Tech Guide Archives

centos, collaboration, encrypted, manager, password, php, secure, sharing, ssl, syspass, team work, update, upgrade, work

Upgrade SysPass from 2.1 to 3.0

Hi Tech Guys,

SysPass It’s one of the best powerful Free and Open Source web application that provides a password management in a secure and collaborative way with intuitive web UI and several useful features.
More informations on the official website syspass.org.
In this tutorial are going to upgrade step by step from version 2.1 to 3.0, and if you installed previously with php 5.6, we will upgrade on version 7.0 because is supported from the application.
There are important changes in the version 3.0, a fully database structure change, “config” directory is moved off to “/app/config”, Composer PHP package manager is used to install and keep up-to-date sysPass dependencies.

Requirements:

-Centos 7.3 server with minimal hardware configuration (depends of your needs).
-Syspass version 2.1 installed.
-ROOT permission on server.
-Internet connection to download all needed packages.
-Good IT basic knowledge and a bit of patience…

Let’s Start!

Stop Apache web server before start, is not mandatory but we prefer to stop it so no one can use the application in the while.

systemctl stop httpd.service

Backup everything and if you can, snapshot your system (just in case).

There are three general ways to backup with mysqldump, choose what you prefer:

shell> mysqldump [options] db_name [tbl_name ...]
shell> mysqldump [options] --databases db_name ...
shell> mysqldump [options] --all-databases

move on /tmp (we backup twice, never enough):

mysqldump -p --all-databases > all_databases.sql

mysqldump -p syspass > syspass.sql

in additions for precautions save on your local pc, so execute those command with scp:

scp root@[syspass_srv_ip]:/tmp/all_databases.sql /(your local path for backup)

scp root@[syspass_srv_ip]:/root/syspass.sql /(your local path for backup)

copy /config folder on your pc

scp -r root@[syspass_ip]:/var/www/html/sysPass/config (your local path for backup)

and on /tmp as well so will be ready at copy time

cp /var/www/html/sysPass/config /tmp

(optional) If your bakup folder is populated and you wish to hold the previous folder, copy also the backup

cp /var/www/html/sysPass/backup /tmp

(optional) only if you have an old php version and would like to switch to 7.0 remove all older php pkgs

yum remove -y php*

once you can, and you are on it, update all server pkgs

yum update -y

install epel to get extras repository and utils tools

yum install epel-release yum-utils -y

and repo to download and activate php 7.0 pkgs, otherwise you will download last version not supported from syspass.

yum install http://rpms.remirepo.net/enterprise/remi-release-7.rpm

yum-config-manager --enable remi-php70

install all required php 7.0 pkgs

yum install php php-common php-opcache php-mcrypt php-cli php-gd php-curl php-mysql php-xml php-devel php-intl php-mbstring php-bcmath php-pdo php-ldap

also install this pkgs required from composer

yum install git zip unzip php7.0-zip -y

be sure maria db and apache are updated to latest version, once you touch the server

yum upgrade -y httpd mariadb-server mariadb

Move on /tmp, download last version of sysPass (if in the time a newer update of version 3 used in this tutorial was released, change the paths) decompress, remove all old folders (or rename if you are not sure) and move the new folder on apache html folder.

cd /tmp
wget https://github.com/nuxsmin/sysPass/archive/3.0.5.19020701.tar.gz
tar -xvzf 3.0.5.19020701.tar.gz
mv sysPass-3.0.5.19020701 sysPass
rm 3.0.5.19020701.tar.gz
rm -rf /var/www/html/sysPass
cp -rf sysPass /var/www/html/.
rm -rf /tmp/sysPass

Move the original syspass config folder that contain “config.xml”, “key.pem” , “pubkey.pem” and “syspass.log” if you want to keep old logs, to the new path

cp /tmp/config/* /var/www/html/sysPass/app/config/.

Change permission to whole folder

chown apache -R /var/www/html/sysPass
chmod 750 /var/www/html/sysPass/app/config /var/www/html/sysPass/app/backup

Be careful at /app/config because contain important information, however you can use .htaccess to make it not accessible to all world (if is on public network).

If selinux is not disabled and is in enforcing mode use those command to allow the program to write its configuration and some other files, so Change SELinux’s context and user

setsebool -P httpd_can_connect_ldap 1
chcon -R -t httpd_sys_rw_content_t /var/www/html/syspass/app/{config,backup,cache,temp}

Go back in the main app folder

cd /var/www/html/sysPass

Download and install composer PHP package manager, used to install and keep up-to-date sysPass dependencies

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "if (hash_file('sha384', 'composer-setup.php') === '48e3236262b34d30969dca3c37281b3b4bbe3221bda826ac6a9a62d6444cdb0dcd0615698a5cbe587c3f0fe57a54d8f5') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
php composer-setup.php
php -r "unlink('composer-setup.php');"
php composer.phar install --no-dev

In conclusion restart Apache service

systemctl start httpd.service

Point your browser to https://[ip_or_hostname]/sysPass/index.php or https://[ip_or_hostname]/sysPass/index.php?r=login

more information at official RTD official site

—>>> ENJOY!!! <<<—

ByYOBICLOUD TEAM

alternative, centos, integration, linux, monitoring, nagios, open-source, python, shinken, system administration

Shinken Monitoring v2.4.3 installation on centos 7+

Hi Tech Guys,
Shinken is a monitoring framework, one of the best open-source alternative to Nagios® Core, completely rewrited in python that enhancing flexibility and large environment management.
You can Keep your old Nagios® configuration and plugins if you willing to switch your monitoring system to Shinken.
More information on Official Shinken Monitoring website.
Requirements:
-Centos 7+ server with minimal hardware configuration (depends of your needs).
-ROOT permission on server.
-Internet connection to download all needed packages.
-Good IT knowledge and a bit of patience…

Let’s Start!

This time we will give you 2 possibility to install this software, the first is for lazy admins through a script and the second is for who love manual install, choose the way you like more!

1. Install with a script

We prepared a script (only for Centos 7+) that will update your system, download all required packages, add firewall exception, install last version of shinken, resolve some problems and run the webui2 module.

Download the shinken installation script for centos 7+

download MD5 hash

Compare it!

md5sum -c md5.text

If says OK, proceding with decompression of the tar archive, add the executions permission at the script and run automagic installation!

untar -xvzf shinkencentos7setup.tar.gz 
cd shinkeninstall
chmod +x shinkencentos7setup.sh
./shinkencentos7setup.sh

If everything will go smooth, login at “your IP or hostname” :7767 with default password admin/admin
This script will create a Centos user named “shinken” with pass “ShinPass”.

2. Install manually from sources

In this tutorial we are using a clean install of Centos 7.4, after setting up a static ip and hostname proceed to install required packages.
Install some useful packages, wget to download, network tools (always useful to troubleshoot network), htop to monitor the hardware and processes.

yum install wget net-tools htop

Install the mandatory packages requirements

 yum install -y epel-release
 yum install -y python-setuptools
 yum install -y redhat-lsb python-crypto mongodb mongodb-server httpd-tools openssl

Python 2.6 is the minimum version requirements but with 2.7 will get higher performance.
Check your version and decide which is the best for your installation:

python -V

Get Python-pycurl package for Shinken daemon communication

yum install python-pycurl

Add Python pip and update to last version for install setuptools or distribute Python package

yum install python-pip
pip install --upgrade pip
pip install setuptools

DEPRECATION: Python 2.7 will reach the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 won't be maintained after that date. A future version of pip will drop support for Python 2.7. Requirement already satisfied: setuptools in /usr/lib/python2.7/site-packages (0.9.8)

python-cherrypy3 (recommended) enhanced daemons communications, especially in HTTPS mode

yum install python-cherrypy

Monitoring Plugins (recommended) provides a set of plugins to monitor host (Shinken uses check_icmp by default install). Monitoring plugins are available on most linux distributions (nagios-plugins package) or manual download from here! in case of problems!
Some plugins require that you have additional programs and/or libraries installed on your system before they can be used.
Plugins that are dependent on other programs/libraries that are missing are usually not compiled.
Requirements for various plugins info and details are listed in this address.

yum install nagios-plugins

Start the Installation of Shinken Monitoring from sources!

After that, create a user and download last stable Shinken tarball archive (or get the latest git snapshot) extract it somewhere and install:

adduser shinken
passwd shinken

Choose and insert password

wget https://codeload.github.com/naparuba/shinken/tar.gz/2.4.3
tar -xvzf 2.4.3
cd shinken-2.4.3
python setup.py install

Install requirement from list with pip and initialize.

pip install -r https://raw.githubusercontent.com/shinken-monitoring/mod-webui/develop/requirements.txt
shinken --init

With shinken command install modules named webui2, simple-log add it in the /etc/shinken/brokers/broker-master.cfg with sed and re-init.

shinken install webui2
shinken install simple-log
sed -i 's/modules/modules                       simple-log,webui2/g' /etc/shinken/brokers/broker-master.cfg
shinken --init

Enable services at boot and start it

systemctl enable shinken
systemctl start shinken
systemctl enable mongod
systemctl start mongod

I had some problem to start shinken service, however i solved reading the systemctl output and if there are some text similarly or related path of $curpath, use the sed command (copy spaces also) above to correct it and re-run daemon and service!

sed -i 's+$curpath/../../var+$curpath/../../../var+g' /etc/rc.d/init.d/shinken
sed -i 's+$curpath/../../etc+$curpath/../../../etc+g' /etc/rc.d/init.d/shinken
systemctl daemon-reload
systemctl restart shinken

In conclusion, add firewall exceptions to access administration dashboard

firewall-cmd --zone=public --permanent --add-port=7767/tcp
firewall-cmd --reload

login at “your IP or hostname” :7767 with default password admin/admin

—>>> ENJOY!!! <<<—

ByYOBIHAT TEAM

centos, collaboration, communication, it, otrs, system, system administration, ticket, update

Update OTRS from v5.x.x+ to v6.x.x+ on centos7

Hi Tech Guys,

Sometimes OTRS need some care to be up-to-date and secure, than here you can find a right and easy way to update OTRS from v5 to v6 (IMPORTANT: only from any v5.x.x to any v6.x.x)

We recommend to test in a clone or test machine before to move and do any edit in a production environment (avoid disaster please).

