Ulaş SAYGIN UlasSAYGINIM

myprint.scl.utah.edu

The myprint service handles wireless printing for the MLIB PC labs. FreeBSD is the operating system that was chosen for this service primarily for its security features.

Details on the current configuration of myprint.scl.utah.edu can be found below. 07/12/2013

Host OS configuration

This first section details the various configuration options applied to the kernel, NAT & traffic passing to jailed (non routable net) env, usage of IPFW service to filter incoming & outgoing traffic to specific subnets & or targets, OS, Jail & TCP stack hardening options

Postfix Installer

Following script may be used for configuring complete and secure email server on fresh install of Debian 7. It will probably work on other distributions using apt-get. After minor changes you'll be able to use it on other Linux distros.

Usage

Run postfix.sh script.
Configure postgres to allow connections.
Configure postfix admin. Remember to set these:

Configure zabbix jail

The smartctl program needs direct read access to raw disk devices. To allow that, we must create a devfs ruleset to un-hide our disk devices in the zabbix jail's /dev/ folder.

# Set the jailname
jailname="zabbix"

# Set the ruleset number. Use the last 3 digits of $jail_ip
rule_num="212"

PSQL

Magic words:

psql -U postgres

Some interesting flags (to see all, use -h or --help depending on your psql version):

-E: will describe the underlaying queries of the \ commands (cool for learning!)
-l: psql will list all databases and then exit (useful if the user you connect with doesn't has a default database, like at AWS RDS)

	# the filesets will be different on each jail, thus, we'll always be doing a full unless
	# we define this for each jail server
	#
	FileSet {
	Name = "zuul jail snapshots"
	Include {
	Options {
	signature = MD5
	Exclude = yes
	}

	<html>
	<head>
	<style>

	/* user styles */
	body {
	max-width: 900px;
	margin: auto;
	padding: 1em;
	}

 # ag <https://github.com/ggreer/the_silver_searcher>
 # usage: ag-replace.sh [search] [replace]
 # caveats: will choke if either arguments contain a forward slash
 # notes: will back up changed files to *.bak files
 ag -0 -l $1 | xargs -0 perl -pi.bak -e "s/$1/$2/g"
 # or if you prefer sed's regex syntax:
 ag -0 -l $1 | xargs -0 sed -ri.bak -e "s/$1/$2/g"

	/* The PKCS #7 container (the receipt) and the output of the verification. */
	BIO *b_p7;
	PKCS7 *p7;

	/* The Apple root certificate, as raw data and in its OpenSSL representation. */
	BIO *b_x509;
	X509 *Apple;

	/* The root certificate for chain-of-trust verification. */
	X509_STORE *store = X509_STORE_new();

	#!/bin/sh

	JLS="/usr/sbin/jls"
	PKG="/usr/sbin/pkg"

	# list of the jail ids for all jails
	JAILS=`${JLS} jid`
	RESULT=""

	CHECKING=$1

	SELECT
	EXISTS (SELECT friend FROM friends WHERE `user` = '$owner' AND friend = '$user') AS ou, --Owner has User
	EXISTS (SELECT friend FROM friends WHERE `user` = '$user' AND friend = '$owner') AS uo; --User has Owner