howto:useful_commands [NethServer Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
=== Useful Commands ===

The commands here can save your life, please help us to maintain this page

====== Not Specific To Nethserver ======
=====ACL=====
Each time you launch 'signal-event ibay-modify IBAYNAME' you will restore the good ACL ownership.
====See ACL====
  getfacl /path/2/files/or/folders

====set ACL====
  setfacl -P -R -m u:UID:rwX,d:u:UID:rwX /path/2/files/or/folders
  setfacl -P -R -m g:UID:rwX,d:g:UID:rwX /path/2/files/or/folders

-R : recursive
-P : physical, follow symlinks

====Remove Specific ACL====
  setfacl -d u:UID:rwX,d:u:UID:rwX /path/2/files/or/folders
  setfacl -d g:UID:rwX,d:g:UID:rwX /path/2/files/or/folders
==== Remove all ACL ====
  setfacl -b /path/2/files/or/folders

===== Apache=====
====Virtualhost parsing order====

-S     Show the settings as parsed from the config file (currently only shows the virtualhost settings).

<file>
httpd -S
</file>

=====Command Line Interface=====
====Adding date and time to bash history====
By default the bash history does not show the date and time of any activity. You can enable this by entering the following command:
<file>
 HISTTIMEFORMAT="%d/%m/%y %T "
</file>
where %d=day, %m is month, &y is year and %T is time

To see the bash history with the date and time added, enter:

  history

the history command can be useful in combination with added comments to shell commands for more precise analysis or (automatic) reporting based on a shell script and cron.


====Find a file/folder====

* find quickly with a database

<file>
locate <FileOrFolderName'>
</file>

do before : 
<file>
yum install mlocate -y ; updatedb
</file>

**updatedb** must be launched manually each time you add new files (a cron job runs each night).

* find by name

<file>
find / -iname 'FileOrFolderName'
</file>

* find files by their size

it could be useful to find large file by the command line 

<file>
find /home/e-smith -type f -size +200M -exec ls -lh {} \; | awk '{ print $ ":_" $5 }';
</file>

use 
<file>
 k    for Kilobytes (units of 1024 bytes)
 M    for Megabytes (units of 1048576 bytes)
 G    for Gigabytes (units of 1073741824 bytes)
</file>

====Replace a chain of characters====

Replace a chain of characters chaine1 by chaine2 in all files of the current directory with '.txt'

<file>
find . -name "*.txt" -type f -exec sed -i "s/chaine1/chaine2/g" {} \;
</file>

==== Run a command a multiple time ====

you can run a command as fast the computer can do to test if it fails or not. For example here the `echo 'plop'` will be executed until you stop it with `ctrl+c`

<file>
time while echo 'plop'; do : ; done
</file>

`time` will save the time it will end, you can remove it if needed

you can add `&` at the end, it will run as a background process and you can launch it several time.

<file>
time while echo 'plop'; do : ; done &
</file>
==== Unix user/group properties ====

^ Explanation ^Command ^
|see informations of a user|id USER|
|change the uid of a user| <nowiki>usermod -u <UID> USER_NAME</nowiki>|
|create a group|<nowiki>groupadd -g <GID> -o GROUPE_NAME</nowiki>|
|modify the GID of a group|<nowiki>groupmod -o -g <GID> GROUPE_NAME</nowiki>|
|add a principal group to a user|<nowiki>usermod -g <GROUP_NAME_OR_GID> USER_NAME</nowiki>|
|add a secondary group to a user|<nowiki>usermod -a -G <GROUP_NAME_OR_GID> USER_NAME</nowiki>|
|change the home directory (-m move files/folders to the new location)|<nowiki>usermod -d /var/lib/jdownloader jdownloader</nowiki>|
|change the shell access of a user|<nowiki>usermod --shell /bin/bash jdownloader</nowiki>|



====Read a TAI64N timestamp in human readable format====
[http://cr.yp.to/daemontools/tai64nlocal.html tai64nlocal] converts precise TAI64N timestamps to a human-readable format. 
tai64nlocal reads lines from stdin. If a line does not begin with @, tai64nlocal writes it to stdout without change. If a line begins with @, tai64nlocal looks for a timestamp after the @, in the format printed by tai64n, and writes the line to stdout with the timestamp converted to local time in ISO format: YYYY-MM-DD HH:MM:SS.SSSSSSSSS. <br />

Eg
<file>
 cat  /var/log/qpsmtpd/current |tai64nlocal|less
</file>
Or
<file>
 tailf /var/log/sshd/current | tai64nlocal
</file>


====Network port tricks ====

* find which service use a specific port 

<file>
fuser -vn tcp 53     #TCP
fuser -vn udp 53     #UDP
</file>

* connect to a port with the command line

<file>
nc -tv 127.0.0.1 53        # TCP
nc -uv 127.0.0.1 53        # UDP
</file>

====Test network connectivity ====

  * mtr does a traceroute to 8.8.8.8 from an interface (use an IP)

