Installing thawte SSL cert in Zimbra 8.6.0

1. Create csr and keep your key file. Copy the key file to /opt/zimbra/ssl/zimbra/commercial/commercial.key
2. Give or upload your csr file to certificate provider
3. Get certificate given by your cert provider after your csr is accepted.
4. Get the root certificate of your provider. For thawte, mine is here
5. Get intermediate certificate. Mine is here
6. Combine the content of the root and intermediate cert files e.g cat intermediate.crt root.crt > commercial_ca.crt and copy it to dir /opt/zimbra/ssl/zimbra/commercial

Below is the steps to verify that the certificates are ok and ready to deploy. You can skip the first step if you have already create the csr.

Single-Node Commercial Certificate

We need to take care and ask for the Certificate authority for the Root and Intermediate Keys, we will need it soon.

We will use at least 2048-bit key, is the minimum for all Certificate Authorities: 1. Begin by generating a Certificate Signing Request (CSR).

/opt/zimbra/bin/zmcertmgr createcsr comm -new -subject "/C=US/ST=CA/L=Sunnyvale/O=Zimbra/OU=Zimbra Collaboration Suite/CN=host.example.com" -subjectAltNames host.example.com

2. Next, submit the CSR to the SSL provider and get a commercial certificate in PEM format. Save the new certificate to a temporary file (e.g. /tmp/commercial.crt).

3. Now, download and save the root Certificate Authority (CA) from your provider to a temporary file. (e.g. /tmp/ca.crt)

4. Download any intermediary CAs from your provider to a temporary file. (e.g. /tmp/ca_intermediary.crt)

5. Combine root and intermediary CAs into a temporary file.

cat /tmp/ca_intermediary.crt /tmp/ca.crt > /tmp/ca_chain.crt

6. Verify your commercial certificate.

/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /tmp/commercial.crt /tmp/ca_chain.crt
**Verifying /tmp/commercial.crt against
/opt/zimbra/ssl/zimbra/commercial/commercial.key
Certificate (/tmp/commercial.crt) and private key
(/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.
Valid Certificate: /tmp/commercial.crt: OK

7. Deploy your commercial certificate.

/opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/commercial.crt /tmp/ca_chain.crt
** Verifying /tmp/commercial.crt against
/opt/zimbra/ssl/zimbra/commercial/commercial.key
Certificate (/tmp/commercial.crt) and private key
(/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.
Valid Certificate: /tmpt/commercial.crt: OK
**Copying commercial.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt
**Appending CA chain /tmp/ca_chain.crt to
/opt/zimbra/ssl/zimbra/commercial/commercial.crt
**Saving server config key zimbraSSLCeretificate…done.
**Saving server config key zimbraSSLPrivateKey…done.
**Installing mta certificate and key…done.
**Installing slapd certificate and key…done.
**Installing proxy certificate and key…done.
**Creating pkcs12 file /opt/zimbra/ssl/zimbra/jetty.pkcs12…done.
**Creating keystore file /opt/zimbra/mailbox/etc/keystore…done.
**Installing CA to /opt/zimbra/conf/ca…done.

If you get error "unable to get issuer certificate, please look at the steps in the link below.

https://wiki.zimbra.com/wiki/Fix_depth_lookup:unable_to_get_issuer_certificate

Changing display manager on Linux Mint using command

If you used to login to Linux using GUI, it means you were using X display manager. There are many display managers. Among popular ones are gdm, kdm, mdm and lightdm. You can change display manager using gui tools but you can also use command for that purpose. On Linux Mint (and i think on other debian-based distros), you can use this command (say you are using gdm):

dpkg-reconfigure gdm

A dialog will ask you whether you want to change to other installed display managers or not. You can replace mdm with other installed display manager.

That's all there is to it folk. Have fun! :D

Proxmox KVM usb passthrough

Open KVM monitor for your KVM machine in Proxmox GUI or in the command line with the following command:

# qm monitor 168
Entering Qemu Monitor for VM 168 - type 'help' for help
qm> 

Show the usb devices info from your host machine:

qm> info usbhost
  Bus 4, Addr 2, Port 1, Speed 12 Mb/s
    Class 00: USB device 046b:ff10, Virtual Keyboard and Mouse
  Bus 6, Addr 2, Port 2, Speed 1.5 Mb/s
    Class 00: USB device 0624:0294, Dell 03R874
  Bus 2, Addr 3, Port 1, Speed 480 Mb/s
    Class 00: USB device 0930:6533, DataTraveler 2.0
  Auto filters:
    Bus *, Addr *, Port *, ID 0930:6533

