January 29

CXS scan with quarantine – 1 line

mkdir -pv /reports;cxs --qcreate --quarantine /home/quarantine;cxs -U;cxs --logfile /var/log/cxs.log --exploitscan --virusscan --sversionscan --bayes -I /etc/cxs/cxs.ignore -Q /home/quarantine --options mMOLfSGchexdnwZRD --voptions mfuhexT --qoptions Mv -Z --www --summary --html --ssl -C /var/clamd --nofallback -T 5 --allusers --quiet --report /reports/full_malware_scan_`date +%d.%m.%Y`.txt

February 14

How to check DNS zone syntax for domain in Bind (named)

find the issue:
named-checkzone somedomain.com /var/named/somedomain.com.db
zone somedomain.com/IN: NS 'ns1.somedomain.com' has no address records (A or AAAA)
zone somedomain.com/IN: NS 'ns2.somedomain.com' has no address records (A or AAAA)
zone somedomain.com/IN: not loaded due to errors.

when it fixed:
named-checkzone somedomain.com /var/named/somedomain.com.db
zone somedomain.com/IN: loaded serial 2020021308
OK

January 29

Replacing the HDD in software raid (mdadm tool)

I have faced the issue on one of my servers where I am using software RAID5.
One of the drives has died, so we replace it with a new one.

However, after that, we need to put it to a raid and recover the normal work, so:

1. We need to create exactly the same structure on the new drive that we are using for the rest of them:

sfdisk -d /dev/sda | sfdisk /dev/sdc
Where SDA is an old one inside the RAID and SDC is a new one (we are copy structure to it)

2. Also, the second issue was discovered – one of the arrays (MD0) is going to an inactive state. To fix it need to do the following:

2.1 stop it
mdadm --stop /dev/md0

2.2 assemble them once again
mdadm --assemble --force /dev/md0 /dev/sd[abd]1

3. readd the new HDD to a RAID array:
mdadm --manage /dev/md0 --add /dev/sdc1
mdadm --manage /dev/md1 --add /dev/sdc2
mdadm --manage /dev/md2 --add /dev/sdc3

Note: Better to start from the small arrays because it can be synced only in a step by step mode. So we can sync small arrays quickly.

August 26

Deny any email from web scripts or users via localhost. Only root can send it

A lot of the issue and issues with the spam can happen if the user can send the emails without authorization. In order to prevent the issue, we can block them:

In the end of acl_check_not_smtp, before accept section need to add the following code:
#############################
accept condition = ${if eq{$originator_uid}{0}}
drop message = Local users can't send mail
#############################

It will prevent all emails except the emails from the root.

The second way, you can limit it, via the following lines:
#############################
deny message = Sender rate overlimit - $sender_rate / $sender_rate_period
ratelimit = 10 / 1h / strict
#############################

It means that only 10 emails can be sent via users or web scripts without authorization in 1 hour.

But only 1 way can be used, it is not possible to mix it.