<file>
mtr -rbwz 8.8.8.8 -a xxx.xxx.xxx.xxx
</file>

Like see you can see if the relevant NIC gets a network connectivity

  * ping

<file>
ping google.fr
</file>

  * traceroute

<file>
traceroute google.fr
</file>

  * see the network setings

<file>
ip r
ip a

</file>
====RPM's====
 

^ Command ^ Explanation ^
| rpm -qa	 | shows all rpms installed|
| <nowiki>rpm -qa --last</nowiki> | shows all rpms installed & installation date|
| rpm -q  | asks for rpm info|
| rpm -qi  | asks for detailed rpm info|
| rpm -qlv <packagename> | lists all files in a package|
| rpm -qlvp <packagename.rpm> | List all files in a rpm which is not installed|
| rpm -qf <filename> | reports what package a file belongs to|
| rpm -ql <packagename> | for listing the files |
| rpm -qc <packagename> | for listing the config files |
| rpm -qd <packagename> | for listing the documentation files |
| rpm -qV <packagename> | reports if permission and ownership are OK|
| rpm -qRp <packagename.rpm> | Find what dependencies have a  rpm|
| rpm -qR <packagename> | Find what dependencies have a package name|
| <nowiki>rpm -q --whatrequires <packagename></nowiki> | find what packages have <packagename> as dependency|
|<nowiki>rpm -e --test <packagename></nowiki> | find what packages have <packagename> as dependancy (more verbose as above)|
| <nowiki>rpm -e --nodeps <packagename></nowiki> | remove packagename without removing dependencies|
| <nowiki>rpm --setugids <packagename></nowiki> | set right ownership to rpm|
| <nowiki>rpm --setperms <packagename></nowiki> | set right permissions to rpm|
| <nowiki>rpm -e --noscripts <packagename></nowiki> | remove packagename without executing sciptlets (%pre, %post, %preun, %postun)|
| rpm -Va |  capture any damaged/incomplete rpms - but will also show lots of configuration files, which you of course expect to be modified.|


  * Restore all permissions and ownership

If you want to restore all permissions and right ownership of rpm, you can do this in a root terminal.
<file>
  for f in $(rpm -qa); do echo $f; rpm --setugids $f; done
  for f in $(rpm -qa); do echo $f; rpm --setperms $f; done
</file>

  * or specific to a rpm


<file>

# rpm --setugids  opendkim
# rpm --setperms  opendkim
# rpm -V opendkim
S.5....T.  c /etc/opendkim.conf
S.5....T.  c /etc/opendkim/KeyTable
S.5....T.  c /etc/opendkim/SigningTable
S.5....T.  c /etc/opendkim/TrustedHosts
</file>





====Yum====

  * reinstall all base dependencies

<file>
yum install @nethserver-iso
</file>

* Yum helper

^ Command                   ^ Explanation          ^
| yum install <packagename> | installs packagename & any package it may need |
| yum remove <packagename> | removes packagename |
| yum history package-info <packagename> | Shows the installation/removal history of a package and it's Transaction ID [http://yum.baseurl.org/wiki/YumHistory  see more commands]|
| yum history undo <Transaction ID> | Removes all packages from a specific Transaction ID [http://yum.baseurl.org/wiki/YumHistory  see more commands]|
| yum list updates | list updates to any installed package|
| yum list available | list available packages in all repos not already installed|
| <nowiki>yum list available | grep <reponame></nowiki> | list available packages -shows only from repo name|
| yum search <packagename>  | lists all packages in all repos matching packagename|
| <nowiki>yum clean all --enablerepo=*</nowiki> | Is used to clean up various things which accumulate in the yum cache (includes disabled repos)|
| <nowiki>yum --enablerepo=<reponame> <command></nowiki> | enable a repo not normally enabled|
| yum autoremove | remove all orphan dependencies|
=====CLAMAV=====

* reload the database

you can force clamav to reload its database

<file>
kill -USR2 `cat /var/run/clamd@rspamd/clamav.pid`
</file>

or to make a long freeze

<file>
kill -STOP `cat /var/run/clamd@rspamd/clamav.pid`
</file>

and to unfreeze 

<file>
kill -CONT `cat /var/run/clamd@rspamd/clamav.pid`
</file> 


slow clamav

<file>
cpulimit -l 10 -p $(pidof clamd)
</file>

When testing, remember to flush caches:

<file>
systemctl restart clamd@rspamd
systemctl restart rspamd
redis-cli -s /var/run/redis-rspamd/rspamd flushall
</file>

Some useful commands:

<file>
Measure time taken by clamd to scan an email: clamdscan --config-file=/etc/clamd.d/rspamd.conf /tmp/mail
Measure time taken by rspam to analyze an email: rspamc -t 120 </tmp/mail
</file>
===== Collabora =====

Enable the repository to get updates 

<file>
yum install yum-utils
yum-config-manager --add-repo https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-centos7
wget https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-centos7/repodata/repomd.xml.key && rpm --import repomd.xml.key
yum update -y
</file>
=====DOCKER=====

* inspect

see all settings of a container

<file>
docker inspect containerName
</file>

see some settings of a container (EG: command given)

<file>
docker inspect  -f "{{.Name}} {{.Config.Cmd}}" containerName
</file>

 * Ping the host

Testing It Out, Can the Container Reach the Docker Host?

We can test this out without needing to run a database or any service. We’ll just run an Alpine image, drop into a shell, install the ping utility and ping the Docker host.

