Disclaimer : You own what you do with this script, and are responsible for it. This script could cause problems with SMTP / mail server administrators, and you should be sure to get any use approved. I make no claims about the scripts fitness for any specific use.

I have several servers that are not allowed to communicate with the outside world. Often times this helps a lot, but it can be a pain when trying to send e-mail alerts. Combine that sometimes I’m not root on these boxes so I can’t simply change the postfix/exim/qmail/sendmail default relay server to something.

The work around is this script, which uses a hard coded SMTP server, so you’ll need to edit the script to change the from, to, and the smtp servers IP.

I haven’t set it to take arguments, as I rarely re-use it for different things. Let me know if you’d benefit from that and I’ll throw them in.

Here is the script in gzipped format

Here is the code of the script :

#!/usr/bin/python
#Author : jon@jonzobrist.com
#License : BSD/public/freeware

import smtplib
import sys

def prompt(prompt):
return raw_input(prompt).strip()

fromaddr = “noreply@example.com”
#toaddrs = ['userA@example.com','userB@example.com','Phone1@txt.att.net','Phone2@txt.att.net','userC@example.com']
toaddrs = ['userA@example.com']
subject = “[ALERT] Alert from localhost”

msg = (“From: %s\r\nTo: %s\r\nSubject: %s\r\n\r\n”
% (fromaddr,toaddrs,subject))
msg = msg + sys.argv[1]
server = smtplib.SMTP(‘server.ip.or.hostname’)
#server.set_debuglevel(1)
server.sendmail(fromaddr, toaddrs, msg)
server.quit()

Enjoy!

Related posts:

1. LCOD 5.29.2011 – 2 quick TCP port check scripts in Python Disclaimer : These scripts could be considered malicious and should...
2. My EC2 EBS RAID-0 creation script I want to write up a full howto/tutorial, but have...

Related posts brought to you by Yet Another Related Posts Plugin.

I write a lot of scripts, configure a lot of systems, and do a lot of snapshot related backup/restore/sync stuff on servers in house, and in the cloud.
Chef is a Ruby-based configuration management engine. There is a good intro here.

I set up a Chef Server. There’s a good overview here.

I followed the instructions to setup a Chef server from this Wiki on Opscode.

I also referred to the information from Grig Gheorghiu’s blog here.

Now that my server is up, I’m hoping to port my server configurations to Chef, with heavy reliance on EC2 and hopefully UEC.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

This will be a quick install to setup your server to e-mail you daily mysql reports using the cool mysqlreport application at hackmysql.com

As the user you want to set this up on, run the following commands.

(Note that I touch and then chmod og-rwx the .my.cnf file, since you’re putting your users mysql password in it, creating it and making it unreadable before editing is always a good idea.)

wget http://hackmysql.com/scripts/mysqlreport
chmod uog+x mysqlreport
mkdir bin logs
mv mysqlreport bin/
touch ~/.my.cnf
chmod og-rwx ~/.my.cnf
vi ~/.my.cnf

Now, put in a client section like this in, you can find your sock file with grep sock /etc/my.cnf, or grep sock /etc/mysql/my.cnf

[client]

user="root"

password="password"

socket=/var/run/mysqld/mysqld.sock

Now, install perl’s DBD::MySQL

Debian/Ubuntu:

sudo su

apt-get install libdbd-mysql-perl

via CPAN/Other Linux/Generic BSD:

perl -MCPAN -e shell

Optional, update CPAN:

install Bundle::CPAN

reload cpan

(If there are errors on following some dependencies exit, and restart your CPAN shell, then start with install Bundle::CPAN)
Install perl DBI

install DBD::mysql
exit

Now, run it to test, you should see a bunch of text output

~/bin/mysqlreport

Now, set it up to run from cron

crontab -e

Add a line like this (this will email to test@example.com a full report nightly at midnight, and put the last nights report in /home/USERNAME/logs/mysqlreport)

0 0 * * * /home/USERNAME/bin/mysqlreport --email test@example.com > /home/USERNAME/logs/mysqlreport.log 2>&1

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Here’s a quick page script for *nix boxes with mail.
I grabbed the mail / file redirect from

http://theos.in/shell-scripting/send-mail-bash-script/


#!/bin/bash
#Author : dougnaka@gmail.comThis e-mail address is being protected from spam bots, you need JavaScript enabled to view it
#Description : Quick alert/page script, edit EMAIL="" to include a comma separated list of emails to send to
#Usage : page.sh "Short or long message"
if [ "${1}" ]
then
SUBJECT="[ALERT] ${1}"
EMAIL=" someone@example.com"
EMAILMESSAGE="/tmp/`date +%s`-message"
echo "ALERT: at `date`" > ${EMAILMESSAGE}
echo "${1}" >> ${EMAILMESSAGE}
echo "From `hostname`" >> ${EMAILMESSAGE}
mail -s "${SUBJECT}" "${EMAIL}" < ${EMAILMESSAGE}
/bin/rm ${EMAILMESSAGE}
else
echo "Usage: ${0} MESSAGE"
exit 1
fi


No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Do you ever try to reformat / repartition disks and Linux complains the kernel is still using the old table and you have to REBOOT (a sin on any *NIX) to fix this?
The error is “WARNING: Re-reading the partition table failed with error 16: Device or resource busy.
The kernel still uses the old table.
The new table will be used at the next reboot.”

