Useful Commands
SME Server locale
By default the sme server 8 locale is ISO-8859-1
Apache Related Commands
Apache options to ibay
Expand httpd.conf template:
expand-template /etc/httpd/conf/httpd.conf sv h /service/httpd-e-smith
ou
/sbin/e-smith/expand-template /etc/httpd/conf/httpd.conf /usr/bin/sv h /service/httpd-e-smith
Restart httpd:
/etc/init.d/httpd-e-smith restart
or
sv t /service/httpd-e-smith
To leave Apache reads the distributed configuration file .htaccess per ibay:
db accounts setprop IBAYNAME AllowOverride All signal-event ibay-modify IBAYNAME
if you want to remove
db accounts delprop IBAYNAME AllowOverride signal-event ibay-modify IBAYNAME
enable Symlinks in that iBay
db accounts setprop IBAYNAME FollowSymLinks enabled signal-event ibay-modify IBAYNAME
if you want to remove
db accounts delprop IBAYNAME FollowSymLinks signal-event ibay-modify IBAYNAME
disable apache directory indexes per ibay:
db accounts setprop IBAYNAME Indexes disabled signal-event ibay-modify IBAYNAME
if you want to remove
db accounts delprop IBAYNAME Indexes signal-event ibay-modify IBAYNAME
PHPBaseDir per ibay:
db accounts setprop IBAYNAME PHPBaseDir /home/e-smith/files/ibays/IBAYNAME/:/tmp/ signal-event ibay-modify IBAYNAME
Allow PHP URL File Open per ibay:
Make custom httpd directory if not exist
mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf
Create the template name 99allow_url_fopen and put the content
<Directory /home/e-smith/files/ibays/IBAYNAME/html> php_admin_flag allow_url_fopen on </Directory>
Save the file
Expand
expand-template /etc/httpd/conf/httpd.conf
Restart httpd.
/etc/init.d/httpd-e-smith restart
https forced redirection using custom template
If it does not already exist then create the following directory
mkdir -p /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/VirtualHosts
cd /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf/VirtualHosts
nano 60redir-ibayname1
Paste or type the following code including the brackets, replacing ibayname with the name of your ibay
{
if ($port ne "443")
{
$OUT .= <<'HERE';
## Redirect Web Address to Secure Address
RewriteEngine on
RewriteRule ^/ibayname https://%{HTTP_HOST}/ibayname
## End Of Redirect
HERE
}
}
Save the file & exit by Ctrl+x
/sbin/e-smith/expand-template /etc/httpd/conf/httpd.conf
/etc/init.d/httpd restart
Command-Line Quick Reference Guide
Below is a list of commands that I use all the time & tend to forget.
Generic Linux
| COMMAND NAME | DESCRIPTION |
|---|---|
| df -h | shows disk usage in human readable form |
| man <commandname> | shows more info about a command |
| uname -a | kernel release version |
| /usr/sbin/smbd -V | samba version |
| /usr/sbin/httpd -v | apache version |
| mysql -v | mysql version |
| php -v | php version |
| mv | moves or renames a file |
| cp | copies or backup a file |
| rm | removes or deletes a file |
| grep <process> | outputs processes running <process> |
| ps -AH | report process status |
| top | shows processes |
| top -i | shows only active processes |
| htop | shows processes (more versatile than top) |
| iptraf | shows network info |
| mc -d | show midnight commander (cli file browser) to navigate through system easily |
| cat /proc/mdstat | shows software raid |
| host -t mx aol.com | shows the mx records for aol.com |
| net groupmap list | shows samba mappings to nt groups |
| telinit 1 | changes to single user mode |
| ifconfig | shows detailed info on ethernet ports |
| grep -r "casesensitivesearch" * | finds all documents containing the criteria in a dir |
| tail -f /var/log/<LOGFILE> | realtime viewing of your log file |
| hdparm -Tt /dev/mdx (where x is 0,1,2,etc) | shows software raid performance |
| mdadm --detail /dev/mdx (where x is 0,1,2,etc) | gives raid info |
| tar -czvf foo.tar.gz foo | creates a tar/zip file of a directory |
| tar -xvzf foo.tar.gz | untar/unzip a tar/zip file |
| scp -P <ssh_portnumber> foo.tar.gz <user>@<other_server_ipaddress>:/opt | transfers file to another server in /opt directory |
| rsync --progress -te "ssh -p <ssh_portnumber>" foo <other_server_ipaddress>:/opt | transfers file to another server |