Start the Alpine container and drop into a Shell prompt.
<file>
docker run --rm -it alpine sh
</file>

Install the ping utility.
<file>
apk update && apk add iputils
</file>

Ping your local network IP address (replace my IP address with yours).
<file>
ping 192.168.1.3
</file>

* ping a host from a container

<file>
docker run busybox ping -c 1 8.8.4.4
PING 8.8.4.4 (8.8.4.4): 56 data bytes
64 bytes from 8.8.4.4: seq=0 ttl=61 time=19.222 ms

--- 8.8.4.4 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 19.222/19.222/19.222 ms
</file>

* query dns from a container

<file>
docker run busybox nslookup google.com
Server:		127.0.0.11
Address:	127.0.0.11:53

Non-authoritative answer:
Name:	google.com
Address: 2a00:1450:4007:805::200e

*** Can't find google.com: No answer
</file>

* start a container and open a shell inside

<file>
docker exec -ti dockername /bin/sh
</file>

* start a nginx container for testing networking

<file>
docker run  -dit --name nginx-test-01 -p 9001:80 --restart=unless-stopped nginx:alpine nginx-debug -g 'daemon off;'
</file>

* delete all container

<file>
docker rm -f $(docker ps -aq)
</file>

* fix docker dns 

https://development.robinwinslow.uk/2016/06/23/fix-docker-networking-dns/

<file>
vim /etc/docker/daemon.json
{
    "dns": ["10.0.0.2", "8.8.8.8"]
}
Then restart the docker service:

sudo service docker restart
</file>

or 

Discover the address of your DNS server
You can find out what network’s DNS server from within Ubuntu as follows:

<file>
$ nmcli dev show | grep 'IP4.DNS'
IP4.DNS[1]:                             10.0.0.2
</file>

Run Docker with the new DNS server
To run a docker container with this DNS server, provide the --dns flag to the run command. For example, let’s run the command we used to check if DNS is working:

<file>
$ docker run --dns 10.0.0.2 busybox nslookup google.com
Server:    10.0.0.2
Address 1: 10.0.0.2
Name:      google.com
Address 1: 2a00:1450:4009:811::200e lhr26s02-in-x200e.1e100.net
Address 2: 216.58.198.174 lhr25s10-in-f14.1e100.net
And that’s what success looks like.
</file>
=====DNS=====
====DNSMASQ====
===Debug===
For a debugging purpose you can redirect queries to logs
add in /etc/dnsmasq.conf
<file>
#redirect dns queries to /var/log/messages (test purpose)
log-queries
</file>

restart dnsmasq
<file>
systemctl restart dnsmasq
</file>

then check /var/log/messages

====Unbound====
Unbound runs on the port ````10053````

<file>
dig @127.0.0.1 -p 10053 maps.rspamd.comf
</file>
=====Mysql=====

==== mysql users ====
===display all mysql users===
<file>
SELECT User,Host FROM mysql.user;
</file>

===delete a mysql user===
<file>
SELECT User,Host FROM mysql.user;
DROP USER 'testuser'@'localhost';
</file>
====Create a database====
<file>
mysql
create database owncloud;
grant all privileges on owncloud.* to username@localhost identified by 'password';
flush privileges;
exit
</file>

====delete a database====
<file>
mysql
drop database owncloud;
</file>

====Backup a database====

<file>
mysqldump database > database.sql
</file>

When you want to diff the differences between two versions of a database, you need to do a specific dump
<file>
mysqldump --skip-comments --skip-extended-insert database >  database.sql
</file>

* Backup a database with the idea to diff the output

You might need to want to dump the database and have the need to diff the output against another database.

<file>
mysqldump --skip-comments --skip-extended-insert database >  filename
</file>

then

<file>
diff -Nur filename1  filename2 > diff_mysql.sql
</file>

a nice mysqldump

<file>
mysqldump databaseName --default-character-set=utf8mb4 --skip-dump-date --ignore-table=mysql.event --single-transaction --quick --add-drop-table > databaseName.sql
</file>

===== Networking =====
==== Find open ports ====

* to find opened udp and tcp ports in the firewall: 

<file>
netstat -tupln
</file>

* to find TCP ports with nmap

<file>
yum install nmap
nmap -p 1-65535  127.0.0.1
</file>

* find a specific port with netstat

<file>
 # netstat -anp|grep 5232
 tcp        0      0 192.168.12.233:5232         0.0.0.0:*                   LISTEN      2028/python
</file>

* find a specific port with nmap

nmap can specify if a port is closed or not

<file>
 yum install nmap
 nmap localhost -p 5232
</file>
==== Get MAC address without ifconfig ====
  cat /sys/class/net/host0/address
=====openssl=====
connect to a remote host and check what tls protocol and cipher is used

<file>
openssl s_client -connect 192.168.56.12:636 -tls1_2
</file>


<file>
 -ssl3         - just use SSLv3
 -tls1_2       - just use TLSv1.2
 -tls1_1       - just use TLSv1.1
 -tls1         - just use TLSv1
 -dtls1        - just use DTLSv1
 -cipher       - preferred cipher to use, use the 'openssl ciphers'
                 command to see what is available
</file>

=====PHP=====
====PHPinfo====
PHPinfo will provide an overview of all PHP related settings. A quick way to get an overview or search for a setting, one could use:

^ explanation ^ Command  ^
|get overview|<nowiki>php -r "phpinfo();" |less</nowiki>|
|to save to a text file|<nowiki>php -r "phpinfo();" > phpinfo.txt</nowiki>|
|to search for specific values and save to a text file|<nowiki>php -r "phpinfo();" | grep mysql > phpmysql.txt</nowiki>|
|to push it directly in the vhost data content|<nowiki>echo '<?php phpinfo(); ?>' > /var/lib/nethserver/vhost/plop.com/info.php</nowiki>|
|in the terminal|<nowiki>php -i</nowiki>|


