How to mount a NTFS disk in Debian.

Find the disk:

# fdisk -l
Disk /dev/sda: 232.9 GiB, 250059350016 bytes, 488397168 sectors
Disk model: ST3250310AS
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x84c02518

Device     Boot     Start       End   Sectors  Size Id Type
/dev/sda1  *         2048 471801855 471799808  225G 83 Linux
/dev/sda2       471803902 488396799  16592898  7.9G  5 Extended
/dev/sda5       471803904 488396799  16592896  7.9G 82 Linux swap / Solaris


Disk /dev/sdb: 931.5 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: WDC WD10EZRX-00L
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x93665d93

Device     Boot Start        End    Sectors   Size Id Type
/dev/sdb1        2048 1953521663 1953519616 931.5G  7 HPFS/NTFS/exFAT

So, the NTFS is disk sdb1. Find the UUID value.

 sudo blkid  /dev/sdb1
/dev/sdb1: LABEL="Backup" UUID="0CF88F39F88F2056" TYPE="ntfs" PTTYPE="atari" PARTUUID="93665d93-01"

Install NTSF-3G:

# sudo apt-get install ntfs-3g

Create the /mnt/ntfs/ directory

# sudo mkdir -p /mnt/ntfs/

Add to fstab.

# nano /etc/fstab
# UUID="YOUR-UID-HERE" /mnt/ntfs/ ntfs-3g rw,uid=1000,gid=1000,dmask=0002,fmask=0003 0 0
UUID="0CF88F39F88F2056" /mnt/ntfs/ ntfs-3g rw,uid=1000,gid=1000,dmask=0002,fmask=0003 0 0

Test it

# sudo mount -a
# df -h
/dev/sdb1       932G  295G  638G  32% /mnt/ntfs
# cd /mnt/ntfs/
# ls -l

How to use wget to download iso’s directly to proxmox 6.2-14. Here is the location for the iso file. There is 1 ISO – a Debian ISO that I uploaded to the GUI. Login the proxmox host via ssh. Now find the location as follows:

cd /var/lib/vz/template/iso
# ls -la
total 357384
drwxr-xr-x 2 root root      4096 Nov  1 08:41 .
drwxr-xr-x 5 root root      4096 Oct 31 16:35 ..
-rw-r--r-- 1 root root 365953024 Nov  1 08:41 debian-10.6.0-amd64-netinst.iso

Download ubuntu 16.04. You can also specify a directory for the file to download to, as well as choose a name for the download. Use the -O (output) option and enter the directory and file name after the URL.

# wget https://releases.ubuntu.com/16.04/ubuntu-16.04.7-server-amd64.iso -O /var/lib/vz/template/iso/ubuntu-16.04.7-se         rver-amd64.iso
--2020-11-01 11:35:34--  https://releases.ubuntu.com/16.04/ubuntu-16.04.7-server-amd64.iso
Resolving releases.ubuntu.com (releases.ubuntu.com)... 2001:67c:1360:8001::33, 2001:67c:1360:8001::34, 2001:67c:1562::25, ...
Connecting to releases.ubuntu.com (releases.ubuntu.com)|2001:67c:1360:8001::33|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 922746880 (880M) [application/x-iso9660-image]
Saving to: ‘/var/lib/vz/template/iso/ubuntu-16.04.7-server-amd64.iso’
/var/lib/vz/template/iso/ubuntu-16.04.7 100%[==============================================================================>] 880.00M  19.2MB/s    in 91s

2020-11-01 11:37:06 (9.64 MB/s) - ‘/var/lib/vz/template/iso/ubuntu-16.04.7-server-amd64.iso’ saved [922746880/922746880]

After the upload, you can see the new ISO in the GUI at p1 > local (storage) > Content.

Check open ports:

How to identify the processes that are keeping ports open

Windows OS

For Windows operating systems, you can use netstat, which is included with the OS. On the scanned server, open command prompt. Run the command:

netstat -ano

This will list all the network connections on the machine. The last column shows the process ID of the process for the specific network connection. You will probably want to filter this down using the ‘find’ command. For example, if you only want to list the network connections on port 135, use:

netstat -ano | find “:135”

This will list a network connection in LISTENING mode and the id of the process that opened the connection. Use “tasklist /SVC /FI “PID eq xxx” to show the name of the process and service for process id xxx.
For example, if you want to list the information about processed id 7424, use:

tasklist /SVC /FI “PID eq 7424

Here is a simple lamp install script for CentOS 8.

