<p>Normally when I need to make a CSR, I would use <code>openssl</code> to generate one like you'll see all over the internet:</p>
<pre><code class="language-bash">openssl req -new -key example.com.key -out example.com.csr
</code></pre>
<p>This generates a CSR and asks you to provide the Common Name (URL) of your site.</p>
<p>Recently I've noticed that certs from the above CSR don't work.
From some research, Chrome's version 58 (2017) is when it changed, so I guess it took me a while to catch on.</p>
<p>Using the CommonName (CN) instead of SubjectAltName (SAN) in your cert was deprecated in RFC 2818 (forever ago).
For a long time for browsers didn't enforce that requirement and could fall back to CN, but it seems like that allows homograph attacks
(fake "a" in apple.com, for instance), where the SAN field somehow does not.</p>
<p>Even if you add and trust the issuing and root CA certs, Chrome will still throw <code>ERR_CERT_COMMON_NAME_INVALID</code>.</p>
<p>Generating a CSR with a SAN is not intuitive. Unless you want to use heredoc, you need to create a file first.</p>
<ul>
<li>The <code>req_distinguished_name</code> values set the prompts during the CSR questionairre.</li>
<li>The DNS.x values are the SAN entries. If you have one URL, then commonName and DNS.1 will match, and you'll have no others (no DNS.2, ect).</li>
</ul>
<p><code>vi san.ini</code></p>
<pre><code>[ req ]
default_bits       = 2048
distinguished_name = req_distinguished_name
req_extensions     = req_ext

[ req_distinguished_name ]
C = Country Name (2 letter code)
ST = State or Province Name (full name)
L = Locality Name (eg, city)
O = Organization Name (eg, company)
OU = Organization Unit (eg, IT)
CN = Common Name (server FQDN)

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
DNS.1 =
DNS.2 =
DNS.3 =
</code></pre>
<p>Now with this file and your private key in hand, you can create your CSR:</p>
<pre><code class="language-bash"># Set the name of your domain
domain=
# Generate the private key and CSR
openssl req -new -newkey rsa:2048 -nodes -keyout $domain.key -out $domain.csr -config san.ini
</code></pre>
<p>Check your work:</p>
<pre><code class="language-bash">openssl req -in $domain.csr -noout -text
</code></pre>
<p>That's it. Send the CSR off to the CA admin or whoever carves out your certificates.</p>


<p>Sometimes you want to test a switch's trunk port without having to carve our an access port to plug your MacBook into.</p>
<p>Here's how:</p>
<ol>
<li>Open System Preferences</li>
<li>Click Network</li>
<li>Select your Thunderbolt Ethernet adapter</li>
<li>Click the gear below the sidebar listing the interfaces</li>
<li>Click Manage Virtual Interfaces</li>
<li>Click the + button</li>
<li>New VLAN</li>
<li>Enter a name, such as "VLAN-200"</li>
<li>Enter a VLAN ID in the Tag field, such as 200</li>
<li>Choose Tunderbolt Ethernet for your Interface</li>
<li>Click Create</li>
<li>On the sidebar, your new vlan ("VLAN-200") is now an option. Click it.</li>
<li>Configure as needed.</li>
</ol>


<h1>Install KVM</h1>
<p>Install the packages</p>
<pre><code class="language-bash">apt-get install -y qemu-kvm libvirt-bin bridge-utils
</code></pre>
<p>Package notes from <a href="https://help.ubuntu.com/community/KVM/Installation">ubuntu.com</a>:</p>
<ul>
<li>libvirt-bin provides libvirtd which you need to administer qemu and kvm instances using libvirt</li>
<li>qemu-kvm (kvm in Karmic and earlier) is the backend</li>
<li>ubuntu-vm-builder powerful command line tool for building virtual machines</li>
<li>bridge-utils provides a bridge from your network to the virtual machines</li>
</ul>
<p>Add users to groups</p>
<pre><code class="language-bash">adduser `id -un` libvirt
adduser `id -un` kvm
</code></pre>
<p>Verify install</p>
<pre><code class="language-bash">virsh list --all
</code></pre>
<hr>
<h1>Networking</h1>
<h2>Configure network bridge</h2>
<p>Your network interfaces should be configured with NetPlan right now.
Since bridge-utils is installed, you can use NetPlan to do the rest.</p>
<p>Before doing this, it's a good idea to double-check your IPMI/IDRAC/ILO is working.</p>
<pre><code class="language-yaml"># Example netplan config defining bridge
network:
  version: 2
  renderer: networkd
  ethernets:
    eno1:
      dhcp4: no
    eno2:
      dhcp4: no
  bridges:
    br0:
      interfaces: [eno2]
      addresses: ["10.1.0.14/24"]
      gateway4: 10.1.0.1
      mtu: 1500
      nameservers:
        addresses: ["10.1.0.154"]
      parameters:
        stp: true
        forward-delay: 4
      dhcp4: no
      dhcp6: no
</code></pre>
<hr>
<h1>Defining the VM using virt-install</h1>
<p>Install virt-install - it's kind of big, about 160MB</p>
<pre><code class="language-bash">apt-get install -y virtinst
</code></pre>
<h2>Optional - list os-variant options</h2>
<pre><code class="language-bash">apt-get install -y libosinfo-bin

