How DKIM key [...]]]> This is a email technology which signs each of your emails send through your SMTP. This signing process would help to identify genuinity of your emails since it was easy to verify by your receiver SMTP to have a valid DKIM check before classifying your mail either spam,phishing or impersonated one etc.

How DKIM key works

You SMTP server will attach a special header each of your email which is encrypted by a private key stored on the server and send it along with email. Once the email is reached at the other trusted/secured smtp server, they will

a. Identify the signing in the mail header.
b. Reading the domain key, domain name mentioned in the mail header

ie (DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mydomain.com;s=default; t=1329441832;) You will see the above entry in original source of DKIM singed emails.

c. Then the receiver SMTP server looking for the DNS entry associated with the signed email ( here mydomain.com)
d. Once the nslookup can found the DNS txt entry ( here default, ie default._domainkey ), they fetch the public key which can able to decrypt the keys in email header.

ie Those emails are correctly originated from the actual sender. So it’s a trusted mail and all of your domains emails get’s white listed in other’s third party SMTP servers and hence drop it in your INBOX finally

How do I install openDKIM

stevejenkins.com website has an excellent tutorials and I adopted his guild lines. But got stuck at few attempts initially and has got it worked at the end.

Here we go,

1. Install openDKIM rpm package from EPEL repositories (http://fedoraproject.org/wiki/EPEL).

choose the correct build for your OS architecture.

2. Generate Singing Keys
create a folder storing keys for my domain

Above command wil create two files under our domain folder as default.private and default.txt

Renaming default.private to default,

3. Configuration files of OpenDKIM

1. /etc/opendkim.conf – OpenDKIM’s main configuration file
2. /etc/opendkim/KeyTable – a list of keys available for signing
3. /etc/opendkim/SigningTable – a list of domains and accounts allowed to sign
4. /etc/init.d/opendkim — Service start up file.

4. Update the etc/opendkim.conf file
Now you need to edit the main config. file (etc/opendkim.conf) and update/un comment the few lines.

my file should look like this. You may need to edit the “KeyFile” to set correct path

5. update the /etc/opendkim/KeyTable file

You may need to add you domain key name and private key file path of the domain in this file. My file looks like as shown below,

you may use the same private key for multiple domain. It’s just like a domain- key mapping.

default._domainkey.mydomain1.com mydomain1.com:default:/etc/opendkim/keys/mydomain.com/default
default._domainkey.mydomain2.com mydomain2.com:default:/etc/opendkim/keys/mydomain.com/default

6. Update /etc/opendkim/SigningTable
This file is actually mapping domain names to a key file. On my setup my server is hosting 4 email domains and I want to use same signing certificate for all domains. File entry should look like this,

Pls not I uses same domain key for all other domain. So that you will get an entry in email source “signed by mydomain.com”

See the mail below,

7.Check the ” /etc/opendkim/TrustedHosts” has loopback IP

8. Edit postfix main configuration file
You need to open the postfix config file (/etc/postfix/main.cf) and add the following lines at the bottom of the file.

9. Restart the opendkim and postfix service.

Ensure that OpenDKIM logs has written on mail log file. This is the only file where you ca see any issue with the opendkim errors.

10. Update the DNS records

This is the final part. You need to add a text entry “default._domainkey”. You will get the text value from the file “/etc/opendkim/keys/mydomain.com/default.txt”

Copy all the value in between double quotes (starts from after TXT”). My Godaddy domain manager look likes as below after adding,

You should also add another TXT Record to your zone file
_adsp._domainkey.mydomain.com IN TXT “dkim=unknown”

There is not standardization to use the name “default” domain key. We can change it whatever we wish to use.
Don’t forget to add SPF record for your domain

imp : Don’t forget to set SPF record that may boost the email delivery.

Verifying whether Postfix sending signed emails,

I uses a test mail send from command line.

If everything goes well you see a messages “DKIM-Singnature header added” in mail log.

It’s shows you have a trusted smtp server in place which may helpful to send bulk mails ..

For better trouble shooting restart opendkim service first then postfix and also check the mail server log to get detailed report.

Quick fix for this error is, add a “?” append to index.php which written in .htaccess file.

