone could chime in on that), however now I am unable to log into the system at the terminal.  It just says login incorrect.  I did notice that even though I've recreated my user, I do not appear in /etc/passwd or /etc/group.  Seems it has also locked me out of the Zentyal web interface.

5

Installation and Upgrades / Upgrading to Precise

« on: April 12, 2012, 03:20:47 am »

My server is currently running Ubuntu Server 10.04.4 with Zentyal 2.2 installed via apt.  When Ubuntu 12.04 and Zentyal 2.3 are released later this month, will I be able to do a clean upgrade?  I noticed Zentyal will be available directly in the Universe repository in 12.04 (source) so I wonder how that upgrade will work, or if I'll need to reload Zentyal.

6

Installation and Upgrades / Configuring transparent bridge

« on: February 18, 2012, 03:54:47 am »

I want to explore Zentyal's capabilities for existing networks where all the usual infrastructure is already in place (where Zentyal may not be used as a gateway or typical server).  According to the Zentyal docs:

The bridged mode consists of associating two physical network interfaces attached to your server that are connected to two different networks. For example, one card connected to the router and another card connected to the local network. By using this association you can redirect the network traffic transparently from one card to the other.

The main advantage here, is that client configurations do not need changing when the Zentyal server gateway is deployed. Traffic that passes through the server can be managed using content filtering or the intrusion detection system.

I understood that to mean Zentyal could operate as a layer 2 segment bridge, meaning with two NICs it could be connected inline between a gateway router and the rest of the network and transparently apply content filtering.  In that configuration, the same subnet would be used on both interfaces.

I'm trying to configure this in a virtual lab environment where I have eth0 bridged to my main network and eth1 on a virtual segment where another VM will use it for internet access.  I've set eth0 and eth1 in bridged mode, creating br1.  I've tried br1 with both DHCP and static addressing (it shouldn't really matter in this scenario).

What's happening is I have no connectivity through br1.  My VM on the private segment can ping its br1 IP (connected to eth1) but Zentyal cannot ping any host regardless of which physical interface it's on.  The only Zentyal modules enabled are network, users and groups, and firewall (tried initially without firewall but then I thought maybe iptables had to be engaged for it to work properly -- made no difference).  I also noticed after setting this up that eth1 and br1 share a MAC address.  I don't know if that's normal or not.

How exactly is this supposed to be configured?

7

Installation and Upgrades / Changing the Zentyal logo

« on: February 16, 2012, 04:36:51 am »

Our company is looking over some things with Zentyal, and one of the questions we had was about the logo displayed to clients.  We were wondering if it's possible to replace the Zentyal logo with a custom logo in places like the http proxy block page or the captive portal.  We would want to have a company logo appear in those instances.  Changing the color scheme to match would also be a plus.

I think changing the logo in those instances would be appropriate if you consider the audience.  In places like the http proxy or the captive portal, it's normal users or customers who will see the logo.  They won't have any idea what Zentyal is, so a custom logo would be more appropriate.

Can this be done?

8

Installation and Upgrades / Ebox inclusion in Ubuntu 12.04 LTS

« on: January 20, 2012, 02:20:43 pm »

Does anyone know if Ebox 2.2 will be included in the official repository for Ubuntu 12.04 LTS?

The package list currently says it has the same version as Ubuntu 11.10 which is 2.0.16.

9

Installation and Upgrades / Managing Virtualbox VMs

« on: January 13, 2012, 04:04:18 pm »

I'm trying to get set up with Virtualbox to manage VMs since I'm not much of a fan of QEMU and the portability of Virtualbox VMs to other machines running Virtualbox may be important at a later date.  So here's what I've got so far.

I installed and updated a fresh Lucid server, installed virtualbox-ose from the Ubuntu repository, and then installed Zentyal 2.2 from the Zentyal repository.  After installing the VM management module, I can see that it is indeed using Virtualbox.  I noted the "manage only" checkbox indicating I can use Virtualbox to reconfigure the VMs and just use Zentyal's interface to manage their execution.  This is exactly what I'd like to do so that I can tweak more of the settings of the VMs.

I quickly figured out there's a discrepancy between the VMs listed in Zentyal's GUI and Virtualbox's GUI.  I did some digging and found that Virtualbox is being executed as the ebox user, and you can get the proper environment with "sudo -u ebox -H virtualbox".  I gather that this would probably work if I had X11 on the test server in question, but I want to keep it CLI-only if possible and I'm not familiar with the Virtualbox CLI commands.  I'm using X11 forwarding to run the Virtualbox GUI via PuTTY (using Cygwin's X server on a Windows 7 laptop).  Although I can run Virtualbox's GUI over X11 forwarding normally, when I use the above command, I get this error:

PuTTY X11 proxy: wrong authorisation protocol attemptedFailed to open the X11 display!

