Tuesday, March 29, 2011

Qmail-Scanner With ClamAV And SpamAssassin On Ubuntu


In continuation of my document http://www.howtoforge.com/qmail-openldap-on-ubuntu about setting up qmail-ldap on Ubuntu this document will help you to set up Qmail-Scanner with ClamAV antivirus and SpamAssassin spamfilter with your qmail server.

Introduction

Qmail-Scanner is an add-on that enables a Qmail email server to scan email for certain characteristics. It is typically used for its anti-virus and anti-spam protection functions, in which case it is used in conjunction with external scanners. It also enables a site (at a server/site level) to create "Policy blocks": i.e. react to email that contains specific strings in particular headers, or particular attachment filenames or types (e.g. *.EXE attachments even in a zip file).
Its archival features helps ISPs and corporations around the world with new or pending legislation, and regulatory requirements. It can archive all processed email into an archive maildir. This is ideal for backup purposes for audit policy reasons. Unlike certain Windows-based server solutions, the mail envelope headers (the "rcpt to:" and "mail from:" headers) are kept intact - appended to the bottom of each message - confirming true sender and destination addresses. Archiving also supports filtering to a subset of addresses (e.g. only archive "support@domain.name" emails instead of all).
We will bind spamassasin and clamav with qmailsacnner. Spamassassin is a open Source mail filter, written in Perl, to identify spam using a wide range of heuristic tests on mail headers and body text. It can also use some use full plugins like Pyzor, Razor, and DCC. Clamav will scan mail message for virus infected mails.

Installation

We will install and configure Qmail-Scanner, ClamAV and SpamAssassin with the plugins Pyzor, Razor, and DCC.

Clam Antivirus

ClamAV is an open source antivirus engine designed for detecting Trojans, viruses, malware and other malicious threats. It is the de facto standard for mail gateway scanning. It provides a high performance mutli-threaded scanning daemon, command line utilities for on demand file scanning, and an intelligent tool for automatic signature updates.

Download

Download latest version from http://downloads.sourceforge.net/project/clamav:
wget http://nchc.dl.sourceforge.net/project/clamav/clamav/0.97/clamav-0.97.tar.gz

Install and Configure ClamAV

cd /download
tar zxvf clamav-0.97.tar.gz
useradd -c "Qmail-Scanner Account" -s /bin/false qscand
cd clamav-0.97
./configure --with-user=qscand --with-group=qscand
make && make install
ldconfig -v
Now, we configure its configuration files, these are as follows:
vi /usr/local/etc/clamd.conf
#Example
LogFile /var/log/clamav/clamd.log
LogFileMaxSize 20M
LogTime yes
LogClean yes
LogSyslog yes
PidFile /var/run/clamav/clamd.pid
TemporaryDirectory /var/tmp
DatabaseDirectory /usr/local/share/clamav
LocalSocket /var/run/clamav/clamd.cl
MaxConnectionQueueLength 30
User qscand
MaxThreads 20
Scanmail yes
Now, create some directories with the ownership of qscand:
mkdir /var/run/clamav
chown -R qscand.qscand /var/run/clamav
mkdir /var/log/clamav
chown -R qscand.qscand /var/log/clamav
chmod -R 755 /var/log/clamav
By this, clamav is successfully installed.
/usr/local/sbin/clamd &
vi /usr/local/etc/freshclam.conf
#Example
DatabaseDirectory /usr/local/share/clamav
UpdateLogFile /var/log/clamav/freshclam.log
LogSyslog yes
DatabaseOwner qscand
DNSDatabaseInfo current.cvd.clamav.net
DatabaseMirror database.clamav.net
DatabaseMirror db.in.clamav.net
NotifyClamd /usr/local/etc/clamd.conf
Save and exit.
freshclam -v
crontab -e
25 1 * * * /usr/local/bin/freshclam -l /var/log/clamav/freshclam.log

SpamAssassin

SpamAssassin is a mail filter to identify spam. It is an intelligent email filter which uses a diverse range of tests to identify unsolicited bulk email, more commonly known as Spam. These tests are applied to email headers and content to classify email using advanced statistical methods.

