Matt Gibson » Howto

Setting up Split-Split DNS with Windows SBS 2003 DNS Services, easily.

Matt G — Sun, 13 Jul 2008 09:23:33 +0000

Have you ever wondered how you could access your external hostnames, internal to your network connected via wifi, mobile devices or just plain old desktops? Today we found out we needed to. Our mobile devices require the use of external hostnames to sync data against. And it’s nice being able to use our external hostname for Outlook Web Access, and debugging internally.

For example:

Billy wants to visit http://www.mycompanyname.com
Billy can’t because that particular site is hosted off the external IP of the network he’s on. Gosh, what to do?
Billy Reads the Howto Setup SPLIT-SPLIT DNS with SBS 2003 DNS Server below
Billy can now visit http://www.mycompanyname.com because it’s mapped to the internal ip of 192.168.1.1 or whatever your networking scheme is.
Billy is now happy.

Off we went to Google, to try and find out what we needed; DNS Redirection? No, IP Port Redirection? No, Redirect External IP to Local IP, No. Tiresom it was, searching for this.

Then we decided to try and jump right in to figuring it out. First, we tried doing it at the router level, but none of us are IOS guru’s so this quickly became out of the question. Next we tried running a secondary DNS server on the SBS2K3 Server, and transferring the domain from our live server at the Datacenter in Seattle. This also didn’t work because once the domain was transferred into our secondary DNS on the Windows 2003 Server we weren’t able to edit any of the records. Pitty.

So, on we were to IRC. Ahhh, IRC. Not too many people use it anymore, but usually really cool people are available to help out. After asking in a couple channels we figured out that what we needed to do was set up something called Split-Split DNS. Basically all this is, is the method of running two DNS Servers. One inside your network, and one external to your network. Here’s a Microsoft Article on the subject of Enterprise DNS Design which involves Split-Split DNS. This allows for internal hosts behind NAT networks to see external hostnames as if they are on the internal network.

With a bit more searching we came across this excellent post by Ginger Lime. Using their instructions we have created a simple howto for doing the same thing on your internal domain.

With our little howto, you’ll be able to get this done quickly and easily on your internal windows sbs 2003 domain name server. Please readon for the howto.

First, we’ll have to open the DNS control panel. This is in the main server management console, under the computer management box. Here’s a screenshot. Make sure you enter into the Forward Lookup Zones box.

Now, right click on “Forward Lookup Zones” and click on “Add New Zone“. Like This.

Now you’ll be presented with the New Zone Wizard window. Click Next.

Now, Select a primary Zone for this tutorial.

Disable the storage of the information in Active Directory. Click Next.

Now type in your domain name that you want to resolve internally. Some common ones might be dev.yourdomain.com or www.yourdomain.com or similar. Click Next.

This window will be automatically filled out for you. Just click Next.

Now, make sure you don’t allow dynamic updates. This record is something you should be manually updating only. Click Next.

Your new zone is complete. Click Finish.

Now, Right Click your new zone (external.hostname.com), and select to “New Host (A)”. Let go of your mouse button now.

Now, add your internal IP address to the host, but leave the Name blank. Like this. Also leave the PTR record one un-checked since we don’t need it. Click Add Host.

You should see a message like this pop up.

Click on the Done button to leave this window.

Now you should see a blank host, with the internal IP address you specified during the last section of this tutorial.

Now you’re finished setting up a SPLIT-SPLIT DNS server using SBS2k3.

Go over to a different computer on your network that uses the Windows 2003 SBS Server as it’s DNS Controller, and try a nslookup or ping against the external hostname you’ve just added. If you get ping returns you’re good to go.

Using SSL POP3 (Google Apps/Gmail) with Kayako SupportSuite

Matt G — Fri, 20 Jun 2008 04:02:25 +0000

Many of us need to run Support Software to keep on top of client needs and requests, as well as remove some of the burden from our support staff.

Because of this need, we are using Kayako SupportSuite for our helpdesk application. While setting it up, we noticed that the latest release has a little bit of an issue with fetching mail using google’s pop3 service.

We haven’t looked into the problem too much, but we have noted that there is mention of it on the Kayako Forums that other users are experiencing the same difficulties.