osinfo-query os
</code></pre>
<h2>Create the VM</h2>
<ul>
<li><code>--disk bus=</code>: 'ide', 'scsi', 'usb', 'virtio' or 'xen'.</li>
</ul>
<h3>Booting from an existing qcow2 image</h3>
<pre><code class="language-bash">virt-install \
  --name MyImportedVM \
  --description "Imported virtual machine" \
  --graphics vnc,listen=0.0.0.0 \
  --noautoconsole \  
  --os-type=linux \
  --memory 8192 \
  --vcpus=4 \
  --disk path=/var/lib/libvirt/images/importedVM.qcow2,bus=virtio\
  --boot hd \
  --network bridge:br0,model=virtio
</code></pre>
<h3>Building a new Windows VM</h3>
<p>Windows can be difficult on KVM because it doesn't ship with Virtio drivers. Using the non-virtio
disk and network emulation is comparatively slow. Things are made harder because <code>virt-install</code>
doesn't let you use --cdrom twice. To mount two iso files at once (so virtio drivers can be installed),
use the --disk argument with device=cdrom. Also be sure to use bus=ide so Windows can read it before
installing the virtio drivers.</p>
<p>The virtio drivers can be downloaded <a href="https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/virtio-win.iso">here</a></p>
<pre><code class="language-bash">virt-install \
  --name Server2019 \
  --description "Windows Server 2019 Template" \
  --os-type=windows \
  --memory 8192 \
  --vcpus=4 \
  --disk path=/var/lib/libvirt/images/windows2019.qcow2,bus=virtio,size=30 \
  --disk /var/lib/libvirt/isos/WindowsServer2019StandardCore_1909.iso,device=cdrom,bus=ide \
  --disk /var/lib/libvirt/isos/virtio-win.iso,device=cdrom,bus=ide \
  --graphics vnc,listen=0.0.0.0 \
  --noautoconsole \
  --network bridge=br0,model=virtio
</code></pre>
<ul>
<li>When installing the OS through your VNC viewer, no drives will show up.</li>
<li>Click the "Load Driver" button, and browse to the virtio iso that was mounted.</li>
<li>Expand the <code>viostor</code> folder and choose your OS. Click the <code>amd64</code> subdirectory. Click OK.</li>
<li>RedHat VirtIO SCSI Controller should show up, click Next</li>
<li>Finish the install</li>
</ul>
<p>Once the install finishes the server will turn off.</p>
<p>Edit the server using <code>virsh edit</code> to remove the disk:</p>
<pre><code class="language-bash">virsh edit Server2019
</code></pre>
<p>Choose your editor of choice (vim, obviously), and remove the boot <code>cdrom</code> disk.
Leave the virtio one, you stil need it. It looks like this:</p>
<pre><code class="language-xml">    &#x3C;disk type='file' device='cdrom'>
      &#x3C;driver name='qemu' type='raw'/>
      &#x3C;source file='/var/lib/libvirt/isos/WindowsServer2019StandardCore_1909.iso'/>
      &#x3C;target dev='hda' bus='ide'/>
      &#x3C;readonly/>
      &#x3C;address type='drive' controller='0' bus='0' target='0' unit='0'/>
    &#x3C;/disk>
</code></pre>
<p>Turn it back on using <code>virsh start</code>:</p>
<pre><code class="language-bash">virsh start Server2019
</code></pre>
<h4>Fix the other drivers</h4>
<p>The storage driver is now installed, but the network driver isn't there.
Since the VM was launched with <code>--network bridge=br0,model=virtio</code>, the VirtIO
driver is required. Not using the virtio NIC leads to some pretty terrible performance.</p>
<p>Log into the server and open up the device manager.
Navigate to "other devices". Right click the question marked network driver
and update the driver. Select your virtio disk and allow searching subdirectories,
it should find the driver and install it for you.</p>
<p>Do the same for the unidentified PCI device, that will install the VirtIO Baloon driver.</p>
<p>The server is now ready to use, or be made into a template. If you intend to use this server
with OpenStack later, consider installing cloud-init from <a href="https://cloudbase.it/cloudbase-init/">cloudbase-init</a>.</p>
<hr>
<h1>Accessing the VM through the console</h1>
<p>When defining the VM, <code>--graphics vnc,listen=0.0.0.0</code> was used. This enabled a VNC server underneath the
VM which can be used to connect in. To find the connection details, run <code>virsh vncdisplay</code>, which will show
the port offset of that VM's VNC console.</p>
<pre><code class="language-bash">virsh vncdisplay Server2019
</code></pre>
<p>The output will be something like <code>:0</code> or <code>:1</code>. Add 5900 to that, and that's your listen port.
If you needed to use a different port, <code>--graphics</code> supports a <code>,port=</code> argument.</p>
<hr>
<h1>Exporting to Glance</h1>
<p>If you want to use this file in OpenStack Glance next, you need to convert it. It's not intuitive, but the file looks like it's basically a thick-provisioned qcow2 (somehow). Use qemu-img:</p>
<pre><code class="language-bash"># thin provision the volume
qemu-img convert -f qcow2 -O qcow2 &#x3C;boot-vol> &#x3C;new-file.qcow2>
# upload it as an image
openstack image create --container-format bare --disk-format qcow2 --public --file &#x3C;new-file.qcow2> "&#x3C;image name>"
</code></pre>


<h1>Regular TCPDUMP</h1>
<p>Since tcpdump is installed by default, it's the first thing to use</p>
<pre><code class="language-bash"># Only listen on one interface
tcpdump -i &#x3C;interface/any>

# Filter to a host
tcpdump 'host &#x3C;ip address/fqdn>'

# filter to a port
tcpdump 'tcp port 5000'

# combine filters
tcpdump '(tcp port 5000 or tcp port 35357) and host 192.168.0.100'

# print packets in ascii (basically always want this)
tcpdump -A

</code></pre>
<h1>Using tshark</h1>
<p>Another option is wireshark's command line, tshark:</p>
<pre><code class="language-bash">apt-get install tshark
</code></pre>
<p>Note that tshark is really slow to get started compared to tcpdump, you need to wait a good while
until it says something like "Capturing on 'eno1'"</p>
<pre><code class="language-bash"># show interfaces
tshark -D

# Capture everything from a given source and interface
tshark -i eno1 -Y "ip.src == 10.1.0.76"

# Capture HTTP to and from a given source
tshark -i eno1 -Y "ip.addr == 10.1.0.76 and http"
</code></pre>


<h1>Install &#x26; Configure NFS Server</h1>
<p>These steps were tested on Ubuntu 18.04.</p>
<pre><code class="language-bash"># Install the NFS server package
apt-get install nfs-kernel-server

# Make a directory to publish
mkdir /nfs

# Set permissions
chown nobody:nogroup /nfs
chmod 777 /nfs
</code></pre>
<p>Configure NFS by writing <code>/etc/exports</code>. In this example I'm allowing access
from anyone on the <code>10.10.0.0/16</code> subnet. This is only secure if you trust that
entire subnet and any systems which might be routed to it.</p>
<pre><code class="language-text">/nfs 10.10.0.0/16(rw,sync,no_subtree_check)
</code></pre>
<p>Apply the changes</p>
<pre><code class="language-bash">exportfs -a
systemctl restart nfs-kernel-server
</code></pre>
<h1>NFS client setup</h1>
<pre><code class="language-bash"># Install client software
apt-get install nfs-common

# Create mount point
mkdir /nfs

# Mount the NFS share manually
mount 10.10.10.9:/nfs /nfs
</code></pre>


<h1>Problem Description</h1>
<p>You need to transfer files to a locked down Windows server from a Linux server.
Sure, you could carve out a file-share. There's an easier way for a one-off
transfer.</p>
<p>This is a bit of an edge-case since newer Windows systems come with SCP
installed, but the image I needed to transfer to had it disabled. Older
versions like Server 2012 also don't support SCP without extra software.</p>
<h1>Hosting files with Python's web server</h1>
<p>Make a directory and move your file into it. In my case, I'm transferring the
CloudBase-Init setup package.</p>
<p><strong>Note</strong>: If you use the package itself inside either a python script or
an interactive Python session you can change things like the listen IP and
port. Using <code>python -m</code> is just easier.</p>
<pre><code class="language-bash"># Move the file to a directory where it's the only thing there
mv CloudbaseInitSetup_1_1_0_x64.msi http/

