How to disable USB port on Ubuntu

ปิดไม่ให้ใช้อุปกรณ์ USB port สำหรับ H/D external, Flash drive แต่ยังคงใช้อุปกรณ์เมาส์ คีย์บอร์ด USB ได้

For a permanent solution edit /etc/modprobe.d/blacklist and add following line:

  blacklist usb_storage
-------------------------------------------------------------------------------------------------------------------

then save and reboot.

สำหรับ Ubuntu 12.04 - 13.04 ใช้วิธีนี้ block-flash-driver-haddis-external

www.makeuseof.com

Set Postfix with SSL Port 465, 587

แก้ไข #vi /etc/postfix/master.cf

เพิ่มเข้าไปในไฟล์ดังกล่าว

## Enable SMTP on port 587 only for authenticated/TLS clients
submission inet n       -       n       -       -       smtpd
  -o smtpd_enforce_tls=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject

## Enable SMTP on port 465 only for authenticated/SSL clients
smtps     inet  n       -       n       -       -       smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject

Restart Service postfix 

Ref.

www.brandonchecketts.com 

new link: PostfixAndSASL

Command to test smtps -Linux

#openssl s_client -connect mymailserver:myport

#openssl s_client -connect mailserver:465

Command to test smtps -Windows (Powershell)
C:\Windows\system32> cd "C:\Program Files\OpenSSL-Win64"

C:\Program Files\OpenSSL-Win64\bin> .\openssl.exe s_client -connect mail.server.org:465

Ref. testing-smtps-certificate

ถ้าเจอ Err. SASL authentication failure: cannot connect to saslauthd server: No such file or directory 

ให้แก้ไขดังนี้

--------------------------------------------------- 

rm -r /var/run/saslauthd/
mkdir -p /var/spool/postfix/var/run/saslauthd
ln -s /var/spool/postfix/var/run/saslauthd /var/run
chgrp sasl /var/spool/postfix/var/run/saslauthd
adduser postfix sasl

---------------------------------------------------

อ้างอิง www.jimmy.co.at 

Setup Postfix on debian

Read Link

perfect-server-debian-squeeze-ispconfig-2-p4


ตัวอย่างไฟล์ postfix config

cat /etc/postfix/main.cf
##################################################################
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = /usr/share/doc/postfix

# TLS parameters
smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = pop3.sirivatana.co.th
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = pop3.sirivatana.co.th, localhost.sirivatana.co.th, , localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 10.10.10.222
mailbox_command =
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
html_directory = /usr/share/doc/postfix/html
smtpd_sasl_local_domain =
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_tls_auth_only = no
smtp_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
home_mailbox = Maildir/
#######################################################################

Set dovecot with SSL port 995,993

Install Dovecot
Dovecot is POP3/IMAP server which needs MTA like Postfix to work properly.
#aptitude install dovecot-imapd dovecot-pop3d dovecot-common
Dovecot configuration file is located at: /etc/dovecot/dovecot.conf
Before we proceed we need to make some changes with dovecot configuration file. Double check the following entries in the file if the values are entered properly.
Edit the dovecot configuration file using the following command

Edit /etc/dovecot/dovecot.conf file

#vi /etc/dovecot/dovecot.conf
protocols = imap imaps pop3 pop3s
# uncomment this and change to no.
disable_plaintext_auth = no
pop3_uidl_format = %08Xu%08Xv

# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root.
ssl_cert_file = /etc/ssl/certs/dovecot.pem
ssl_key_file = /etc/ssl/private/dovecot.pem

Look for the line that starts with auth default, before that insert the lines below.

auth default {
mechanisms = plain login
passdb pam {
}
userdb passwd {
}
socket listen {
client {
path = /var/spool/postfix/private/auth
mode = 0660
user = postfix
group = postfix
}
}
}
Now, rename previous auth default to auth default2. If you dont rename this then dovecot server will give you error like multiple instances of auth default.


Now, create a user to test our pop3 mail with outlook:
#adduser user_name
Note: Always create a separate user to test your mail or ftp.
Restart Dovecot using the following command
#/etc/init.d/dovecot restart

Ref.
www.debianadmin.com


create a self-signed SSL certificate for the Dovecot

openssl req -new -x509 -days 1000 -nodes -out "/etc/ssl/certs/dovecot.pem" -keyout "/etc/ssl/private/dovecot.pem"

cd /etc/ssl/private
# chown root:dovecot dovecot.pem
# chmod 440 dovecot.pem
# cd /etc/ssl/certs
# chown root:dovecot dovecot.pem
# chmod 440 dovecot.pem

 Ref.
paulschreiber.com 

Postfix Autorespon mail

Set auto reply mail on postfix

www.howtoforge.com

Source Debian 6, 7.5

Source list debain 6

deb http://ftp.th.debian.org/debian/ squeeze main contrib non-free
deb-src http://ftp.th.debian.org/debian/ squeeze main contrib non-free

ตัวนี้ใช้ได้ สำหรับ Debain 6.0.10
** deb http://archive.debian.org/debian/ squeeze contrib main non-free **

Source Liste debian 7.5 Wheezy
# /etc/apt/sources.list :
deb http://ftp.th.debian.org/debian/ wheezy main contrib non-free
deb-src http://ftp.th.debian.org/debian/ wheezy main contrib non-free