The database migration from OTRS 5 to 6 performs significant changes to database tables and data. Be sure that there is enough storage space available to complete the migration. You cannot update from any OTRS version directly to OTRS 6. For example, if you come from OTRS 3.0, you first have to full update to OTRS 3.1, then to 3.2, 3.3, 4, 5 and finally to OTRS 6. If you have any custom Perl or XML configuration files in Kernel/Config/Files, these need to be converted to the new formats supported by OTRS 6 before running the migration script.

Requirements:

-Centos 7.3 server with minimal hardware configuration (depends of your needs).

-ROOT permission on server.

-Internet connection to download all needed packages.

-Good IT basic knowledge and a bit of patience…

Let’s Start!

Stop all services used by the ticketing system before proceding

systemctl stop crond
systemctl stop postfix
systemctl stop httpd

Move in the main path and stop daemon as otrs user

cd /opt/otrs/
su -c "/opt/otrs/bin/otrs.Daemon.pl stop" -s /bin/bash otrs
su -c "/opt/otrs/bin/Cron.sh stop" -s /bin/bash otrs

Backup otrs database and /opt/otrs/ folder, i prefer to keep safe everything on other location than the working server

mysqldump -p otrs > otrsdbbackup.sql
scp root@otrs.yobicloud.local:/root/otrsdbbackup.sql (your local path for backup)
scp -r root@otrs.yobicloud.local:/opt/otrs (your local path for backup)

Rename the old folder because you will need some files of your previous configuration, download the packages of the newer version (in this case the v5.0.21) decompress and rename the folder as the oldest, without the version number

yum update -y
cd /opt/
mv otrs otrs-old
wget http://ftp.otrs.org/pub/otrs/otrs-6.0.14.tar.gz
tar -xzf otrs-6.0.14.tar.gz
mv otrs-6.0.14 otrs

Move your olds config and ticket numbers files, from the backup folder to the new

cp /opt/otrs-old/Kernel/Config.pm /opt/otrs/Kernel/
cp /opt/otrs-old/Kernel/Config/Files/ZZZAuto.pm /opt/otrs/Kernel/Config/Files/

(Optional) If you store article data in the filesystem you have to restore the article folder, or the specified folder in the SysConfig if is tuned

(Optional) 
cp -rf /opt/otrs-old/var/article/ /opt/otrs/var/.

(Optional) Restore already installed default statistics. If you have additional packages with default statistics you have to restore the stats xml files with the suffix *.installed to /opt/otrs/var/stats.

(Optional) 
cd OTRS-BACKUP/var/stats
cp *.installed /opt/otrs/var/stats

Set the permission as root user, will detect the correct user and group settings needed for your setup

cd /opt/otrs/
bin/otrs.SetPermissions.pl

Check if some PERL modules are missing, and install any modules that might be needed for your configuration

/opt/otrs/bin/otrs.CheckModules.pl

The output will be something like this:

o Apache::DBI................................ok (v1.12)
o Apache2::Reload............................ok (v0.13)
o Archive::Tar...............................ok (v1.92)
o Archive::Zip...............................ok (v1.30)
o Crypt::Eksblowfish::Bcrypt.................ok (v0.009)
o Crypt::SSLeay..............................ok (v0.64)
o Date::Format...............................ok (v2.24)
o DateTime...................................Not installed! Use: 'yum install "perl(DateTime)"' (required)
o DBI........................................ok (v1.627)
o DBD::mysql.................................ok (v4.023)
o DBD::ODBC..................................Not installed! (optional - Required to connect to a MS-SQL database.)
o DBD::Oracle................................Not installed! (optional - Required to connect to a Oracle database.)
o DBD::Pg....................................Not installed! Use: 'yum install "perl(DBD::Pg)"' (optional - Required to connect to a PostgreSQL database.)
o Digest::SHA................................ok (v5.85)
o Encode::HanExtra...........................Not installed! Use: 'yum install "perl(Encode::HanExtra)"' (optional - Required to handle mails with several Chinese character sets.)
o IO::Socket::SSL............................ok (v1.94)
o JSON::XS...................................ok (v3.01)
o List::Util::XS.............................ok (v1.27)
o LWP::UserAgent.............................FAILED! Not all prerequisites for this module correctly installed.
o Mail::IMAPClient...........................ok (v3.37)
o IO::Socket::SSL............................ok (v1.94)
o Authen::SASL...............................ok (v2.15)
o Authen::NTLM...............................ok (v1.09)
o ModPerl::Util..............................ok (v2.000010)
o Net::DNS...................................ok (v0.72)
o Net::LDAP..................................ok (v0.56)
o Template...................................ok (v2.24)
o Template::Stash::XS........................ok (undef)
o Text::CSV_XS...............................ok (v1.00)
o Time::HiRes................................ok (v1.9725)
o XML::LibXML................................ok (v2.0018)
o XML::LibXSLT...............................ok (v1.80)
o XML::Parser................................ok (v2.41)
o YAML::XS...................................ok (v0.54)

This is an update, than the installation of other modules are not necessary except for “perl(DateTime)”, because all you need was already installed, until you need to change DB.

The module “perl(DateTime)” is required from version 6 of otrs for the new features, otherwise the installation cannot proceed.

In my case i will not install any DB modules but only the required (note that LWP::UserAgent will be automagically installed after DateTime)

yum install "perl(DateTime)"

You can re-check the modules with the script

/opt/otrs/bin/otrs.CheckModules.pl

and if the missing will be only the DB packages other than your, you can proceed with the migration.

Is time to migrate…

This is required only If you have any custom Perl or XML configuration files in Kernel/Config/Files from previus version and need to be converted to the new formats supported by OTRS 6 before running the migration script more information here.

Important: Kernel/Config/Files/ZZZAuto.pm has been merged into Kernel/Config/Files/ZZZAAuto.pm.

If Between the folder /opt/otrs/Kernel/Config/Files/ and /opt/otrs-old/Kernel/Config/Files/ there are differents files .pm, copy the missing files from /opt/otrs-old/Kernel/Config/Files/ to /opt/otrs/Kernel/Config/Files/ except ZZZAuto.pm, if there are different .XML files, copy them in /opt/otrs/Kernel/Config/Files/

In my case, as you can see in the video i moved the files from my production envirorment to test the migration, you can move it from otrs-old folder if there are.

scp (your local path for backup)xmlotrs/* root@otrs.yobicloud.local:/opt/otrs/Kernel/Config/Files/

OTRS 6 uses a new XML configuration file format and the location of configuration files moved from Kernel/Config/Files to Kernel/Config/Files/XML. To convert existing XML configuration files to the new format and location, you can use the following tool that is part of the OTRS framework:

cd /opt/otrs/
su -c "bin/otrs.Console.pl Dev::Tools::Migrate::ConfigXMLStructure --source-directory Kernel/Config/Files/" -s /bin/bash otrs

Now is time to apply the database changes and update schema as otrs user NOT as root.

cd /opt/otrs
su -c "scripts/DBUpdate-to-6.pl" -s /bin/bash otrs

Last step is to update the installed packages because from OTRS 5 are not compatible with OTRS 6 and have to be updated.

You can use the command below to update all installed packages. This works for all packages that are available from online repositories. You can update other packages later via the package manager from GUI.

cd /opt/otrs/
su -c "bin/otrs.Console.pl Admin::Package::UpgradeAll" -s /bin/bash otrs

Restart your services

systemctl start httpd
systemctl start postfix
systemctl start crond

Start the daemon as otrs user.

su -c "/opt/otrs/bin/otrs.Daemon.pl start" -s /bin/bash otrs
su -c "/opt/otrs/bin/Cron.sh start" -s /bin/bash otrs

delete install packages, my sql backup, and otrs-old folder locate in /opt for the production server, to clean the machine or leave more space.

here the link for the official docs

—>>> ENJOY!!! <<<—

ByYOBIHAT TEAM

centos, collaboration, communication, free, install, Issue Tracker, it, otrs, otrs setup, support, system, system administration, ticket, troubleshooting

Install OTRS v5.x.x on centos 7 with SSL

OTRS is an Open source Ticket Request System, the best, flexible ticket and process management system that allows service management professionals in any company to support, managing, ordering and track back the solutions, based on IT department cooperation, will become an indispensable tool in everyday life of IT troubleshooters.