# Change to that directory
cd http

# Start the web server. It will listen on 0.0.0.0:8000 by default.
python -m SimpleHTTPServer
</code></pre>
<h1>Downloading the file</h1>
<p>Now the file can be downloaded from your Linux server. In your Windows system,
open Internet Explorer and navigate to the Linux IP address. Don't forget to
add the <code>:8000</code> to specify the port. From here you can easily download the
file. Be sure to close the server (<code>CTRL+c</code>) when you're done.</p>


<h1>Getting the certificate</h1>
<p>So far as I can tell, certbot works in the following way:</p>
<ol>
<li>Certbot is executed from the web-server CLI, and told to download a cert for
an FQDN. Let's say it's getting a cert from <code>example.com</code>.</li>
<li>Certbot opens up a port, I think 443, and listens for requests from the
LetsEncrypt service.</li>
<li>Certbot calls out to LetsEncrypt's service, letting the service know it's
listening on <code>example.com</code> and ready to prove it owns that domain.</li>
<li>LetsEncrypt sends some secret, or maybe collects some secret from the
listening certbot service, proving that certbot's server does indeed own
this domain name.</li>
<li>LetsEncrypt signs a cert and makes it available. Certbot downloads the cert
to the local server.</li>
</ol>
<h2>Configure DNS</h2>
<p>First, ensure that your DNS A record, such as <code>example.com</code>, resolves to
the IP address your server is using. This needs to be an internet accessible
IP address, not an internal RFC-1918 address.</p>
<h2>Install Certbot</h2>
<p>This guide assumes you're using Ubuntu Server.</p>
<pre><code class="language-bash">add-apt-repository ppa:certbot/certbot
apt-get update
apt-get install certbot
</code></pre>
<h2>Download the certificate</h2>
<p>Set the <code>site</code> variable here to your DNS entry which will point to this server.</p>
<pre><code class="language-bash">site="example.com"
certbot certonly --standalone --preferred-challenges http -d $site
</code></pre>
<h2>Use the certificate</h2>
<p>You can find the certificates as files on your server.</p>
<pre><code class="language-bash">> cd /etc/letsencrypt/live/$site
README  cert.pem  chain.pem  fullchain.pem  privkey.pem
</code></pre>
<p>Copy these certs to your web service and use them like any other cert.</p>
<p>Note that if you want to use these certs for HAProxy, you need to combine
<code>cert.pem</code> and <code>privkey.pem</code> into a single file.</p>
<pre><code class="language-bash">cat cert.pem privkey.pem > haproxy-$site.pem
</code></pre>


<p><strong>Note:</strong> This is usually a bad idea. You should really get the team who runs
the CA to send you the certificate in case some <em>bad guy</em> is doing the MITM and
not the local security team. Use this procedure with caution.</p>
<hr>
<h1>Get the signing certificate</h1>
<p>Use <code>openssl</code> to print the certificate data.</p>
<pre><code class="language-bash">openssl s_client -connect google.com:443 -showcerts
</code></pre>
<p>In the output you'll see, among other things, some certificates.
They look like this:</p>
<pre><code class="language-text">-----BEGIN CERTIFICATE-----
blaBLAbla
-----END CERTIFICATE-----
</code></pre>
<p>Find the one signed by your local CA. Copy and paste it into a new file,
such as <code>example.com.crt</code>. The <code>.crt</code> file extension is required.
Don't copy anything before or after the BEGIN and END lines.</p>
<hr>
<h1>Trust the certificate</h1>
<p>As root, move the certificate file to <code>/usr/local/share/ca-certificates</code>,
then run <code>update-ca-certificates</code>.</p>
<pre><code class="language-bash">mv example.com.crt /usr/local/share/ca-certificates
update-ca-certificates
</code></pre>
<p>That's it. Now your system will trust certs signed by that CA too.</p>


<p>When you use a tool like <code>dd</code> or <a href="https://www.balena.io/etcher/">Etcher</a> to
turn a USB
stick into boot media, usually for installing an operating system, any attempt
at formatting that disk later will be met with a drive that only has a few GB
total. This is particularly annoying when you use something like a 100+GB USB
stick for that.</p>
<p>The cause of this problem is that a smaller partition is created on the drive
than the drive could potentially hold. To fix the drive you need to
removing all the partitions.</p>
<p>List your devices. Note your USB stick (example: <code>/dev/disk2</code>)</p>
<pre><code class="language-bash">diskutil list
</code></pre>
<p>Try to fix it using diskutil:</p>
<pre><code class="language-bash">diskutil eraseDisk free EMPTY /dev/disk2
</code></pre>
<p>Often that's good enough, and the drive now shows up in Disk Utility with its full capacity.</p>
<hr>
<p>If that fails, you can overwrite the partition/filesystem's metadata at the start of the disk with zeros.</p>
<p>If the drive is mounted, unmount it.</p>
<pre><code class="language-bash">diskutil umountDisk /dev/disk2
</code></pre>
<p>Delete the partition. Note that I tried <code>gpt</code> first but it threw an error
saying <code>gpt show: error: bogus map</code>. Also, as far as I can tell, <code>diskutil</code>
won't actually erase a partition and instead will only reformat it. Strangely,
even <code>fdisk</code> seems to have hidden the option to delete a partition. Guess Apple
<strong>REALLY</strong> doesn't trust its users. That's too bad, since I ended up doing
something even more dangerous.</p>
<p>Overwrite the partition and filesystem data in the first 1GB of the USB drive
with zeros. Be <strong>really really sure</strong> that you select the right disk here.
You can 100% toast your workstation's boot disk if you accidentally specify it.</p>
<pre><code class="language-bash">sudo dd if=/dev/zero of=/dev/disk2 count=1 bs=1GB
</code></pre>
<p>If that doesn't work, set <code>bs=1MB</code> and remove the <code>count=1</code>. You might need to
delete the end of it instead. That'll take a while.</p>


<p>You've deployed a server in a customer environment and you don't have remote
network access configured. The customer is OK with you being able to remote
into their network, but its not practical to set you up with a VPN. Enter the
"Dial-Home Device".</p>
<h1>What is the Dial-Home Device</h1>
<p>It's just an Ubuntu server that repeatedly tries to dial an internet connected
jump box in order to open a reverse session. As soon as the networking is set
up, it will dial home and open itself up for remote administration.</p>
<p>Also, <a href="https://stargate.fandom.com/wiki/Dial_Home_Device">this.</a></p>
<hr>
<h1>Deploy the Pivot Server</h1>
<h2>What's a Pivot Server?</h2>
<p>This is an internet-connected server such as a VPS that the DHD will SSH to.</p>
<p>You'll SSH to it, then from there you can SSH through the DHD's reverse tunnel.</p>
<h2>Steps to Deploy</h2>
<h3>Launch a VPS</h3>
<p>Using AWS, GCP, Azure, Linode, Digital Ocean, so on, launch an
internet-connected Ubuntu server. It needs to have a static, internet routed IP
address. Its not a bad idea to make a DNS entry for it too, so you can change
the IP down the road.</p>
<p>SSH to the server to confirm that it works.</p>
<h3>Configure Remote User</h3>
<p>These steps will create a user named <code>remoteuser</code></p>
<pre><code class="language-bash"># Create the user
useradd remoteuser