====List PHP modules====

drop a file 

<file>
<?php

echo implode("\n", get_loaded_extensions());
echo "\n";
</file>

then 
<file>
php file
</file>
=====PODMAN=====

* remove **all** podman containers, if you use podman containers just for makerpms

<file>
sudo rm -rf $HOME/.local/share/containers/ 
</file>

=====RSPAMD=====

====Uptime====
<file>
rspamc uptime
</file>
====Dump the configuration====

Display all settings in rspamd, useful to understand what it occurs 
<file>
 rspamadm configdump
</file>


<file>
rspamadm configdump | grep -E '(WHITE|BLACK)LIST \{'
</file>
====Test manually to check an email====

<file>
 rspamc email.eml
</file>

<file>
curl smtp://127.0.0.1:25 -v --anyauth --mail-from no-reply@neth.net --mail-rcpt filippo@neth.net --upload-file ./2019.eml
</file>

- test the fom IP

<file>
[root@ns7loc14 ~]# host $(hostname)
[root@ns7loc14 ~]# config setprop postfix AccessBypassList 192.168.56.15

((++I)) ; curl smtp://$(hostname):25/$(hostname) -v --mail-from davidep2@email.celio.com --mail-rcpt postmaster@dpnet.nethesis.it <<EOF
Subject: Test ${I}
Date: $(date -R)
Message-ID: <${I}.$(date +%s)@$(hostname -d)>
From: davidep2@nethserver.org
To: postmaster@dpnet.nethesis.it
Mime-Version: 1.0

Test $I

Configuration settings for bayes expiry module should be 
added to the corresponding classifier section (for instance 
in the local.d/classifier-bayes.conf).
Bayes expiry module provides intelligent expiration of 
statistical tokens for the new schema of Redis statistics 
storage.

EOF

</file>

- test from email/domain

<file>
((++I)) ; curl smtp://$(hostname):25/$(hostname) -v --mail-from davidep2@email.celio.com --mail-rcpt postmaster@dpnet.nethesis.it <<EOF
Subject: Test ${I}
Date: $(date -R)
Message-ID: <${I}.$(date +%s)@$(hostname -d)>
From: davidep2@nethserver.org
To: postmaster@dpnet.nethesis.it
Mime-Version: 1.0

Test $I

Configuration settings for bayes expiry module should be 
added to the corresponding classifier section (for instance 
in the local.d/classifier-bayes.conf).
Bayes expiry module provides intelligent expiration of 
statistical tokens for the new schema of Redis statistics 
storage.

EOF

</file>

- test with getMail and a eicar 


<file>

[root@vm5 ~]# /usr/bin/rspamc-getmail "-i" "127.0.0.1" "--mime" "-t" "120" "-h" "localhost:11334" <<'EOF' 
Return-Path: <root@nethservice.nethesis.it>
Delivered-To: davidep2@nethesis.it
Received: from nethservice.nethesis.it
by nethservice.nethesis.it with LMTP id 2MyWCgn7O14ucwAAJc5BcA
for <davidep2@nethesis.it>; Thu, 06 Feb 2020 12:39:53 +0100
Received: by nethservice.nethesis.it (Postfix, from userid 0)
id 2A0133054108E; Thu,  6 Feb 2020 12:39:53 +0100 (CET)
From: virus-tester@nethservice.nethesis.it
To: undisclosed-recipients:;
Subject: amavisd test - simple - virus scanner test pattern
Message-Id: <20200206113953.2A0133054108E@nethservice.nethesis.it>
Date: Thu,  6 Feb 2020 12:39:53 +0100 (CET)

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
EOF
</file>
====check the content of all maps ====

<file>
grep -r -F .  /etc/rspamd/{white,black}list* | grep -v -F '#' | sort
</file>
==== Train rspamd for bayes ====

train rspamd to learn about spam and ham

https://wiki.nethserver.org/doku.php?id=userguide:manual_training_of_the_bayes_filter_rspamd

==== Statistics====
- Display statistics

<file>
rspamc stat
</file>

- Show scores and actions (no action, reject...) from a log file

<file>
rspamd_stats </var/log/maillog
</file>

====Validate the settings====

When you upgrade a rspamd version, useful to check if the settings are not obsoleted
<file>
rspamadm configtest
</file>

==== check clamav reloading ====

<file>
grep -E '(Cannot validate the message now|SelfCheck|Database correctly reloaded|/var/run/clamd@rspamd/clamav)' /var/log/maillog
</file>


==== flush clamav cache====

<file>
systemctl restart clamd@rspamd
systemctl restart rspamd
redis-cli -s /var/run/redis-rspamd/rspamd flushall
</file>

====Some useful commands====

<file>
Measure time taken by clamd to scan an email: clamdscan --config-file=/etc/clamd.d/rspamd.conf /tmp/mail
Measure time taken by rspam to analyze an email: rspamc -t 120 </tmp/mail
</file>

==== Yomi ====

Yomi is a plugin for the enterprise version who send attachment to [[https://yoroi.company/|yoroy servers]] to be analysed, authenticated users are not able to use it, only attachments of unauthenticated senders are tested by yomi 

make with thunderbird an email with an attachment that yomi will verify and scp it to the server, then issue the command