Requirements:

-Centos 7.3 server with Minimum 1 CPU, 2 GB of RAM for normal working ( if you have a massive email flow, we suggest to upgrade the hardware )

-ROOT permission on server.

-E-mail account and mail-server settings

-Internet connection to download all needed packages.

-Good IT knowledge and a bit of patience…

Let’s Start!

Setup network with static IP and set DNS

First of all, update your server

yum update -y

Change hostname at your server if needed

hostnamectl set-hostname otrs.yobicloud.local

Install some useful packages, wget to download, network tools (always useful to troubleshoot network), htop to monitor the hardware and processes with a helpful graphics and mod_ssl to configure Secure connection SSL/TLS over HTTP on Apache2.

yum install wget net-tools htop mod_ssl

Enable the EPEL repository

yum install epel-release

Disable selinux in /etc/selinux/config file to avoid problems until you know what are doing…

Then open the file and change the line SELINUX=enforcing to SELINUX=disabled, save and reboot server

reboot

Then re-update your system.

yum update -y

I will use MySQL opensource for database, then install MariaDB, but there are different alternatives like Postgres, Oracle or MS-SQL, and if you are comfortable with them, use it. you just need to install differents otrs modules for make it working properly. I will continue with a standard MariaDB database

yum install mariadb-server mariadb

You will need to change the default MySQL settings in order to make it suitable for OTRS. Open its configuration file using vi or your favorite text editor

vi /etc/my.cnf

Add the following lines under the [mysqld] section, which specify the sizes of a few files.

[mysqld]
max_allowed_packet=64M
query_cache_size=32M
innodb_log_file_size=256M
datadir=/var/lib/mysql

Then save and close the file. Make sure you do this before you start MySQL for the first time.

Now, start MariaDB.

systemctl start mariadb

Next, secure the MySQL database.

/usr/bin/mysql_secure_installation

You will be asked a few questions. You can accept the default values for all of the questions by just pressing ENTER for each, except for setting the new root password. Make a note of your root user password because you will need it later in this tutorial.

Now that we have everything, we need to install the OTRS application

We will install OTRS using the pre-built RPM package for CentOS. First, we need to download the latest RPM from their official repository. You can browse the repository directory to determine the latest version.

wget http://ftp.otrs.org/pub/otrs/RPMS/rhel/7/otrs-5.0.21-02.noarch.rpm

Next, install OTRS (note that sometimes you have to install twice).

yum install --nogpgcheck otrs-5.0.21-02.noarch.rpm

OTRS is written in Perl and uses a number of Perl modules. We can check for missing modules by using the CheckModules.pl script included with OTRS.

If some PERL modules are missing, install which might be needed for your configuration

/opt/otrs/bin/otrs.CheckModules.pl

The output will be something like this:

o Apache::DBI......................ok (v1.12) 
o Apache2::Reload..................ok (v0.13)
o Archive::Tar.....................ok (v1.92)
o Archive::Zip.....................ok (v1.30)
o Crypt::Eksblowfish::Bcrypt.......Not installed! Use: 'yum install "perl(Crypt::Eksblowfish::Bcrypt)"' (optional - For strong password hashing.)
o Crypt::SSLeay....................ok (v0.64)
o Date::Format.....................ok (v2.24)
o DBI..............................ok (v1.627)
o DBD::mysql.......................ok (v4.023
o DBD::ODBC........................Not installed! (optional - Required to connect to a MS-SQL database.)
o DBD::Oracle......................Not installed! (optional - Required to connect to a Oracle database.)
o DBD::Pg..........................Not installed! Use: 'yum install "perl(DBD::Pg)"' (optional - Required to connect to a PostgreSQL database.)
o Digest::SHA......................ok (v5.85)
o Encode::HanExtra.................Not installed! Use: 'yum install "perl(Encode::HanExtra)"' (optional - Required to handle mails with several Chinese character sets.)
o IO::Socket::SSL..................ok (v1.94)
o JSON::XS.........................Not installed! Use: 'yum install "perl(JSON::XS)"' (optional - Recommended for faster AJAX/JavaScript handling.)
o List::Util::XS...................ok (v1.27)
o LWP::UserAgent...................ok (v6.13)
o Mail::IMAPClient.................Not installed! Use: 'yum install "perl(Mail::IMAPClient)"' (optional - Required for IMAP TLS connections.)
o IO::Socket::SSL..................ok (v1.94)
o Authen::SASL.....................ok (v2.15)
o Authen::NTLM.....................Not installed! Use: 'yum install "perl(Authen::NTLM)"' (optional - Required for NTLM authentication mechanism in IMAP connections.)
o ModPerl::Util....................Not installed! Use: 'yum install "perl(ModPerl::Util)"' (optional - Improves Performance on Apache webservers dramatically.)
o Net::DNS.........................ok (v0.72)
o Net::LDAP........................ok (v0.56)
o Template.........................ok (v2.24)
o Template::Stash::XS..............ok (undef)
o Text::CSV_XS.....................Not installed! Use: 'yum install "perl(Text::CSV_XS)"' (optional - Recommended for faster CSV handling.)
o Time::HiRes......................ok (v1.9725)
o Time::Piece......................ok (v1.20_01)
o XML::LibXML......................ok (v2.0018)
o XML::LibXSLT.....................ok (v1.80)
o XML::Parser......................ok (v2.41)
o YAML::XS.........................Not installed! Use: 'yum install "perl(YAML::XS)"' (required - Very important)

As you can see, all checked modules are followed by a comment that will help you in the installation. Not all modules are necessary to you, for example if you have a my-sql DB (DBD::mysql module already install), the “perl(DBD::Pg)” or “perl(DBD::ODBC)” or “perl(DBD::Oracle)” are not required to OTRS, instead if you have a PG DB than follow the comments and install with the command shown below, an so on…

example: yum install "perl(DBD::Pg)"

In my case i will not install any DB modules other than my-sql, but I’ll proceed with the missing tagged like required, optional and recommended needed to me (so analyze your needs before continue and install your needs )

yum install "perl(XML::LibXSLT)" 
yum install "perl(Authen::NTLM)" 
yum install "perl(YAML::XS)"
yum install "perl(Text::CSV_XS)"
yum install "perl(ModPerl::Util)"
yum install "perl(Mail::IMAPClient)"
yum install "perl(JSON::XS)"
yum install "perl(Crypt::Eksblowfish::Bcrypt)"

You can re-check the modules with the script:

/opt/otrs/bin/otrs.CheckModules.pl

Add firewall exceptions for port 80-443 and reload firewalld conf

firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

Restart Apache2 service.

systemctl restart httpd

Start the OTRS daemon, activate cronjob as otrs user, and as root enable webserver and database at boot, now reboot to check that everything is starting alone.

sudo su - otrs -c "bin/otrs.Daemon.pl start"
sudo su - otrs -c "/opt/otrs/bin/Cron.sh start"
systemctl enable httpd
systemctl enable mariadb

reboot

Configure from the front-end, once all previous step went done.

Open in browser https://otrs.yobicloud.local/otrs/installer.pl use your own ip or hostname instead of “otrs.yobicloud.local”, note that if you installed mod_ssl, the apache package for SSL, you will have https already activated with basic configuration and certificate, later you will need just to make default, and tune otrs sysconfig and the apache conf files, to generate new certificate follow our apache tutorial.

will show world offices info, click next, and after reading you have to accept the license terms and conditions.

Is time to choose the DB, our installation is with MariaDB, so select MYSQL and ‘Create new DB for OTRS’ if you don’t want to use an existing one.

Fill in password, DB address if is different than local and press check DB settings, if everything is green like the photo below you can continue, Write down the password generated or change it (this is needed to log-in OTRS)

In the STEP 3 fill in a fully qualified domain name(FQDN), or you can just use your server’s IP address, the Administrator email to get notify about errors or warning, the organization name, select logging type, main language and if you prefer to check MX record select YES.

To receive e-mails from customers configure an incoming account with type of mail ‘IMAP preferred’ mail address, user and password.

For outbound you can leave it so, if you not have particular configuration, you can check if will work pressing button ‘check mail configuration’ or ‘Skip this step’ to continue and check later.

Congratulation!!! Installation Completed, write down the Admin login credential

Now login using the credentials of the previus page at the link https://otrs.yobicloud.local/otrs/index.pl (use your own ip or hostname instead of “otrs.yobicloud.local”), after login you will receive two advice, one to create a new user for working with otrs, clicking on this link will redirect to the operators management page so create the new user here, and the other are relative at otrs daemon, to check if the daemon is up, use:

sudo su - otrs -c "bin/otrs.Daemon.pl status"

Note that the cron call the daemon every 5 minutes, than wait minimum 5 minutes and if the Daemon still is not running, follow the suggestion in the pop-up.

SSL/TLS connection over http is essential today in the scary web, consider activate the HTTPS on your web server.

(OPTIONAL)

If you have no possibility to activate it from the server click in the header menu on admin and select SysConfig, search for HTTPS, in the result click on core, scroll untill the configuration option HttpType and change to HTTPS.