Install and configure SpamAssassin

apt-get install spamassassin libdigest-sha1-perl libnet-dns-perl libmail-spf-query-perl libgeo-ip-perl libnet-ident-perl libio-socket-ssl-perl libio-socket-inet6-perl perl-modules
groupadd spamd
useradd -g spamd -s /bin/false spamd
vi /etc/default/spamassassin
ENABLED=1
OPTIONS=" --user-config --username=spamd --max-children 5 --debug --helper-home-dir=/home/spamd"
vi /etc/mail/spamassassin/local.cf
required_score 5.0
dns_available yes
use_pyzor 1
use_razor2 1
use_bayes 1
bayes_auto_learn 1
bayes_file_mode 0700
include /etc/mail/spamassassin/autowhitelist
bayes_path /etc/mail/spamassassin/.spamassassin/bayes
bayes_auto_learn_threshold_nonspam       0.1
bayes_auto_learn_threshold_spam         12.0
ok_languages en hi
ok_locales en
Now start up SpamAssassin...
/etc/init.d/spamassassin start
Now add some plugins..

Razor

cd /downloads/
wget "http://citylan.dl.sourceforge.net/project/razor/razor-agents/2.85/razor-agents-2.85.tar.bz2"
wget 'http://citylan.dl.sourceforge.net/project/razor/razor-agents-sdk/2.07/razor-agents-sdk-2.07.tar.bz2'
tar xvf razor-agents-sdk-2.07.tar.bz2
cd razor-agents-sdk-2.07
perl Makefile.PL
make
make test
make install
cd /downloads/
tar xvfj razor-agents-2.85.tar.bz2
cd razor-agents-2.85
perl Makefile.PL
make
make test
make install
Make sure your firewall is allowing port tcp/2703.
razor-admin -home=/home/spamd/.razor -create
razor-admin -home=/home/spamd/.razor -register
razor-admin -home=/home/spamd/.razor -discover

DCC

cd /downloads/
wget http://www.rhyolite.com/anti-spam/dcc/source/dcc.tar.Z
tar xvfz dcc.tar.Z
cd dcc-1.3.120/
./configure
make && make install
Make sure your firewall is allowing port udp/6277.

Pyzor

cd /downloads/
wget http://space.dl.sourceforge.net/project/pyzor/pyzor/0.5.0/pyzor-0.5.0.tar.gz
tar xvf pyzor-0.5.0.tar.gz
cd pyzor-0.5.0
python setup.py build
python setup.py install
python -c 'import gdbm' && echo 'gdbm found'
Run the next command to complete pyzor installation.
pyzor --homedir /home/spamd discover
vi /etc/mail/spamassassin/v310.pre
enable the line
loadplugin Mail::SpamAssassin::Plugin::DCC
spamassassin –lint

Qmail-Scanner

cd /downloads/qmailrocks
tar xvfz qmail-scanner-1.25.tgz
tar zxvf qms-analog-0.4.2.tar.gz
cd qms-analog-0.4.2
make all
cp qmail-scanner-1.25-st-qms-20050219.patch ../qmail-scanner-1.25/
cd ../qmail-scanner-1.25
patch -p1 < qmail-scanner-1.25-st-qms-20050219.patch
vi qms-config
./configure --domain yourdomain.com \
--admin postmaster \
--local-domains "yourdomain.com" \
--add-dscr-hdrs yes \
--dscr-hdrs-text "X-Antivirus-YOURDOMAIN" \
--ignore-eol-check yes \
--sa-quarantine 0 \
--sa-delete 0 \
--sa-reject no \
--sa-subject ":SPAM:" \
--sa-alt yes \
--sa-debug yes \
--sa-report yes \
--notify "psender,admin" \
--redundant yes \
--unzip yes \
--qms-monitor no \
"$INSTALL"
chmod 755 qms-config
./qms-config
If configuration is ok then...
./qms-config install
setuidgid qscand /var/qmail/bin/qmail-scanner-queue.pl -z
setuidgid qscand /var/qmail/bin/qmail-scanner-queue.pl -g
vi /var/qmail/bin/qmail-scanner-queue.pl
msg_size > 500000
chown -R qscand:qscand /var/spool/qmailscan
vi /service/qmail-smtpd/run
QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl" ; export QMAILQUEUE
Now restart your qmail server and see if everything works...
Posted by at No comments:

Installation Of PlaySMS And SMS Server Tools 3 On Debian Server


This tutorial will show you how you can set up an SMS server on Debian with playsms and smstools. In my example I have used an old Nokia 5140i with a USB datacable.
What we need before we start is apache2, mysql server, php5, lynx, wget, curl.
Now we install updates, and install dependencies:
apt-get update
apt-get upgrade
apt-get install apache2 mysql-server php5 php5-cli php5-cgi php-pear php-db phpmyadmin make gcc sendmail lynx wget curl
Now create a password for mysql root user, and remember it.

Installing playsms

adduser playsms
mkdir -p /var/www/playsms
mkdir -p /var/spool/playsms
mkdir -p /var/log/playsms
chown -R www-data /var/www/playsms
chown -R www-data /var/spool/playsms
chown -R www-data /var/log/playsms
And next download latest version of playSMS, find latest here, or grab my url: http://sourceforge.net/projects/playsms/
wget http://downloads.sourceforge.net/project/playsms/playsms/Version%200.9.5.2/playsms-0.9.5.2.tar.gz
This will extract playsms to /usr/local/src.
tar -zxvf playsms-0.9.5.2.tar.gz -C /usr/local/src
Now go to the following folder:
cd /usr/local/src/playsms-0.9.5.2/web
Now run the following commands:
Type mysql root password, when you are asked for the password.
cp -rR * /var/www/playsms
chown -R www-data /var/www/playsms
mysqladmin -u root -p create playsms
And now we import the mysql database from playsms, remember to change the path, if you install another version.
Type mysql root password, when you are asked for the password.
mysql -u root -p playsms < /usr/local/src/playsms-0.9.5.2/db/playsms.sql
Here we will make the config file, you have to fill out the fields:
cd /var/www/playsms
cp config-dist.php config.php
nano config.php
So it looks like this (replace 'my_password_for_mysql_root_user' with your password, and do not remove ' '):

// PHP PEAR DB compatible database engine:
// msql, mssql, mysql, oci8, odbc, pgsql, sqlite
$core_config['db']['type'] = 'mysql';        // database engine
$core_config['db']['host'] = 'localhost';    // database host/server
$core_config['db']['port'] = '3306';        // database port
$core_config['db']['user'] = 'root';        // database username
$core_config['db']['pass'] = 'my_password_for_mysql_root_user';    // database password
$core_config['db']['name'] = 'playsms';        // database name
$core_config['db']['pref'] = 'playsms';        // table's prefix without trailing underscore


// SMTP configuration
$core_config['smtp']['relm'] = ''; // yes, not realm, its relm
$core_config['smtp']['user'] = '';
$core_config['smtp']['pass'] = '';
$core_config['smtp']['host'] = 'localhost';
$core_config['smtp']['port'] = '25';


// Do not change anything below this line unless you know what to do

// -----------------------------------------------------------------

// you can turn on or off PHP error reporting
// on production level you should turn off PHP error reporting (set to 0), by default its on

//error_reporting(0);
//error_reporting(E_ALL ^ (E_NOTICE | E_WARNING | E_DEPRECATED));
error_reporting(E_ALL ^ (E_NOTICE | E_WARNING));

// logs directories
$apps_path['logs']    = '/var/log/playsms';

// log level: 0=disabled, 1=info, 2=warning, 3=debug, 4=verbose

// WARNING: log level 3 and 4 will also save sensitif information such as password for used gateway
$core_config['logstate']    = 0;

// 0 for single session login; 1 for multi session login
// multi session login is not secure because playsms leaves md5 crypted username and password

// on admin's computer
$core_config['multilogin']    = 0;

// are we using http or https ? the default is using http instead https
$core_config['ishttps']        = false;

?>
Now run the following commands:
cd /usr/local/src/playsms-0.9.5.2/bin
cp playsmsd playsmsd.php playsmsd_start /usr/local/bin/
cp playsms /etc/default/
Now we have to make sure that the program will start everytime the systems boots; do the following:
nano /etc/init.d/rc.local
Add on the bottom of the file (before exit if there's an exit command). This way playsmsd_start will start automatically on boot. Save and exit.
.... last line ....