<file>
curl smtp://localhost:25 -v --anyauth --mail-from no-reply@neth.net --mail-rcpt stephane@domain.fr --upload-file ./hello.eml
</file>

then you can go to the maillog to see if the archive has been uploaded

<file>
Jun 28 14:56:46 ns7dev13 rspamd[5057]: <7fac8e>; proxy; rspamd_add_passthrough_result: <f5b43be1-2c53-2655-e6c3-0d2cb75ceaa3@domain.fr>: set pre-result to 'soft reject' (no score): 'Yomi cannot validate the message now. Try again later' from force_actions(0)
Jun 28 14:56:46 ns7dev13 rspamd[5057]: <7fac8e>; proxy; rspamd_task_write_log: id: <f5b43be1-2c53-2655-e6c3-0d2cb75ceaa3@domain.fr>, qid: <A77ED10813B2>, ip: 127.0.0.1, from: <no-reply@neth.net>, (default: F (soft reject): [-0.90/20.00] [SIGNED_PGP(-2.00){},YOMI_WAIT(1.00){Analysis in progress for CB_P5_fournissez-un-support-aux-utilisateurs_2021-06-25T162139.zip;},FORGED_SENDER(0.30){stephane@domain.fr;no-reply@neth.net;},MIME_GOOD(-0.20){multipart/signed;multipart/mixed;multipart/alternative;text/plain;},FORCE_ACTION_YOMI_FAIL(0.00){soft reject;},FROM_HAS_DN(0.00){},FROM_NEQ_ENVFROM(0.00){stephane@domain.fr;no-reply@neth.net;},HAS_ATTACHMENT(0.00){},MID_RHS_MATCH_FROM(0.00){},MIME_TRACE(0.00){0:+;1:+;2:+;3:+;4:+;5:~;6:~;7:~;...;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},TO_DN_NONE(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){},YOMI_FAIL(0.00){Analysis in progress for CB_P5_fournissez-un-support-aux-utilisateurs_2021-06-25T162139.zip;},YOMI_SKIPPED(0.00){OpenPGP_signature has MIME type to skip: application/pgp-signature;}]), len: 439113, time: 3194.391ms, dns req: 4, digest: <65cc257b362cd78c777438eaab09c6e7>, rcpts: <stephane@nethserver.fr>, mime_rcpts: <stephane@nethserver.fr>, forced: soft reject "Yomi cannot validate the message now. Try again later"; score=nan (set by force_actions)
</file>

You have to wait the remote provider scan your archive, but we could test also that the archive has been well submitted

{{:howto:screenshot_from_2021-06-28_14-59-06.png?400|}}


Yomi is supposed to work with a list of mime contents

<file>
[root@ns7dev13 ~]# cat /usr/share/nethserver-yomi/mime_type_graylist
application/octet-stream
application/javascript
application/vnd.ms-excel
application/vnd.ms-excel.sheet.macroEnabled.12
application/vnd.ms-word.document.macroEnabled.12
application/x-7z-compressed
application/x-ms-dos-executable
application/x-dosexec
application/x-vbscript
application/x-rar
text/x-sh
text/x-python
application/zip
application/gzip
application/x-silverlight
application/x-python-code
application/x-msdos-program
application/vnd.openxmlformats-officedocument.wordprocessingml.document
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
application/vnd.openxmlformats-officedocument.presentationml.presentation
application/vnd.oasis.opendocument.text
application/vnd.oasis.opendocument.spreadsheet
application/vnd.oasis.opendocument.presentation
application/vnd.ms-word.template.macroEnabled.12
application/vnd.ms-powerpoint
application/vnd.ms-excel.template.macroEnabled.12
application/msword
application/CDFV2-unknown
application/x-iso9660-image
application/x-tar
</file>

===== Redis =====
==== Flush cache data in redis ====

<file>
redis-cli -s /var/run/redis-rspamd/rspamd FLUSHALL
</file>

==== Delete all the keys of the currently selected DB in redis ====

https://redis.io/commands/flushdb

<file>
redis-cli -s /var/run/redis-rspamd/rspamd FLUSHDB
</file>
==== check bayes in redis ====

<file>
[root@prometheus ~]# redis-cli -s /var/run/redis-rspamd/rspamd
redis /var/run/redis-rspamd/rspamd> HGET BAYES_HAM learns 
redis /var/run/redis-rspamd/rspamd> HGET BAYES_SPAM learns
</file>


=== check keys/values in redis ===

<file>
#!/bin/bash

for key in $(redis-cli -s /var/run/redis-rspamd/rspamd keys \*);
  do
     #if [[ $key =~ 'BAYES' ]]; then
       echo "Key : '$key'" 
       redis-cli -s /var/run/redis-rspamd/rspamd type $key;
       redis-cli -s /var/run/redis-rspamd/rspamd GET $key;
     #fi
done
</file>


=== redis monitor === 

<file>
redis-cli -s /var/run/redis-rspamd/rspamd monitor
</file>
====Test rspamd by the command line====

https://github.com/NethServer/dev/issues/5755#issuecomment-492547473

==== RESET bayes data====

https://mailcow.github.io/mailcow-dockerized-docs/u_e-rspamd/#reset-learned-data

You need to delete keys in Redis to reset learned mail, so create a copy of your Redis database now:

Backup database


<file>
# It is better to stop Redis before you copy the file.
cp /var/lib/redis/rspamd/dump.rdb /root/Reset Bayes data
</file>


<file>
 redis-cli -s /var/run/redis-rspamd/rspamd --scan --pattern BAYES_* | xargs redis-cli -s /var/run/redis-rspamd/rspamd del
 redis-cli -s /var/run/redis-rspamd/rspamd --scan --pattern RS* | xargs redis-cli -s /var/run/redis-rspamd/rspamd del
</file>

If it complains about...