Good practice is to also redirect all HTTP traffic to HTTPS, in case someone tries to access via an insecure link. This should be done on web server configuration level for maximum effect. However, in case this is not possible, you can set HTTPSForceRedirect to Yes in SysConfig if available.

(BEST WAY)

The best way is edit apache2 configuration, than if can be possible, chose this method instead previus (optional method), by creating a new file that will redirect all http request to otrs main page in https.

cd /etc/httpd/conf.d
vi ssl.conf

And add the following text (remember to edit with your own settings):

<VirtualHost *:80>
ServerName otrs.yobicloud.local
ServerName 192.168.24.101
Redirect permanent / https://otrs.yobicloud.local/otrs/index.pl
</VirtualHost>

Edit the main SSL config file for all HTTPS connection with some hardening tips

vi /etc/httpd/conf.d/ssl.conf

Uncomment and edit (always with your data) as:

DocumentRoot "/var/www/html"
ServerName 192.168.24.101:443

Some where in the file comment this line:

SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA

and add the following lines to hardening a bit apache2

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLHonorCipherOrder On
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains"
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff

until you leave untouched the default certificates, paths and names, you don’t need further changes, than restart apache2 to apply configuration.

systemctl restart httpd

Here the official documentation about OTRS.

—>>> ENJOY!!! <<<—

ByYOBIHAT TEAM

centos, collaboration, communication, it, otrs, system, system administration, ticket, update

Update OTRS from v4.x.x+ to v5.x.x+ on centos7

Hi Tech Guys,

Sometimes OTRS need some care to be up-to-date and secure, than here you can find a right and easy way to update OTRS from v4 to v5 (IMPORTANT: only from any v4.x.x to any v5.x.x)

We recommend to test in a clone or test machine before to move and do any edit in a production environment (avoid disaster please).

Requirements:

-Centos 7.3 server with minimal hardware configuration (depends of your needs).

-ROOT permission on server.

-Internet connection to download all needed packages.

-Small IT basic knowledge and a bit of patience…

Let’s Start!

Stop all services used by the ticketing system before proceding

systemctl stop crond
systemctl stop postfix
systemctl stop httpd

Move in the main path and stop daemon

cd /opt/otrs
su -c "bin/Cron.sh stop" -s /bin/bash otrs
su -c "bin/otrs.Scheduler.pl -a stop" -s /bin/bash otrs

Backup otrs database and /opt/otrs/ folder, i prefer to keep safe everything on other location than the working server

mysqldump -p otrs > otrsdbbackup.sql
scp root@10.0.0.58:/root/otrsdbbackup.sql /home/user/otrs/.
scp -r root@10.0.0.58:/opt/otrs /home/user/otrs

cd /opt/
mv otrs otrs-old
wget ftp://ftp.otrs.org/pub/otrs/otrs-5.0.21.tar.gz
tar -xzf otrs-5.0.21.tar.gz
mv otrs-5.0.21 otrs

Move your olds config and ticket numbers files, from the backup folder to the new

cp /opt/otrs-old/Kernel/Config.pm /opt/otrs/Kernel/
cp /opt/otrs-old/Kernel/Config/GenericAgent.pm /opt/otrs/Kernel/Config/
cp /opt/otrs-old/Kernel/Config/Files/ZZZAuto.pm /opt/otrs/Kernel/Config/Files/
cp /opt/otrs-old/var/log/TicketCounter.log /opt/otrs/var/log/

(Optional) If you store article data in the filesystem you have to restore the article folder, or the specified folder in the SysConfig if is tuned

(Optional) cp -rf  /opt/otrs-old/var/article/ /opt/otrs/var/.

Set the permission for Centos or Red Hat (Webserver with apache user)

cd /opt/otrs
bin/otrs.SetPermissions.pl --web-group=apache

Check if some PERL modules are missing, and install any modules that might be needed for your configuration

/opt/otrs/bin/otrs.CheckModules.pl

The output will be something like this:

o Apache::DBI......................ok (v1.12) 
o Apache2::Reload..................ok (v0.13)
o Archive::Tar.....................ok (v1.92)
o Archive::Zip.....................ok (v1.30)
o Crypt::Eksblowfish::Bcrypt.......Not installed! Use: 'yum install "perl(Crypt::Eksblowfish::Bcrypt)"' (optional - For strong password hashing.)
o Crypt::SSLeay....................ok (v0.64)
o Date::Format.....................ok (v2.24)
o DBI..............................ok (v1.627)
o DBD::mysql.......................ok (v4.023
o DBD::ODBC........................Not installed! (optional - Required to connect to a MS-SQL database.)
o DBD::Oracle......................Not installed! (optional - Required to connect to a Oracle database.)
o DBD::Pg..........................Not installed! Use: 'yum install "perl(DBD::Pg)"' (optional - Required to connect to a PostgreSQL database.)
o Digest::SHA......................ok (v5.85)
o Encode::HanExtra.................Not installed! Use: 'yum install "perl(Encode::HanExtra)"' (optional - Required to handle mails with several Chinese character sets.)
o IO::Socket::SSL..................ok (v1.94)
o JSON::XS.........................Not installed! Use: 'yum install "perl(JSON::XS)"' (optional - Recommended for faster AJAX/JavaScript handling.)
o List::Util::XS...................ok (v1.27)
o LWP::UserAgent...................ok (v6.13)
o Mail::IMAPClient.................Not installed! Use: 'yum install "perl(Mail::IMAPClient)"' (optional - Required for IMAP TLS connections.)
o IO::Socket::SSL................ok (v1.94)
o Authen::SASL...................ok (v2.15)
o Authen::NTLM...................Not installed! Use: 'yum install "perl(Authen::NTLM)"' (optional - Required for NTLM authentication mechanism in IMAP connections.)
o ModPerl::Util....................Not installed! Use: 'yum install "perl(ModPerl::Util)"' (optional - Improves Performance on Apache webservers dramatically.)
o Net::DNS.........................ok (v0.72)
o Net::LDAP........................ok (v0.56)
o Template.........................ok (v2.24)
o Template::Stash::XS..............ok (undef)
o Text::CSV_XS.....................Not installed! Use: 'yum install "perl(Text::CSV_XS)"' (optional - Recommended for faster CSV handling.)
o Time::HiRes......................ok (v1.9725)
o Time::Piece......................ok (v1.20_01)
o XML::LibXML......................ok (v2.0018)
o XML::LibXSLT.....................ok (v1.80)
o XML::Parser......................ok (v2.41)
o YAML::XS.........................Not installed! Use: 'yum install "perl(YAML::XS)"' (required - Very important)

 example: yum install "perl(DBD::Pg)"

In my case i will not install any DB modules other than my-sql, but i’ll proceed with the missing tagged like required, optional and recommended needed to me (so analyze your needs before continue and install your needs )

yum install "perl(XML::LibXSLT)" 
yum install "perl(Authen::NTLM)" 
yum install "perl(YAML::XS)"
yum install "perl(Text::CSV_XS)"
yum install "perl(ModPerl::Util)"
yum install "perl(Mail::IMAPClient)
yum install "perl(JSON::XS)"
yum install "perl(Crypt::Eksblowfish::Bcrypt)"

You can re-check the modules with the script:

/opt/otrs/bin/otrs.CheckModules.pl

Now is time to apply the database changes and update schema as otrs user NOT as root.

cd /opt/otrs

cat scripts/DBUpdate-to-5.mysql.sql | mysql -p -f -u root otrs
su -c "bin/otrs.Console.pl Maint::Database::Check" -s /bin/bash otrs
su -c "scripts/DBUpdate-to-5.pl" -s /bin/bash otrs

Always as otrs user delete caches and refresh the configuration

su -c "bin/otrs.Console.pl Maint::Config::Rebuild" -s /bin/bash otrs
su -c "bin/otrs.Console.pl Maint::Cache::Delete" -s /bin/bash otrs

Restart your services

systemctl start httpd
systemctl start postfix
systemctl start crond

Start the daemon as otrs user.

su -c "/opt/otrs/bin/otrs.Daemon.pl start" -s /bin/bash otrs

The defaults OTRS cron files are located in /opt/otrs/var/cron/*.dist, they assicuring that the OTRS Daemon is running. They need to be activated by copying them without the “.dist” filename extension, and than use the script Cron.sh as OTRS user to schedule these jobs.

cd /opt/otrs/var/cron for foo in *.dist; do cp $foo `basename $foo .dist`; done
su -c "/opt/otrs/bin/Cron.sh start" -s /bin/bash otrs

delete the install packages, my sql backup, and otrs-old folder locate in /opt for the production server

here the link for the official docs

—>>> ENJOY!!! <<<—

ByYOBIHAT TEAM

centos, kloxo, server managment, system administration

Install Kloxo MR7 in centos 7

Hi Tech Guys,

this is a small tutorial that will help your installation of Kloxo MR7 in a Centos 7.3.

Kloxo MR7 is a fork of the deprecated project Kloxo and is a Powerful free Open-Source hosting control panel and more…

If you have some trouble to make it work, DO NOT HESITATE to comment here, feel free to ask.

Requirements:

-Centos 7.3 server with minimal hardware configuration (depends of your needs).

-ROOT permission on server.

-Internet connection to download all needed packages.

-Small IT basic knowledge and a bit of patience…

Let’s Start!