# Set a password for the user
passwd remoteuser

# Create the home &#x26; ssh directories for the user
mkdir -p /home/remoteuser/.ssh
chown -R remoteuser:remoteuser /home/remoteuser

# Disable shell access to the user, so it can't run commands on the pivot
usermod -s /bin/false remoteuser
</code></pre>
<hr>
<h1>Deploy the Dial-Home Device</h1>
<p>Install Ubuntu Server on a physical server or VM at the remote location. This
server should have network connectivity to whatever resource you want to
manage, and outbound internet access (it can ping google).</p>
<h2>Create an SSH key on the DHD</h2>
<p>On the DHD server, you may already have SSH keys. Look in <code>~/.ssh</code>. If not,
run the following to create one. Don't use a passphrase, just hit enter when
prompted.</p>
<pre><code class="language-bash">ssh-keygen
</code></pre>
<p>Collect the public key for the next step:</p>
<pre><code class="language-bash">cat ~/.ssh/id_rsa.pub
</code></pre>
<p>For convenience, I like to copy the key to the root user too. Optional.</p>
<h2>Authorize the SSH Public Key on the Pivot Serer</h2>
<p>Back on the Pivot server, edit the remote user's <code>authorized_keys</code> file to
grant this SSH key-pair access. Paste the SSH key at the end of the file</p>
<pre><code class="language-bash">vi /home/remoteuser/.ssh/authorized_keys
</code></pre>
<h2>Test a remote connection</h2>
<h3>Initiate the connection</h3>
<p>From the DHD server, open the reverse tunnel manually to make sure it works.</p>
<ul>
<li>Replace the username as needed</li>
<li>The <code>$pivot</code> variable should be the IP or FQDN of the pivot server</li>
<li>Pick a random port in the range 1024-49151 for the listen port.</li>
</ul>
<pre><code class="language-bash">user="remoteuser"
pivot="support.example.com"
port=22222
ssh -fN -R 0.0.0.0:$port:127.0.0.1:22 $user@$pivot
</code></pre>
<h3>Connect through the pivot</h3>
<p>From the pivot server, SSH to the DHD. This example assumes your username
is <code>myuser</code>.</p>
<pre><code class="language-bash">ssh -p 22222 myuser@127.0.0.1
</code></pre>
<p>Consider adding your public key to the <code>~/.ssh/authorized_keys</code> file now so
passwords aren't needed.</p>
<p>Now you can jump through the pivot into the DHD.</p>
<hr>
<h1>Persist the Connection</h1>
<h2>Build the dial-home command</h2>
<p>From any directory, create the script:</p>
<p><code>vi dial-home</code></p>
<pre><code class="language-bash">#!/usr/bin/env bash

# Check if the reverse tunnel  is already open
port=22222
if [[ $(ps aux | grep ssh | grep $port) ]]; then
  # reverse tunnel is open
  exit 0
fi

# tunnel is not open, open it
user="remoteuser"
pivot="support.example.com"
ssh -fN -R 0.0.0.0:$port:127.0.0.1:22 $user@$pivot
</code></pre>
<p>Make the script executable</p>
<pre><code class="language-bash">chmod +x dial-home
</code></pre>
<p>Move the script to somewhere in the <code>$PATH</code></p>
<pre><code class="language-bash">sudo mv dial-home /usr/local/bin/
</code></pre>
<p>Now the <code>dial-home</code> command will open the tunnel.</p>
<h2>Make cron dial-home every minute</h2>
<p>The connection will die for lots of reasons. Make it bring itself back online
automatically using cron.</p>
<p>From the DHD, make sure cron is running (by default, it is)</p>
<pre><code class="language-bash">systemctl status cron
</code></pre>
<p>Edit the crontab</p>
<p><code>sudo vi /etc/crontab</code></p>
<p>and insert this line, where <code>myuser</code> is your username on the DHD.
If you use root, you have to also give root the ssh private key.</p>
<pre><code class="language-text">* * * * *   myuser dial-home
</code></pre>
<p>Reload cron</p>
<pre><code class="language-bash">service cron reload
</code></pre>
<p>Then kill the session (using <code>ps aux</code> and <code>kill</code>) then watch it come back.</p>
<p>Done. Now the server is a dial-home device. It will constantly dial your pivot
server and re-open the session whenever its closed. To lock the server out,
just remove its public key from <code>remoteuser</code>'s <code>authorized_keys</code> file.</p>


<p><strong>This post is linked to from the <a href="/project-email.html">Automated Emails Project</a></strong></p>
<h1>What is SPF?</h1>
<p>Sender Policy Framework</p>
<p>SPF uses a DNS attribute assigned to the sending domain name that lists which
hosts are expected to send emails for that domain.</p>
<h1>How to use SPF</h1>
<h2>Find your external IP address</h2>
<p>Many VMs use NAT to accesss the internet. Their <code>ifconfig</code> output won't match
the actual internet IP that the emails will send from.</p>
<p>To check your external IP address, execute:</p>
<pre><code class="language-bash">dig +short myip.opendns.com @resolver1.opendns.com
</code></pre>
<p>Below, the output of this command will be used as <code>&#x3C;ext_ip></code></p>
<p>If you have a static public IP address you can use it as <code>&#x3C;ext_ip></code></p>
<h2>Set the SPF DNS Record</h2>
<p>There used to be a site with reference data at openspf.org but they ran out of
funding so it went offline. You can still get to its reference page from the
<a href="http://web.archive.org/web/20190224184030/http://www.openspf.org/SPF_Record_Syntax">WayBackMachine</a>.</p>
<p>To configure SPF, first
go to your domain registrar's website and create a new entry for your domain.
In Cloudflare, you just go to the DNS page. Cloudflare supports both SPF and
TXT records, some registrars will only offer TXT. If yours offers both, use
both for this.</p>
<p>Create a record for the domain your emails will send from. For instance, if
your emails will send from <a href="mailto:noreply@alerts.example.com">noreply@alerts.example.com</a>, create an entry for
alerts.example.com.</p>
<p>Check the above linked reference for other options such as using A records,
but here's an example of an SPF record stating that emails are expected from
the IP address 1.2.3.4. You can also use subnet masks if you own a range.</p>
<pre><code>v=spf ip4:1.2.3.4 -all
</code></pre>
<p>Set your DNS SPF record, and that's it, you're done. Receiving "milters"
might check this and add a few points or whatever towards your sender's
trustworthiness.</p>