(error) ERR wrong number of arguments for 'del' command
...the key pattern was not found and thus no data is available to delete.
==== redis & oletools ====

* To flush the oletools verdicts cache run the following command

<file>
redis-cli -s /var/run/redis-rspamd/rspamd --raw KEYS rs_oletools_* | xargs -- redis-cli -s /var/run/redis-rspamd/rspamd DEL
</file>

* To check how much seconds before a cache entry is being expunged from the cache (first match only)

<file>
redis-cli -s /var/run/redis-rspamd/rspamd --raw KEYS rs_oletools_* | xargs -L 
</file>

===== Send email =====

[[:curl_howto|Curl]] could be a good way too but sendmail could help

<file>
echo "Subject: Test d'envoi mail"| sendmail -f stephane@domain.com  -v stephane@domain.com
</file>

Send an email to the recipient with the maillog transaction

===== Shorewall =====

==== Clear dynamic ====
<file>
iptables -F dynamic
shorewall save
</file>

==== Disable shorewall ====

<file>
shorewall clear
</file>

to restart 

<file>
shorewall start
</file>

===== Systemd =====

==== RedHat documentation====

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/chap-managing_services_with_systemd

==== Check customized services====

<file>
systemd-delta
</file>

==== Manage  a service====

Procedure
The following commands control the foo service:

- Activate a service immediately:

<file>
# systemctl start foo
</file>

- Deactivate a service immediately:

<file>
# systemctl stop foo
</file>

- Restart a service:

<file>
# systemctl restart foo
</file>

- Show the status of a service including, whether it is running or not:

<file>
# systemctl status foo
</file>

- Enable a service to be started on boot:

<file>
# systemctl enable foo
</file>

- Disable a service to not start during boot:

<file>
# systemctl disable foo
</file>

- Prevent a service from starting dynamically or even manually unless unmasked:

<file>
# systemctl mask foo
</file>

- Check if a service is enabled or not:

<file>
# systemctl is-enabled foo
</file>

- Check if the service is active (started) or inactive (stopped)

<file>
# systemctl is-active foo
</file>

- Related Information
Run ```man systemctl``` for more details.
=====TCPDUMP=====

capture packet and check port activity

<file>
tcpdump -i any port 389
</file>

====== Specific To Nethserver ======

=====Backup=====
====Rsync Backup====
The official backup module is probably the better way to do, but you can rsync the data of the NS by rsync. Only rsync the /var/lib/nethserver, might not be enough since some additional modules put a link in /etc/backup-data.d/ to save their data with the backup module.

<file>
[root@NS7DEVAllModules ~]# cat /etc/backup-data.d/*
/var/lib/nethserver/backup/duplicity/
/var/lib/nethserver/db
/var/www/bandwidthd/stats.db
/var/lib/nethserver/secrets
/root
/var/lib/nethserver
/var/lib/collectd
/var/spool/hylafax/log/seqf
/var/spool/hylafax/sendq/seqf
/var/spool/hylafax/docq/seqf
/var/spool/hylafax/recvq/seqf
/var/lightsquid
/var/lib/nethserver/webtop/logs
/var/www/html/nextcloud/config/config.php
</file>

so if you want a full backup solution, these paths must be saved also.

Therefore a solution like this should be better

<file>
rsync -avzR $(cat /etc/backup-data.d/*) root@YourIP:/your/path/to/save
</file>

the -R rsync option save the full path, it will ease your restoration


=====E-smith Database=====

You have a full [[howto:db_command_tutorial|howto Page to RTFM]], Like in every Linux shell you can use the TAB key when you use the command line to auto complete or propose all available answers.

  dbfile : database name see them in /var/lib/nethserver/db or type 'db' then 'tab'
  key    : uniq name not modifiable
  prop   : property of key
  val    : value of property

^ Command ^ Explanation
|db dbfile keys| List all keys|
|db dbfile print [key]|Print the [key] properties|
|db dbfile printjson [key]|Print the [key] properties in a Json format|
|db dbfile show [key]|Display the [key] properties|
|db dbfile showjson [key]|Display the [key] properties in a Json format|
|db dbfile get [key]|Retrieve the values of [key] properties|
|db dbfile getjson [key]|Retrieve the values of [key] properties in a Json format|
|db dbfile set [key] [type] [prop1 val1] [prop2 val2] ...|<nowiki>Create the [key] and [prop* val*] following a 'type' value(adjust the 'type')</nowiki>|
|db dbfile setdefault [key] [type] [prop1 val1] [prop2 val2] ...|<nowiki>Create the default [key] and [prop* val*] following a key 'type' (adjust the 'type')</nowiki>|
|db dbfile delete [key]|Delete the [key]|
|db dbfile printtype [key]|Print the type value of [key]|
|db dbfile gettype [key]|Retrieve the type value of [key]|
|db dbfile settype [key] [type]| Set a different type of [key]|
|db dbfile printprop [key] [prop1] [prop2] [prop3] ...|<nowiki>Print the value of [key] following [prop*]</nowiki>|
|db dbfile getprop [key] [prop]|Give the value of  [prop]|
|db dbfile setprop [key] [prop1] [val1] [prop2 val2] [prop3 val3] ...|<nowiki>Set the values of [prop*]</nowiki>|
|db dbfile delprop [key] [prop1] [prop2] [prop3] ...|Delete the values of [prop*]|


