webadmin-list — Webmin users mailing list

Re: [webmin-l] Planning on setting up Postfix + Dovecot + Webmail + Apache + MariaDB + PHP using Webmin Control Panel in the Cloud

[<eri...@tr...>]

> From: Turritopsis Dohrnii Teo En Ming <ceo...@gm...> 
> Sent: Wednesday, April 21, 2021 10:41 AM
> To: web...@li...
> Subject: [webmin-l] Planning on setting up Postfix + Dovecot + Webmail + Apache + MariaDB + PHP using Webmin Control Panel in the Cloud
>
> I am planning to setup Postfix Email Server + Dovecot IMAP/POP3 Incoming Mail Server + Webmail (Roundcube or Squirrelmail) + Apache Web Server + MariaDB Database Server + PHP using Webmin Control Panel specifically, in the cloud, preferably Amazon EC2.
> Are there any very good and well written guides on doing this type of setup?

Personally, I would just setup a Virtualmin site, it will pre-setup a LAMP/Email server for you.
https://www.virtualmin.com/

Sincerely,

Eric Tykwinski
TrueNet, Inc.
P: 610-429-8300

[webmin-l] Planning on setting up Postfix + Dovecot + Webmail + Apache + MariaDB + PHP using Webmin Control Panel in the Cloud

[Turritopsis D. T. En M. <ceo...@gm...>]

Subject: Planning on setting up Postfix + Dovecot + Webmail + Apache +
MariaDB + PHP using Webmin Control Panel in the Cloud

Good day from the Republic of Singapore,

I am planning to setup Postfix Email Server + Dovecot IMAP/POP3 Incoming
Mail Server + Webmail (Roundcube or Squirrelmail) + Apache Web Server +
MariaDB Database Server + PHP using Webmin Control Panel specifically, in
the cloud, preferably Amazon EC2.

Are there any very good and well written guides on doing this type of setup?

I am looking forward to your reply.

Thank you very much.

Mr. Turritopsis Dohrnii Teo En Ming, 43 years old as of 21 April 2021 Wed,
is a TARGETED INDIVIDUAL (TI) living in Singapore. He is an IT Consultant
with a System Integrator (SI)/computer firm in Singapore. He is an IT
enthusiast.




-----BEGIN EMAIL SIGNATURE-----

The Gospel for all Targeted Individuals (TIs):

[The New York Times] Microwave Weapons Are Prime Suspect in Ills of
U.S. Embassy Workers

Link: https://www.nytimes.com/2018/09/01/science/sonic-attack-cuba-microwave.html

********************************************************************************************

Singaporean Targeted Individual Mr. Turritopsis Dohrnii Teo En Ming's
Academic Qualifications as at 14 Feb 2019 and refugee seeking attempts
at the United Nations Refugee Agency Bangkok (21 Mar 2017), in Taiwan
(5 Aug 2019) and Australia (25 Dec 2019 to 9 Jan 2020):

[1] https://tdtemcerts.wordpress.com/

[2] https://tdtemcerts.blogspot.sg/

[3] https://www.scribd.com/user/270125049/Teo-En-Ming

-----END EMAIL SIGNATURE-----


<http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.
www.avg.com
<http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

Re: [webmin-l] Let's encrypt auto renew problem

[Mátyás C. <cs...@gm...>]

Hello!


What was strange that upgrading to webmin latest seemed to cause the
problem, After upgrading virtualmin too, it works again.

Thank both of you!

M


Jamie Cameron <jca...@we...> ezt írta (időpont: 2021. márc. 26., P,
21:37):

> Make sure you've upgraded to the latest Webmin and Virtualmin versions -
> older releases had a bug where they weren't recognizing that Let's Encrypt
> certs needed a renewal.
>
> On 22/Mar/2021 06:58 Mátyás Csere <cs...@gm...> wrote ..
>
> Hello!
>
> My LE certificates are not auto renewed.
> On the Virtualmin dashboard it lists them as "about to expire", then lets
> them expire eventually.
>
> If I press the "Request certificate" button on in the virtual server's SSL
> configuration, it  fetches a new certificate without an error. (the auto
> renew time is set lower than the time passed since last request)
>
> Inside Webmin scheduled tasks I have 'Virtual servers / run_cron_script/
> collectinfo.pl  " scheduled every 8 minutes.
>
> Could you help me resolve this issue?
>
> Thanks,
> M
>
>
>
> -
> Forwarded by the Webmin mailing list at
> web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>

Re: [webmin-l] Let's encrypt auto renew problem

[Jamie C. <jca...@we...>]

Make sure you've upgraded to the latest Webmin and Virtualmin versions - older releases had a bug where they weren't recognizing that Let's Encrypt certs needed a renewal.  