#!/bin/bash
#update system
dnf update
#install apache
dnf install httpd httpd-tools -y
systemctl enable httpd
systemctl start httpd
systemctl status httpd
#update firewall
firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --permanent --zone=public --add-service=https
firewall-cmd --reload
#install mariadb
dnf install mariadb-server mariadb -y
systemctl start mariadb
systemctl enable mariadb
systemctl status mariadb
mysql_secure_installation
# Install PHP 7 on CentOS 8
dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
#dnf install dnf-utils http://rpms.remirepo.net/enterprise/remi-release-8.rpm
#dnf module list php
dnf install php php-opcache php-gd php-curl php-mysqlnd -y
systemctl start php-fpm
systemctl enable php-fpm
systemctl status php-fpm
setsebool -P httpd_execmem 1
systemctl restart httpd

Check the installation

# nano /var/www/html/info.php

Insert the PHP code below and save the file.


[/bash]
Then head out to your browser, and type the URL below. Remember to replace the server IP address with your server’s actual IP address.

http://server-ip-address/info.php

Flushing the DNS cache on Windows 10 is a very easy process and may be needed to connect to web sites that have changed servers. Due to system security permissions, you must ensure that you run the command prompt as an administrator user.

Here is how:

Ensure that you’re on the Windows 10 desktop.
Right click on the start menu and choose Command Prompt (Admin) from the menu.
Type in the command;

ipconfig /flushdns

Here we provide a particularly useful command-line command that shows you which scripts are responsible for outbound mail. For example, when WordPress themes get exploited, you will see a large number of messages coming out of a long directory inside of the user’s WordPress directory. Very large numbers of messages coming from home directories is generally a source of concern.

# grep cwd=/ /var/log/exim_mainlog | cut -d = -f 2 | cut -d " " -f 1 | sort | uniq -c | sort -n

Using Exiqgrep

Much like the exigrep utility we mentioned previously, exiqgrep is also a powerful tool to help you parse through your queue output and retrieve the specific information you’re looking for.

For example, to search through your queue and output only the messages with a specific sender address, you can use the following syntax:

# exiqgrep -f [user]@domain.tld

Above: An example of using exiqgrep with the -f flag followed by a sender address, to specifically identify messages sent by a particular user.

This is particularly useful to identify the source of local spam or to determine what happened after a user reports that a sent message has not arrived (you would first check to see if they are stuck in the queue, then use the logs to find out why).

By Recipient

Need to track down messages by their recipient instead? You can use the exiqgrep command to do this as well. Here, instead of using the -f flag, we would instead use the -r flag (a bit easier to remember, right?).

# exiqgrep -r [user]@domain.tld

Above: An example of an exiqgrep command with the -r flag followed by the recipient you’d like to search the queue for.

This can be useful to investigate when a user reports that an account is no longer receiving mail. Additionally, you can use this to identify when a user has been mail-bombed, and determine if exim has been set to automatically queue messages when over-quota.

By Age

Another handy feature of the exiqgrep utility is to search the queue for messages based on age criteria. Exiqgrep uses flags based on the younger and older terminology, and appropriately uses -o for older, and -y for younger, followed by a number of total seconds.

Two practical examples of this:

# exiqgrep -o 172800

Above: An example of searching the queue for messages older than one day (172,800 seconds).

# exiqgrep -y 1800

Above: An example of searching the queue for messages younger (newer) than 30 minutes (1,800 seconds) old.

Viewing Headers

It can be extremely useful to analyze a message’s header when attempting to determine what exactly happened to that message, or how it was handled by the server.

After acquiring the message’s Exim ID value, you can then use it to specifically output that message’s header using the following syntax:

# exim -Mvh <exim-id>

Above: Using the exim command-line tool with the -Mvh flags (case-sensitive), followed by a valid Exim ID value (the <> braces are simply for the placeholder; these should not exist in the actual command), will print that message’s header information to STDOUT (read: the terminal).

Viewing the Body

Sometimes the header just isn’t enough, and you need to see what the actual contents of the message’s body look like. You can use a very similar format using the exim command-line tool again, but this time with the -Mvb flag set, followed again by the message’s Exim ID.