=====LDAP=====

==== Access to the LDAP server ====
the STARTTLS command is supported on port 389, and is the preferred method if the clients have it. Check the libuser's password has been correctly set. The libuser's DN should be

  uid=libuser,ou=People,dc=directory,dc=nh

or, if your domain part is example.com

  uid=libuser,ou=People,dc=example,dc=com

The port 636 is disabled by default

you have two specific users to bind for ldap service 
  * ldapservice - read-only
  * libuser - full access, read-write restricted to the localhost
  * Anonymous bind has read-only access and does not require STARTTLS.
passwords are stored under /var/lib/nethserver/secrets/

For more documentation, please read 

  * http://docs.nethserver.org/projects/nethserver-devel/en/latest/directory.html
  * http://docs.nethserver.org/projects/nethserver-devel/en/v7b/nethserver-directory.html


===List all entries with libuser bind===

  ldapsearch  -D cn=libuser,dc=directory,dc=nh -w `cat /var/lib/nethserver/secrets/libuser`

=== List all entries with admin user remotely over starttls===

<file>
ldapsearch -b dc=directory,dc=nh -ZZ -h 192.168.56.12 -D uid=admin,ou=People,dc=directory,dc=nh -W
</file>

same over ldaps

<file>
ldapsearch -b dc=directory,dc=nh -H ldaps://192.168.56.12 -D uid=admin,ou=People,dc=directory,dc=nh -W
</file>

same with ldapservice

<file>
ldapsearch -b dc=directory,dc=nh -ZZ -h 192.168.56.12 -D cn=ldapservice,dc=directory,dc=nh -w V_85617fr2bK3Csj

</file>
=====LOG=====

===Log retention policy on nethserver===

By default set to 4 weeks, if you want to increase to one year

<file>
config setprop logrotate Times 52
signal-event nethserver-base-update
</file>

You have other options like compression and rotate condition

<file>
# config show logrotate
logrotate=configuration
    Compression=disabled
    Rotate=weekly
    Times=52
</file>

===Force log rotation=== 

<file>
logrotate -vf /etc/logrotate.conf

</file>
=====OTP (one time password)=====

- generate the backup code (5 code, it is not possible to know if they have not been already used, reset the key or generate more code)

<file>
oathtool -w 5 $(cat /var/lib/nethserver/home/user/.2fa.secret)
</file>

- generate a time based code (valid 30 seconds)

<file>
oathtool --totp $(cat /var/lib/nethserver/home/user/.2fa.secret)
</file>

- reset the otp for a user

<file>
rm -f /var/lib/nethserver/home/user/.2fa.secret
</file>
=====SAMBA4=====
====have a shell inside the nsdc container====
If you find something strange, you need to access the container and use the samba-tool

<file>
systemd-run -M nsdc -t /bin/bash
</file>

====Control samba container ====

stop, start and status of the samba DC process
<file>
systemctl -M nsdc stop samba
systemctl -M nsdc start samba
systemctl -M nsdc status samba
</file>


====Search following filter in SAMBA AD====
search with filters

<file>
net ads search -P objectClass=Computer
net ads search -P objectClass=User
net ads search -P objectClass=Group
</file>

you can retrieve for a specific cn
<file>
net ads search -P cn=stephane
</file>
or use wildcard

<file>
net ads search -P cn=*|less
</file>

====list all entries with the administrator bind====
<file>
  ldapsearch -Z -x -D CN=Administrator,CN=Users,DC=neth,DC=eu -w Nethesis,1234 -b CN=Users,DC=neth,DC=eu -h 192.168.5.44
  ldapsearch -Z -x -D  CN=stephane,CN=Users,DC=ad,DC=nethservertest,DC=org -w 'azerty' -b CN=Users,DC=ad,DC=nethservertest,DC=org -h 192.168.56.101
  ldapsearch -Z -x -D "DOMAIN\stephane' -w 'azerty' -b CN=Users,DC=ad,DC=domain,DC=com -h 192.168.56.101
  ldapsearch -Z -x -D "stephane@domain.com' -w 'azerty' -b CN=Users,DC=ad,DC=domain,DC=com -h 192.168.56.101
</file>
 
  * the ip must be relevant to the one of your container.
  * the default password (Nethesis,1234) must be changed to the right one.

====Browse SAMBA AD field without password ====

<file>
systemd-run -M nsdc -q -t  /usr/bin/ldbsearch -H /var/lib/samba/private/sam.ldb
</file>
==== Retrieve the dn without password with ldapsearch====

<file>
systemd-run -M nsdc -q -t \
    /usr/bin/ldbsearch -H /var/lib/samba/private/sam.ldb "samaccountname=${userName}" dn | \
    sed -n '/^dn: / { s/\r// ; p ; q }'
</file>
====reset administrator's password====
If you're running a local Samba DC account provider, to enable and reset administrator's password:

  systemd-run -t -M nsdc /bin/bash
  samba-tool user enable administrator
  samba-tool user setpassword administrator --newpassword=Nethesis,1234
  
====join the domain====
It supports -U flag, to specify an alternative user with domain join rights. For instance

  realm join -U administrator  YOURDOMAIN.COM

to leave it 
  realm leave

====Demote a Secondary Domain Controller====
Please check this [[https://wiki.samba.org/index.php/Demoting_a_Samba_AD_DC#Demoting_an_Offline_Domain_Controller]]

A **secondary** DC is down, you are sure it will never come up again (e.g. hardware failure). You may want to remove it. Make sure the "broken DC" is offline.

From Nethserver root log into the NSDC chroot.

