Difference between revisions of "SME Server:Documentation:FAQ:Section01"

Centos - os

linux all-generic-ide

CentOS - os
CentOS - updates
SME Server - addons
SME Server - extras
SME Server - os
SME Server - updates.

/sbin/e-smith/audittools/repositories

base: enabled
updates: enabled
smeaddons: enabled
smeextras: enabled
smeos: enabled
smeupdates: enabled

yum update dbus dbus-glib smeserver-support smeserver-yum yum yum-plugin-fastest-mirror python-sqlite 
signal-event post-upgrade; signal-event reboot

signal-event post-upgrade; signal-event reboot

Warning: The SSH and rkhunter configuration options should be the same:
        SSH configuration option 'PermitRootLogin': yes
        Rkhunter configuration option 'ALLOW_SSH_ROOT_USER': no

rpm -e rkhunter

yum install smeserver-rkhunter --enablerepo=smecontribs

config setprop yum check4updates weekly;signal-event yum-modify

config setprop yum check4updates monthly;signal-event yum-modify

config delprop yum check4updates;signal-event yum-modify

yum clean metadata
or
yum clean all --enablerepo=*
then 
yum update

http://apt.sw.be/fedora/3/en/i386/dag/repodata/primary.xml.gz: 
[Errno -1] Metadata file does not match checksum Trying other mirror.
Error: failure: repodata/primary.xml.gz from dag: [Errno 256] No more mirrors to try.

wget --cache=off http://apt.sw.be/fedora/3/en/i386/dag/repodata/filelists.xml.gz
wget --cache=off http://apt.sw.be/fedora/3/en/i386/dag/repodata/primary.xml.gz
wget --cache=off http://apt.sw.be/fedora/3/en/i386/dag/repodata/repomd.xml
yum update

---> Downloading header for php-mysql to pack into transaction set.
php-mysql-4.3.9-3.22.15.i 100% |=========================|  37 kB    00:00
http://sme-mirror.firewall-services.com/releases/7/smeupdates/i386/RPMS/php-mysql-4.3.9-3.22.15.i386.rpm: [Errno -1] Header is not complete.
Trying other mirror.

rpm -qa | sort | less 

rpm -e --nodeps rpmname

yum install rpmname
signal-event post-upgrade; signal-event reboot

db yum_repositories delete repositoryname
signal-event yum-modify

db yum_repositories setprop repositoryname status disabled
signal-event yum-modify

yum update --enablerepo=reponame  packagename

rpm -e rpmname

RoundUpWriteTimeOnSync
HKLM\Software\Microsoft\Windows\CurrentVersion\NetCache
 yum install mod_perl
 config setprop modPerl status enabled
 signal-event post-upgrade ; signal-event reboot

 db accounts setprop //ibayname// Indexes disabled 
 signal-event ibay-modify //ibayname// 

db accounts setprop ibayname PHPBaseDir /tmp/:/home/e-smith/files/ibays/ibayname/
signal-event ibay-modify ibayname

  single

 passwd root
 passwd admin

db domains setprop test.com Nameservers a.b.c.d
signal-event domain-modify

cat /var/service/dnscache/root/servers/test.com

db domains set <domainname> domain-remote Nameservers 4.2.2.1
signal-event domain-modify

db domains set <domainname> domain-remote Nameservers localhost
signal-event domain-modify

config setprop clamav FilesystemScanFilesystems /home/e-smith/files

config setprop clamav FilesystemScanFilesystems "/home/e-smith/files /opt"

 config setprop clamav FilesystemScanExclude /proc,/sys,/usr/share,/var

config setprop clamav FilesystemScanExclude /proc,/sys,/usr/share,/var,/home/e-smith/files/ibays

signal-event clamav-update

db domains set proxypassdomain.com domain 
db domains setprop proxypassdomain.com Nameservers internet
db domains setprop proxypassdomain.com ProxyPassTarget http://xxx.xxx.xxx.xxx/
db domains setprop proxypassdomain.com TemplatePath ProxyPassVirtualHosts 
signal-event domain-create proxypassdomain.com

db domains delete proxypassdomain.com
signal-event domain-delete proxypassdomain.com