<h1>Setup</h1>
<p>This setup was done on an <a href="https://www.intel.ca/content/www/ca/en/products/boards-kits/nuc.html">Intel Nuc</a>.</p>
<p>The Nuc is running Ubuntu Server 18.04 Bionic, CLI only. It has a wired
connection to a rack switch on an access port, and a wireless connection to the
office WiFi.</p>
<p>The server will host 192.168.0.1 and act as a gateway for the wired servers.
It will do NAT just like a home router does to ensure there are no routing
problems with the upstream layer 3 devices.</p>
<p>This setup begins where my <a href="ubuntu-bionic-wifi">Ubuntu WiFi Guide</a> left off.
Check it out if you're not sure how to connect to the WiFi from an Ubuntu
server.</p>
<h1>Enable IP Routing</h1>
<p>Check if it's enabled in your config file. This command will just print the
file and ignore any comments or blank lines.</p>
<pre><code>cat /etc/sysctl.conf | grep -v -e "#" -v -e "^$"
</code></pre>
<p>If you don't have this entry, edit the file and insert it:</p>
<pre><code>net.ipv4.ip_forward=1
</code></pre>
<p>If you changed the file, apply your changes:</p>
<pre><code>sysctl -p
</code></pre>
<h1>Configure Interfaces</h1>
<p>Here's my netplan, with the wireless details changed:</p>
<pre><code>network:
  version: 2
  renderer: networkd
  ethernets:
    enp0s25:
      dhcp4: false
      addresses:
        - 192.168.0.1/24
  wifis:
    wlp2s0:
      dhcp4: true
      access-points:
        "My SSID":
          password: "My Password"
</code></pre>
<p>If you changed your netplan file, apply the changes with</p>
<pre><code>netplan try
</code></pre>
<h1>Configure NAT</h1>
<p>We'll use <code>iptables</code> for NAT.</p>
<p>First, make a file that defines the rules you want:</p>
<h2>Define iptables rules file</h2>
<p>These rules will take any traffic coming from 192.168.0.0/24 that are being
routed out the WiFi interface <code>wlp2s0</code> (the default gateway / default route),
and apply the MASQUERADE rule which will run port address translation, allowing
internet.</p>
<p>There are two tables, <code>nat</code> and <code>filter</code>. The NAT table does the translation,
the filter table defines what's allowed in and out. We need to specify that
traffic is allowed to go:</p>
<ul>
<li>From the Ethernet port to the WiFi port</li>
<li>Back from WiFi to Ethernet, when it is <code>RELATED</code> or <code>ESTABLISHED</code></li>
</ul>
<p><code>vi /etc/iptables_rules.sh</code></p>
<pre><code>#!/usr/bin/env bash
echo "Loading rules..."
iptables -t filter -A FORWARD -i enp0s25 -o wlp2s0 -j ACCEPT
iptables -t filter -A FORWARD -i wlp2s0 -o enp0s25 -m state \
  --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o wlp2s0 -j MASQUERADE
echo "Done"
</code></pre>
<p>Make the script executable</p>
<pre><code class="language-bash">chmod +x /etc/iptables_rules.sh
</code></pre>
<h2>Load iptables rules now</h2>
<p>Run the new file to apply the rules.</p>
<pre><code class="language-bash">/etc/iptables_rules.sh
</code></pre>
<p>You can now use this device as a router without having to configure any special
routes.</p>
<h2>Configure iptables rules to load on boot</h2>
<p>Add the following line to your rc.local file. If it doesn't exist, create it.</p>
<p><code>vi /etc/rc.local</code></p>
<pre><code>/etc/iptables_rules.sh
</code></pre>
<p>If the file didn't exist, make sure that it starts with a shebang:</p>
<pre><code>#!/usr/bin/env bash
</code></pre>
<p>Ensure that it's executable:</p>
<pre><code>chmod +x /etc/rc.local
</code></pre>


<h1>Setup</h1>
<p>This setup was done on an <a href="https://www.intel.ca/content/www/ca/en/products/boards-kits/nuc.html">Intel Nuc</a>.</p>
<p>The Nuc is running Ubuntu Server 18.04 Bionic, CLI only. It has a wired
connection to a DHCP-enabled home router initially, but will use wireless
internet after this in finished</p>
<h1>Find and Start the Wireless Device</h1>
<pre><code class="language-bash">ip link
</code></pre>
<p>Mine was called <code>wlp2s0</code>. Start it:</p>
<pre><code class="language-bash">ip link set dev wlp2s0 up
</code></pre>
<hr>
<h1>Download &#x26; Install wireless software</h1>
<p>Ubuntu server doesn't ship with the required packages to connect to WiFi.</p>
<p>From another Ubuntu server that <strong>does</strong> have internet, plug in a USB stick
and mount it. This example assumes it's mounted to /mnt.</p>
<p>I'm pretty sure that it can connect to WEP without this, and its just the
newer WPA2 networks that basically everyone is using that need this.</p>
<pre><code class="language-bash"># Delete anything currently in the apt cache
apt-get clean

# building some temp package lists, drop them in ~ or wherever
cd ~

# use apt-rdepends to get the dependencies
apt-get install apt-rdepends

# find deps for wireless-tools
apt-rdepends wireless-tools 2>/dev/null | grep "Depends: " | awk '{print $2}' | sort | uniq > packages1
echo wireless-tools >> packages1

# find deps for wpasupplicant
apt-rdepends wpasupplicant 2>/dev/null | grep "Depends: " | awk '{print $2}' | sort | uniq > packages2
echo wpasupplicant >> packages2
cat packages1 packages2 | sort | uniq > packages

# download the debs
cd /var/cache/apt/archives
cat ~/packages | while read p; do echo $p; apt-get download $p; done

# Copy the files
mkdir -p /mnt/debs
cp /var/cache/apt/archives/*.deb /mnt/debs
umount /mnt
</code></pre>
<p>Now remove the USB drive from that system and plug it into the offiline one.</p>
<pre><code class="language-bash"># mount the usb drive
mount /dev/sdb1 /mnt