| sed -i s/foo/fee/g <FILENAMEORPATHTODIR> | replaces foo with fee |
| watch mysqladmin process | shows the mysql processes running |
Estimate file space usage - drill down into directories
cd / du --si --max-depth 1 cd /home du --si --max-depth 1 cd /home/e-smith du --si --max-depth 1
display what are your network interfaces
# perl -Mesmith::ethernet -e "print esmith::ethernet::probeAdapters();" EthernetDriver1 e1000 08:00:27:23:85:a6 "Intel Corporation 82540EM Gigabit Ethernet Controller (rev 02)"
create missing group and set gid
If a specific sme group or linux group is missing, you can create it again. see bugzilla:7932#c48
groupadd -g 102 -o apache rpm --setperms rpm1 rpm2 rpm --setugids rpm1 rpm2
where 102 is the correct gid of apache group, adapt it to the right setting where rpm1 and rpm2 are valid rpm but broken due to the lack of apache group during installation or upgrade
RPM's
| Command | Explanation |
|---|---|
| rpm -qa | shows all rpms installed |
| rpm -qa --last | shows all rpms installed & installation date |
| rpm -q | asks for rpm info |
| rpm -qi | asks for detailed rpm info |
| rpm -ql <packagename> | lists all files in a package |
| rpm -qf <filename> | reports what package a file belongs to |
| rpm -qV <packagename> | reports if permission and ownership are OK |
| rpm --setugids <packagename> | set right ownership to rpm |
| rpm --setperms <packagename> | set right permissions to rpm |
| rpm -Va | capture any damaged/incomplete rpms - but will also show lots of configuration files, which you of course expect to be modified. |
Restore all permissions and ownership
If you want to restore all permissions and right ownership of rpm, you can do this in a root terminal. See bugzilla:6851#c15
for f in $(rpm -qa); do echo $f; rpm --setugids $f; done for f in $(rpm -qa); do echo $f; rpm --setperms $f; done
YUM'ing and repositories
| Command | Explanation |
|---|---|
| yum install <packagename> | installs packagename & any package it may need |
| yum remove <packagename> | removes packagename |
| yum list updates | list updates to any installed package |
| yum list available | list available packages in all repos not already installed |
| grep <reponame> | list available packages -shows only from repo name |
| yum search <packagename> | lists all packages in all repos matching packagename |
| yum clean all | Is used to clean up various things which accumulate in the yum cache |
| yum --enablerepo=<reponame> <command> | enables a repo not normally enabled |
| /sbin/e-smith/audittools/newrpms | shows all extra packages installed |
| /sbin/e-smith/audittools/repositories | show all repositories and if they are activated or not |
| db yum_repositories show <reponame> | show properties of the repository <reponame> (you may use TAB to auto-complete your command line) |
Restoring Default Yum Repositories
cd /home/e-smith/db/ mv yum_repositories yum_repositories.po /etc/e-smith/events/actions/initialize-default-databases
Now you have a clean install, you can re-add 3rd party repos as described above
signal-event yum-modify
and check if you can update your server
yum update
LDAP
Display LDAP parameters
you can display LDAP parameters, either by the server-manager or by the command line :
ldapsearch -x -h localhost -s base |grep 'dn'
Log
Parse Log to find errors
When you want to test the SME Product it can be useful to see what it occurs This CL can help you, but you should read the entire log
less /var/log/messages| grep -iE "useless|uninitialized|warn|fail|error|disable|unable|exit"
of course this is for the /var/log/messages
Parse all Logs to find errors
Parse all logs and write the output to a file text named with the date of day. For example log012214
find /var/log/ -mtime -2 -print -exec sh -c 'cat "{}" | tai64nlocal | egrep -i "useless|warn|fail|error|disable|remov|unable|exit"' \; > "log$(date +'%m%d%y')" 2>&1
see Email
check blocked email address by the server
grep -i 'blocked email address' /var/log/qpsmtpd/current
maximum email size
Spam filter with Server-Manager
Using the Server-Manager Configuration/E-Mail panel, adjust the settings to these reasonable defaults.