This annoys me, what was happening on my Ubuntu 7.10 computer was I had a disk that used to be Linux and I put it into a USB / Firewire enclosure and fdisk’d it and then formatted it, but the automounter sees the partition exists as soon as the kernel rereads the partition table and mounts it. This isn’t safe or a good idea really, so, if you’re going to nuke a disk you should zero out any previous partitions by nuking the master partition table.

THIS IS A POTENTIALLY DANGEROUS OPERATION, YOU PROCEED AT YOUR OWN RISK, I WILL NOT ASSUME LIABILITY FOR LOST DATA OR ANY DAMAGES.

Ok, so make 100% absolutely sure you know the drive letter you’re getting with something like

dmesg | tail

and you’ll see something like

sd 18:0:0:0: [sdf] 488397168 512-byte hardware sectors (250059 MB)
[3010413.606563] sd 18:0:0:0: [sdf] Test WP failed, assume Write Enabled
[3010413.606568] sd 18:0:0:0: [sdf] Assuming drive cache: write through
[3010413.607559] sd 18:0:0:0: [sdf] 488397168 512-byte hardware sectors (250059 MB)
[3010413.608807] sd 18:0:0:0: [sdf] Test WP failed, assume Write Enabled
[3010413.608811] sd 18:0:0:0: [sdf] Assuming drive cache: write through
[3010413.608815] sdf: sdf1 sdf2 < sdf5 >
[3010413.651837] sd 18:0:0:0: [sdf] Attached SCSI disk
[3010413.651880] sd 18:0:0:0: Attached scsi generic sg5 type 0
[3010415.111787] kjournald starting. Commit interval 5 seconds

Now run this (as root), substitude sdf for the device you found. BE WARNED that if Linux didn’t see your disk when you just plugged it in, you may be seeing the detection of an actual file system disk. The best way to tell is to run tail -f /var/log/kern.log (or /var/log/messages or something where the kernel logs, depending on your distribution of Linux)

fdisk -l /dev/sdf

This showed me

Disk /dev/sdf: 250.0 GB, 250059350016 bytes

255 heads, 63 sectors/track, 30401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x000969e0

Device Boot Start End Blocks Id System
/dev/sdf1 * 1 30024 241167748+ 83 Linux
/dev/sdf2 30025 30401 3028252+ 5 Extended
/dev/sdf5 30025 30401 3028221 82 Linux swap / Solaris

Now I check df -h and see that Ubunu already mounted /dev/sdf1 on /media/disk
So I (as root) unmount it with
umount /dev/sdf1

Now I zero the partition table, THIS CAN TOTALLY MESS UP YOUR DISK IN AN UNRECOVERABLE FASHION, SO BE REALLY REALLY REALLY SURE YOU HAVE THE CORRECT DISK DEVICE NODE. IF YOU ARE UNSURE DO NOT PROCEED.
(More info about the master boot record on the wikipedia article here. )

dd if=/dev/zero of=/dev/sdf bs=512 count=1

Now, proceed with creating the partition(s) and formatting
fdisk /dev/sdf
select n,p,enter,enter,w
mkfs.ext3 /dev/sdf1

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

In light of an increase in ssh attacks , vulnerabilities and scans I am writing this guide to help you keep unwanted people from connecting to your server via SSH.

If you have generated any of your SSH keys on a Debian or Ubuntu system they are likely very vulnerable to guessing, e.g. someone could login to your box if they know the name of one of your users that you allow in via ssh within 30 minutes!
See here for more info: http://metasploit.com/users/hdm/tools/debian-openssl/

This applies to any PAM enabled Linux (or other PAM-enabled *nix like OS)

This guide will walk you through configuring your OpenSSH server to only allow public key authentication and limit that to specific users and groups. Errors in this guide or mistakes or differences in system configurations could lock you out of your own systems, be very careful and do not proceed unless you understand and assume the risk you are taking.

I assume no responsibility for YOUR actions. This guide was tested on Ubuntu 7.10 and fairly recent Gentoo system.

