nginx: [emerg] open() “/usr/share/nginx/off” failed (13: Permission denied) [SOLVED]

August 1, 2018
by chirale
Leave a comment
Howtos / System Administration

After a failed restart of the nginx server, you can get this error typing journalctl -xe:

nginx: [emerg] open() “/usr/share/nginx/off” failed (13: Permission denied) [SOLVED]

This is caused by a misconfiguration of nginx.conf or a conf inside the /etc/nginx/conf.d/ directory where there’s something like:

error_log off;

This is the wrong way to disable logs. Nginx is actually trying to write a file called off inside the default folder.

The right way

To disable error_log simply do not declare it in your .conf file.

To stop logging accesses, you can disable access_log writing in your .conf file:

access_log off;

Advertisements

Use external mail server for mdadm

July 30, 2018
by chirale
Leave a comment
Howtos / System Administration

mdadm is the utility to check and report failures on RAID disks. The usual way this Linux application send its message is a plain old e-mail. In this howto you’ll find the instruction to use an external mail server with mdadm.

First, replace sendmail with an external email account. After you’ve configured and tested msmtp you’re ready to configure mdadm.

Configure mdadm with the new SMTP

Change /etc/mdadm/mdadm.conf to

# instruct the monitoring daemon where to send mail alerts
# MAILADDR root
MAILADDR alertrecipient@example.com
MAILFROM senderaddress@example.com

Where:

  • senderaddress@example.com is your FROM e-mail, the email or alias you’re sending emails from.
  • alertrecipient@example.com is your recipient TO e-mail. It must be a frequently-used e-mail since alerts of failures are sent there.

Actually, using /etc/aliases and assigning root to the right recipient should allow you to avoid this step but you’ve to test yourself.

Send test message with mdadm

Type this command to emulate a disk failure message from mdadm:

sudo mdadm --monitor --scan --test -1

If you receive the message in the alertrecipient@example.com this job is finally done!

This is an automatically generated mail message from mdadm
running on YOURSERVERHOSTNAME

A TestMessage event had been detected on md device /dev/md/1.

Faithfully yours, etc.

P.S. The /proc/mdstat file currently contains the following:

Personalities : [raid1] [linear] [multipath] [raid0] [raid6] [raid5] [raid4] [raid10]
md0 : active raid...

md1 : active raid...

unused devices:
...

See also

Use external SMTP server for system mails on Linux

July 25, 2018
by chirale
Leave a comment
Howtos / System Administration

To use an external SMTP for all system e-mails, you have to install these:

sudo apt-get install msmtp msmtp-mta

Where msmtp-mta transform the external reference in the sendmail command usable by any application using sendmail. In this way you haven’t to install and configure Postfix since you’ll rely on an external SMTP service.

Create the config file for msmtp

This is an example based on the popular Gmail by Google:

# Example for a system wide configuration file

# A system wide configuration file is optional.
# If it exists, it usually defines a default account.
# This allows msmtp to be used like /usr/sbin/sendmail.
account default
aliases /etc/aliases

# The SMTP smarthost.
# host mailhub.oursite.example

# Construct envelope-from addresses of the form "user@oursite.example".
#auto_from on
#maildomain oursite.example

# Construct envelope-from addresses of the form "user@oursite.example".
# this fix the error: msmtp: account default from /etc/msmtprc-php: envelope-from address is missing
### auto_from on

# Use TLS.
tls on
auth on
tls_trust_file /etc/ssl/certs/ca-certificates.crt

# Syslog logging with facility LOG_MAIL instead of the default LOG_USER.
syslog LOG_MAIL

host smtp.gmail.com
port 587
from senderaddress@example.com
user realaccount@example.com
password GMAIL-AUTH-PASSWORD

Replace these with the real data from your e-mail account.

In this example, the realaccount@example.com in GMail is the user that created the Gmail app password. He has to have the senderaddress@example.com configured as sender address alias in GMail.

Add aliases

To match local users with sender address, create the aliases file:

nano /etc/aliases

# See man 5 aliases for format
# postmaster: root
postmaster: senderaddress@example.com
root: senderaddress@example.com
default: senderaddress@example.com

If you’ve any process sending emails using a specific username, add to this list with the right email to use. Any occurrence of the original address will be translated to the right address.