/etc/e-smith/templates/etc/httpd/conf/httpd.conf/ProxyPassVirtualHosts

cp -R /etc/e-smith/templates/etc/httpd/conf/httpd.conf/ProxyPassVirtualHosts /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/MyProxyPassHost

db domains setprop proxypassdomain.com TemplatePath MyProxyPassHost

db accounts set extra ProxyPass
db accounts setprop extra Target http://192.168.1.35
db accounts setprop extra Description InternalServer
db accounts setprop extra HTTP on
db accounts setprop extra HTTPS on
db accounts setprop extra ValidFrom 80.90.100.0/24,74.125.93.105
expand-template /etc/httpd/conf/httpd.conf
sv t httpd-e-smith

mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf
cd /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf
echo '# ProxyPass Support for Internal Exchange Server
        ProxyPreserveHost On
        #OWA % character in email subject fix
        RewriteEngine On
        RewriteMap percentsubject int:escape
        RewriteCond $1 ^/exchange/.*\%.*$
        RewriteRule (/exchange/.*) ${percentsubject:$1} [P]
        #OWA
        ProxyPass /exchange https://a.b.c.d/exchange
        ProxyPassReverse /exchange https://a.b.c.d/exchange
        ProxyPass /Exchange https://a.b.c.d/exchange
        ProxyPassReverse /Exchange https://a.b.c.d/exchange
        ProxyPass /exchweb https://a.b.c.d/exchweb
        ProxyPassReverse /exchweb https://a.b.c.d/exchweb
        ProxyPass /public https://a.b.c.d/public
        ProxyPassReverse /public https://a.b.c.d/public
        ProxyPass /iisadmpwd https://a.b.c.d/iisadmpwd
        ProxyPassReverse /iisadmpwd https://a.b.c.d/iisadmpwd
        #OMA
        ProxyPass /oma https://a.b.c.d/oma
        ProxyPassReverse /oma https://a.b.c.d/oma
        #ActiveSync (for WM5+ devices)
        ProxyPass /Microsoft-Server-ActiveSync https://a.b.c.d/Microsoft-Server-ActiveSync
        ProxyPassReverse /Microsoft-Server-ActiveSync https://a.b.c.d/Microsoft-Server-ActiveSync
        #Force 'RequestHeader' in order to get IE to work
# End of Exchange settings
' > 91ProxyPassOWA
expand-template /etc/httpd/conf/httpd.conf
sv restart httpd-e-smith

# Forward remote.domainA.com to iis.private.local
 <VirtualHost 0.0.0.0:80>
 ServerName remote.domainA.com
 ProxyPass / http://iis.private.local/
 ProxyPassReverse / http://iis.private.local/
 </VirtualHost>
 <VirtualHost 0.0.0.0:443>
 ServerName remote.domainA.com
 ProxyPass / https://iis.private.local/
 ProxyPassReverse / https://iis.private.local/
# Preserve meta info in the http line as a resolvable request
 ProxyPreserveHost On
#OWA % character in email subject fix
 RewriteEngine On
 RewriteMap percentsubject int:escape
 RewriteCond $1 ^/exchange/.*\%.*$
 RewriteRule (/exchange/.*) ${percentsubject:$1} [P]
#OWA
 ProxyPass /exchange https://iis.private.local/exchange
 ProxyPassReverse /exchange https://iis.private.local/exchange
 ProxyPass /owa https://iis.private.local/owa
 ProxyPassReverse /owa https://iis.private.local/owa
 ProxyPass /Exchange https://iis.private.local/exchange
 ProxyPassReverse /Exchange https://iis.private.local/exchange
 ProxyPass /exchweb https://iis.private.local/exchweb
 ProxyPassReverse /exchweb https://iis.private.local/exchweb
 ProxyPass /public https://iis.private.local/public
 ProxyPassReverse /public https://iis.private.local/public
 ProxyPass /iisadmpwd https://iis.private.local/iisadmpwd
 ProxyPassReverse /iisadmpwd https://iis.private.local/iisadmpwd
#OMA
 ProxyPass /oma https://iis.private.local/oma
 ProxyPassReverse /oma https://iis.private.local/oma
#ActiveSync (for WM5+ devices)
 ProxyPass /Microsoft-Server-ActiveSync https://iis.private.local/Microsoft-Server-ActiveSync
 ProxyPassReverse /Microsoft-Server-ActiveSync https://iis.private.local/Microsoft-Server-ActiveSync
# End of Exchange settings
</VirtualHost>

expand-template /etc/httpd/conf/httpd.conf
sv restart httpd-e-smith

db domains set <domainname> domain-remote Nameservers a.b.c.d
signal-event domain-modify

db domains set <domainname> domain-remote Nameservers localhost
signal-event domain-modify

server-manager -> Security -> Remote Access

db accounts setprop username Shell /bin/bash
chsh -s /bin/bash username

/sbin/e-smith/db configuration set maxIbayNameLength xx
/sbin/e-smith/db configuration set maxAcctNameLength xx
/sbin/e-smith/db configuration set maxGroupNameLength xx