First of all update server

yum update

Change hostname at your server if needed

hostnamectl set-hostname kloxomr7.yobicloud.local

Add an entry in your /etc/hosts file (use your own IP Address and Hostname)

vi /etc/hosts

Add the entry

10.0.0.100           kloxomr7          kloxomr7.yobicloud.local

Install some packages required for optimal kloxo MR7 functionality

yum install yum-utils yum-priorities wget vim-minimal subversion curl net-tools zip unzip telnet -y

Move to temp folder, remove old rpm packages if any, now download and install version 7.0.0 (rpm naming as kloxomr7-7.0.0-*.rpm) read WARNING when install rpm package

cd /tmp
rm -f mratwork*
rpm -ivh https://github.com/mustafaramadhan/rpms/raw/master/mratwork/release/neutral/noarch/mratwork-release-0.0.1-1.noarch.rpm --no-check-certificate
cd /
yum update mratwork-* -y
yum install kloxomr7 -y
sh /script/upcp

Once the installation is completed you can login in the web panel using default user and password admin:admin by enter one of the following address

https://10.0.0.100:7777
http://10.0.0.100:7778

(use your own IP address or hostname)

—>>> ENJOY!!! <<<—

ByYOBIHAT TEAM

centos, collaboration, communication, mail, multi-server, system administration, zimbra

Zimbra Tips & Tricks

Tips & Tricks

Here few tips & tricks based on our Zimbra experience.

SNMP package is optional, and if you want to use it, you need to install on all servers, i decide to not use it.
In case that you need to reinstall the zm packages use

./install.sh –-platform-override

make sure during the zm installation to check if all password are correctly setted and the same at both server.
If you will not setup zimbra configuration correctly you will not be notify to apply configurations in a multiserver envirorment, so check all settings to make smoothly the connections between master and replica.
If you cant apply configuration on the replica server, and LDAP connections work correctly, go on the master LDAP server, as a Zimbra user, type:

/opt/zimbra/libexec/zmldapenablereplica

If you can’t apply configuration because doesn’t show [a] for apply it mean that doesn’t have connection with the other server, or you did’t complete the setup configuration so check all parameters.
After apply configuration you will be asked to save in a conf file, Save config in file: [/opt/zimbra/config.”numbers”] inside that you will find the actual running configuration. Check Timezone on both server and check password on master to be the same on replica

zmlocalconfig -s ldap_replication_password

Important: If you have installed Zimbra MTA on the LDAP server, configure the Amavis and the Postfix passwords.
To find these values, run:

zmlocalconfig -s ldap_amavis_password
zmlocalconfig -s ldap_postfix_password
zmlocalconfig -s ldap_nginx_password

Use ‘’ for insert the value and to change those value use:

zmlocalconfig -e ldap_nginx_password=’newvalue’

Other password value in zimbra:

antispam_mysql_password

antispam_mysql_root_password

client_ssl_truststore_password

ldap_amavis_password

ldap_bes_searcher_password

ldap_postfix_password

ldap_replication_password

ldap_root_password

ldap_nginx_password

mailbox_keystore_base_password

mailbox_keystore_password

mailbox_truststore_password

mysql_root_password

zimbra_ldap_password

zimbra_mysql_password

zimbra_vami_password

Note: Execution of ‘zmlocalconfig’ without argument shows present Zimbra configuration parameters and values. To see the local config, type:

zmlocalconfig

To check services status use as zimbra user:

zmcontrol (followed by) status start restart stop

To configure proxy use as zimbra user on both servers:

/opt/zimbra/libexec/zmproxyconfig -e -w -H zimbra1.demo.local

on the other

/opt/zimbra/libexec/zmproxyconfig -e -w -H zimbra2.demo.local

In this folder /opt/zimbra/libexec/ are saved all command of zimbra user, than if you search inside you will find the names of the commands and you can also use man to check the commands helps.

Zimbra infos

Firewall Configuration should be set to No firewall, and the Security Enhanced Linux (SELinux) should be disabled if you don’t know how to hardening.

Table 1 Zimbra Default Port Mapping

Postfix	25
HTTP	80
POP3	110
IMAP	143
LDAP	389
HTTPS	443
Tomcat IMAP SSL	993
Tomcat POP SSL	995
Tomcat LMTP	7025

Table 2 Attributes Mapped to Zimbra contact

Standard LDAP Attribute	Zimbra Contact Field
co	workCountry
company	Company
givenName/gn	firstName
sn	lastName
cn	fullName
initials	initials
l	workCity
physicalDeliveryOfficeName	office
ou	department
street, streetaddress	workStreet
postalCode	workPostalCode
telephoneNumber	workPhone
st	workState
title	jobTitle
mail	email
objectClass	Not currently mapped

GAL Attributes in Zimbra
Two possible sources for GAL information are the Zimbra server and the Active Directory server. The relevant LDAP/Active Directory fields are referenced in the Zimbra schema under the same names as listed in the Active Directory schema.

LDAP Mapped Attributes table maps generic GAL search attributes to their Zimbra contact fields.

Zimbra GAL Search Parameters

Like authentication, GAL is configured on a per-domain basis. From the administration console, you can run the GAL Configuration Wizard to configure the domain’s attributes.

Modifying Attributes

The OpenLDAP directory should not be modified directly. Any additions, changes and deletions are made through the Zimbra administration console or from the CLI utility for provisioning, zmprov.

Users modify attributes for their entry (accounts) in the OpenLDAP directory when they change their options from the Zimbra Web Client.

Administrators can also modify LDAP attributes using the command-line tools described in Appendix A: Command-Line Utilities.

Important: Do not use any LDAP browsers to change the Zimbra LDAP content.

Overview of Installation Process

When you run the install script, the Zimbra install verifies that the correct prerequisite packages are installed.

Zimbra Core installs the libraries, utilities, and monitoring tools.

Zimbra LDAP installs the OpenLDAP software, an open source LDAP directory services.

Zimbra MTA installs the Postfix open source MTA, the Clam AntiVirus antivirus engine, the SpamAssassin junk mail filter, and the Amavisd-New content filter.

Zimbra Store installs the mailbox server, including Apache Tomcat, the servlet container for the Zimbra server.

Zimbra Spell installs the Aspell open source spelling checker. When Zimbra spell is installed, Zimbra-Apache is also installed.

Zimbra SNMP installs the SNMP package for monitoring. This package is optional.

Zimbra Logger installs tools for syslog aggregation, reporting, and message tracing.

The Zimbra server configuration is menu driven. The installation menu shows you the default configuration values. The menu displays the logical host name and email domain name [mailhost.example.com] as configured on the computer. You can change any of the values. For single server installs, the only value you must define is the administrator’s password. The password is used to log on to the Zimbra administration console.

Basic Configuration

The default configuration installs the Zimbra-LDAP, the Zimbra-MTA with anti-virus and anti-spam protection, the Zimbra mailbox server, the SNMP monitoring tools (optional), Zimbra-spell (optional), and the logger tool (optional), on one server.

The menu driven installation displays the components and their existing default values. During the installation process you can modify the information.

The table below describes the menu options

Table 2 Main Menu Options

1) Hostname	The host name configured in the operating system installation.
2) LDAP master host	The LDAP host name. On a single server installation this name is the same as the hostname.
3) LDAP port	The default port is 389.
4) LDAP password	The root LDAP password for the host. This password is automatically generated.
5) zimbra-ldap	Configuration includes the following: Create Domain – Yes. You can create one domain during installation and additional domains can be created from the administration console. Domain to create – The default domain is the fully qualified hostname of the server. If you created a valid mail domain on your DNS server, enter it now. In most cases, you will accept the default.
6) zimbra-store	Configuration includes the following. Create Admin User – The administrator account is created during installation. This account is the first account provisioned on the Zimbra server and allows you to log on to the administration console. Admin user to create – The default is admin@[mailhost.example.com]. Admin Password – You must set the admin account password. The password is case sensitive and must be a minimum of six characters. The administrator name, mail address, and password are required to log in to the administration console. Enable automated spam training – By default, the automated spam training filter is enabled and two mail accounts are created. 1. Spam Training User to receive mail notification about mail that was not marked as junk, but should be. 2. Non-spam (HAM) training user to receive mail notification about mail that was marked as junk, but should not have been. These addresses are automatically configured to work with the spam training filter. The accounts created have a randomly selected name. To recognize what the account is used for you may want to change this name. Global Documents Account – The Global Documents account is automatically created when ZCS is installed. The Global Documents account holds the templates and the default Documents Notebook. The Documents feature is enabled from the COS or for individual accounts.
7) zimbra-mta	The following options can be modified. MTA Auth host. This is configured automatically if the MTA authentication server host is on the same server, but must be configured if the authentication server is not on the MTA. Enable Spamassassin. Default is enabled. Enable ClamAV. Default is enabled. Notification address for AV alerts. Sets the notification address for AV alerts. You can either accept the default or create a new address. If you create a new address, remember to provision this address from the admin console. Note: If the virus notification address does not exist and your host name is the same as the domain name on the Zimbra server, the virus notifications queue in the Zimbra MTA server and cannot be delivered.
8) zimbra-snmp (optional)	You can modify the following options Enable SNMP notifications. The default is No. If you enter yes, you must enter the SNMP Trap hostname. SNMP Trap hostname Enable SMTP notification – The default is No. SMTP Source email address – If you enter yes for SMTP notification, you must enter the SMTP source email address and SMTP Destination email address – destination email address.
9) zimbra-logger	When installed, it is automatically enabled. This information is used to generate the statistics graphs and is used for message tracing.
10) zimbra-spell	When installed, it is automatically enabled.(optional)
11) Enable default backup schedule	For the Network Edition only, sets the schedule for Backup session to run as a full backup every Sunday at 1 a.m. and as incremental on the other days at 1 a.m.
r) Start servers after configuration	When the installation and configuration is complete, if this is set to Yes, the Zimbra server is automatically started.
s) Save config to file	At any time during the installation, you can save the configuration to file.
q) Quit	Quit can be used at any time to quit the installation.