First test

Type this to test the new configuration:

sendmail alertrecipient@example.com
WRITE YOUR TEXT
Ctrl+D

Additional step

If you need to use the mail command, install mailutils without installing postfix:

sudo apt-get install --no-install-recommends mailutils

Done

Now any application using sendmail will actually use your external SMTP service. Use a mail server supporting TLS to avoid transmitting clear text filled with system information.

Tested on Ubuntu Linux 18

Automate log cleanup for GDPR: the Sentry case

May 29, 2018
by chirale
Leave a comment
Howtos / System Administration

With the General Data Protection Regulation (GDPR) enforced by European Union logs have to be cleaned regularly to delete IP addresses and other information about visitors. This can be interpreted as a way to protect an emerging and discussed right, the right to be forgotten.

This new regulation is impacting every automated log system out of there. Since Sentry is a good open source error monitoring software* and it’s widely used, this guide will show how to clean Sentry logs on Linux systems according to GDPR using the sentry cleanup command line utility.

Set a time limit for logs

Before starting discover the maximum time limit a log can be kept according to the service policy you’re working on.

In the below examples, the max time a log can be kept is 26 months, one of the sizes proposed by Google Analytics on cleanup settings.

A 26 months limit for stored logs in sentry are set like this:

env SENTRY_CONF='/usr/local/etc/sentry' sentry cleanup --days 749

where /usr/local/etc/sentry is the directory where config.yml and sentry.conf.py are located or

env SENTRY_CONF='/usr/local/etc/sentry' sentry cleanup --days 749 --project 5

where 5 is the id of the project you can find in Project settings > Client Keys (DSN) as the very last part of the DSN path (always an integer number).

749 days are calculated like this:

30 days × 26 month = 780 days – 31 days = 749

31 days are a margin to safely delete logs the same day of each month.

Apparently, sentry cleanup needs to be root to access to postgres user and thus all sentry database tables so we have to put it on the cron for root.

Schedule the cleanup

  1. Login as root with su – or sudo bash
  2. crontab -e
  3. add a command line like this
. /usr/local/etc/virtualenvs/sentry/bin/activate && env SENTRY_CONF='/usr/local/etc/sentry' sentry cleanup --days 758 --project 5 && deactivate

leading dot . is an alternative for source available on /bin/sh (environment of cron) and not only by /bin/bash. This avoid to set the environment variable SHELL=’/bin/bash’ on crontab.

The resulting cron entry would be:

20 3 28 * * . /usr/local/etc/virtualenvs/sentry/bin/activate && env SENTRY_CONF='/usr/local/etc/sentry' sentry cleanup --days 749 --project 5 && deactivate

It isn’t a bad idea to add a fallback cleanup command the day after, so if you forget to cleanup logs for a specific project it will be done automatically:

20 3 29 * * . /usr/local/etc/virtualenvs/sentry/bin/activate && env SENTRY_CONF='/usr/local/etc/sentry' sentry cleanup --days 749 && deactivate

Now even your Sentry logs are GDPR compliant. The power of this method is that you can set a different cleanup limit for every project, according to its policies. And you haven’t to use any proprietary software to do this, just free/libre open source software.

If you are in a hurry to publish privacy policies and you have a dedicated hosting, give a try to JournaKit legalazy on GitHub.

* Plus it’s written on top of Django.

Cannot connect to wired connection on Ubuntu (SOLVED)

May 9, 2018
by chirale
Leave a comment
Howtos / System Administration

When your Wireless interface is working and the ethernet isn’t working on Ubuntu, here’s a quick howto to check and fix a misconfiguration. It doesn’t solve any ethernet issues but you can give a try and on an Asus laptop (with JMicron chipset) I worked on it makes the job done.

Tested on Ubuntu 16.04 LTS

First steps

To detect Ethernet interface:

ifconfig

To check and configure connection:

apt-get install ethtool

To save the current status of network interface:

ethtool ens5f5 > ethernet_before.txt

Make ethernet interface works

ethtool -s ens5f5 speed 1000 duplex full autoneg on

or:

ethtool -s ens5f5 speed 100 duplex full autoneg on

Then to check what is the difference between the old non-working configuration and the configuration that works:

ethtool ens5f5 > ethernet_after.txt
diff ethernet_before.txt ethernet_after.txt

If it doesn’t work try other ways, e.g. looking for specific issue on your Ethernet driver:

lspci | grep Ethernet

or

lspci | grep ethernet

to check your driver.