- Virus scanning Enabled
- Spam filtering Enabled
- Spam sensitivity Custom
- Custom spam tagging level 4
- Custom spam rejection level 12
- Sort spam into junkmail folder Enabled
- Modify subject of spam messages Enabled
spam retention in junk mailbox
The server will automatically delete old spam in the junkmail folders after 90 days. You can control the number of days old spam is kept with the following commands. Where 15 is the number of days you want to keep messages, do...
db configuration setprop spamassassin MessageRetentionTime 15 signal-event email-update svc -t /service/qpsmtpd
then config show spamassassin
Mail Statistics
See Mailstats for details on the mailstats package.
yum install --enablerepo=smecontribs smeserver-mailstats
Whitelist and Blacklist
If mail comes in and it is misclassified as spam, you can add the sender to the whitelist so that future messages coming in from that sender are not filtered. Conversely, you can add a spammer to the blacklist so you never see their spam again. Add senders (or their entire domains) to the global whitelist (or blacklist) with commands similar to these (as root):
db spamassassin setprop wbl.global *@vonage.com White db spamassassin setprop wbl.global *domain2.com White db spamassassin setprop wbl.global user@domain3.com White db spamassassin setprop wbl.global spammer@spamdomain.com Black
expland template and save the configuration to the database
expand-template /etc/mail/spamassassin/local.cf svc -t /service/spamd
You can view the lists with this command:
db spamassassin show
MySQL
There appears to be no password set for the MySQL root password, but this is not true. If you are logged in to the SME Server shell a special mechanism is in place to log you in with MySQL root privileges without prompting you for the password.
The MySQL root password for SME Server is a 72 character random string generated during installation of SME Server. You should never change the MySQL root password as this will break your SME Server configuration. How to login as MySQL root user? describes how to access MySQL with root privileges on SME Server.
For more informations you can see the MySQL page
Login as MySQL root user
To login as MySQL root user, simply type 'mysql' at the SME Server shell, this will log you in with root privileges. the mysql admin password is a random password generated which can be find
- /root/.my.cnf
- /etc/ldap.secret
do not modify these files.
if you need to call the mysql password in a script you can invoke this bash variable
PWD=$(cat /etc/ldap.secret)
Create a Database and its User
Create a new MySQL database (In this example the database name is databasename. Change databasename, username and password with your own choices as required)
Login as root and issue the following command:
mysql create database databasename; grant all privileges on databasename.* to username identified by 'password'; flush privileges; exit
Remove a database
Get access to the SME Server shell and MySQL and issue the following command:
drop database databasename;
Replace databasename with the name of the database.
Remove a user
Get access to the SME Server shell and MySQL and issue the following command:
USE mysql; DELETE FROM user WHERE user = 'username'; FLUSH PRIVILEGES;
Replace username with the username you wish to delete.
Other useful MySQL commands:
show databases;
list all available database.