Of course, we made sure our PHP installation was indeed compiled with SSL and IMAP and IMAP-SSL support, but this still did not fix the problem. So far, this is the only “solution” given by the Kayako support representatives.

Well, we actually wanted it to work, so we dug a little furthur into it. As it turns out, it’s not actually Kayako’s fault that this doesn’t work, but merely a not-so-great implementation of SSL/POP3 in PHP. Kayako could work around this, and are aware of the problem so we assume it will get fixed in future releases.

We did get IMAP SSL working using the Kayako fetching script, but IMAP is not perfect for support queues. So, we still wanted to get POP3 working. No matter what was tried, we could not get it to work.

Then, an ephinany hit – we also use Microsoft Small Business Server on our Intranet, and we ran into this problem previously with Exchange server not being able to communicate with SSL enabled mail hosts.

So, we introduced the same hack that we did on the Microsoft Exchange Server, to our Kayako SupportSuite Linux Server.

We used Stunnel.

Elegant? No. Best Solution Ever? No. Does it work? So far, flawlessly.

It’s very easy to setup, and get going. Here is what we had to do under Gentoo Linux.

First we made sure our use flags were proper

# emerge -pv stunnel

Which outputs this

net-misc/stunnel-4.21-r1 USE=”ssl tcpd -ipv6 (-selinux)”

This looks fine, we need tcpd, and ssl. Now we install stunnel.

# emerge stunnel

Then we have to configure some options, which are very straight forward

# nano /etc/stunnel/stunnel.conf

Now we make the file look like this

setuid = stunnel
setgid = stunnel
pid = /var/run/stunnel/stunnel.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
output = stunnel.log
client = yes
debug = 7

[pop3s]
accept = 127.0.0.1:1109
connect = pop.gmail.com:995

[smtps]
accept = 127.0.0.1:259
connect = smtp.gmail.com:465

Save and exit the file. These lines will make the SMTP-SSL server listen on localhost port 259, and connect out to gmail at port 465. The POP-SSL will be listening on localhost port 1109, connecting out to gmail on port 995.

That’s it for the stunnel configuration. You can start it up like so.

# /etc/init.d/stunnel start

Now add it to your defaults so it will auto start

# rc-update add stunnel default

So, we’re done with the stunnel configuration. Now we’ll need to configure Kayako so make use of this.

Login to your Kayako Administration Interface
Click on Settings on the left menu
Click on CPU Optimization & Server
Scroll down to “SMTP Settings” and make sure it’s the following:Enable SMTP: Yes
SMTP Host: 127.0.0.1
SMTP Port: 259
Use SMTP Authentication: Yes
SMTP Username: youraddress@gmail.com (or youraddress@yourdomain.com)
SMTP Password: yourpassword
Click Update Settings.

Now we’re done with the SMTP setup, so we’ll have to setup your email queues with the proper information. We’ll assume you’ve already read the Kayako documentation on email queues and will not go into them here.

Still in the Kayako Administration Interface Click Mail Parser on the left menu
Now click on Manage E-mail Queues from the dropdown menu
Click on your Email Queue (for example: support@yourdomain.com) or create a new one
Scroll down to Login Information and ensure these settings are configured:Host: 127.0.0.1
Port: 1109
Username: youraddress@gmail.com (or youraddress@yourdomain.com)
Password: yourpassword
Configure any other options for your email queue.
Scroll down and click on Update to save your changes.
Repeat with any other email queues changing the email address/password for each account.

Now you are finished the Kayako configuration. You should be able to run your administrative cron script to check for new mail. Check the Scheduled Tasks -> Task Log to verify that your mail is being fetched. If you don’t know what we’re talking about here, you haven’t read the Kayako documentation, and should do so now.

We’ve been using this for a few weeks now and haven’t had an issue. It’s cronned to check mail every 2 minutes, and we have the added benefit of Google Apps archiving all incoming mail for us automatically before Kayako picks it up for delivery.

Hope you like the tutorial, we welcome feedback in the comments.

Monitoring Asterisk with SNMP, Nagios and Nagios Administrator using Ubuntu LTS 8.0.4 Server

Matt G — Thu, 19 Jun 2008 09:24:17 +0000

Gone are the days of tedious console only configuration of Nagios. While it’s an excellent system monitoring tool, it can be a little daunting to configure and setup. Not to mention editing 5 or 6 configuration files when adding one host.