# exim -Mvb <exim-id>

Above: Using the exim command line tool again but with the -Mvb flag this time, still followed by the Exim ID, to retrieve the contents of the message’s body and print it to STDOUT (I’ll be using this term ‘STDOUT’ more often as we progress; if you’re not familiar with it, just remember for now that it stands for standard output, and essentially means that it prints the text normally to your terminal).

Using xargs

The xargs utility can be extremely useful for creating quick one-liner command. It’s essentially a for loop packaged up into a single command. It works by taking the output from one command, and turning it into a line-by-line execution of another command.

For example, let’s say I’ve got a text file that has a list of files in it, each on their own line.

I could cat that file, then pipe the output to xargs to perform a different operation on each of the files listed. This can be quite useful for handling Exim queue operations in bulk, which we’ll explain in a moment.

Using Pipes

To use an example, one of the most common uses you might run across is for the purposes of either “grepping” (using the grep tool to search through a file) or paging through the output of a command:

# cat /var/log/exim_mainlog | less

Above: An example command used to allow you to scroll through the contents of a log file page-by-page, rather than printing the entire contents to the screen at one time.

# exim -bp | grep SPAM

Above: An example command using a pipe to search the output of exim -bp (the command used to print a summary of each message in the queue, remember?) for any mention of the word “SPAM”, case-intact (though the -i flag of course can be used with grep to remove case sensitivity).

Resending a Message

At times, you may want to attempt to re-send a message that exists in your queue. Maybe it was delayed for some time, but you’re ready to go ahead and try to resend it now, rather than waiting for the scheduled retry. Who knows? It’s your call.

However, to do this, you can use the exim command once again, but this time by simply providing it with the -M flag alone, followed again by the Exim ID.

What can be useful here, though, is the use of this command within a one-liner, by providing the kind of piped output and xargs command that we described before.

Let’s take a look at one practical example:

# exiqgrep -r user@domain.tld -i | xargs exim -M

Above: In this example command that utilizes piping and the xargs command, we’re instructing Exim to provide us with all messages in the queue (exiqgrep) with the recipient designated as user@domain.tld (-r user@domain.tld), and informing the exiqgrep tool that we ONLY want to output the Exim IDs that match (-i).

This, by itself, gives us a basic, line-by-line output of Exim IDs that match messages with user@domain.tld as the recipient address.

So you can probably guess what we’re doing with that next, right? We’re piping (|) that output as input for xargs to perform the exim -M command on each matching message. We know now that exim -M attempts a resend of messages, so we can discern that this full command will try to resend all messages that have the user@domain.tld address as its recipient. All in one fell swoop. Nice, right?

Deleting a Message

Now for the scarier stuff. Well… not-so-scary as long as you take caution to confirm what it is you’re taking action on.

At some point in time, you’ll almost certainly need to delete messages from your queue. When that time comes, it’s likely that it won’t just be a single message, either. You’ll probably need to clear out a large number of messages that you’ve determined as spam or otherwise “bad” mail.

The basic command syntax you would use to do this involves the exim tool again, but with the -Mrm flags this time, and again – as usual – followed by the Exim ID of the message:

# exim -Mrm <exim-id>

Above: The basic syntax for deletion of a message from the queue, based on its Exim ID. Again, we see the pattern (-M followed by rm; just like you’d rm a file from the file system).

So how about doing this as a bulk operation?

Deleting in bulk should of course always be performed with caution. Once you delete mail from your queue, there’s no guarantee that the sender will ever resend it.

So, if you delete a valid message that was intended for a recipient, you’re creating a chance that your user will never receive that mail or the message within it. So basically… be careful.

Let’s look at an example again using a similar circumstance as before.

We’re going to again utilize the exiqgrep command, but this time we’re going to look for all messages with a particular domain in its sender address, using the -f flag, then finally printing only the Exim ID values by specifying the -i flag, as we did before:

# exiqgrep -i -f  @spammer.tld | xargs exim -Mrm

Above: We’re again using xargs to run exim -Mrm (the command to delete messages by Exim ID) on each Exim ID returned from the exiqgrep command that precedes it, which in our case should match all messages with a sender that uses the domain @spammer.tld (they probably could have been a bit more subtle about it, am I right?).