<file>
systemd-run -M nsdc -t /bin/bash
</file>

If you know the DC-name, you can check is status in your AD, please notice the name is case-sensitive.

<file>
ldbsearch -H /var/lib/samba/private/sam.ldb '(invocationId=*)' --cross-ncs objectguid | grep -A1 DC-NAME
</file>

If you do not know the name, you may check all configured AD-DCs:
<file>
ldbsearch -H /var/lib/samba/private/sam.ldb '(invocationId=*)' --cross-ncs objectguid
</file>

Now the magic ... you are sure what you are doing?
<file>
samba-tool domain demote --remove-other-dead-server=DC-NAME 
</file> 
  
==== Modify the SAMBA4 AD settings====
You can modify the samba ldap of the samba container with a ldif file, put your file in **/var/lib/machines/nsdc/var/lib/samba/private/file.ldif**.

then launch 

<file>
/usr/bin/systemd-run -M nsdc -q -t /usr/bin/ldbmodify -H /var/lib/samba/private/sam.ldb /var/lib/samba/private/file.ldif
</file>

this is an example of a ldif file

<file>
dn: cn=stephane,cn=Users,dc=ad,dc=plop,dc=org
changetype: modify
replace: loginShell
loginShell: /usr/libexec/openssh/sftp-server
</file>
==== Get MAC address of nsdc interface ====
  cat /var/lib/machines/nsdc/sys/class/net/host0/address
  
====Samba Member Server Troubleshooting====
Please check this [[https://wiki.samba.org/index.php/Samba_Member_Server_Troubleshooting|page]]
In short

* Do you have a keytab on the file server ?

<file>
klist -k
</file>

* check if the computer is joined to the domain.

<file>
sudo net ads testjoin
</file>

This should print:

<file>
Join is OK
</file>

* leave the domain and rejoin:

<file>
net ads leave -U Administrator

net ads join -U Administrator
</file>

You should now have a keytab, if it is still not there, try creating it manually:

<file>
net ads keytab create -U Administrator
</file>



=====Retrieve LDAP Settings=====

To retrieve the ldap settings, in a shell type the following command to get the current NethServer setup:

<file>
[root@vm5 ~]# account-provider-test dump
{
   "startTls" : "",
   "bindUser" : "VM5$",
   "userDN" : "dc=dpnet,dc=nethesis,dc=it",
   "port" : 636,
   "isAD" : "1",
   "host" : "dpnet.nethesis.it",
   "groupDN" : "dc=dpnet,dc=nethesis,dc=it",
   "isLdap" : "",
   "ldapURI" : "ldaps://dpnet.nethesis.it",
   "baseDN" : "dc=dpnet,dc=nethesis,dc=it",
   "bindPassword" : "secret",
   "bindDN" : "DPNET\\VM5$"
}
</file>


===== Reconfigure the Server =====
To expand all templates and restart the relevant services (no reboot, a business server shouldn't be rebooted) you can use:

<file>
/etc/e-smith/events/actions/system-adjust
</file>

===== Reinstall  all required packages  =====

<file>
yum install @nethserver-iso
</file>
=====Server-manager=====
==== Allow a user to the server-manager====
  * NS7
The builtin /usr/share/nethesis/NethServer/Authorization/base.json policy grants full access to members of administrators.

  groupadd administrators
  usermod -G administrators -a davidep@adnethesis.it

Now user davidep@adnethesis.it has full privileges from server-manager.
You have two groups with delegated powers

  -     administrators: Users of this group have the same permissions as the root or admin user.
  -     managers: Users of this group are granted access to the Management section.

====Use the server-manager with a SSH tunnel====

A SSH local port forward of 980

<file>
ssh -L 9980:localhost:980 <public IP>
</file>

Then connect to

<file>
https://localhost:9980
</file>
==== Use the Server Manager by the terminal ====
Of course the display is not as good  as you can have in a real browser :)

<file>
elinks -eval 'set connection.ssl.cert_verify = 0' https://localhost:980/
</file>
or
<file>
yum install links     # if not installed yet
links2 https://localhost:980
</file>
=====Sudoers=====
====Allow sudo power for a group====

  - create a group powerusers in Users & Groups page
  - add one ore more user to the group
  - create a sudo file like this:

<file>
  echo "%powerusers ALL=(ALL) ALL" > /etc/sudoers.d/90powerusers
  chmod 440  /etc/sudoers.d/90powerusers
</file>

====Sudoers files validation====

Validation of the sudoers.d syntax 

<file>
visudo -c
</file>

====Determine what commands a user can do====

See all commands that the user may do on your system

<file>
sudo -ll -U userName
</file>

====Edit sudoers files====

Edit and valid when you exit the sudoers file

<file>
visudo -f /etc/sudoers.d/20_nethserver_sssd
</file>

{{tag>userguide ht_tips}}


=====NethServer repository Tests =====

- Test changes in comps file

https://github.com/NethServer/dev/issues/6117#issuecomment-618316043



=====Upgrade to major version =====

- if you want to test the upgrade of centos rpm (only) to a major version (eg 7.8 -> 7.9)

<file>
yum --enablerepo=cr update
</file>

- if you want to upgrade your nethserver to a major version with the CLI

<file>
yum update
yum --enablerepo=nethserver-testing update nethserver-subscription\*
signal-event software-repos-upgrade
</file> 

Or

<file>
yum install -y http://mirror.nethserver.org/nethserver/nethserver-release-7.rpm
signal-event software-repos-save
yum update
</file>