In April 2008, Nagios Administrator was released, which promises to deliver an easy to use administration interface for configuring your Nagios installation with ease. The interface allows for adding contacts, contact groups, services, operating systems, and other settings. The one thing we noticed that was missing was service groups, but we’re not sure that really matters.

Using this article in conjunction with our previous Monitoring Asterisk with SNMP article will yeild you great results and awesome statistics.

Since there is already a demo running of the Nagios Administrator, I don’t think I need to show you screenshots, instead here is a link from their site.

NagiosAdministrator: http://demo.nagiosadmin.de
Nagios: http://demo.nagiosadmin.de/nagios

Username: nagiosadmin
Password: nagiosadmin

We installed this on a VMWare Appliance, running Ubuntu Server Edition LTS 8.04, so you may have to change the instructions to suit your particular flavour of Linux. Or Microsoft Windows if you’re brave enough to try this on that OS.

Anyhow, now on to the tutorial on getting Nagios 3.0 running with Nagios Administrator on your Ubuntu Server.

First, with the help of Michel Sigloch, we have this from a script of his that we’ve edited. This will install Nagios 3.0 from source on your ubuntu server, since the apt tree still holds an older version.

Installing Nagios

Start with the preliminaries:

# sudo apt-get install apache2 build-essential wget perl libgd2-xpm-dev openssl libssl-dev openssh-server openssh-client ntpdate snmp smbclient libldap-2.3-0 libldap2-dev mysql-server libmysqlclient15-dev qstat libnet-snmp-perl mrtg nut unzip
# sudo userdel -f nagios
# sudo useradd -c “Nagios Admin” nagios
# sudo groupadd nagcmd
# sudo usermod -G nagcmd nagios
# sudo usermod -G nagcmd www-data
# sudo usermod -a -G nagios www-data

Then We’ll setup the Nagios directories and configure Nagios.

# sudo mkdir /usr/local/src
# cd /usr/local/src
# sudo wget http://nagios.sourceforge.net/download/cvs/nagios-cvs.tar.gz
# sudo tar xvzf nagios-cvs.tar.gz
# sudo rm nagios-cvs.tar.gz
# cd nagios-cvs
# sudo ./configure –with-command-group=nagcmd

Now lets install Nagios and update the default boot programs, while restarting apache and Nagios

# sudo make all
# sudo make install
# sudo make install-init
# sudo make install-commandmode
# sudo make install-config
# sudo ln -sf /usr/local/nagios/etc/ /etc/nagios
# sudo make install-webconf

Next we’ll setup our htaccess file:

# sudo htpasswd -c /etc/nagios/htpasswd.users nagiosadmin
# sudo chown www-data htpasswd.users
# sudo chmod 600 htpasswd.users

Download and configure nagios plugins. The plugins are what let you monitor things like your Asterisk PBX using SNMP or other methods.

# cd /usr/local/src
# sudo wget http://heanet.dl.sourceforge.net/sourceforge/nagiosplug/nagios-plugins-1.4.11.tar.gz
# sudo tar xvzf nagios-plugins-1.4.11.tar.gz
# cd nagios-plugins-1.4.11
# sudo ./configure –with-nagios-user=nagios –with-nagios-group=nagios
# sudo make
# sudo make install

Now we are pretty much done with Nagios setup. We can move on to setting up Nagios Administrator. This part of the process can be a little confusing since their documentation is in german. I taught myself a bit of german last night reading this, but I decyphered it for us to use it. Keep reading for the Nagios Administrator Setup portion.

Configuring and installing Nagios Administrator

First, we’ll have to install any pre-requisite packages for Nagios Administrator:

# sudo apt-get install php5-common traceroute php5-cli php5-gd

Now lets create our web directory

# sudo mkdir /var/www/nagiosadmin

Now we can download our Nagios Administrator files and drop them into the web directory on our server.