SELECT user FROM mysql.user;
display a list of the MySQL users
SHOW GRANTS FOR 'user'@'localhost';
list the privileges granted to the account user
GRANT ALL PRIVILEGES ON *.* TO 'new_dba'@'localhost' IDENTIFIED BY 'password' WITH GRANT OPTION; FLUSH PRIVILEGES;
give all rights on all databases for new_dba user
GRANT SELECT, UPDATE, INSERT, DELETE ON database.* TO 'new_user'@'localhost' IDENTIFIED BY 'password'; FLUSH PRIVILEGES;
give all rights on database for new_user
mysqladmin drop databasename;
will let you destroy a database. Use with care. Use 'mysqladmin --help' for all available options.
Password
Password strength
First a warning - Far too many systems out there have weak passwords and they will be broken into. Educating your users on the necessity of strong passwords is the best option. If that fails, here is how you change the password strength checking from 'strong' to 'normal', which was the setting in previous versions of SME. Be careful to use the exact capitalization.
config setprop passwordstrength Admin normal config setprop passwordstrength Users normal config setprop passwordstrength Ibays normal
It is also possible, but strongly discouraged, to disable password strength checking by setting to 'none'
none : no check is performed on the password normal : the password must be composed of at least seven characters with uppercase and lowercase letters, numbers and non-alphanumeric characters strong : the restrictions are the same as for the normal level, but in addition, the password is verified by cryptlib which ensures its actual complexity
Change Password Users by the command line
If you want to change password to your users by the command Line instead of the user panel of SME Server you can do it like this.
perl -e "use esmith::util;esmith::util::setUserPassword( 'username', 'password');"; /sbin/e-smith/signal-event password-modify username
run it for each user separately and replace
username
and
password
with the appropriate values for each of your users.
Signalling events : Signal-event
The signal-event program takes an event name as an argument, and executes all of the actions in that event, providing the event name as the first parameter and directing all output to the system log. It works by listing the entries in the event directory and executing them in sequence. So for example, the command:
signal-event console-save
will perform all the actions associated with the console-save event, which is defined by the contents of the /etc/e-smith/events/console-save/ directory. This is exactly what the console user interface does when you select save at the end of the console configuration wizard.
PHP Related Commands
Show current php settings
config show php
Expand php.ini template
expand-template /etc/php.ini
Configure PHP Basedir Restriction per ibay
db accounts setprop IBAYNAME PHPBaseDir DIR1:DIR2:DIRn signal-event ibay-modify IBAYNAME
Example
db accounts setprop Primary PHPBaseDir /home/e-smith/files/ibays/Primary:/tmp signal-event ibay-modify Primary
Configure PHP UploadDir Restriction per ibay
db accounts setprop IBAYNAME PHPUploadDir DIR1:DIR2:DIRn signal-event ibay-modify IBAYNAME
Example
db accounts setprop Primary PHPUploadDir /home/e-smith/files/ibays/Primary/tmp signal-event ibay-modify Primary
Execution Time
db configuration setprop php MaxExecutionTime ZZ expand-template /etc/php.ini /etc/init.d/httpd-e-smith restart
where ZZ is the time in seconds.
Memory Limit
db configuration setprop php MemoryLimit XXM expand-template /etc/php.ini /etc/init.d/httpd-e-smith restart
where XX is the amount of memory in Mb.
Upload Max File Size
db configuration setprop php UploadMaxFilesize WW expand-template /etc/php.ini /etc/init.d/httpd-e-smith restart
where WW is the file size in Mb.
Allow URL FOpen
Not secure. Instead use per ibay or directory.