/usr/local/bin/playsmsd_start

Install smstools

cd
wget http://smstools3.kekekasvi.com/packages/smstools3-3.1.14.tar.gz
tar -zxvf smstools3-3.1.14.tar.gz -C /usr/local/src
cd /usr/local/src/smstools3
make
make install
Now we make playsms and smstools work together:
cd /usr/local/src/playsms-0.9.5.2
cp contrib/smstools/smsd.conf /etc/
Now we have to edit the config file.
My Nokia 5140i with USB datacable is detected as ttyUSB0 so I don't have to edit the port, but if your phone is detected as something else, change it on line 27 to etc. ttyUSB1, ttyACM0
nano /etc/smsd.conf
My config file looks like this:
# Global configuration
devices = modem1
loglevel = 4
logfile = /var/log/sms/smstools.log
outgoing = /var/spool/sms/outgoing
checked = /var/spool/sms/checked
failed = /var/spool/sms/failed
incoming = /var/spool/sms/incoming
sent = /var/spool/sms/sent
delaytime = 6
errorsleeptime = 12
blocktime = 180
autosplit = 3
receive_before_send = yes
# Modem configuration # iTegno 3000 USB
[modem1]
#init = device = /dev/ttyUSB0
incoming = yes
#pin = baudrate = 115200
Now run the following commands:
mkdir -p /var/spool/sms/checked
mkdir -p /var/spool/sms/failed
mkdir -p /var/spool/sms/incoming
mkdir -p /var/spool/sms/outgoing
mkdir -p /var/spool/sms/sent
mkdir -p /var/log/sms
chown -R www-data /var/spool/sms
update-rc.d sms3 defaults
Browse http://your-server-ip/playsms/ and log in using default administrator user:
Username: admin

Password: admin
Click Gateway, click Manage smstools, click (click here to activate).
Your server is now up and running, ready to be used.
Posted by at 3 comments:

Set Up OpenVPN Server With Authentication Against OpenLDAP On Debian 6.0 (Squeeze)


OpenVPN, or Open Virtual Private Network, is a tool for creating networking "tunnels" between and among groups of computers that are not on the same local network. This is useful if you have services on a local network and need to access them remotely but don't want these services to be publicly accessible. By integrating with OpenSSL, OpenVPN can encrypt all VPN traffic to provide a secure connection between machines.
The OpenLDAP backend of iRedmail allows you to integrate all kinds of applications and to realize centralized account management. This tutorial shows you how to integrate OpenVPN into the iredmail ldap backend on Debian 6.0; passwords will be stored in ldap and you can change passwords through webmail.
This tutorial is based on Debian 6.0, so I suggest you set up a minimal Debian 6.0 system with SSH; make sure you install all updates. Install iredmail 0.7.0 and choose openldap as backend, as shown in this tutorial:

1 Install OpenVPN

Install OpenVPN and ldap support:
apt-get install openvpn openvpn-auth-ldap
Install dnsmasq:
To forward DNS traffic through the VPN you will need to install the dnsmasq package:
apt-get install dnsmasq

2 easy-rsa

The OpenVPN package provides a set of encryption-related tools called "easy-rsa". These scripts are located by default in the /usr/share/doc/openvpn/examples/easy-rsa/ directory. However, in order to function properly, these scripts should be located in the /etc/openvpn directory.
cp -R /usr/share/doc/openvpn/examples/easy-rsa/ /etc/openvpn