If the issue reappears after reboot, to make the command to run on startup do:

sudo bash
crontab -e

And add:

@reboot /sbin/ethtool -s ens5f5 speed 100 duplex full autoneg on

Now reboot to check if changes takes effect

Delete git files from public GitHub history

May 1, 2018
by chirale
Leave a comment
Coding / Howtos

To delete git files uploaded accidentally to GitHub (or any other public repository) do these steps:

  1. Download https://rtyley.github.io/bfg-repo-cleaner/ as suggested by GitHub
  2. git clone –mirror GIT_REPOSITORY_URL
  3. cd path/to/cloned/repository
  4. Download BFG
  5. java -jar /path/to/download/dir/bfg-VERSION.jar –delete-files filename.ext
  6. Run the command specified by BFG (usually git reflog expire –expire=now –all && git gc –prune=now –aggressive)
  7. git push

If you get an error on pull, probably you haven’t cloned the repository as step 2.

Browsing the public history, any reference to the filename.ext file disappear.

Read more about BFG and the –mirror option on this discussion.

Mass delete old email on Gmail preserving Special and Tagged ones

April 26, 2018
by chirale
Leave a comment
Howtos

To mass delete old emails on Gmail type this search query in the search box of mail.google.com (or Gmail for Business):

after:2017/01/01 before:2017/31/12 -has:userlabels -is:starred

You can use these filters in any language but remember to use the YYYY/DD/MM format for the data (Year/Day/Month) for the after and before filters.

This search will show you all emails between January, 1st and December, 31st 2017 that:

  • Haven’t any User Label
  • Aren’t starred (without Star)

Change dates according to the time period you want to cover and select the select all checkbox inside the header to select all items from the Gmail dashboard.

Optionally, you can select them all using the dedicated link that appears after the step above.

These two criteria are usually enough to don’t delete important e-mails but you can add more exclusion criteria adding a minus sign before any new filter, e.g. unread. However, if you don’t use Stars and Labels you have to double-check email in the list before deletion to prevent to delete useful data.

This approach is very useful in these two scenarios:

  • To free space on the Gmail mailbox when it’s almost full.
  • To delete old emails to comply with regulations like GDPR at the end of their usable life.

Happy houseworks!

How to shrink a scanned PDF on Linux

April 4, 2018
by chirale
Leave a comment
Howtos

When you want to reduce the file size of a PDF document, this quick command using convert will shrink the original PDF file.

convert -density 150x150 -quality 60 -compress jpeg -colorspace Gray original.pdf new.pdf

This command is particularly useful against scanned documents, the jpeg quality will be 60% for 150dpi.

Converting an original 300dpi / color PDF to a 150dpi, greyscale PDF can reduce file size up to 50%. There will be some quality loss but in this way you can reduce file size enough to send scanned documents of dozens of pages via e-mail without using third-party services.

How to import .ovpn files on Ubuntu Linux network manager

March 27, 2018
by chirale
Leave a comment
Howtos

On Linux you don’t need to install OpenVPN because it’s already installed. However, configuration especially via the network manager can be tricky.

Install this additional package on your distro to display a new OpenVPN option in the network manager:

sudo apt-get install network-manager-openvpn-gnome

If you’re migrating from Windows and you’ve already a Windows installation of OpenVPN you can copy .key, .crt, .conf and .ovpn files from the OpenVPN location. Copy these files to your Linux home (e.g. ~/openvpn/) and reshape permissions to allow the access only to the owner.

After you’ve the .ovpn, .crt, .key files locally, you can test the connection using these commands:

cd ~/openvpn/;
sudo openvpn my-openvpn-file.ovpn

Type the sudo password, wait and the connection should be established successfully. Press Ctrl+C to stop the VPN from command line.

Now you can configure the Network Manager to accept the .ovpn file.

Click on the network icon on the top right corner of the screen and look for VPN Settings.

Click the + icon aside the VPN title and select Import from file…

Select the my-openvpn-file.ovpn you’ve checked before. A form containing user certificate, CA, private key and the gateway will be automatically filled. It’s very important to select .ovpn and not .conf since the latter will not work.

If the private key is password protected you can also type the password and on Advanced you can do some fine tuning but it’s usually unnecessary.

On the Details tab, uncheck the automatic connection option if you don’t want to start the VPN at every login and choose if you want to allow other users to access the connection.

On IPv4 and IPv6 you can disable a specific protocol or limit the connection to “Use this connection only for resources on its network“. This last step is particularly important because using VPN can limit network connection.

Press Apply and you should be able to connect pressing the network icon on the top right corner > VPN > your VPN name.

Tested on Ubuntu 17.