1. Limit SSH access to public/private keys only, deny X11 and TCP forwarding, and deny root ssh access
Step 1 Discussion:
Public/Private keys are not necessarily more secure than passwords, but it’s harder to guess a private key, and if your users put passwords on their keys then an attacker must have or guess 2 things, the key and its password.

The root user is GOD on almost every Linux/*nix system out there, and nobody should be able to login directly as root remotely. In addition it’s a very common user, on almost every Linux/*nix system.

TCP and X11 forwarding is one of the coolest features of an ssh server. Unless you want people to be able to use your ssh server like a full access vpn to your local network, or any other network (bounce their attacks through your server), then you want this disabled. And X11 forwarding is great, but I never run an X11 server on something that is a “production” environment. If something requires an X11 server, like Oracle, then I run vncserver and allow ssh port forwarding so people can connect via ssh. I make sure to have full deny by default firewalls on all machines like this, limiting outbound access.

Step 1 HOWTO
Edit /etc/ssh/sshd_config
Make sure the following lines are not commented out, and don’t say something different

Protocol 2
PermitRootLogin no
UsePAM yes
PasswordAuthentication no
PubkeyAuthentication yes
RSAAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication no
AllowTcpForwarding no
X11Forwarding no

2. Create an ssh remote users group and add users to it who need remote ssh access
Step 2 Discussion:
The main reason I want to limit who has remote ssh access is because there are frequently system accounts or other automatically created accounts that I don’t want to have to monitor to make sure the installer didn’t just make a new user with a simple password or key. I want to have the default be nobody can ssh, and then I’ll add ssh permissions to users who need it.

Step 2 HOWTO:
Let’s call our remote ssh users list rsshusers, we create it with the command
groupadd rsshusers
Now let’s say we have a user named mikey already setup, let’s add him to our new rsshusers group, with the command
usermod -a -G rsshusers mikey
Do this for every user you want to have ssh in remotely. Note that if you’re used to logging in remotely as root and are going to stop doing that, make sure you user can su to root with the command su.
Login as the user, run
su
Put in your root password, if it accepts it and you are root (run whoami to verify) then you’re good to go. If it fails to let you su and you’re sure you have the password right you may need to be in the wheel group to us (default on FreeBSD and Gentoo).
Back as root run the following command to add your user (again, mikey in this example) to your wheel group.
usermod -a -G wheel mikey

Now we’re going to edit 2 files to limit remote ssh users to the group we made called rsshusers.
First, edit /etc/pam.d/sshd (this was ssh on my Debian/Ubuntu systems)
Add the line
account required pam_access.so

This enables access accounting based on the /etc/security/access.conf file, which is the next one we are going to edit.
On both my Gentoo and Debian system this file had every line commented out.
At the end I added the following lines.

-:ALL EXCEPT root mikey:LOCAL
+ : (rsshusers) : ALL
- : ALL : ALL

Initially I tried to use a group like @rsshusers, however this didn’t seem to work, but () designates explicitly a group.

Restart sshd
Gentoo:
/etc/init.d/sshd restart
Debian/Ubuntu:
/etc/init.d/ssh restart

Now, without closing your root terminal, open a new one and make sure you can ssh in as mikey, and su to root.

Assuming everything went well you could try ssh’ing in as another user whose public key is correctly in place, but who isn’t in the rsshusers group.

Related links:

PAM:

http://devmanual.gentoo.org/tasks-reference/pam/index.html

http://linuxdocs.org/HOWTOs/User-Authentication-HOWTO/x101.html

http://tldp.org/HOWTO/User-Authentication-HOWTO/

http://www.faqs.org/docs/Linux-HOWTO/Secure-Programs-HOWTO.html

OpenSSH:

http://www.openssh.com/

http://thinkhole.org/wp/2006/10/30/five-steps-to-a-more-secure-ssh/

http://www.cyberciti.biz/tips/rhel-centos-linux-install-configure-rssh-shell.html

http://geekzine.org/2007/09/28/easy-sftp-and-chroot-sftp-with-scponly/

Misc:
Securing RedHat

http://help.unc.edu/?id=1859

Debian SSLkeys

http://wiki.debian.org/SSLkeys

Links in post:

http://www.securityfocus.com/news/11518

http://metasploit.com/users/hdm/tools/debian-openssl/

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

ssh -X -C -f HOSTNAME PROGRAM

Of course you need to be running an X server (Linux/*BSD Desktop) on your client, and you need to have
ForwardX11 yes
or
ForwardX11Trusted yes

in your CLIENT’s /etc/ssh/ssh_config file
and
X11Forwarding yes
in /etc/ssh/sshd_config
on the SERVER.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.