Configure Public Key Infrastructure Variables

Before we can generate the public key infrastructure for OpenVPN we must configure a few variables that the easy-rsa scripts will use to generate the scripts. These variables are set near the end of the /etc/openvpn/easy-rsa/2.0/vars file. Here is an example of the relevant values:
Edit /etc/openvpn/easy-rsa/2.0/vars according to your environment. 
[...]
export KEY_COUNTRY="CN"
export KEY_PROVINCE="BJ"
export KEY_CITY="BeiJing"
export KEY_ORG="iRedMail"
export KEY_EMAIL="www@example.com"

Initialize the Public Key Infrastructure (PKI)

Issue the following commands in sequence to internalize the certificate authority and the public key infrastructure:
cd /etc/openvpn/easy-rsa/2.0/
chmod +rwx *
source ./vars
./clean-all
./pkitool --initca

Generate Certificates

With the certificate authority generated you can generate the private key for the server. This script will also prompt you for additional information. By default, the Common Name for this key will be "server". You can change these values in cases where it makes sense to use alternate values. To accomplish this, issue the following command:
./pkitool --server server

Generate Diffie Hellman Parameters Link

The "Diffie Hellman Parameters" govern the method of key exchange and authentication used by the OpenVPN server. Issue the following command to generate these parameters:
./build-dh

Relocate Secure Keys

The keys and certificates for the server need to be relocated to the /etc/openvpn directory so the OpenVPN server process can access them. These files are:
  • ca.crt
  • ca.key
  • dh1024.pem
  • server.crt
  • server.key
cp keys/{ca.crt,ca.key,server.crt,server.key,dh1024.pem} /etc/openvpn/
These files don't need to leave your server. Maintaining integrity and control over these files is of the utmost importance to the integrity of your server. If you ever need to move or back up these keys, ensure that they're encrypted and secured.

3 Configure OpenVPN Support For LDAP Auth

Find cn=vmail password

The vmail password was randomly created during the iredmail installation. You can find the password in /etc/postfix/ldap_virtual_mailbox_domains.cf:
cat /etc/postfix/ldap/virtual_mailbox_domains.cf 
[...]
bind_dn         = cn=vmail,dc=example,dc=com
bind_pw         = 4LFqZFiT6yx8oP7R2BctvUSLpYWRdJ #cn=vmail password
[...]

Configure OpenVPN auth OpenLDAP

Issue the following two commands in sequence to create the /etc/openvpn/auth folder and copy the example files of OpenVPN auth LDAP to the /etc/openvpn/auth directory.
mkdir /etc/openvpn/auth
cp /usr/share/doc/openvpn-auth-ldap/examples/auth-ldap.conf /etc/openvpn/auth
Now edit /etc/openvpn/auth/auth-ldap.conf.

# LDAP server URL
URL             ldap://127.0.0.1
# Bind DN (If your LDAP server doesn't support anonymous binds)
BindDN                cn=vmail,dc=example,dc=com
# Bind Password cn=vmail password
Password      4LFqZFiT6yx8oP7R2BctvUSLpYWRdJ

# Network timeout (in seconds)
Timeout         15




# Base DN
BaseDN          "o=domains,dc=example,dc=com"
# User Search Filter
SearchFilter    "(&(objectClass=mailUser)(accountStatus=active)(enabledService=vpn))"
# Require Group Membership
RequireGroup    false

4 Configuring OpenVPN

We'll now need to configure our server file. There is an example file in the /usr/share/doc/openvpn/examples/sample-config-files directory. Issue the following sequence of commands to retrieve the example configuration files and move them to the required directories:
cd /usr/share/doc/openvpn/examples/sample-config-files
gunzip -d server.conf.gz
cp server.conf /etc/openvpn/
Now edit /etc/openvpn/server.conf: 
[...]
;push "redirect-gateway def1 bypass-dhcp"
push "redirect-gateway def1"
[...]
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"
push "dhcp-option DNS 10.8.0.1"
[...]
##Add it at the bottom line
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth/auth-ldap.conf
client-cert-not-required


5 Enable VPN Service For Mail User

Use phpLDAPadmin or other tools to add LDAP values for existing mail users.
Log into phpLDAPadmin:

Find the existing mail user www@example.com:

Enable the VPN service for the user www@example.com:



6 Enable IP Forwarding And Configure iptables

 
Edit the /etc/sysctl.conf file to modify the following line to ensure that your system is able to forward IPv4 traffic:
[...]
#net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1
[...]
Issue the following command to ensure that your system is able to forward IPv4 traffic:
echo 1 > /proc/sys/net/ipv4/ip_forward
Edit /etc/default/iptables and add the below. Let iptables open port 1194.
[...]
#openvpn
-A INPUT -p udp -m multiport --dport 1194 -j ACCEPT
[...]
Issue the following commands to set this variable for the current session:
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
Before continuing, insert these iptables rules into your system's /etc/rc.local file to ensure that theses iptables rules will be recreated following your next reboot cycle:
#!/bin/sh
#
# [...]
#
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
exit 0

7 Restart Related Services

We need to restart all related services to make the configuration work.
/etc/init.d/slapd restart
/etc/init.d/openvpn restart
/etc/init.d/iptables restart

8 Client Settings

cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/easy-rsa/2.0/keys/client.ovpn
cd /etc/openvpn/easy-rsa/2.0/keys
Edit the client.ovpn file to modify the following line:
[...]
# Add the vpn server
remote mail.example.com 1194
[...]
#Comment out the below two line  
#cert client.crt
#key client.key
[...]
#Add thes line at the botton
auth-user-pass
Copy the client.ovpn and ca.crt files to your client system. Also you can use mutt to send the files to your mailbox. You can log into your email account and download the files.
apt-get install mutt zip
cd /etc/openvpn/easy-rsa/2.0/keys
zip config.zip client.ovpn ca.crt
mutt -s "OpenVPN client config files" www@example.com -a /etc/openvpn/easy-rsa/2.0/keys/config.zip < /usr/share/doc/openvpn/README

Installing OpenVPN GUI On Windows XP / Vista / Windows 7

Download the client software here: http://openvpn.net/index.php/open-source/downloads.html. After installation, put the client.ovpn and ca.crt files to C:\Program Files\OpenVPN\config.
IMPORTANT NOTE FOR VISTA and Windows 7 USERS:
Note that on Windows Vista and Windows 7, you will need to run the OpenVPN GUI with administrator privileges, so that it can add routes to the routing table that are pulled from the OpenVPN server. You can do this by right-clicking on the OpenVPN GUI desktop icon, and selecting "Run as administrator".
Now you can use the account www@example.com to connect to the vpn.

Now you can access the Internet through VPN; you can check on http://www.whatismyip.com if the IP address is the server IP address.

9 Troubleshooting

Before you troubleshoot, you can try to restart the server and check whether it works then.
To enable ldap logging, edit /etc/ldap/slapd.conf:
[...]
loglevel    256 # <-- change form 0 to 256  
[...]

Separate OpenVPN Log

By default, log messages will go to the syslog. We use "log" to override this by changing/etc/openvpn/server.conf.
Issue the following command to create log files and set the right permissions:
touch /var/log/openvpn.log
chown nobody.nogroup /var/log/openvpn.log
Edit /etc/openvpn/server.conf: 
[...]
user nobody
group nogroup
[...]
log    /var/log/openvpn.log