SME Server specific
| Command | Explanation |
|---|---|
| signal-event post-upgrade | performs SME Server to go regenerate all templates |
| signal-event reboot | reboots the server |
| signal-event <event> | performs SME Server to go regenerate event template (you may use TAB to auto-complete your command line) |
| signal-event console-save | Expands templates and reconfigures services which can be changed from the text-mode console and which do not require a reboot |
| signal-event dns-update | refreshes the DNS cache, useful for when you know a domain has changed IP and the TTL is too long to wait |
| /etc/e-smith/events/actions/navigation-conf | recreates server-manager navigation panel |
| config show | display the internal configuration of the server |
| config show <service name> | show the service configuration (you may use TAB to auto-complete your command line) |
| db | shows the syntax of the db command |
| db configuration show | shows the entire server configuration |
| db configuration setprop <record> <property> <value> | sets or changes a property in the configuration database |
| db accounts show | shows all account details |
| db accounts show <accountname> | shows the account details |
| /etc/e-smith/events/actions/initialize-default-databases | action for initializing the default database values |
db command
you can see this page of the wiki DB_Variables_Configuration
Setting db variables to default values
Any db variable that has a default value can be reset to the default by deleting the variable entirely, then re-initializing the default database values as follows:
config delprop <key> <prop> /etc/e-smith/events/actions/initialize-default-databases
Delete a property value
To delete the property
db accounts delprop <key> <prop>
Reset a property value
To reset to an empty value
db accounts setprop <key> <prop> ''
Give a shell access to "user"
db accounts setprop user Shell /bin/bash signal-event user-modify user
Give some external or internal access permissions to foo service
config setprop foo PublicAccess OPTION signal-event console-save
OPTION is either of the following.
none => No access
local => Local network (no password required)
local-pw => Local network (password required)
global => Entire Internet(no password required)
global-pw => Entire Internet(password required)
global-pw-remote => Entire Internet(password required outside local network)
General Service Handling
- start
sv u /service/servicename
- stop
sv d /service/servicename
- restart
sv t /service/servicename
Example
Restarting:
sv t /service/httpd-e-smith
Squid Cache
Extracted from: http://forums.contribs.org/index.php?topic=38848.msg176737#msg176737
Flush and Restart
sv d /service/squid echo "" > /var/spool/squid/swap.state sv u /service/squid
& to check it's running
sv s /service/squid
SSH
Enable SSH
- Enable ssh access (the lazy not-so-secure way, but I am assuming for this testing/dev scenario that your external IP is really a local address behind a router)
db configuration setprop sshd status enabled
db configuration setprop sshd PermitRootLogin yes
db configuration setprop sshd acccess public
db configuration setprop sshd PasswordAuthentication yes
/sbin/e-smith/signal-event remoteaccess-update
- Allow ssh in public or private mode : public= all internet private= only your network
db configuration sshd access public signal-event remoteaccess-update
Access to the terminal of your remote sme
ssh root@ip-sme-or-remote-hostname
or
ssh -pX root@ip-sme-or-remote-host (X is the port listened by ssh service)
Execute or run a command over ssh to a remote server and auto disconnect after quit
ssh -t root@ip-sme-or-remote-hostname command
where 'command' is the program or command to run. An example could be:
ssh -t root@192.168.1.5 top
Access to the server-manager through SSH
We can access to the server-manager of your remote SME Server by SSH with a tunneling protocol initiated by "ssh -L". This command has to be done by a superuser in a Terminal like if you want to be connected to your SME Server by SSH.
Do this in a root terminal of your Linux computer outside of your network
ssh -L 443:localhost:443 root@your-static-external-network-IP-or-host.dyndsn.org
host.dyndsn.org could be a free service as dyndns.org or noip.com
Keep the terminal open, Then you need to use this specific URL in your WEB Browser to go to the server-manager
https://localhost/server-manager
Access with non standard ports
In certain cases which you are not root on the local computer, you can not redirect port < 1024, so you have to use port > 1024 as the example below.
ssh -L 9443:localhost:443 root@your-remote-ip -p 22
9443 : local port 443 : remote https port your-remote-ip : the remote host (could be an ip or a domain name) 22 : this is the port where the ssh server is listening, you can change it in accordance with the remote server
Keep the terminal open, Then you need to use this specific URL in your WEB Browser to go to the server-manager
https://localhost:9443/server-manager