Description

–config	-c	<arg> File in which the configuration is stored
–default	-d	Show default values for keys listed in [args]
–edit	-e	Edit the configuration file, change keys and values specified. The [args] is in the key=value form.
–force	-f	Edit the keys whose change is known to be potentially dangerous
–help	-h	Shows the help for the usage options for this tool
–info	-i	Shows the documentation for the keys listed in [args]
–format	-m	<arg> Shows the values in one of these formats: plain (default), xml, shell, nokey.
–changed	-n	Shows the values for only those keys listed in the [args] that have been changed from their defaults
–path	-p	Shows which configuration file will be used
–quiet	-q	Suppress logging
–random	-r	This option is used with the edit option. Specified key is set to a random password string.
–show	-s	Forces the display of the password strings
–unset	-u	Remove a configuration key. If this is a key with compiled-in defaults, set its value to the empty string.
–expand	-x	Expand values

Table 1 Zimbra CLI Commands

The table below lists the CLI commands in /opt/zimbra/bin.

ldap	Start, stop, or find the status of Zimbra LDAP
ldapsearch	Perform a search on an LDAP server
logmysqladmin	Send myslqadmin commands to the logger mysql
mailboxd	Start, stop, find the status of the mailboxd server
mysql	Enters interactive command-line MySQL session with the mailbox mysql
mysql.server	Start, stop the SQL instance for the mailbox package
mysqladmin	Send admin commands to MySQL
postconf	Postfix command to view or modify the postfix configuration
postfix	Start, stop, reload, flush, check, upgrade-configuration of postfix
qshape	Examine postfix queue in relation to time and sender/recipient domain
zmaccts	Lists the accounts and gives the status of accounts on the domain
zmamavisdctl	Start, stop, restart, or find the status of the Amavis-D New
zmantispamctl	Start, stop, reload, status for anti-spam service
zmantivirusctl	Start, stop, reload, status for the anti-virus service
zmapachectl	Start, stop, reload, or check status of Apache service (for spell check)
zmarchive config	Command to view, modify, or configure archiving
zmarchivectl	Start, stop, reload, status for archiving
zmarchivesearch	Search archives on the account
zmauditswatchctl	Start, stop, restart, reload, status of the auditswatch
zmbackup	Performs full backups and incremental backups for a designated mail host.
zmbackupabort	Stops a backup that is in process.
zmbackupquery	Find a specific full backup set
zmblobchk	Check consistency of the Zimbra blob store
zmcalchk	Check consistency of appointments and attendees in the Zimbra calendar
zmcertmgr	Manage self-signed and commercial certificates
zmclamdctl	Start, stop, or find the status of Clam AV
zmcleaniplanetics	Clean iPlanet ICS calendar files
zmcontrol (Start/Stop Service)	Start, stop, status of the Zimbra servers. Also can use to find the Zimbra version installed.
zmconvertctl	Start, stop, the conversion server or find the status of the converted attachments conversion/indexing
zmdumpenv	General information about the server environment is displayed
zmgsautil	Create, delete the GAL sync account and initiate manual syncs.
zmhostname	Find the hostname of the Zimbra server
zmhsm	Start, stop and status of a HSM session.
zmitemdatafile	Extracts and packs tgz files that ZCS uses for REST import/export
zmjava	Execute Java with Zimbra-specific environment settings
zmldappasswd	Changes the LDAP password
zmlicense	View and install your Zimbra license
zmlmtpinject	Testing tool
zmlocalconfig	Used to set or get the local configuration of a Zimbra server
zmloggerctl	Start, stop, reload, or find the status of the Zimbra logger service
zmloggerhostmap	Used to manually map a DNS hostname to a zmhostname.
zmlogswatchctl	Start, stop, status of the swatch that is monitoring logging
zmmailbox	Performs mailbox management tasks
zmmailboxdctl	Start, stop, reload, or find the status of the mailbox components (mailboxd, MySQL, convert)
zmmailboxmove (Move Mailbox)	Used to move selected mailboxes from one Zimbra server to another.
zmmboxsearch (Cross Mailbox Search)	Search across mailboxes to find messages and attachments
zmmetadump	Support tool that dumps an item’s metadata in a human-readable form
zmmtaconfigctl	Start, stop, or find the status of the MTA configuration daemon
zmmtactl	Start, stop, or find the status of the MTA
zmmypasswd	Trace messages
zmmypasswd	Change MySQL passwords
zmmysqlstatus	Status of mailbox SQL instance
zmperditionctl	Start, stop, or find the status of the perdition IMAP proxy
zmplayredo	Performs data restore using backed up snapshots taken periodically. Users who use snapshots to backup and restore their information from a standby site use this command.
zmprov (Provisioning)	Performs all provisioning tasks in Zimbra LDAP, including creating accounts, domains, distribution lists and aliases
zmproxyconfgen	Generates configuration for the nginx proxy
zmproxyctl	Start, stop, restart, and find the status of the IMAP proxy service
zmproxypurge	Purges POP/IMAP routing information from one or more memcached servers
zmpython	Ability to write Python scripts that access Zimbra Java libraries. It sets the ZCS class path and starts the Jython interpreter.
zmredodump	Support tool for dumping contents of a redolog file for debugging purposes
zmrestore	Performs full restores and incremental restores for a designated mail host
zmrestoreldap	Restore accounts from the LDAP backup
zmrestoreoffline (Offline Restore)	Performs full restore when the Zimbra server (i.e., the mailboxd process) is down
zmsaslauthdctl	Start, stop, or find the status of saslauthd (authentication)
zmschedulebackup	Schedule backups and add the command to your cron table
zmshutil	Used for other zm scripts, do not use
zmskindeploy	Deploy skins for accounts from the command line
zmsoap	Print mail, account, and admin information in the SOAP format
zmspellctl	Start, stop, or find the status of the spell check server
zmsshkeygen	Generate Zimbra’s SSH encryption keys
zmstat-chart	Generate charts from zmstat data collected in a directory
zmstat-chart-config	Generate an .xml file with data included from the account setup
zmstat-chart-config	Outputs an XML configuration that describes the current state of the data gathered from zmstat-chart to generate charts on the administration console.
zmstatctl	Start, stop, check status, or rotate logs of zmstat data collectors
zmstorectl	Start, stop, or find the status of Zimbra store services
zmswatchctl	Start, stop, or find the status of the Swatch process, which is used in monitoring
zmsyslogsetup	Used to setup system log config file
zmthrdump	Initiate a thread dump and save the data to a file with a timestamp
zmtlsctl	Set the Web server mode to the communication protocol options: HTTP, HTTPS or mixed
zmtrainsa	Used to train the anti-spam filter to recognize what is spam or ham
zmtzupdate	Provides mechanism to process timezone changes from the command line
zmupdateauthkeys	Used to fetch the ssh encryption keys created by zmsshkeygen
zmvolume	Manage storage volumes on your Zimbra Mailbox server
zmzimletctl	Deploy and configure Zimlets

If you use non-ASCII characters in the CLI, in order for the characters to display correctly, you must change this setting to the desired UTF-8 before running the CLI command. To change this, type:

export LC_All=<UTF_locale>

Important: The default locale on the zimbra user system account is LANG=C. This setting is necessary for starting ZCS services. Changing the default LANG=C setting may cause performance issues with amavisd-new and the IM services may fail to start.

Some of the content is from zimbra official documentation site.

—>>> ENJOY!!! <<<—

ByYOBIHAT TEAM

database, installation, pgadmin, postgres, server managment, system administration, ubuntu

Install pgAdmin4 v3.2 in server mode on ubuntu 16/18 with HTTPS on apache2

Hi Tech Guys,

this is a small tutorial that will help your installation of pgAdmin 4 v3.2+ in Ubuntu server 16/18 on Apache2 webserver with a secure connection HTTPS, i will use a self-signed certificate, but you can change it with your own.

If you have some trouble to make it work, DO NOT HESITATE to comment here, feel free to ask.

Anyway we realized a small video located on the bottom of this guide.

Requirements:

-Ubuntu server 16 or 18 with minimal hardware configuration (depends of your needs).

-ROOT permission on server.

-Internet connection to download all needed packages.

-Small IT basic knowledge and a bit of patience…

Let’s Start!