On 22/Mar/2021 06:58 Mátyás Csere <cs...@gm...> wrote ..   Hello!  My LE certificates are not auto renewed. On the Virtualmin dashboard it lists them as "about to expire", then lets them expire eventually.  If I press the "Request certificate" button on in the virtual server's SSL configuration, it  fetches a new certificate without an error. (the auto renew time is set lower than the time passed since last request)  Inside Webmin scheduled tasks I have 'Virtual servers / run_cron_script/  collectinfo.pl  " scheduled every 8 minutes.  Could you help me resolve this issue?  Thanks, M    

Re: [webmin-l] Let's encrypt auto renew problem

[<sou...@ro...>]

Hi, Mátyás.

*> Could you help me resolve this issue?*


Yes, please upgrade to Virtualmin 6.15, which doesn't have this issue. The
latest Webmin is 1.973, by the way.

On Mon, 22 Mar 2021 at 17:00, Mátyás Csere <cs...@gm...> wrote:

> Hello!
>
> My LE certificates are not auto renewed.
> On the Virtualmin dashboard it lists them as "about to expire", then lets
> them expire eventually.
>
> If I press the "Request certificate" button on in the virtual server's SSL
> configuration, it  fetches a new certificate without an error. (the auto
> renew time is set lower than the time passed since last request)
>
> Inside Webmin scheduled tasks I have 'Virtual servers / run_cron_script/
> collectinfo.pl  " scheduled every 8 minutes.
>
> Could you help me resolve this issue?
>
> Thanks,
> M
>
> -
> Forwarded by the Webmin mailing list at
> web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>

[webmin-l] Let's encrypt auto renew problem

[Mátyás C. <cs...@gm...>]

Hello!

My LE certificates are not auto renewed.
On the Virtualmin dashboard it lists them as "about to expire", then lets
them expire eventually.

If I press the "Request certificate" button on in the virtual server's SSL
configuration, it  fetches a new certificate without an error. (the auto
renew time is set lower than the time passed since last request)

Inside Webmin scheduled tasks I have 'Virtual servers / run_cron_script/
collectinfo.pl  " scheduled every 8 minutes.

Could you help me resolve this issue?

Thanks,
M

Re: [webmin-l] FreeBSD 12.2 and upgrade webmin to 1.970 fails

[Jamie C. <jca...@we...>]

Hi Dave,That's the UID of the user on my build system where the tarball is created. Normally I wouldn't expect this to matter though, as usually the tar command will either preserve that UID when restoring, or just change ownership to root. And when setup.sh is run, it will also chown to root.  

On 23/Jan/2021 13:27 Dave Overton <da...@sy...> wrote ..    Using Freebsd 12.2, but I doubt that part matters.  The installation fails after extracting the files, and this is why:  in /usr/local/lib immediately after failure drwxr-xr-x  132 root  bin        231 Nov  9 23:40 webmin-1.962/ drwxr-xr-x  132 3001  wheel      231 Jan 23 13:11 webmin-1.970/ User 3001 doesn't exist here.  #chown -R root /usr/local/lib/webmin-1.970 and run the setup.sh manually and all is good.    Dave Overton, Owner SYIX.COM da...@sy... 530-755-1751   

[webmin-l] FreeBSD 12.2 and upgrade webmin to 1.970 fails

[Dave O. <da...@sy...>]

Using Freebsd 12.2, but I doubt that part matters.  The installation fails
after extracting the files, and this is why:

in /usr/local/lib immediately after failure
drwxr-xr-x  132 root  bin        231 Nov  9 23:40 webmin-1.962/
drwxr-xr-x  132 3001  wheel      231 Jan 23 13:11 webmin-1.970/

User 3001 doesn't exist here.

 #chown -R root /usr/local/lib/webmin-1.970 and run the setup.sh manually
and all is good.





Dave Overton, Owner
SYIX.COM
da...@sy...
530-755-1751

Re: [webmin-l] Just a quick heads up...

[<eri...@tr...>]

Jamie,

> Re: [webmin-l] Just a quick heads up...
> 
> Are you still seeing this? I just updated the cert on the site to use the latest Let's Encrypt CA cert.
> 
> On the other hand, I heard that some clients don't support the new CA cert!

I was still getting an error on 104.207.151.13.
I simply copied the intermediates to /usr/local/share/ca-certificates
You can download them here: https://letsencrypt.org/certificates/

If anyone else wants to know.
Once you download it, rename the .pem to .crt and run:
sudo /usr/sbin/update-ca-certificates

Sincerely,

Eric Tykwinski
TrueNet, Inc.
P: 610-429-8300

Re: [webmin-l] Just a quick heads up...

[Joaquim H. <jo...@we...>]

So far it looks good.


