Want to know a user’s distribution list membership?

$ ldapsearch -xh ldap1.domain.com -D uid=zimbra,cn=admins,cn=zimbra -w pass
-Lb dc=domain,dc=com zimbramailforwardingaddress=morgan@domain.com mail|egrep -i '^mail'|
awk '{print $2}'

(to get your ldap password: $ zmlocalconfig -s|grep ldap_password)

Deleted or re-created a user but forgot to note which lists to which they belonged?
You can get it from an ldap backup:

$ cd /opt/zimbra/backup/sessions/full-date.xxx.xxx/ldap
$ export i=morgan; egrep "^dn:|$i" ldap.bak | grep -B1 -i "zimbraMailForwardingAddress:
${i}@domain.com"|grep uid| cut -d '=' -f2|cut -d ',' -f 1

We chose to configure the Zimbra mtas to only accept mail from certain networks (the av/as appliance and a few servers) and authenticated users.

The base postfix smtpd_recipient_restrictions configuration looks like this:

smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject

Note that Postfix will no longer receive mail destined for the domain(s) for which it is authoritative unless it comes from an authenticated session or a host on $mynetworks. The downside is if mail comes from one of those sources there are no restrictions.

We added some “rejects” to provide better error messages to users and cut down on junk:

smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unlisted_recipient,
reject_invalid_hostname,  reject_non_fqdn_sender, reject_unknown_sender_domain,
permit_sasl_authenticated, permit_mynetworks, reject

Here’s how we configured it within Zimbra: not particularly complex in retrospect but it’s helpful to see all the pieces in one place.

Set smtpd_recipient_restrictions:

$ zmprov mcf zimbraMtaRestriction reject_invalid_hostname zimbraMtaRestriction reject_non_fqdn_sender zimbraMtaRestriction reject_unknown_sender_domain
$ vi /opt/zimbra/conf/postfix_recipient_restrictions.cf
reject_non_fqdn_recipient
permit_sasl_authenticated
permit_mynetworks
reject_unlisted_recipient
[%%contains VAR: ...]
reject

Set mynetworks globally (rather than per mta):

$ zmprov mcf zimbraMtaMyNetworks 127.0.0.1/32,192.168.2.0/24
$ zmprov ms mta01.domain.com zimbramtamynetworks ""
$ zmprov ms mta02.domain.com zimbramtamynetworks ""
$ zmprov ms mta03.domain.com zimbramtamynetworks ""
...

Force users who auth to also use TLS:

$ zmprov mcf zimbraMtaTlsAuthOnly TRUE
$ zmprov ms mta01.domain.com zimbraMtaTlsAuthOnly ""
$ zmprov ms mta02.domain.com zimbraMtaTlsAuthOnly ""
$ zmprov ms mta03.domain.com zimbraMtaTlsAuthOnly ""
...
$ zmprov mcf zimbraMtaSaslAuthEnable TRUE
$ zmprov ms mta01.domain.com zimbraMtaSaslAuthEnable ""
$ zmprov ms mta02.domain.com zimbraMtaSaslAuthEnable ""
$ zmprov ms mta03.domain.com zimbraMtaSaslAuthEnable ""
...

rebuild the configuration and restart the mta:

$ zmmtactl restart

For example: I’m looking to set smtpd_sasl_auth_enable = yes. This setting is controlled by zimbraMtaSaslAuthEnable in zimbra.

However, there are two places to set it:

$ zmprov gs mta01.morganjones.org |grep -i zimbraMtaSaslAuthEnable
zimbraMtaSaslAuthEnable: FALSE
$ zmprov gacf |grep -i zimbraMtaSaslAuthEnable
zimbraMtaSaslAuthEnable: TRUE

If it is FALSE in 'gs' but TRUE in gacf smtpd_sasl_auth_enable will be set to 'no' on mta01 in this example.