# move the files to your cache directory
cp /mnt/debs/* /var/cache/apt/archives/

# Install the packages
apt-get install wireless-tools wpasupplicant
</code></pre>
<h1>Scan for SSIDs</h1>
<p>The <code>iwlist</code> command can also give you other information about the network if
you don't pipe its output to grep, but it's pretty verbose.</p>
<pre><code class="language-bash">iwlist wlp2s0 scanning | grep -ie ssid
</code></pre>
<h1>Join the WiFi Network with Netplan</h1>
<p>You can use various commands to interactively connect to the network, but I
want this connection to come up with the NUC. Netplan is the new tool used to
configure networks since Ubuntu's Bionic stable release. Here's the netplan
config I used. You can see the wired connection in there too, it doesn't need
to be there once this is finished.</p>
<p>Be sure to replace "<code>MySSID</code>" and "<code>My Password</code>" with your own.</p>
<p><code>vi /etc/netplan/01-netcfg.yaml</code></p>
<pre><code>network:
  version: 2
  renderer: networkd
  ethernets:
    enp0s25:
      dhcp4: yes
  wifis:
    wlp2s0:
      dhcp4: yes
      access-points:
        "MySSID":
          password: "My Password"
</code></pre>
<p>Then apply the changes.</p>
<pre><code>netplan try
</code></pre>
<p>You should have an IP address now in <code>ifconfig</code>. For some reason I didn't get
one right away, so I forced the DHCP request like this:</p>
<pre><code>dhclient wlp2s0 -v
</code></pre>
<p>After that, you can connect to the wireless IP and don't need the wired one.</p>
<h1>Reference Links</h1>
<ul>
<li><a href="https://askubuntu.com/questions/138472/how-do-i-connect-to-a-wpa-wifi-network-using-the-command-line">AskUbuntu post about wpasupplicant</a></li>
<li><a href="https://ubuntuforums.org/showthread.php?t=2392154">Ubuntuforums.org netplan post</a></li>
</ul>


<p>One pain point I often have is SSH forwarding the ports for a bunch of web
services and IPMI/IDRAC/ILO/Whatever connections through my pivot server to my
workstation. Its really tedious, and having a web UI right on the jump server's
subnet can be really helpful.</p>
<p>In this guide, I show how I launch Chrome on a remote Ubuntu server without
ever installing any graphics tools like Ubuntu Desktop on that server, and
without needing VNC/RDP/PCOIP/etc. X11 forwarding lets the XQuarts process on
a MacBook render the browser, while it still uses the networking on the Ubuntu
server it launched from.</p>
<hr>
<h3>Table of Contents</h3>
<ul>
<li><a href="#configure-workstation-macbook-ssh-settings-for-x11-forwarding">Configure Workstation (MacBook) SSH Settings for X11 Forwarding</a>
<ul>
<li><a href="#set-xauthlocation">Set XAuthLocation</a></li>
<li><a href="#enable-forwardagent-and-forwardx11">Enable ForwardAgent and ForwardX11</a></li>
</ul>
</li>
<li><a href="#remotely-launch-graphical-apps-with-xwindows">Remotely Launch Graphical Apps with XWindows</a>
<ul>
<li><a href="#install-chrome">Install Chrome</a></li>
<li><a href="#install-x11-apps-for-xeyes">Install X11-apps for xeyes</a></li>
</ul>
</li>
<li><a href="#launch-forwarded-xwindows-session">Launch Forwarded XWindows Session</a>
<ul>
<li><a href="#open-ssh-session-with-x11-forwarding-enabled">Open SSH session with X11 Forwarding Enabled.</a></li>
</ul>
</li>
<li><a href="#troubleshooting">Troubleshooting</a>
<ul>
<li><a href="#xauth--timeout-in-locking-authority-file-xauthority">xauth:  timeout in locking authority file ~/.Xauthority</a></li>
<li><a href="#display-is-empty-no-xauth-program">$DISPLAY is Empty, No xauth program</a></li>
<li><a href="#x11-connection-rejected-because-of-wrong-authentication">X11 connection rejected because of wrong authentication.</a></li>
</ul>
</li>
<li><a href="#reference-links">Reference Links</a></li>
</ul>
<h1>Configure Workstation (MacBook) SSH Settings for X11 Forwarding</h1>
<p>If you're not using a MacBook, this won't apply.</p>
<h2>Set XAuthLocation</h2>
<p>The workstation needs to allow X11 forwarding. Some brilliant update broke it
in my version of Mac OS I had to set the XAuthLocation in <code>ssh_config</code>.</p>
<p><code>vi /etc/ssh/ssh_config</code></p>
<pre><code class="language-bash">Host *
  SendEnv LANG LC_*
  XAuthLocation /usr/X11/bin/xauth
  ServerAliveInterval 60
  ForwardX11Timeout 596h
</code></pre>
<h2>Enable ForwardAgent and ForwardX11</h2>
<p>My hostname was <code>adc-bmc</code> and its IP was 192.168.2.2. Alter this as needed.
On your workstation:</p>
<p><code>vi ~/.ssh/config</code></p>
<pre><code class="language-bash">Host adc-bmc
  HostName 192.168.2.2
  ForwardAgent yes
  ForwardX11 yes
</code></pre>
<h1>Remotely Launch Graphical Apps with XWindows</h1>
<h2>Install Chrome</h2>
<p>You can use Firefox or whatever instead. Chrome's install will fail due to
missing dependencies, but apt can sort it out.</p>
<pre><code class="language-bash">wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
dpkg -i google-chrome-stable_current_amd64.deb
apt-get install -f
dpkg -i google-chrome-stable_current_amd64.deb
</code></pre>
<h2>Install X11-apps for xeyes</h2>
<p>This is just for fun and testing. Xeyes is kind of neat.</p>
<pre><code>apt-get install -y x11-apps
</code></pre>
<hr>
<h1>Launch Forwarded XWindows Session</h1>
<h2>Open SSH session with X11 Forwarding Enabled.</h2>
<p>XWindows can be passed through SSH. Open a new terminal window and connect to
the server using the <code>-X</code> flag to enable X forwarding on the client.</p>
<p>The xeyes application is a fun test.</p>
<pre><code class="language-bash">ssh -X myuser@192.168.2.2 xeyes
</code></pre>
<p>If that works, try Chrome. The extra flags enable compression and use a faster
encryption algorithm. If they cause problems, just use <code>-X</code>.</p>
<pre><code class="language-bash">ssh -XC -c chacha20-poly1305@openssh.com myuser@192.168.2.2 google-chrome
</code></pre>
<h1>Troubleshooting</h1>
<h2>xauth:  timeout in locking authority file ~/.Xauthority</h2>
<p>As your not-root user, remove and <code>chmod</code> some files.</p>
<pre><code class="language-bash">sudo rm ~/.Xauthority-c
sudo rm ~/.Xauthority-l
sudo rm -r ~/.Xauthority
mkdir ~/.Xauthority
chmod 0600 ~/.Xauthority
</code></pre>
<h2>$DISPLAY is Empty, No xauth program</h2>
<p>On your mac, if you connect with <code>ssh -v -X ...</code> and you get an error line
saying <code>No xauth program</code>, then you need to edit your SSH config to specify
the xauth path. Mine was <code>/usr/X11/bin/xauth</code>.</p>
<h2>X11 connection rejected because of wrong authentication.</h2>
<p>If you're on Mac, this can happen when you didn't set the <code>XAuthLocation</code> ssh
configuration.</p>
<h1>Reference Links</h1>
<ul>
<li><a href="https://linuxize.com/post/how-to-install-google-chrome-web-browser-on-ubuntu-18-04/">linuxize.com - Install chrome</a></li>
<li><a href="https://github.com/dnschneid/crouton/issues/2676">github.com - x11 forwarding tshooting</a></li>
</ul>