According to device “USB device 0930:6533” in the example, add the device to guest machine:

qm> device_add usb-host,id=myusb,vendorid=0x0930,productid=0x6533

Verify that the new usb device is added in your guest:

qm> info usb
  Device 0.1, Port 1, Speed 12 Mb/s, Product QEMU USB Tablet
  Device 0.3, Port 2, Speed 12 Mb/s, Product QEMU USB Hub
  Device 0.4, Port 2.1, Speed 480 Mb/s, Product DataTraveler 2.0

After using it, remove usb device from your guest:

qm> device_del myusb

If you run the command again, you will see the usb device is gone from your guest:

qm> info usb
  Device 0.1, Port 1, Speed 12 Mb/s, Product QEMU USB Tablet
  Device 0.3, Port 2, Speed 12 Mb/s, Product QEMU USB Hub

This has been tested in Proxmox 3.0/957f0862

Source

FreeRDP - The Free Remote Desktop Client for Linux

RDP stands for Remote Desktop Connection. It is a way to connect to Windows desktop/server. Default port is 3389. If you use Linux, there are 2 client programs: 

1. rdekstop is the old client. Support Windows XP,2000,NT,Windows Server 2012 R2.

2. freerdp resumes the work of rdesktop and support new MS authentication for remote desktop.

To connect to Windows, following is the example: 

xfreerdp -u login -p password 192.168.0.5

There are many other options. Just run xfreerdp -h to see them.

mplayer-gui error : Error in skin config file

After installing mplayer-gui package, I can't start it.

$ gmplayer

MPlayer 1.1-4.8 (C) 2000-2012 MPlayer Team

mplayer: could not connect to socket

mplayer: No such file or directory

Failed to open LIRC support. You will not be able to use your remote control.

Error in skin config file on line 6: PNG read error in /usr/share/mplayer/skins/default/main

Config file processing error with skin 'default'

After googling a bit, I found out that it was due to the png files in dir /usr/share/mplayer/skins/default. This is the default skin directory. To fix this error, I have to install ImageMagick package because I want to use the convert program to convert all of the png files to format png24. Thus,

cd /usr/share/mplayer/skins/default; for FILE in *.png ; do sudo convert $FILE -define png:format=png24 $FILE ; done

Rerun gmplayer and all should be fine.

Have fun!

UPDATE (02-10-2017)

It doesn't work on Ubuntu 16.04 (xenial) but there's a workaround here.

You can update your system with unsupported packages from this untrusted PPA by adding ppa:mc3man/mplay-skins to your system's Software Sources. (Read about installing) 

sudo add-apt-repository ppa:mc3man/mplay-skins
sudo apt-get update 

Now just upgrade the related package by running:

sudo apt-get upgrade 

Have fun!

New job, new place and new adventure

I have been working in a new place and environment for almost 6 months now. A lot has happened since in my life and i am very excited to begin blogging again.

I gained new knowledge in many areas of Linux, servers and networking. I dealt with 6 hypervisors here, many virtual machines on them, about 20 vlans, many vpns, many pfsenses, NAS, HAS, AD, win 2012 R2 and zimbra collaboration suite.

I need to master all of this and hopefully with my basic knowledge in Linux, AD and postfix, it will be easier to grasp them.

The most important things here are the bosses and colleagues. So far they are very helpful, friendly and supportive.

I will post more about my Linux work here soon. So stay tuned but don't hold your breath. :D

Cheers.

cannot ssh to server

If you got the following error when trying to connect to ssh server:

me@pluto ~]$ ssh -vvv -l you localhost.localdomain  
OpenSSH_6.2p2, OpenSSL 1.0.1k 8 Jan 2015
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 49: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to localhost.localdomain [192.168.5.11] port 22.
debug1: Connection established.
debug1: identity file /home/zamri/.ssh/identity type -1
debug1: identity file /home/zamri/.ssh/identity-cert type -1
debug1: identity file /home/zamri/.ssh/id_rsa type -1
debug1: identity file /home/zamri/.ssh/id_rsa-cert type -1
debug1: identity file /home/zamri/.ssh/id_dsa type -1
debug1: identity file /home/zamri/.ssh/id_dsa-cert type -1
debug1: identity file /home/zamri/.ssh/id_ecdsa type -1
debug1: identity file /home/zamri/.ssh/id_ecdsa-cert type -1
ssh_exchange_identification: Connection closed by remote host

Try putting this in /etc/host.allow:

sshd:ALL

It solved my problem. Your mileage may vary.