So, if you want all your mtas to use auth you simply need to unset zimbraMtaSaslAuthEnable for each mta and set it globally:

$ zmprov ms mta01.morganjones.org zimbraMtaSaslAuthEnable ""
$ zmprov ms mta02.morganjones.org zimbraMtaSaslAuthEnable ""
...
$ zmprov mcf zimbraMtaSaslAuthEnable TRUE

and then restart the mta on each mta host:

$ zmmtactl restart
Rewriting configuration files...done.
Stopping zmmtaconfig...done.
Starting zmmtaconfig...done.
postfix/postfix-script: refreshing the Postfix mail system
Stopping saslauthd...done.
Starting saslauthd...done.
$

install redhat source repository and yum-utils
http://www.cyberciti.biz/faq/yum-download-source-packages-from-rhn

# vi /etc/yum.repos.d/srpm.repo
[rhel-src]
name=Red Hat Enterprise Linux $releasever - $basearch - Source
baseurl=ftp://ftp.redhat.com/pub/redhat/linux/enterprise/$releasever/en/os/SRPMS/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
# yum install yum-utils
# mkdir /usr/src/redhat

get kernel source.

# yumdownloader --source kernel-2.6.18
# tar xfj /usr/src/redhat/SOURCES/linux-2.6.18.tar.bz2 -C /usr/src

get iptables source

# yumdownloader --source iptables
# tar xfj /usr/src/redhat/SOURCES/iptables-1.3.5.tar.bz2 -C /usr/src

get patch-o-matic—we will use it to patch iptables and the kernel.

# wget http://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/patch-o-matic-ng-20070414.tar.bz2
# tar xjf patch-o-matic-ng-20070414.tar.bz2

get the geoip patchlet:

# wget http://people.netfilter.org/peejix/patchlets/geoip.tar.gz
# tar xfz geoip.tar.gz -C patch-o-matic-ng-20070414/patchlets

Apply the geoip patchlet

# cd patch-o-matic-ng-20070414
# KERNEL_DIR=/usr/src/linux-2.6.18/ IPTABLES_DIR=/usr/src/iptables-1.3.5/ ./runme geoip

Loading patchlet definitions.................. done

Welcome to Patch-o-matic ($Revision: 6736 $)!

Kernel:   2.6.18, /usr/src/linux-2.6.18/

Iptables: 1.3.5, /usr/src/iptables-1.3.5
Each patch is a new feature: many have minimal impact, some do not.
Almost every one has bugs, so don't apply what you don't need!
-------------------------------------------------------
Already applied:
Testing geoip... not applied
The geoip patch:
   Author: Samuel Jean ; Nicolas Bouliane 
   Status: Stable

This patch makes possible to match a packet
by its source or destination country.

GeoIP options:
        [!]   --src-cc, --source-country country[,country,country,...]

                        Match packet coming from (one of)
                        the specified country(ies)

        [!]   --dst-cc, --destination-country country[,country,country,...]

                        Match packet going to (one of)
                        the specified country(ies)

           NOTE: The country is inputed by its ISO3166 code.

The only extra files you need is a binary db (geoipdb.bin) & its index file (geoipdb.idx).
Take a look at http://people.netfilter.org/peejix/geoip/howto/geoip-HOWTO.html
for a quick HOWTO.
-----------------------------------------------------------------
Do you want to apply this patch [N/y/t/f/a/r/b/w/q/?] ?
Answer one of the following:
  T to test that the patch will apply cleanly
  Y to apply patch
  N to skip this patch
  F to apply patch even if test fails
  A to restart patch-o-matic in apply mode
  R to restart patch-o-matic in REVERSE mode
  B to walk back one patch in the list
  W to walk forward one patch in the list
  Q to quit immediately
  ? for help
-----------------------------------------------------------------
Do you want to apply this patch [N/y/t/f/a/r/b/w/q/?] T
Patch geoip applies cleanly
-----------------------------------------------------------------
Do you want to apply this patch [N/y/t/f/a/r/b/w/q/?] y

Excellent! Source trees are ready for compilation.