<p>This post covers how to create a bash script that runs every minute to send an
email when a ping fails.</p>
<p>You could use <a href="https://www.pingdom.com/">Pingdom</a> but there's no need to pay
someone else if you have compute resources available. Also, this works from
inside your local network, so it can ping <a href="https://tools.ietf.org/html/rfc1918">RFC1918</a>
addresses.</p>
<p>This script watches for ICMP (ping) availability.
You can replace the ping command with a netcat call to watch a port, or run
whatever other test you like.</p>
<hr>
<h3>Table of Contents</h3>
<ul>
<li><a href="#building-the-alert-tool">Building the Alert Tool</a>
<ul>
<li><a href="#test-the-mail-command">Test the mail command</a></li>
<li><a href="#create-the-bash-script">Create the bash script</a></li>
</ul>
</li>
<li><a href="#create-cron-job">Create cron job</a>
<ul>
<li>
<ul>
<li><a href="#restart-cron-to-apply-the-changes">Restart Cron to apply the changes</a></li>
</ul>
</li>
</ul>
</li>
</ul>
<h1>Building the Alert Tool</h1>
<p>Before you begin, consider <a href="/emails-postfix-ubuntu">setting up a local send-only postfix service</a>.</p>
<h2>Test the mail command</h2>
<p>Emails in this script will send using the <code>mail</code> command. Make sure it works
before continuing.</p>
<pre><code class="language-bash">echo "Test alert please ignore" | mail \
    -a "FROM:noreply@alerts.example.com" \
    -s "Test alert" \
    alerts@example.com
</code></pre>
<h2>Create the bash script</h2>
<p>Create a directory to place the script.</p>
<pre><code class="language-bash">mkdir -p /etc/cronjobs &#x26;&#x26; cd /etc/cronjobs
chmod +x ping_alert.sh
</code></pre>
<p>Create the script. Here's a commented example of one I wrote:</p>
<p><code>vi ping_alert.sh</code></p>
<pre><code class="language-bash">#!/usr/bin/env bash

# Positional arguments. If debug is set to '1', debug will echo to stdout
target_ip=$1
debug_enabled=$2

# debug function for troubleshooting
function debug () {
    if [[ "$debug_enabled" == "1" ]]; then
        echo $1
    fi
}

# The token file will be written when an email has been sent, and ensure that
# another email doesn't get sent again too soon. This helps prevent your emails
# from being marked as SPAM and is also way less annoying.

token_file='/etc/cronjobs/.email_sent'
sent_recently=false
now_ts=$(date +%s)
if [ -f $token_file ]; then
    file_ts=$(cat $token_file)
    # hour_in_seconds defined how long between emails to wait before another
    # can be sent.
    hour_in_seconds=3600
    hour_from_file_ts=$(($file_ts+$hour_in_seconds))
    if [[ $now_ts -le $hour_from_file_ts ]]; then
        sent_recently=true
    fi
fi

# The script will gracefully exit if its within the cooldown window.
if [[ $sent_recently == true ]]; then
    debug "sent recently, exiting. Check $token_file"
    exit
fi

# Ping the target IP and collect the return code. If the return code is 0 then
# the ping was OK and this script will exit.
debug "Pigning $target_ip..."
ping -c 1 $target_ip >/dev/null
if [[ $? == 0 ]]; then
    debug "ping ok, exiting"
    exit
fi

# Since the script hasn't exited, the ping failed. Send the warning email.
debug "Sending warning email"
msg="Warning: Ping to IP $target_ip failed."
echo $msg | mail \
    -a  "FROM:noreply@alert.example.com" \
    -s "Test alert" \
    alerts@example.com

# Update the token file to reset the cooldown.
debug "Writing new timestamp $now_ts"
# Write the new timestamp
echo $now_ts > $token_file
</code></pre>
<p>Make the script executable:</p>
<pre><code class="language-bash">chmod +x ping_alert.sh
</code></pre>
<p>Give the script a test run against a valid and invalid IP. It should send an
email for the invalid IP but not the valid one.</p>
<pre><code># test that should pass
/etc/cronjobs/ping_alert.sh 1.1.1.1
# test that should fail
/etc/cronjobs/ping_alert.sh 10.2.3.4
</code></pre>
<hr>
<h1>Create cron job</h1>
<p>We'll run this script every minute. Since it has a cool-down timer it won't
send spam.</p>
<p>This example will ping <a href="https://new.blog.cloudflare.com/announcing-1111/">Cloudflare's DNS</a>,
<code>1.1.1.1</code>, so replace the IP with one that you actually watch to watch.</p>
<p><code>vi /etc/crontab</code></p>
<pre><code># Keep whatever is currently there
*  *    * * *   root    /etc/cronjobs/ping_alert.sh 1.1.1.1 0 | tee -a /var/log/ping_alert.log
</code></pre>
<h3>Restart Cron to apply the changes</h3>
<pre><code>systemctl restart cron
</code></pre>
<p>Now the job will run every minute, and send emails at most every hour.</p>