The new .htaccess file part will looks like,

a. Generating private key using keytool

This step will create a private key pair stored in a file named “keystore.jks” encrypted using a password. Private key associate with certain information [...]]]> The following steps will help you to install SSL certificate on Glassfish web server which is a free community edition web sever from Sun Microsystems.

a. Generating private key using keytool

This step will create a private key pair stored in a file named “keystore.jks” encrypted using a password. Private key associate with certain information about the ssl issued for.

NB : Do not change the keystore passoword to anything other than “changeit”. Glassfish sever won’t take it if it changed.

-dname : Is the collection of data required to fill out.
CN : Obeviously it should be “www.mydomain.com” Here I uses a wild card ssl certiificate which require a prefix “*.” infont of domain name.
O: You company name
L : locality
S : State
C: Country
keypass: password to de-crypt the private key file
storepass : This password requires to make any operations inside the key stored in the private key files
keystore : Path of keystore file to be saved.

You may verify the private key contents

#keytool -list -v -alias s1as -keystore keystore.jks

Now we have a private key and next we need to generate CSR (Certificate Signing Request) to be send to CA authority.

Here is the step to create CSR

Now you have a new file “mydomain.com.csr and open it in vi, copy and paste it in to Godaddy CSR fill out form. You will get new SSL issued once after the domain owner verification process has completed.

Then download the SSL certificate for Tomcat web server from the Godaddy cert download manager.

Download and extract it the same folder where CSR generated. My file structure is as shown below.

Now you have all files to install the SSL. I would recommend to copy your private key jks file before importing certificate in to it.

First you need to download “valicert_class2″ root certificate from Godaddy repository

https://certs.godaddy.com/repository/

a. Import the root certificate into the glassfish key

If you getting error messages something say like ” certificate is already exists in system wide CA” then you do not need to install this.

b. Installing secondary CA certificates

C. Installing domain certificate to keystore.

Pls note that server certificate could be installed only after the support ssl installed to the keystore file.

NB: keep the same alias s1as to install SSL since it is hard coded glassfish in domain.xml file. It can be changed anyway if you wish to make another.

How do I view all the certificate imported to the keystore

Check that domain certificate entry type is set as “keyEntry” on the above screen.

Exporting private key from a keystore file

I have a need of installing this SSL on Apache server as well. So I need to get back the private key from the keystore file. I found there is a third party site provides a tool to felicitate this requirement.

Download that tool from here http://coreygilmore.com/uploads/2009/06/exportprivatekey.zip

Generate the private key from keystore

Wallah !! now you have all the files required for Basic SSL install.

Copy this keystore.jks file under your “config” inside the respective domains.Then restart the glassfish.

Most of us are getting this type of errors when we used “MyISM” storage engine for huge tables. Inodb tables also were affect sometimes. We can skip this errors, if we have uses high [...]]]> mysqldump: Error 1194: Table ” is marked as crashed and should be repaired when dumping table `db_table` at row :

Most of us are getting this type of errors when we used “MyISM” storage engine for huge tables. Inodb tables also were affect sometimes. We can skip this errors, if we have uses high I/O operation supported drives like RAID 10. Most of the disk related/write related issues can be solved by empowering more stable drive mechanism.

Solution :

Use “repair table table name ;” This will repair the table automatically.

a. How to find corrupted tables for a database
# mysqlcheck -uroot -p –databases database name

b. Checking whole the database for any damage/corruption
#mysqlcheck –all-databases

c. Analyzing and repairing corrupted database/s Recommended

For a particular table,

# mysqlcheck –auto-repair –check –optimize database name table name

If you want to see the verbose
#mysqlcheck -uroot -p –databases database_name –tables table_name –extended –verbose

5. Repairing MyISM tables in offline mode for huge GB tables

myisamchk –key_buffer_size=512M –sort_buffer_size=512M –read_buffer_size=8M –write_buffer_size=8M path/to/table/file/.MYI

-read_buffer_size/–write_buffer_size : Used to read and write data from the table and to the temporary file.
–sort_buffer_size : When the keys are repaired by sorting keys and this option would useful when you use “–recover”
–key_buffer_size : When you check the table with –extend-check option.