Note again the pipe (|) being used to pipe the output of exiqgrep into the input for xargs.

When in doubt – see https://bradthemad.org/tech/notes/exim_cheatsheet.php

Finding out the Delivery Path of an Address

exim -bt

Another very important exim command line flag we want to make sure and highlight is the -bt flag, which would be followed by a recipient email address.

Exim -bt works like some of the Email Deliverability tests found within the WHM interface. It effectively shows you where exim thinks a message should be going, and how it should get there.

For instance, messages to this user are destined for a local account:

# exim -bt dogs@animals.test
dogs@animals.test
  router = virtual_user, transport = virtual_userdelivery

While messages to this user will leave the server to a remote destination:

# exim -bt noone@gmail.com
noone@gmail.com
  router = lookuphost, transport = remote_smtp
  host gmail-smtp-in.l.google.com      [64.233.169.26]  MX=5
  host alt1.gmail-smtp-in.l.google.com [173.194.219.26] MX=10
  host alt2.gmail-smtp-in.l.google.com [173.194.204.26] MX=20
  host alt3.gmail-smtp-in.l.google.com [74.125.141.26]  MX=30
  host alt4.gmail-smtp-in.l.google.com [64.233.186.26]  MX=40

Notice that the user doesn’t actually need to exist; exim is only checking on the domain part for remote deliveries.

To test, you will need a client and test server. The client server is where we generate the keys.

When we generate keys, there will be a private key and a public key.

Then we copy the public key to the test server. When we ssh to the test server, the private key we have on the client server matches the public key that we copied to the test server.

To generate a new pair of SSH keys that uses Ed25519 algorithm on the client server, run:

# ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/id_ed25519 -C "somename"
Generating public/private ed25519 key pair.
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_ed25519.
Your public key has been saved in /root/.ssh/id_ed25519.pub.
The key fingerprint is:
SHA256:S5mglsGaa7byro5iFvC01VyFt+plsvrt5SLtTTzUHVU geekdecoder
The key's randomart image is:
+--[ED25519 256]--+
|         o.     E|
|   .    o .     .|
|    oo.. . .   . |
|. .o.+o. o.  . ..|
|.ooo+   S.  . . .|
| .oo   .o.oo     |
|  =    ..*  =    |
|+= .    +.o= .   |
|B*+   .o.++.o    |
+----[SHA256]-----+

-f
Specifies filename of the keyfile, used for specifying other than default name
-a
number of primality test while screening DH-GEX candidates
-t
type of key (RSA, ED25519, DSA, etc)
-C
Comment (not used in algorithm, only used in public key)
-o
openSSH key format instead of older PEM (needs OpenSSH 6.5+)

If your account on the remote system doesn’t already contain a ~/.ssh/authorized_keys file, create one; on the command line, enter the following commands:

# mkdir -p ~/.ssh
# touch ~/.ssh/authorized_keys

On Client, Copy Public SSH Key (id_ed25519.pub) to Remote Server
Using the command “ssh-copy-id” is the preferred way. You will need to have ssh access to the server to copy the key.

Here is the command:

# ssh-copy-id -i ~/.ssh/id_ed25519.pub root@server1.server.com -p22

Now try logging into the machine, with:

"ssh -p '22' 'root@server1.server.com'"

Check to make sure that only the key(s) you wanted were added.

Adding Your Key to SSH Agent

You can find your newly generated private key at ~/.ssh/id_ed25519 and your public key at ~/.ssh/id_ed25519.pub. Always remember that your public key is the one that you copy to the target host for authentication.

Before adding your new private key to the SSH agent, make sure that the SSH agent is running by executing the following command:

# eval "$(ssh-agent -s)"

Then run the following command to add your newly generated Ed25519 key to SSH agent:

#ssh-add ~/.ssh/id_ed25519

Or if you want to add all of the available keys under the default .ssh directory, simply run:

# ssh-add

If you want to just login to the server with the hostname vs the full domain like:

ssh “server1” vs “ssh -p ’22’ ‘root@server.com'”, then add a hostname entry to the client with the following:

# nano /etc/hosts
ip.of.the.server  server1.server.com        server1

Now try the short ssh:

# ssh server1

Recently, I had the task of importing emails form a cPanel email account to Outlook. This was after the DNS had changed to the office365 servers (mail.protection.outlook.com). There is no export from Horde to PST format – only MBOX. So, there are 3rd party programs to take the MBOX and Convert to PST, but I wanted a solution that was free.