First of all update server repo list

sudo apt-get update

Change hostname at your server if needed

hostnamectl set-hostname pgadmin.yobicloud.local

Install POSTGRESQL packages if is not already installed

sudo apt-get install postgresql postgresql-contrib
Here is the repo if you need to do it manually “https://download.postgresql.org/pub/repos/“

After DB installation change the password of your user postgres for the postgres DB

sudo -u postgres psql postgres
\password postgres

Insert your password twice and quit

\q

Now we are ready to prepare dependency to install last pgAdmin4 version from official Postgresql repo

sudo apt-get install build-essential libssl-dev libffi-dev libgmp3-dev virtualenv python-pip libpq-dev python-dev

Chose the path where Pgadmin will be installed, i use home, and setup a hidden folder with virtualenv move in and activate it

virtualenv .pgadmin4
cd .pgadmin4
source bin/activate

Now install with pip all pgadmin4 dependency

pip install flask-htmlmin
pip install wheel
pip install cryptography pyopenssl ndg-httpsclient pyasn1

Now we are ready to download and install last pgAdmin4 version from offical repo

wget https://ftp.postgresql.org/pub/pgadmin/pgadmin4/v3.2/pip/pgadmin4-3.2-py2.py3-none-any.whl
pip install pgadmin4-3.2-py2.py3-none-any.whl

If you receive some error try with sudo

sudo pip install pgadmin4-3.2-py2.py3-none-any.whl

Once is installed let’s configure it

sudo nano /home/ubu/.pgadmin/lib/python2.7/site-packages/pgadmin4/config.py

And edit the line DEFAULT_SERVER this text or your specific IP:

DEFAULT_SERVER = '0.0.0.0' or ip address server

Now create a file to specific the destination of software data

LOG_FILE = '/var/log/pgadmin4/pgadmin4.log'
SQLITE_PATH = '/var/lib/pgadmin4/pgadmin4.db'
SESSION_DB_PATH = '/var/lib/pgadmin4/sessions'
STORAGE_DIR = '/var/lib/pgadmin4/storage'
SERVER_MODE =  TRUE

Now is time to run Pgadmin4 and if show to connect to 0.0.0.0:5050 after user and password setup everything went smooth, you can test it or stop here if SSL is not needed

sudo python /home/ubu/.pgadmin4/lib/python2.7/site-packages/pgadmin4/pgAdmin4.py

Email address: admin@yobicloud.local
Password:Type the Password
Retype password:Retype the Password
pgAdmin 4 - Application Initialisation
======================================

CTRL+C to shutdown pgadmin

Deactivate virtualenv in the folder

deactivate

Set the proper permission to write in the folders

sudo chown -R www-data:www-data /var/lib/pgadmin4/
sudo chown -R www-data:www-data /var/log/pgadmin4/

Install Apache2 if is not already installed

sudo apt-get install apache2 apache2-utils libexpat1 ssl-cert python curl
sudo apt-get install libapache2-mod-wsgi
sudo systemctl restart apache2

Edit apache2 configuration to redirect all pgAdmin4 connection from port 80 to 443 or whatever you chose by creating conf files

sudo nano pgadmin4.conf

<VirtualHost *:80>
ServerName ubuntu.yobicloud.local[or IP]
Redirect permanent / https://[IP or hostname]/login?next=%2F
</VirtualHost>
<VirtualHost _default_:443>
ServerName pgadmin.yobicloud.local
DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/pgadmin4.crt
SSLCertificateKeyFile /etc/apache2/ssl/pgadmin4.key
WSGIDaemonProcess pgadmin processes=1 threads=25
WSGIScriptAlias / /home/ubu/.pgadmin4/lib/python2.7/site-packages/pgadmin4/pgAdmin4.wsgi
<Directory "/home/ubu/.pgadmin4/lib/python2.7/site-packages/pgadmin4/">
WSGIProcessGroup pgadmin
WSGIApplicationGroup %{GLOBAL}
Require all granted
</Directory>
</VirtualHost>

Remove apache default conf files and link the pgadmin4.conf you created

cd /etc/apache2/sites-enabled/
sudo rm -r 000-default.conf
sudo ln -s ../sites-available/pgadmin4.conf .

Generate the certificate and fill in all info of the wizard (the path of the certificates is already in the pgadmin.conf apache file)

sudo mkdir /etc/apache2/ssl
sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/apache2/ssl/pgadmin4.key -out /etc/apache2/ssl/pgadmin4.crt

Set SSL mode restart apache2 and enable it at OS boot

sudo a2enmod ssl
sudo systemctl restart apache2
sudo systemctl status apache2
sudo systemctl enable apache2
apachectl configtest

Open your browser and write the ip address or hostname of your pgAdmin4 installed machine

—>>> ENJOY!!! <<<—

ByYOBIHAT TEAM

centos, database, installation, pgadmin, postgres, server managment, system administration

Install pgAdmin4 v3.2 in server mode on Centos 7.3 with HTTPS as WSGI application

Hi Tech Guys,

this is a small tutorial that will help your installation of pgAdmin 4 v3.2 in a Centos 7.3 on Apache webserver as wsgi application with a secure HTTPS connection over your browser, i will use a self-signed certificate, but you can change it with your own.

If you have some trouble to make it work, DO NOT HESITATE to comment here, feel free to ask, anyway we realized a small video located on the bottom of this guide.

Requirements:

-Centos 7.3 server with minimal hardware configuration (depends of your needs).

-ROOT permission on server.

-Internet connection to download all needed packages.

-Small IT basic knowledge and a bit of patience…

Let’s Start!

First of all update server

yum update

Change hostname at your server if needed

hostnamectl set-hostname pgadmin.yobicloud.local

Download and install POSTGRESQL packages

yum install https://download.postgresql.org/pub/repos/yum/9.6/redhat/rhel-7-x86_64/pgdg-redhat96-9.6-3.noarch.rpm -y

Install EPEL

yum install epel-release

Now we are ready to install last pgAdmin4 version from repo

yum install pgadmin4

Once the installation finished without any problem, let’s create a file for pgadmin configuration

vi /usr/lib/python2.7/site-packages/pgadmin4-web/config_distro.py

And add this text:

LOG_FILE = '/var/log/pgadmin4/pgadmin4.log'
SQLITE_PATH = '/var/lib/pgadmin4/pgadmin4.db'
SESSION_DB_PATH = '/var/lib/pgadmin4/sessions'
STORAGE_DIR = '/var/lib/pgadmin4/storage'
SERVER_MODE =  TRUE

Now is time to setup the admin account that will manage your installation, follow the wizard and after the application will start

python /usr/lib/python2.7/site-packages/pgadmin4-web/setup.py

Email address: admin@yobicloud.local
Password:Type the Password
Retype password:Retype the Password
pgAdmin 4 - Application Initialisation
======================================

CTRL+C to shutdown pgadmin

Set the proper permission to write in the folders

chown -R apache:apache /var/lib/pgadmin4
chown -R apache:apache /var/log/pgadmin4
chcon -R -t httpd_sys_content_rw_t "/var/log/pgadmin4/"
chcon -R -t httpd_sys_content_rw_t "/var/lib/pgadmin4/"

If you have problem to start the application we suggest to deactivate SElinux.

After everything working well let’s go ahead with the certificate creation to use for HTTPS protection

yum install mod_ssl
cd /etc/ssl/certs
mkdir /etc/ssl/private
chmod 700 /etc/ssl/private
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/sslcert.key -out /etc/ssl/certs/sslcert.crt
openssl dhparam -out /etc/ssl/certs/dhgroup.pem 2048
cat /etc/ssl/certs/dhgroup.pem | sudo tee -a /etc/ssl/certs/sslcert.crt

Create and edit the file in the apache path for pgadmin

vi /etc/httpd/conf.d/pgadmin4.conf

Add the text below:

<VirtualHost *:80>
ServerName (your ip or host)
Redirect permanent / https://(your ip or host)/browser/
</VirtualHost>

<VirtualHost *:443>
    ServerName (your ip or host)
        SSLEngine on
        SSLCertificateFile /etc/ssl/certs/sslcert.crt  
SSLCertificateKeyFile /etc/ssl/private/sslcert.key 
 WSGIDaemonProcess pgadmin processes=1 threads=25 
 WSGIScriptAlias / /usr/lib/python2.7/site-packages/pgadmin4-web/pgAdmin4.wsgi 
<Directory "/usr/lib/python2.7/site-packages/pgadmin4-web/"> 
 WSGIProcessGroup pgadmin 
 WSGIApplicationGroup %{GLOBAL} 
 Require all granted 
</Directory> 
</VirtualHost>

Create a file that redirect any connection from port 80 (HTTP) to port 443 (HTTPS)

vi /etc/httpd/conf.d/non-ssl.conf

Add the text below:

<VirtualHost *:80>
ServerName (your ip or host)
Redirect permanent / https://(your ip or host)
</VirtualHost>

Edit the main SSL config file for all HTTPS connection with some hardening tips

vi /etc/httpd/conf.d/ssl.conf

Uncomment:

DocumentRoot "/var/www/html" 
ServerName 192.168.24.20:443

Comment:

# SSLProtocol all -SSLv2 
# SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA

Edit the certificate files path:

SSLCertificateFile /etc/ssl/certs/sslcert.crt

SSLCertificateKeyFile /etc/ssl/private/sslcert.key

Add this text somewhere in the file:

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH 
SSLProtocol All -SSLv2 -SSLv3 
SSLHonorCipherOrder On 
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains" 
Header always set X-Frame-Options DENY 
Header always set X-Content-Type-Options nosniff

The firewall if active need the ports to be open to properly allow you to use the web services.