Ref
how-to.linuxcareer.com

Remove exim4

วิธีลบโปรแกรมเมล Exim4
1. aptitude search ~i~nexim   แสดงโปรแกรม exim4 มีอะไรบ้าง?
2. aptitude purge ~i~nexim    ลบโปรแกรม exim4


อ้างอิง
forums.debian.net 

Install Joomla

digitalocean.com

Cron [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -type f -cmin +$(/usr/lib/php5/maxlifetime) -delete

วิธีการปิด Cron ดังกล่าวให้แก้ไข 2 ไฟล์คือ
1. /etc/php5/cli/conf.d/ming.ini
ลบบรรทัดแรก # configuration for php MING module ออกไป

2. /etc/php5/cli/conf.d/ps.ini
 ลบบรรทัดแรก # configuration for php ps module ออกไป

Script iptables on mail server

 root@smtp:/home/man# cat /etc/init.d/iptables

---------------------Begin-----------------------------------
 #!/bin/sh
#
# Firewall script for ChilliSpot
# A Wireless LAN Access Point Controller
#
# Uses $EXTIF (eth0) as the external interface (Internet or intranet) and
# $INTIF (eth1) as the internal interface (access points).
#
#
# SUMMARY
# * All connections originating from chilli are allowed.
# * Only ssh is allowed in on external interface.
# * Nothing is allowed in on internal interface.
# * Forwarding is allowed to and from the external interface, but disallowed
#   to and from the internal interface.
# * NAT is enabled on the external interface.

IPTABLES="/sbin/iptables"
EXTIF="eth0"
INTIF="eth1"

$IPTABLES -F
$IPTABLES -F INPUT
$IPTABLES -F FORWARD
$IPTABLES -F OUTPUT

$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT

#Allow related and established on all interfaces (input)
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i lo -j ACCEPT
#$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

#Block ip Spam with IP
$IPTABLES -A INPUT -s 41.203.64.0/24 -p tcp --dport 25 -j DROP
$IPTABLES -A INPUT -s 41.203.64.131 -p tcp --dport 25 -j DROP
$IPTABLES -A INPUT -s 41.203.64.132 -p tcp --dport 25 -j DROP
$IPTABLES -A INPUT -s 41.203.64.133 -p tcp --dport 25 -j DROP
$IPTABLES -A INPUT -s 41.203.64.134 -p tcp --dport 25 -j DROP
$IPTABLES -A INPUT -s 41.203.64.135 -p tcp --dport 25 -j DROP
$IPTABLES -A INPUT -s 67.15.76.50 -p tcp --dport 25 -j DROP
$IPTABLES -A INPUT -s 186.82.169.236 -p tcp --dport 25 -j DROP
$IPTABLES -A INPUT -s 122.164.34.182 -p tcp --dport 25 -j DROP
$IPTABLES -A INPUT -s 89.123.161.227 -p tcp --dport 25 -j DROP
$IPTABLES -A INPUT -s 208.83.136.12 -p tcp --dport 25 -j DROP
$IPTABLES -A INPUT -s 208.83.136.13 -p tcp --dport 25 -j DROP
curl -s http://www.spamhaus.org/drop/drop.lasso |grep ^[1-9]|cut -f 1 -d ' ' | xargs -iX -n 1 /sbin/iptables -A INPUT -s X -p tcp --dport 25 -j DROP

#Allow http and https on other interfaces (input).
$IPTABLES -A INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 22 -i $EXTIF -m state --state NEW -m recent --set
$IPTABLES -A INPUT -p tcp --dport 22 -i $EXTIF -m state --state NEW -m recent --update --seconds 600 --hitcount 3 -j DROP
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 25 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 465 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 110 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 10000 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 3990 --syn -j ACCEPT

# Drop everything to and from $INTIF (forward)
$IPTABLES -A FORWARD -i lo -j ACCEPT

#Protect Syn Flood
$IPTABLES -N syn-flood
$IPTABLES -A syn-flood -i eth0 -m limit --limit 75/s --limit-burst 100 -j RETURN
$IPTABLES -A syn-flood -j LOG --log-prefix "SYN-FLOOD: "
$IPTABLES -A syn-flood -j DROP

-----------------//End//--------------------------------------

Run script boot up!

#update-rc.d iptables defaults

show iptables
#iptables -L --line-number
#iptables -S
#iptables -L -v

Save iptable
1. install package to autosave during install have a question choose Yes to save rule

aptitude install iptables-persistent

2. command: iptables-save

----For Centos----------พิมพ์คำสั่งด้านล่าง service ssh port 55001--------------------------------------

iptables -F

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -p tcp -m tcp --dport 55001 --syn -j ACCEPT

iptables -A INPUT -p tcp --dport 55001 -m state --state NEW -m recent --set

iptables -A INPUT -p tcp --dport 55001 -m state --state NEW -m recent --update --seconds 600 --hitcount 3 -j DROP

iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

-----------------------------------------------------------------------------

#For samba
iptables -A INPUT -p tcp -m tcp --dport 445 --syn -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 139 --syn -j ACCEPT


Ref: digitalocean
Ref: serverfault.com