/sbin/e-smith/signal-event console-save

signal-event user-delete <username>
db accounts delete <username>

signal-event ibay-delete <ibayname>
db accounts delete <ibayname>

signal-event group-delete <groupname>
db accounts delete <groupname>

Workaround: log out after creating the group and then log back in

perl -e "use esmith::util;esmith::util::setUserPassword( 'username', 'password');";  /sbin/e-smith/signal-event  password-modify username

username

password

config setprop passwordstrength Admin strengthvalue
config setprop passwordstrength Users strengthvalue
config setprop passwordstrength Ibays strengthvalue

config setprop passwordstrength Users normal

config show passwordstrength

passwordstrength=configuration
 Admin=strong
 Ibays=strong
 Users=strong

config setprop flexbackup TapeBlocksize 512

config setprop flexbackup Blocksize 256
config setprop flexbackup BufferMegs 16

config set PasswordSet no 
signal-event post-upgrade; signal-event reboot 

-NOW plug in the usb drive (Do not plug in the usb drive until you reach this point).
-pick YES or RESTORE (or whatever is presented to you)

ps ax |grep runsv

man sv

signal-event post-upgrade;  signal-event reboot

rm /home/e-smith/ssl.key/*.key
rm /home/e-smith/ssl.pem/*.pem
rm /home/e-smith/ssl.crt/*.crt
signal-event domain-modify; signal-event reboot

ssh -L 443:localhost:443 root@ip-sme-or-hostname-sme

https://localhost/server-manager/

ssh -L 9443:localhost:443 root@your-remote-ip -p 22

9443 : local port
443 : remote https port
your-remote-ip : the remote host (could be an ip or a domain name)
22 : this is the port where the ssh server is listening, you can change it in accordance with the remote server

https://localhost:9443/server-manager

-login to the shell console
-type: db hosts setprop <local.mycompany.local> static no
-go to the HOSTNAMES & ADDRESSES panel and you should be able to modify/remove the name

yum install kernel-smp kmod-ppp-smp kmod-slip-smp kmod-appletalk-smp
signal-event post-upgrade
signal-event reboot

db configuration setprop smb UnixCharSet ISO8859-1
expand-template /etc/smb.conf
/etc/init.d/smb restart

config set SquidParent a.b.c.d
config set SquidParentPort nnn
signal-event post-upgrade
signal-event reboot

mkdir -p /etc/e-smith/templates-custom/etc/yum.conf
cd /etc/e-smith/templates-custom/etc/yum.conf
echo '{
    my $YumProxy = $yum{'Proxy'} || "none";
    $OUT = ($YumProxy eq "none") ? "" : "proxy=$YumProxy";
}' > 10main_proxy
config setprop yum Proxy http://localhost:3128/
expand-template /etc/yum.conf

http://localhost:3128
/etc/e-smith/templates/etc/freshclam.conf/ProxySettings
config setprop clamav HTTPProxyServer localhost
config setprop clamav HTTPProxyPort 3128
config setprop clamav HTTPProxyUsername ""
config setprop clamav HTTPProxyPassword ""
expand-template /etc/freshclam.conf
sv t freshclam

[root@gateway0 ~]# freshclam
ClamAV update process started at Mon Nov 12 09:22:00 2012
main.cvd is up to date (version: 54, sigs: 1044387, f-level: 60, builder: sven)
daily.cvd is up to date (version: 15564, sigs: 284901, f-level: 63, builder: guitar)
bytecode.cld is up to date (version: 191, sigs: 37, f-level: 63, builder: neo)

[LibClamAV] Detected duplicate databases /var/clamav/daily.cvd and /var/clamav/daily.cld, please manually remove one of them
[LibClamAV] Detected duplicate databases /var/clamav/main.cvd and /var/clamav/main.cld, please manually remove one of them

export http_proxy='http://localhost:3128'
export http_proxy=localhost:3128

export http_proxy=localhost:3128
curl http://www.google.com

export http_proxy=localhost:3128
curl http://www.google.com

/var/log/squid/access.log:
1329759611.923     64 127.0.0.1 TCP_MISS/301 726 GET http://www.google.com - DIRECT/74.125.113.94 text/html