<p>In order to send emails from a VM you need a mail server. Often you can use
a public, corproate, or cloud mail server, but sometimes you might need to
deploy your own locally.</p>
<p>This guide covers how to configure Postfix as a local send-only mail service on
a dedicated Ubuntu VM.</p>
<hr>
<h3>Table of Contents</h3>
<ul>
<li><a href="#create-a-send-only-mail-server-with-postfix">Create a send-only mail server with Postfix</a>
<ul>
<li><a href="#find-your-external-ip-address">Find your external IP address</a></li>
<li><a href="#set-your-hostname-to-an-fqdn-in-etchosts">Set your hostname to an FQDN in /etc/hosts</a></li>
<li><a href="#install-postfix">Install Postfix</a></li>
<li><a href="#configure-postfix">Configure Postfix</a></li>
<li><a href="#send-a-test-email-from-the-command-line">Send a test email from the command-line</a></li>
</ul>
</li>
<li><a href="#troubleshooting">Troubleshooting</a>
<ul>
<li><a href="#check-for--remove-mail-stuck-in-the-queue">Check for &#x26; remove mail stuck in the queue</a>
<ul>
<li><a href="#outlook-is-blocking-your-emails">Outlook is blocking your emails</a></li>
</ul>
</li>
</ul>
</li>
<li><a href="#other-references">Other References</a></li>
</ul>
<h1>Create a send-only mail server with Postfix</h1>
<h2>Find your external IP address</h2>
<p>Many VMs use NAT to accesss the internet. Their <code>ifconfig</code> output won't match
the actual internet IP that the emails will send from.</p>
<p>To check your external IP address, execute:</p>
<pre><code class="language-bash">dig +short myip.opendns.com @resolver1.opendns.com
</code></pre>
<p>Below, the output of this command will be used as <code>&#x3C;ext_ip></code></p>
<p>If you have a static public IP address you can use it as <code>&#x3C;ext_ip></code></p>
<h2>Set your hostname to an FQDN in /etc/hosts</h2>
<p>This step is only required if you don't already have a local DNS server or
internet routed static IP with a valid FQDN.</p>
<p>Lets say that your mail will come from a server named alerts.example.com.
Set the hosts file like this:</p>
<p><code>vi /etc/hosts</code></p>
<pre><code class="language-text">127.0.0.1 alerts.example.com
&#x3C;ext_ip>  alerts.example.com
</code></pre>
<h2>Install Postfix</h2>
<p>This is the software that manages your mail queue and handles SMTP.</p>
<pre><code class="language-bash">apt-get install -y postfix mailutils
</code></pre>
<p>If it asks you which type of server to install, select Internet Site.
Give it an FQDN when prompted. If you will be sending emails from
<a href="mailto:noreply@alerts.example.com">noreply@alerts.example.com</a>, enter <code>alerts.example.com</code>.</p>
<h2>Configure Postfix</h2>
<p>Here's a configuration that's worked for me.
Be sure to change the <code>myhostname</code> field.</p>
<p><code>vi /etc/postfix/main.cf</code></p>
<pre><code class="language-ini">myhostname = alerts.example.com

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
append_dot_mydomain = no
readme_directory = no
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
mydestination = $myhostname, 63ec22ec9fc1, localhost.localdomain, , localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = loopback-only
inet_protocols = all
</code></pre>
<p>Once configured, restart Postfix:</p>
<pre><code class="language-bash">systemctl restart postfix
</code></pre>
<h2>Send a test email from the command-line</h2>
<p>Pipe some stdout to the <a href="https://linux.die.net/man/1/mail">mail</a> command.
This will be used as the body of the email.</p>
<pre><code class="language-bash">echo "Test alert please ignore" | mail \
  -a "FROM:noreply@alerts.example.com" \
  -s "Test alert" kyle@example.com
</code></pre>
<hr>
<h1>Troubleshooting</h1>
<p>Often emails don't go through. There are lots of reasons that can happen.</p>
<h2>Check for &#x26; remove mail stuck in the queue</h2>
<p>Show the mail queue. It might tell you the error if the email is there.</p>
<pre><code class="language-bash">mailq
</code></pre>
<p>If you've got a scheduled job that is adding emails, it can fill the queue up
and make you look like a spammer. Some mail servers will rate limit a sender,
especially if they haven't set up mechanisms by which they can be trusted.</p>
<p>To remove items from the mail queue by ID, run</p>
<pre><code class="language-bash"># If you don't pass &#x3C;ID> it will delete the all.
postsuper -d &#x3C;ID>
</code></pre>
<h3>Outlook is blocking your emails</h3>
<p>If you get a 500 error from outlook.*, it could need a connector or a rule
exception for the filter. I haven't tested the connector.</p>
<ul>
<li><a href="https://docs.sophos.com/central/Customer/help/en-us/central/Customer/tasks/bypassingexchange.html">Disable the spam filter</a></li>
<li><a href="https://docs.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail">Use a connector (not tested)</a></li>
</ul>
<h1>Other References</h1>
<ul>
<li><a href="https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-postfix-as-a-send-only-smtp-server-on-ubuntu-16-04">Postfix install guide from Digital Ocean</a></li>
<li><a href="https://hostadvice.com/how-to/how-to-setup-postfix-as-send-only-mail-server-on-an-ubuntu-18-04-dedicated-server-or-vps/">Postfix setup guide from hostadvice.com</a></li>
<li><a href="http://www.postfix.org/BASIC_CONFIGURATION_README.html">Basic Postfix config referece</a></li>
<li><a href="http://www.postfix.org/postconf.5.html">Detailed Postfix config docs</a></li>
<li><a href="https://www.cyberciti.biz/faq/how-to-find-my-public-ip-address-from-command-line-on-a-linux/">Whats My IP from Curl</a></li>
<li><a href="https://tecadmin.net/ways-to-send-email-from-linux-command-line/">5 ways to send email from cli</a></li>
<li><a href="https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-dkim-with-postfix-on-debian-wheezy">DigitalOcean DKIM guide</a></li>
</ul>


<p>I owned some domain names that used godaddy.com as their registrar. With
Godaddy it takes <strong>forever</strong> for changes to propagate, which can be a real
problem when you need to update TXT records.</p>
<p>Cloudflare is awesome in that they're really affordable for domains, have
really nice CDN capabilities, don't charge you for "protection", and their DNS
changes replicate super fast.</p>
<p>Here's how to move a domain from Godaddy to Cloudflare.</p>
<h1>Steps</h1>
<h2>Unlock the Domain</h2>
<ol>
<li>Log into Godaddy</li>
<li>Go to <a href="https://dcc.godaddy.com/domains/">My Domains</a> and select your domain</li>
<li>Click "Edit" next to <code>Domain lock: On</code> to show the slider. Set it to "off".</li>
</ol>
<h2>Get your transfer authorization code</h2>
<ol>
<li>Log into Godaddy</li>
<li>Go to <a href="https://dcc.godaddy.com/domains/">My Domains</a> and select your domain</li>
<li>Click 'Transfer domain away from GoDaddy'</li>
<li>Continue with transfer</li>
<li>Skip whatever annoying ads they give you</li>
<li>Go to your email and get your registration code</li>
</ol>
<h2>Transfer the Domain to Cloudflare</h2>
<p>If you haven't added your site yet, add it now in Cloudflare. You need to add
the nameserver settings too before you can transfer it. This tripped me up,
since I hadn't redirected the nameservers from GoDaddy's default ones to
Cloudflare's yet.</p>
<ol>
<li>From Cloudflare's dashboard, go to Domain Registration</li>
<li>It should let you choose your domain here. If it says there are none
available, you haven't set up your existing domain with them yet.</li>
<li>Enter your auth code, click Confirm Authorization Codes</li>
<li>Fill out the contact info, Confirm and Finalize Transfer</li>
</ol>
<p>That's it, your domain is now transferred to Cloudflare</p>
<h1>References</h1>
<ul>
<li><a href="https://developers.cloudflare.com/registrar/transfer-instructions/godaddy/">Cloudflare transfer guide</a></li>
<li><a href="https://ca.godaddy.com/help/unlock-my-domain-for-transfer-410">GoDaddy unlock for xfer</a></li>
</ul>


Kyle Pericak

"It works in my environment"

Categories

Tags