6. How to optimize tables

to all databases
# mysqlcheck -o –all-databases;

For a particular table

mysqlcheck -o database_name table-name

7. How to check all the maintenance operations at a time

Useful params in mysqlcheck

1. -r : Repair the table
2. -o : optimize the table
3. –auto-repair : Repair the table automatically
4. -c : Check table errors
5. -C : Check only the table changed since from the last check.
6. –fix-db-names/–fix-table-names : Check database name/table name if corrupted.
7. -e : Extended operations even check or repairing.
8. -q : Quick checking
9. -o : optimize the table
10. -B : This option keeping a a file copy before repairing it.

Sometime you got the following errors when try to repair a myISAM table where index file is missing. So you need to use the extra parms “USE_FRM” to solve this.

ERROR : Can’t find file: ‘table’ (errno: 2) Corrupt

Earlier I had started tomcat from the root account and created Virtual [...]]]> As we all are familiar with virtual hosting in Apache and we can isolate each users to publish their sites to a folder under thier home directory. So there is no any issue with operating the files copied on the hosting root.

Earlier I had started tomcat from the root account and created Virtual hosting in tomcat and isolate the hosting root according to the users. The issue I had faced is none of the FTP users to modify/delete the files in their hosting root since all the files are owned by the root account because of root user is operating tomcat service.

So I have to gave ssh access to the server and gave sudo command to deploy users newly uploaded files. So it’s a security threat to allow users to have ssh access and permit to operate sudo commands.

After few R&D I decided to run the tomcat service from a normal user who does not have shell access

Solution :

1. create new user and group for tomcat user

2. Permitting tomcat users to access the Tomcat installation files

3. Start the tomcat daemon within the user account.

You almost done !!!

Creating FTP users and Virtual hosting

a. An example of Virtualhost entry is showing below,

b. FTP user creation
1. create new user and set their primary group as tomcat.

Setting sticky bit on the web directory where both users would have the same access

That’s it !!!!! Everything set..

Now upload your war file named as “ROOT.war” under the public_html folder and see the application running … There is not need to restart the tomcat to deploy new application, Just like we do with Apache

You will get the sample war file from here “http://tomcat.apache.org/tomcat-5.5-doc/appdev/sample/sample.war” for the initial testing.

Here are the some useful file locations/path if you plan to run the Tomcat as a backend server over the AJP connector in Apache ( Recommended by me )

1. /etc/httpd/modules/mod_jk.so
2. /etc/httpd/conf.d/jk.conf
3. /etc/httpd/conf.d/workers.properties
4. /etc/httpd/conf.d/javasite1.conf

A sample Apache virtualhost entry

Solution

Just delete the “lock” file from the glassfish directory. The location of this file is [...]]]> You may got the following errors when you start the glasshfish server where files are copied it from some other servers. The error exact look likes as follows.

Solution

Just delete the “lock” file from the glassfish directory. The location of this file is “imq/instances/imqbroker/lock” under glassfish.

Then try to restart the web server.

This script can have the following features,

1. Synchronize the remote sftp location to local path 2. Can configure sftp custom port 3. An email alert will send to [...]]]> Here I got a requirement to automate the download which using sftp account with custom ports. This account doesn’t not have any ssh access enabled.

This script can have the following features,

1. Synchronize the remote sftp location to local path
2. Can configure sftp custom port
3. An email alert will send to the specified users when a new file placed in the ftp location.

Pls note that the location “/var/RKFeeds/FROM” is the local path where lftp sync the remote folder ” FROM” folder.
sendEmail : Is another smtp email sending program that help you to send email from the command line which using smtp account. So that these emails are not been marked as spam anywhere.

Simple fix is to add “skip-name-resolve” in my.cnf file which will be shown in MySQL installation directory.

Since the MySQL server is using WAMP environment, You need to put the same line inside [wampmysqld].

The my.cnf file location will [...]]]> I’m getting this error message while I’m accessing remote mysql database which was running on WAMP.

Simple fix is to add “skip-name-resolve” in my.cnf file which will be shown in MySQL installation directory.

Since the MySQL server is using WAMP environment, You need to put the same line inside [wampmysqld].

The my.cnf file location will be the “C:\wamp\bin\mysql\mysql5.5.8\my.cnf”

Eg:

1. Print a count of the messages in the queue: #exim -bpc

2. Print a listing of the messages in the queue #exim -bp