# cd /usr/src
# sudo wget http://www.nagiosadmin.de/nagiosadmin-0.9.1.tar.bz2
# sudo tar xjpf nagiosadmin-0.9.1.tar.bz2 -C /var/www/nagiosadmin/

Now we’ll create the mysql database. Like this

# mysqladmin -u root -p create nagiosadmin
# mysql -u root -p

mysql> GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,ALTER,INDEX,DROP
ON nagiosadmin.*
TO ‘nagiosadmin’@'localhost’
IDENTIFIED BY ‘somepassword’;

Now we have to configure Nagios Administrator to connect to our Database.

# cd /var/www/nagiosadmin
# nano config/propel.ini

and set

propel.database.url = mysql://nagiosadmin:yourpassword@localhost/nagiosadmin

Now we edit the databases file and enter our database settings

# sudo nano config/databases.yml

and set

database: nagiosadmin
username: nagiosadmin
password: yourpassword

Now we have to make sure our Nagios shell commands are set properly in Nagios Administrator.

# sudo nano apps/backend/modules/generator/config/module.yml

and make sure your paths are correct for these two lines

config_check_command: /usr/local/nagios/bin/nagios -v /etc/nagios/nagios.cfg 2>&1
reload_nagios_command: /usr/bin/sudo /usr/bin/killall -HUP nagios

Now we have to enter visudo to set up the permissions for our Nagios user, done like this:

# sudo visudo

then add

# for nagios
%nagcmd ALL= NOPASSWD: /usr/bin/killall -HUP nagios

Exit visudo by hitting the ESC key, and then typing “:wq” hitting enter.

Now, We have to do a few things that are pretty self explanitory with the Nagios Administrator control file.

# cd /var/www/nagiosadmin
# sudo ./symfony fix-perms
# sudo ./symfony propel-insert-sql
# sudo ./symfony propel-load-data backend
# sudo ./symfony check

Next we’ll have to insert our Apache virtual host.

# sudo nano /etc/apache2/conf.d/nagios.conf

Make sure you enter this line, and change the path to match your install if you changed the above instructions

Alias /nagios/images/logos/nagiosimages /var/www/nagiosadmin/web/uploads/os_images

Also, in the default settings, make sure to change all of the references to the htpasswd file to the following

AuthUserFile /etc/nagios/htpasswd.users

Now, lets setup the new virtual host for our Nagios Administrator and Nagios site.

# sudo mv /etc/apache2/sites-enabled/000-default ~/000-default.backup
# sudo rm /etc/apache2/sites-enabled/000-default

Now we have to add our new default virtual host configuration like so

# sudo touch /etc/apache2/sites-enabled/nagios.conf

Enter the following, changing any paths as according to your configuration if you deviated from above.

ServerAdmin root@yourdomain.com
ServerName monitor.yourdomain.com
DocumentRoot “/var/www/nagiosadmin/web”
php_admin_flag magic_quotes_gpc 0
php_admin_value memory_limit “32M”

AllowOverride All
Order allow,deny
Allow from all

AuthType Basic
AuthName “NagiosAdmin”
AuthUserFile /etc/nagios/htpasswd.users
require user nagiosadmin

Alias /phpmyadmin /var/www/phpmyadmin

AllowOverride All
Order allow,deny
Allow from all

Now we have to enable mod rewrite like this

# sudo mod_rewrite aktivieren

And next lets restart Apache

# sudo /etc/init.d/apache2 restart

Configuring Nagios 3.0 to work with Nagios Administrator

Now we have to make some quick edits to the nagios configuration and we’ll be up and running in no time.

First lets edit the Nagios configuration file

# nano /etc/nagios/nagios.cfg

Now make sure yours looks like the following, commenting out the ones that are on by default and adding the new Nagios Administrator directory at the bottom.

#cfg_file=/usr/local/nagios/etc/objects/commands.cfg
#cfg_file=/usr/local/nagios/etc/objects/contacts.cfg
cfg_file=/usr/local/nagios/etc/objects/timeperiods.cfg
#cfg_file=/usr/local/nagios/etc/objects/templates.cfg

# Definitions for monitoring the local (Linux) host
#cfg_file=/usr/local/nagios/etc/objects/localhost.cfg

#cfg_dir=/usr/local/nagios/etc/servers
#cfg_dir=/usr/local/nagios/etc/printers
#cfg_dir=/usr/local/nagios/etc/switches
#cfg_dir=/usr/local/nagios/etc/routers
cfg_dir=/var/www/nagiosadmin/data/nagios

Now, before starting nagios for the first time, lets go into the configuration interface and set up some default values.