@@ Line 6: / Line 6: @@
 If you have validated the disk and are sure that the disk passes you might try to add the all-generic-ide option to the boot prompt before starting the installer like this:
   linux all-generic-ide
+==Installing with encrypted filesystem - SME10==
+In the installer for SME10, the option is given to modify the partitions created automagically.  If you go into the (manual) partition edit screen then there is a tick box for the mainroot partition "encrypt data". If you tick then "update" then "done", then after allowing the installation to proceed it will ask for a passphrase. This is put in twice to verify it. Do not forget or lose this phrase else you will NOT be able to boot into your server.
+Once the installation is complete, then at the beginning of every boot the system will ask for the passphrase.  This means that you will always need a console on the server during the boot process.
 ==Yum Updates==
@@ Line 184: / Line 190: @@
 ==Windows Client Computers==
+{{Warning box|msg=All versions of Windows prior to versions 10 and 8.1 are unsupported by Microsoft unless you are paying them directly for support. Version 10 is a rolling edition which is continuously updated, so even early version of Windows 10 without updates are unsafe to use. Windows 8.1 is in limited "extended support" until January 20, 2023. Whatever our opinions of this situation may be, '''versions of Windows previous to v.8.1 are not safe to use on the public internet.''' We cannot support use of Windows previous to v.8.1. If you have an application that only runs on an earlier version be sure to lock it down from access outside of your network.
+}}
 *Windows 7 support for SME Server 8. See [[Windows_7_Support]]
 Actually the SME Server 8.0 allows this windows client to reach the SME Server domain, Be aware you have to import the registery patch which you can download at http://your-sme-server/server-resources/regedit
@@ Line 267: / Line 275: @@
 ==Reset the root and admin password==
+=== For versions previous to 10 ===
 . Restart your server and at the beginning of the boot-up use the arrow keys to select the kernel you would like to boot into.
@@ Line 281: / Line 290: @@
    passwd admin
 Reboot your server and everything should be okay now.
+=== For version 10 on ===
+# At boot use ESC to bring up the boot prompt.
+# At the boot prompt, use E to enter edit mode.
+# Find the kernel line which starts with '''linux16'''.
+# Alter '''ro''' to '''rw init=/sysroot/bin/sh'''. The rest of the line after that can be left as-is.
+# Use either CTRL+X or F10 to boot into single user mode.
+# Change root to the system by issuing: '''chroot /sysroot'''.
+# Type '''passwd''' and follow the prompts to change the root password.
+# Type '''passwd admin''' and follow the prompts to change the admin password. This and the root password must both be the same.
+# Run '''reboot -f''' or ctrl-alt-del to reboot the server.
 ==File Size Limitations==

setting explanation
strong	The password is passed through Cracklib for dictionary type word checking as well as requiring upper case, lower case, number, non alpha and a mimimum length of 7 characters.
normal	The password requires upper case, lower case, number, non alpha and a minimum length of 7 characters.
none	The password can be anything as no checking is done. Please note that "none" does not mean no password, it just means no password strength checking, so you can enter any (weak) password you want as long as it is at least 7 characters long.

	Note:
	A system installed from the SME 7.1 CD will have the 5 repositories above enabled. A system installed from the SME 7.0 iso and updated to 7.1 or later will only have the 3 SME Server repositories enabled. After updating from SME 7.0 to SME 7.1.x you should enable the Centos - os & Centos - updates repositories in server-manager.

	Note:
	If you have added the internal or external server's domain name as a virtual domain on the SME Server, you must remove it prior to issuing these commands. The server-manager domains panel will show the proxy pass entry but you will not be able to edit it, see ~~bugzilla:1612~~

	Warning:
	It is strongly advised not to set the password strength setting to none as this will lower the security of your server significantly.

	Note:
	PAM module requires passwords to be at least 6 characters long, so setting a password that is shorter than that may cause other problems later. SME server default settings enforce 7 character passwords.

	Note:
	ssh, ftp and telnet do not work via an http "upstream" proxy, although they may work in conjunction with tsocks (available from the dag repository)

Difference between revisions of "SME Server:Documentation:FAQ:Section01"

Latest revision as of 20:44, 3 June 2021

Installer prompts for installation file location

Installing with encrypted filesystem - SME10

Yum Updates

Which repositories should be enabled

Reconfigure / post-upgrade and reboot

Updating from SME 7.x to SME 7.2

Warning in rkhunter email report

Frequency

General

Adding, removing or disabling repositories

Other popular repositories

Removing Software

Hardware Compatibility List

Windows Client Computers

Web Applications

Reset the root and admin password

For versions previous to 10

For version 10 on

File Size Limitations

External DNS

Domains

Delegate DNS

DNS Forwarding

Virus Scanning

Proxy Pass

ProxyPass a domain

ProxyPass a alias/directory/location

ProxyPass for Exchange Outlook Web Access

DNS Forwarding

Shell Access

Upgrading Server

Changing maximum Ibay, Account or Group name length

Deletion of Users Ibays Groups

Access denied to i-bay with newly created group

Change the User Password by command line

Password Strength Checking

Hard Drives, RAID's, USB Hard Drives

Backups & Restores

Supervised Services

Server-Manager

Booting with SMP kernel after upgrade to version 7.2 from CD

Special Characters

Upstream proxy server configuration

Browser Access from LAN Workstations

Yum (system updates)

ClamAV / freshclam

Spamassassin

curl, wget

ssh, ftp, telnet

Testing and Verification

Memory usage and limits

Navigation menu

Search