Recompile the kernel image (if there are non-modular netfilter modules).
Recompile the netfilter kernel modules.
Recompile the iptables binaries.
#

Build the kernel module

# cd /usr/src/linux-2.6.18
# make oldconfig
…
    geoip match support (IP_NF_MATCH_GEOIP) [N/m/?] (NEW) m
…
# make modules_prepare

Compile just the netfilter modules

# make -C $(pwd) M=net/ipv4/netfilter/ modules
# cp -i net/ipv4/netfilter/ipt_geoip.ko /lib/modules/2.6.18-128.1.10.el5/kernel/net/ipv4/netfilter/

Build the iptables libipt_geoip.so library

# cd /usr/src/iptables-1.3.5
# make KERNEL_DIR=/usr/src/linux-2.6.18/ extensions/libipt_geoip.so
Making dependencies: please wait...
cc -O2 -Wall -Wunused -I/usr/src/linux-2.6.18//include -Iinclude/ -DIPTABLES_VERSION=\"1.3.5\"  -fPIC -o extensions/libipt_geoip_sh.o -c extensions/libipt_geoip.c
ld -shared  -o extensions/libipt_geoip.so extensions/libipt_geoip_sh.o
# cp extensions/libipt_geoip.so /lib64/iptables

Insert the module into the kernel

# depmod
# modprobe ipt_geoip

Todo: load the module on boot?

Create the IP-country mapping

# wget http://www.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip
# unzip  GeoIPCountryCSV.zip
# wget http://people.netfilter.org/peejix/geoip/tools/csv2bin-20041103.tar.gz
# tar tzf csv2bin-20041103.tar.gz
# cd csv2bin
# make
# ./csv2bin ../GeoIPCountryWhois.csv
# mkdir /var/geoip
# mv geoipdb* /var/geoip

Test
World Cup mania means we happened to have a colleague in South Africa so we blocked the whole country on a test server and had him attempt to connect to https:

# /sbin/iptables -A INPUT -p tcp --dport 443 -m geoip --src-cc ZA -j REJECT

The solution is very simple. On each host running postfix:

As zimbra:

$ vi /opt/zimbra/postfix/conf/main.cf
relay_recipient_maps = ldap:/opt/zimbra/conf/ldap-vam.cf
$ vi /opt/zimbra/conf/zmmta.cf
POSTCONF smtpd_reject_unlisted_recipient yes
$ zmmtactl restart

This works in zcs 5.0.x and 6.0.6. It will likely work in other versions as well.

In February B attended a burn “conference” held on Maui, Hawaii. I am not much of a beach person but it seemed silly to turn down a week of free lodging in Hawaii as I’d never been.

She was busy from 8-12 each day at the conference so I rented a motorcycle and had a look around the island. I rented a Harly Fat Bob the first day which I’m a little embarrassed to admit is a pretty nice motorcycle. Cost and image aside I could consider owning one. The position is leaned way back with your feet and arms stretched far forward.. The forward controls are surprisingly comfortable, the only real disadvantage is that your heels drag in even moderate turns. The passenger accommodations are horrendous.. I suspect some quality time with Sargents would fix the problem but B still complains about how uncomfortable the seat was.

The Harley motor is not unlike the Guzzi motor in that it’s a laid back, torquey twin. It makes it’s max torque very low making in comfortable for just, well, cruising around. It’s plenty fast by real-world standards.

I switched to a Heritage Softtail which I would give about a 7 out 10 for rider position, comfort and style. B really liked the passenger accomodations and it had bags so ultimately was a better choice for us. The riding position was neither laid back nor leaned forward–really just a little further back than a “standard” motorcycle and equally awkward.. The style is just too “classic” for my tastes.. between the huge white fenders and the studs I just felt like a fool riding it around.

The island is surprisingly small, there couldn’t be more than a few hundred miles of paved road and a lot of them are highway that just connect one place to another. A lot of the island is a state park which means there are no shortcuts–if you go down many a road a distance you either have to follow it all the way around the island which can be a multi-hour ride and, as in the case with the road to Hana a washed out dirt road.