Open a web browser and hit this url:

http://monitor.yourdomain.com/

You should see the login box for your Nagios Administrator site, which you can login with “nagiosadmin” and the password you entered earlier.

Once you login to the site, you will have to configure the following things:

contacts -> create -> make one or two contacts
contact groups -> create -> create a contact group, and assign some contacts to it
host groups -> create -> create a host group
host -> create -> create some hosts

Now, go to the “Generator” Menu, and click on “Save”.

Now, go back to your command prompt, and start Nagios. It should start with no errors.

# sudo /etc/init.d/nagios start

Now, go back to the web interface, you should be able to save and generate your configuration file with no errors.

Finally, add Nagios to your default runlevel

# sudo update-rc.d nagios defaults

Congratulations, we’re finished!

We are now finished with the setup. It’s up to you to setup proper security measures for the Nagios Administrator and Nagios site.

You can visit the Nagios Administrator panel here:

http://monitor.yourdomain.com/

and you can visit Nagios here

http://monitor.yourdomain.com/nagios/

Remember, you can also take a look at our Monitoring Asterisk with SNMP Howto for information on getting even more statistics from your Asterisk PBX than you ever thought possible. We hope you like this article, and welcome comments.

Ubuntu Server LTS 8.04 VMWare VMTools Howto and Tutorial

Matt G — Tue, 17 Jun 2008 05:57:26 +0000

You may have some difficulty with Ubuntu Server and VMWare Tools. Here’s how we got it working in the end:

start vm
# sudo mount /cdrom
# cd /cdrom
# cp *.tgz /tmp
# cd /tmp
# apt-get install build-essentials
# apt-get install linux-headers-`uname -r`
# tar xzvf vmtools
# cd vmtools
# perl vmware-install.pl

That’s it. You might want to modify your console settings so you can get 1024×768 from VMWare Workstation, but it’s not really required if you’re just SSH’ing to it.

How to fix your hackable SSH on Debian and Ubuntu Servers

Matt G — Thu, 15 May 2008 17:55:53 +0000

If you’re running debian or ubuntu, your ssh keys are vulnerable. Follow these steps to regenerate them and secure your box back up.

apt-get update
apt-get upgrade
cd /etc/ssh/
rm ssh_host_dsa_key
rm ssh_host_dsa_key.pub
rm ssh_host_rsa_key
rm ssh_host_rsa_key.pub
ssh-keygen -t dsa (filename as /etc/ssh/ssh_host_dsa_key)
ssh-keygen -t rsa (filename as /etc/ssh/ssh_host_rsa_key)
/etc/init.d/ssh restart

Adding TinyMCE to your ProjectPier or ActiveCollab Installation

Matt G — Sat, 19 Apr 2008 20:59:14 +0000

Many of you are project managers, and may be using Activecollab or ProjectPier.

We were tired of their lame editor, so we decided to add TinyMCE into our installed version, both for ease of client use, and internal use.

The instructions are very simple.

1. Go to ProjectPier, grab the latest version (or svn)

2. Install ProjectPier as you would normally

3. Install any custom patches or addons to project pier.

4. Download TinyMCE

5. Uncompress TinyMCE, and enter the newly extracted directory. You will see a javascript directory. Rename this to tiny_mce.

6. Copy your newly renamed “tiny_mce” directory to the root of your ProjectPier installation.

# cp -R tiny_mce /var/www/yoursite/htdocs/projectpier/

7. Now, this is the only “complicated” part. Go into your ProjectPier installation directory, and then enter the applications directory. Like this.

# cd /var/www/yoursite/htdocs/projectpier/
# cd application
# cd layouts

8. Now you’re going to want to edit three files

# nano administration.php dashboard.php project_website.php

9. Now in these files, you’re going to want to add the include for tiny_mce. Add the following code after the last “add_javascript_to_page” line at the top of each file and then you are done.

10. That’s It! You are finished adding TinyMCE to your Project Management Installation! It should look something like this.

Enjoy!