I've had this problem before when trying to run X11 programs after switching to the root environment, so I was anticipating it.  I was rolling around a couple solutions such as symlinking ebox's Virtualbox VMs folder to my user, or adding SSH keys to the ebox user so I could log in as ebox directly and run it, but those don't feel like good solutions.  What's the best way to fix this?

10

Installation and Upgrades / Combining Zentyal and Nagios

« on: November 29, 2011, 06:34:20 pm »

At our company, we've often looked into different solutions to have a drop-in substitute server for certain network roles, or purely for troubleshooting.  We actually have a redeployable Opsview/Nagios computer that we sometimes place at various sites for monitoring of intermittent problems, etc.

We're rolling around the idea of combining that with Zentyal in order to create something vastly more useful.  I have two possible options I'm looking into:

Plan A: Ubuntu 10.04 with the current versions of Zentyal and Opsview, both installed from the respective external repositories.
Plan B: Ubuntu 11.10 with eBox 2.0.16 and Icinga 1.4.2 (new OS but old software), both installed from the official Ubuntu repositories.
Plan C: Ubuntu 11.10 with current Zentyal and Opsview, eyes covered and fingers crossed.

I think plan A would have better support and a higher chance of success because both Zentyal and Opsview were intended for installation on Lucid, although clearly some tweaking of Apache may be required.  My only gripe with using the LTS edition is all the other software in its repository is now 16 months old.

I was wondering if anyone has attempted one of these setups and knows if they work or have any major/insurmountable hurdles.

11

Installation and Upgrades / Config for non-gateway SSL VPN

« on: August 19, 2011, 06:48:53 am »

I'm testing out Zentyal on our network using VMware ESXi.  I would really like to see the client access VPN in action.  However, we have a Cisco ASA at one site and a Cisco PIX at another, with an IPSec VPN between them.  This probably goes without saying, but it's not feasible for me to down production equipment to play with this.  So what I've done is forwarded 1194/udp in the ASA to the Zentyal virtual server which has only one internal NIC configured.

According to the Zentyal documentation at http://doc.zentyal.org/en/vpn.html:

If you need a VPN server that is not the gateway of the local network, i.e., the host does not have any external interfaces, then you need to use the Port redirection with Zentyal. As this is one of the firewall options, you must ensure that the firewall module is enabled, otherwise you cannot enable this option. With this option, the VPN server will act on behalf of the VPN clients within the local network. In reality, it will act on behalf of all the advertised networks in order to ensure that it receives all the response packages that it will later forward through the private network to its clients.

However, it does not say what port forwarding rule should be added...  Currently I have no custom NAT rules since this isn't a gateway.  Currently when I connect to the VPN, it fails with a TLS handshake error.

Thu Aug 18 23:45:16 2011 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Aug 18 23:45:16 2011 TLS Error: TLS handshake failed

12

Installation and Upgrades / Hardware reqs for home server

« on: July 20, 2011, 06:00:57 pm »

I'm a systems administrator at an IT provider/consulting company, and although I'm very familiar with Windows servers and relatively familiar with Ubuntu, I'm new to Zentyal.  I'm thinking of setting up a Zentyal server at home for my family.  It would be used primarily as a gateway/firewall and http proxy (for clamav, ad-zapping, and spyware site blocking), and also a light duty file/print server and maybe some of the communications features like a shared calendar.  As it's related to my work, I may experiment with the mail and VPN setup and maybe even a SIP softphone later on, although those won't likely be permanent additions.  I may also run virtual machines on it from time to time but nothing too heavy and I do have other hardware for that.

I was thinking of possibly building a small form factor computer to serve this purpose.  Something that would sit nicely next to my cable modem or under the desk.  I might also use some old hardware I have lying around, but I'm concerned about the energy usage and heat output.  I'm looking to make something energy-efficient that won't heat up the room which already has a high-powered gaming rig in it.  If it can run with a 65W power supply for example, that's only the juice of three little wireless routers.  I know it needs two NICs, but what else am I looking at as far as hardware specs?  I might use an old laptop if not for the dual NIC requirement of being the gateway, or maybe there's a workaround like getting a USB wired NIC for the WAN link.  Bear in mind this platform will be for 2-4 users, and Zentyal's listed recommended specs are for >50.

Can I make that happen with something like, say... a dual-core CPU, 2 GB RAM, and 320 GB HDD?  More/less?

Thanks