We skipped the road to Hana in favor of seeing the rest of the island.. A combination of lack of time and anxiety about piloting a huge Harley though roads that the rental company is apparently not insured for.. So we rode around West Maui and much of central Maui. The stretch from Kahului to Kahakuloa is beautiful on the scale of the Pacific Coast Highway along the Northern California Coast. The surface is pretty bad in spots but it’s very passable.

Another day we took the road to Haleakala which is supremely frustrating with it’s seemingly endless switchbacks, generally cold and dreary demeanor for the first half. The ride pays off however as you break the cloud cover somewhere around 15 miles into the ride and it is clear and sunny with a view of the top of the clouds you just passed through. I remember the revelation of breaking through the clouds and upon arriving at checkpoint to pay the entry fee I enthusiastically asked if breaking out of the clouds so dramatically was common.. The ranger gave me a bored look and simply said, “oh, yes..”

The top of Haleakala is almost exclusively volcanic rock, post of it red. It truly looks like the surface of Mars. It is populated by Nene, which appear to be a strange mix of a goose and a pigeon. They make chirping noises are are relatively tame, likely because people feed them.

We stayed at The Makena Golf and Beach resort, formerly the Maui Prince–an aging independent resort that was in the hands of a slightly neglectful investment group.. It was either for sale or in the process of being sold. The downside is the overpriced restaurants closed early and pretty mediocre menus.. just enough to be considered a restaurant really. The up side was the staff didn’t seem terribly concerned about late night hot tub use.. B and I spent quality time tempting fate with a few beers in the hot tub. We did go up to the Four Seasons one night for dinner but by and large you had to make the 20 minute drive to Kihei for dinner.

Makena is a perfect example of place at the end of a road with no alternate routes–it’s 20 minutes from access to anything else on the island. Not far below the resort was a public beach (Big Beach) which was clearly populated by locals and had an attached seemingly unofficial but far from secret nude beach (Little Beach).. Little Beach also had much better waves.

I can’t stress enough how beautiful Maui’s beaches really are.. the water is a clear blue-green, you can stand neck deep it water and see your feet. The water has got to be 80 degrees in February. It’s really amazing. I don’t like the beach and I found it pleasant.

However if I attempt to connect a pptp or ipsec vpn the connection drops with the error: “Disconnected. Multiple connections are not allowed. Your CDMA connection was terminated.” It behaves the same way if you attempt to connect to a wireless network.

The fix turns out to be simple. In SmartView:
Tools->Settings
click Hardware
select ‘Allow Simultaneous Connections.’

Here’s the link that got me on the right track:
http://forums.juniper.net/t5/SSL-VPN/Sprint-SmartView-disconnects-when-NC-launches/td-p/9579;jsessionid=C56E06204F45FFF85712812235447301

I generally don’t post web links but it’s been slow here on the blog and this is a clever project.

They built a series of simple, nicely designed chairs, left them on the streets of NYC, monitored them via video and GPS to see who took them.

The use case may be obvious but I’ll say it: you write a small utility routine that you want to call as $pack->func(1); and from within the Package as func(1);;

The problem of course is that when called as $pack->func(1); the first arg will the object itself and when called as func(1); from within the package the first arg will be “1.”

There’s a very simple solution:
shift if ((ref $_[0]) eq __PACKAGE__);

Here’s a simple example:

#!/usr/bin/perl -w
#
package Pack;

sub new {
    my $c = shift;

    my $self = {};
    bless $self, $c;
    return $self;
}

sub func {
    shift if ((ref $_[0]) eq __PACKAGE__);
    my $a = shift;

    print "passed in: $a\n";
}

sub call_func {
    print "calling func from inside ", __PACKAGE__, ":\n";
    func(2);
}
1;

my $p = new Pack;

print "calling func from main:\n";
$p->func(1);

$p->call_func();

Try commenting the “shift” line in sub func() and see how it behaves differently.