So here are the requirements:

  1. Have Outlook installed and the DNS changed to the new office 365 MX Records.
  2. Have the email set up on Office365 (In this example – user1@testdomain.com).
  3. IP Address of the cPanel Server

So, our test domain changes are set up as follows:

Old DNS Settings:

# dig mx ptestdomain.com +short
0 mail.testdomain.com.

New DNS Setting:

# dig mx testdomain.com +short
0 testdomain-com.mail.protection.outlook.com.

Now, we need to add the old email to outlook.

For this example, the email is: user1@testdomain.com
Since user1@testdomain.com is already set up in outlook, we need to add this email from the old server, but we change the name a bit – use a name – such as “old-user1@testdomain.com”. This is due to Outlook not allowing 2 emails the same. It’s OK, we can change it later.

Here are the steps.

You will need the IP of the cPanel account where the email is stored.
Add the email “old-user1@testdomain.com” to outlook.

Change the name a bit so we can add it.

Choose POP3

Now use the IP address for the old cPanel server for the Incoming and Outgoing mail servers. Ports 110 and 25. You can use port 587 for outgoing if needed.:

Enter password and complete.

Now a Popup appears for the username and password. Enter in the original cPanel username which is the old email name and password.

Now, go to Outlook and let’s change the settings.

Click the drop down and click “Account Settings”. A popup appears. Select the new account and click “Change”. Keep the names as you can separate this from the new outlook email. Make sure the Mail Settings are set to Leave a copy on server. Click “Next” and “Done”.

Now, send and receive. The email should populate in the new folders. Once completed, you can create a new folder (ex., cpanel-mail) under the outlook email and drag the emails to there and drop them to move them to the new outlook folder. Once moved, they will reside on the outlook server.

Create a folder C:\Esxibuild

Download to C:\Esxibuild
VMware vSphere Hypervisor (ESXi) 6.7U3b Bundle (not the ISO).
https://my.vmware.com/web/vmware/details?downloadGroup=ESXI67U3B&productId=742

Download the Realtek Drivers:
https://vibsdepot.v-front.de/wiki/index.php/List_of_currently_available_ESXi_packages
(For this one, I used the net55-r8168-8.045a-napi-offline_bundle)

Here is what the files look like:

Download and install the VMware PowerCLI
https://my.vmware.com/group/vmware/details?productId=614&downloadGroup=PCLI650R1

Open powershell. Got to the folder C:\Esxibuild in PS.

Add the VMware Modules for Powershell:

Get-Module -ListAvailable VM* | Import-Module

Check Modules:

$env:PSModulePath.Split(‘;’)

Import Modules:

Get-Module -ListAvailable VM* | Import-Module

Find the build information. Open the compressed file for the Esxi bundle you downloaded: c:\esxibuild > ESXi670-201912001 > metadata > profiles. There should be 4 profiles. Copy the path for the next commands.

Change your paths to match.
run:

Add-EsxSoftwareDepot "C:\esxibuild\net55-r8168-8.045a-napi-offline_bundle.zip", "C:\esxibuild\ESXi670-201912001.zip"

Get-EsxImageProfile

New-EsxImageProfile -CloneProfile ESXi-6.7.0-20191204001-standard -name ESXi-6.7.0-20191204001-standard-RTL8111 -Vendor Razz

Set-EsxImageProfile -ImageProfile ESXi-6.7.0-20191204001-standard-RTL8111 -AcceptanceLevel CommunitySupported

Get-EsxSoftwarePackage | Where {$_.Vendor -eq "Realtek"}

Add-EsxSoftwarePackage -ImageProfile ESXi-6.7.0-20191204001-standard-RTL8111 -SoftwarePackage net55-r8168

Export-EsxImageProfile -ImageProfile ESXi-6.7.0-20191204001-standard-RTL8111 -ExportToIso -filepath C:\esxibuild\VMware-ESXi-6.7.0-8169922-RTL8111.iso

Now, there should be an ISO to burn.

Other sources: https://www.sysadminstories.com/2018/08/adding-realtek-8111-driver-to-vsphere.html