Restart the related services.
/etc/init.d/slapd restart
/etc/init.d/openvpn restart
Monitor the log:
# tail -0f /var/log/openldap.log
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1000 fd=15 ACCEPT from IP=127.0.0.1:42020 (IP=0.0.0.0:389)
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1000 op=0 BIND dn="cn=vmail,dc=example,dc=com" method=128
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1000 op=0 BIND dn="cn=vmail,dc=example,dc=com" mech=SIMPLE ssf=0
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1000 op=0 RESULT tag=97 err=0 text=
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1000 op=1 SRCH base="o=domains,dc=example,dc=com" scope=2 deref=0
filter="(&(objectClass=mailUser)(accountStatus=active)(enabledService=vpn))"
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1001 fd=19 ACCEPT from IP=127.0.0.1:42021 (IP=0.0.0.0:389)
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1001 op=0 BIND dn="cn=vmail,dc=example,dc=com" method=128
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1001 op=0 BIND dn="cn=vmail,dc=example,dc=com" mech=SIMPLE ssf=0
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1001 op=0 RESULT tag=97 err=0 text=
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1001 op=1 BIND anonymous mech=implicit ssf=0
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1001 op=1
BIND dn="mail=www@example.com,ou=Users,domainName=example.com,o=domains,dc=example,dc=com" method=128
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1001 op=1
BIND dn="mail=www@example.com,ou=Users,domainName=example.com,o=domains,dc=example,dc=com" mech=SIMPLE ssf=0
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1001 op=1 RESULT tag=97 err=0 text=
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1001 op=2 UNBIND
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1000 op=2 UNBIND
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1001 fd=19 closed
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1000 fd=15 closed
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1002 fd=15 ACCEPT from IP=127.0.0.1:42022 (IP=0.0.0.0:389)
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1002 op=0 BIND dn="cn=vmail,dc=example,dc=com" method=128
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1002 op=0 BIND dn="cn=vmail,dc=example,dc=com" mech=SIMPLE ssf=0
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1002 op=0 RESULT tag=97 err=0 text=
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1002 op=1
SRCH base="o=domains,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=mailUser)(accountStatus=active)(enabledService=vpn))"
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1002 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1002 op=2 UNBIND
Sep 20 06:01:22 li163-121 slapd[3846]: conn=1002 fd=15 closed
# tail -0f /var/log/openvpn.log
Mon Sep 20 06:01:20 2010 MULTI: multi_create_instance called
Mon Sep 20 06:01:20 2010 211.99.216.18:50094 Re-using SSL/TLS context
Mon Sep 20 06:01:20 2010 211.99.216.18:50094 LZO compression initialized
Mon Sep 20 06:01:20 2010 211.99.216.18:50094 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Sep 20 06:01:20 2010 211.99.216.18:50094 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Sep 20 06:01:20 2010 211.99.216.18:50094 Local Options hash (VER=V4): '530fdded'
Mon Sep 20 06:01:20 2010 211.99.216.18:50094 Expected Remote Options hash (VER=V4): '41690919'
Mon Sep 20 06:01:20 2010 211.99.216.18:50094 TLS: Initial packet from [AF_INET]211.99.216.18:50094, sid=216fe588 ae0a6a58
Mon Sep 20 06:01:22 2010 211.99.216.18:50094 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Mon Sep 20 06:01:22 2010 211.99.216.18:50094 TLS: Username/Password authentication succeeded for username 'www@example.com'
Mon Sep 20 06:01:22 2010 211.99.216.18:50094 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Sep 20 06:01:22 2010 211.99.216.18:50094 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Sep 20 06:01:22 2010 211.99.216.18:50094 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Sep 20 06:01:22 2010 211.99.216.18:50094 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Sep 20 06:01:22 2010 211.99.216.18:50094 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Mon Sep 20 06:01:22 2010 211.99.216.18:50094 [] Peer Connection Initiated with [AF_INET]211.99.216.18:50094
Mon Sep 20 06:01:22 2010 211.99.216.18:50094 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_CLIENT_CONNECT status=0
Mon Sep 20 06:01:22 2010 211.99.216.18:50094 MULTI: Learn: 10.8.0.10 -> 211.99.216.18:50094
Mon Sep 20 06:01:22 2010 211.99.216.18:50094 MULTI: primary virtual IP for 211.99.216.18:50094: 10.8.0.10
Mon Sep 20 06:01:23 2010 211.99.216.18:50094 PUSH: Received control message: 'PUSH_REQUEST'
Mon Sep 20 06:01:23 2010 211.99.216.18:50094 SENT CONTROL [UNDEF]: 'PUSH_REPLY,
redirect-gateway def1,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' (status=1)
 

10 Links


Posted by at No comments:
Subscribe to: Posts (Atom)