After everything working well let’s go ahead with the certificate creation to use for HTTPS protection

firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-service=http
firewall-cmd --reload

Restart Apache service and enable it to start-up at OS boot

systemctl restart httpd
systemctl enable httpd

Test Apache config and set SElinux exception on it.

apachectl configtest
setsebool -P httpd_can_network_connect 1

Open your browser and write the ip address or hostname of your pgAdmin4 installed machine

—>>> ENJOY!!! <<<—

ByYOBIHAT TEAM

centos, collaboration, it, mail, multi-server, zimbra

Install Zimbra Collaboration 8.6 multiserver in Centos 7

System Requirements for Zimbra Installation

The official website recommends the following hardware specification for Zimbra open-source edition.

-Intel/AMD 2.0 GHz 64-bit CPU

-A minimum of 8GB of RAM for a single server installation

-10 GB disk space for software and logs, and additional disk space for mail storage and temporary files

-At least 4GB of RAM for each server if you split the server in 2, but all depend of the kind of services you decide to install on each machine.

General Requirements

-Firewall Configuration should be set to “No firewall”.

-RAID-5 is not recommended for installations with more than 100 accounts.

-SSH client software to transfer and install the Zimbra Collaboration software.

-Valid DNS configured with an A record and MX record.

-Servers should be configured to run Network Time Protocol (NTP) on a scheduled basis.

Installation step by step

On both centos VM update the OS, install all packages needed for zimbra install, and disable firewall and sendmail services

yum update -y 
yum install net-tools usbutils firewalld wget nc perl perl-core ntpl nmap sudo libidn gmp libaio libstdc++ unzip sysstat sqlite -y 
yum erase postfix
systemctl stop sendmail
systemctl disable sendmail
systemctl stop firewalld
systemctl disable firewalld

Add following entries to your both host files to change selinux config

vi /etc/selinux/config

change line SELINUX=permissive

Add following entries to your both host files

vi /etc/hosts
10.0.17.101      zimbra1.demo.local    zimbra1
10.0.17.102      zimbra2.demo.local    zimbra2

and remove all ipv6 relations comment or delete all ::1
Make static address in your NIC on all servers

vi /etc/sysconfig/network-scripts/ifcfg-………

Remove ipv6 configuration in file

vi /etc/sysctl.conf

Append the text below at the end of the file

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

Apply and if print 1 everything related to ipv6 is disabled and you can reboot

sysctl -p
reboot

Now create and mount the partition will store the data of your mail system, if you are not familiar to this please search on internet to understand better what you are doing.
The server that need the second hard drive to store email data is the server where you are going to install zimbra store service, in our case the server 1.
We suppone that /dev/sda is your main linux HDD and /dev/sdb/ is the second disk that will be mounted on /opt/zimbra.
The above command will help you to understand the status of your system

fdisk -l
lsblk
lvs
pvdisplay /dev/sd...
vgdisplay vg...

Let’s create the partition on /dev/sdb/ and mount on /opt/zimbra

mkdir /opt/zimbra
pvcreate /dev/sdb
pvdisplay /dev/sdb
vgcreate vg1 /dev/sdb
lvcreate -l 100%FREE -n zmstore vg0
mkfs.ext4 /dev/vg0/zmstore
blkid /dev/vg1/* >> /etc/fstab

once the UUID is sent in append to /etc/fstab open the file and delete the title sent as in the example

vi /etc/fstab
example:    UUID=00000xxxx-xxxxxx-xxxxxxxx              /opt/zimbra      ext4      defaults     0 0

After save the file mount and check if is mounted correctly

mount -a
mount | grep opt
lsblk

If everything is ok we are ready to install zimbra, go the folder you decide to use for download zimbra packages

cd /home/
wget https://files.zimbra.com/downloads/8.6.0_GA/zcs-8.6.0_GA_1153.RHEL7_64.20141215151110.tgz
tar xzvf zcs-8.6.0_GA_1153.RHEL7_64.20141215151110.tgz
cd zcs-8.6.0_GA_1153.RHEL7_64.20141215151110
./install.sh

in this case we are going to split the zimbra mail server in 2 different server with different services running on the servers, you can decide to use more servers depends of your needs, Let’s install

Services to install in server 1

cd zcs-…
./install.sh

Do you agree with the terms of the software license agreement? [N] Y

Select the packages to install Install zimbra-ldap [Y] y

Install zimbra-logger [Y] y

Install zimbra-mta [Y] N

Install zimbra-dnscache [N] N

Install zimbra-snmp [Y] N

Install zimbra-store [Y] y

Install zimbra-apache [Y] y

Install zimbra-spell [Y] y

Install zimbra-memcached [Y] y

Install zimbra-proxy [Y] N

after install edit the field marked with **** before to save change timezone change default ldap admin password and make sure all password are set save config and apply. Before to start with second server apply config here and test with:

zmcontrol status

Services to install in second server

cd zcs-…
./install.sh

Do you agree with the terms of the software license agreement? [N] Y

Select the packages to install Install zimbra-ldap [Y] n

Install zimbra-logger [Y] n

Install zimbra-mta [Y] y

Install zimbra-dnscache [N] y

Install zimbra-snmp [Y] N

Install zimbra-store [Y] n

Install zimbra-apache [Y] n

Install zimbra-spell [Y] n

Install zimbra-memcached [Y] y

Install zimbra-proxy [Y] y

before to save change timezone, check ldap_master_host change default ldap admin password as the other server and check all password on the other server with zmlocalconfig -s (password to know).

Set Up the SSH Keys – both servers

We need to manually populate ssh keys on each server

su - zimbra
zmupdateauthkeys

Enabling Server Statistics – both servers

In order for the server statistics to display on the administration console, the syslog configuration files must be modified. On each server, as root, type

/opt/zimbra/libexec/zmsyslogsetup

Verify configuration

zmcontrol status

Setting up proxy zimbra1.demo.local

zimbra1.demo.local

su zimbra
/opt/zimbra/libexec/zmproxyconfig -e -m -H mailboxsrv.demo...
/opt/zimbra/libexec/zmproxyconfig -e -w -H mailboxsrv.demo...

mtasrv.demo…

su zimbra
/opt/zimbra/libexec/zmproxyconfig -e -m -H mtasrv.demo...
/opt/zimbra/libexec/zmproxyconfig -e -w -H mtasrv.demo...
zmcontrol restart

Common Steps to Run Servers Properly

Once installation is complete, do the common following steps on each server to function properly.
1: Restart and Enable crond service

systemctl restart crond
systemctl enable crond

2: Open rsyslog.conf file and uncomment following two lines and restart service

vim /etc/rsyslog.conf
$ModLoad imudp
$UDPServerRun 514
# Provides TCP syslog reception 
$ModLoad imtcp 
$InputTCPServerRun 514

service rsyslog restart

3: Restart and Enable rsyslog service

systemctl restart rsyslog
systemctl enable rsyslog

4: Now run the below command to update rsyslog

/opt/zimbra/libexec/zmsyslogsetup
updateSyslog: Updating /etc/rsyslog.conf...done.

If the installation are successful you can access via web:

https://zimbra1.demo.local:443

for a webmail

https://zimbra2.demo.local:7071/zimbraAdmin

for admin managment site

(use your own link).

—>>> ENJOY!!! <<<—

Category Archive Tech Guide

Hi Tech Guys,

Requirements:

Let’s Start!

Let’s Start!

1. Install with a script

2. Install manually from sources

Hi Tech Guys,

Hi Tech Guys,

Hi Tech Guys,

this is a small tutorial that will help your installation of Kloxo MR7 in a Centos 7.3.

Kloxo MR7 is a fork of the deprecated project Kloxo and is a Powerful free Open-Source hosting control panel and more…

If you have some trouble to make it work, DO NOT HESITATE to comment here, feel free to ask.

Tips & Tricks

Zimbra infos

Table 1 Zimbra Default Port Mapping

Table 2 Attributes Mapped to Zimbra contact

Zimbra GAL Search Parameters

Modifying Attributes

Overview of Installation Process

Basic Configuration

Table 2 Main Menu Options

Table 1 Zimbra CLI Commands

Hi Tech Guys,

this is a small tutorial that will help your installation of pgAdmin 4 v3.2+ in Ubuntu server 16/18 on Apache2 webserver with a secure connection HTTPS, i will use a self-signed certificate, but you can change it with your own.

If you have some trouble to make it work, DO NOT HESITATE to comment here, feel free to ask.

Anyway we realized a small video located on the bottom of this guide.

Hi Tech Guys,

this is a small tutorial that will help your installation of pgAdmin 4 v3.2 in a Centos 7.3 on Apache webserver as wsgi application with a secure HTTPS connection over your browser, i will use a self-signed certificate, but you can change it with your own.

If you have some trouble to make it work, DO NOT HESITATE to comment here, feel free to ask, anyway we realized a small video located on the bottom of this guide.

System Requirements for Zimbra Installation

Installation step by step

Common Steps to Run Servers Properly

Recent Guides