On 2020-12-08 23:49, Jamie Cameron wrote:
> Are you still seeing this? I just updated the cert on the site to use
> the latest Let's Encrypt CA cert.
>
> On the other hand, I heard that some clients don't support the new
> CA cert!
>

Re: [webmin-l] Just a quick heads up...

[Andrey R. <anr...@ya...>]

Greetings, Jamie Cameron!

> Are you still seeing this? I just updated the cert on the site to use
> the latest Let's Encrypt CA cert.

Seems fine http://prntscr.com/vynlda

> On the other hand, I heard that some clients don't support the new 
> CA cert!

>>
>> It's causing errors on Ubuntu 18.04.LTS too now:
>> 
>> Err:14 https://download.webmin.com/download/repository sarge Release
>>    Certificate verification failed: The certificate is NOT trusted. The 
>> certificate issuer is unknown.  Could not handshake: Error in the 
>> certificate verification. [IP: 108.60.199.109 443]
>> Reading package lists... Done
>> E: The repository 'https://download.webmin.com/download/repository sarge 
>> Release' no longer has a Release file.
>> 
>> 
>> On 2020-12-08 17:43, eri...@tr... wrote:
>> > Just a heads up.
>> > Looks like the full chain isn’t in https://download.webmin.com/


-- 
With best regards,
Andrey Repin
Wednesday, December 9, 2020 4:28:23

Sorry for my terrible english...

Re: [webmin-l] Just a quick heads up...

[Jamie C. <jca...@we...>]

Are you still seeing this? I just updated the cert on the site to use
the latest Let's Encrypt CA cert.

On the other hand, I heard that some clients don't support the new 
CA cert!

On 08/Dec/2020 14:08 Joaquim Homrighausen <jo...@we...> wrote ..
> 
> It's causing errors on Ubuntu 18.04.LTS too now:
> 
> Err:14 https://download.webmin.com/download/repository sarge Release
>    Certificate verification failed: The certificate is NOT trusted. The 
> certificate issuer is unknown.  Could not handshake: Error in the 
> certificate verification. [IP: 108.60.199.109 443]
> Reading package lists... Done
> E: The repository 'https://download.webmin.com/download/repository sarge 
> Release' no longer has a Release file.
> 
> 
> On 2020-12-08 17:43, eri...@tr... wrote:
> > Just a heads up.
> > Looks like the full chain isn’t in https://download.webmin.com/
> 
> 
> 
> -
> Forwarded by the Webmin mailing list at web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list

Re: [webmin-l] Strange issues with ICMP monitoring

[Joaquim H. <jo...@we...>]

Hi there

As stated in the post(s), Webmin 1.962 on Ubuntu 20.04.LTS.

We do indeed use fail2ban on the servers being "pinged", but the ping 
interval is set rather high.

The checking server all of a sudden starts reporting monitors as being 
down, but they are actually not. If I ssh into that checking server, and 
issue ping to the servers reported as being down by Webmin, I get a 
response. Every time.

If I reboot the checking server, which takes about 10-15 seconds, 
everything goes back to normal.

It sounds/looks to me like a "build-up" issue, but I've only ever seen 
this on that particular server. It happened with Ubuntu 18.04.LTS, and 
it's happening with Ubuntu 20.04.1.LTS.

It happens frequently, but not every day.

The checking server is not logging in to the remote servers, it's simply 
sending ICMP/pings.


-joho


On 2020-12-08 23:04, Eric Tykwinski wrote:
> Sorry new to the list, but what are you running?
> VirtualMin, Webmin, Cloudmin?
>
> My first guess would be a fail2ban issue as that is a popular 
> dictionary attack mitigation method, so a cluster of webmin servers 
> with an incorrect password on one would cause this.

Re: [webmin-l] Just a quick heads up...

[Joaquim H. <jo...@we...>]

It's causing errors on Ubuntu 18.04.LTS too now:

Err:14 https://download.webmin.com/download/repository sarge Release
   Certificate verification failed: The certificate is NOT trusted. The 
certificate issuer is unknown.  Could not handshake: Error in the 
certificate verification. [IP: 108.60.199.109 443]
Reading package lists... Done
E: The repository 'https://download.webmin.com/download/repository sarge 
Release' no longer has a Release file.


On 2020-12-08 17:43, eri...@tr... wrote:
> Just a heads up.
> Looks like the full chain isn’t in https://download.webmin.com/

Re: [webmin-l] Strange issues with ICMP monitoring

[Eric T. <eri...@tr...>]

Sorry new to the list, but what are you running?
VirtualMin, Webmin, Cloudmin?

My first guess would be a fail2ban issue as that is a popular dictionary attack mitigation method, so a cluster of webmin servers with an incorrect password on one would cause this.

Sincerely,

Eric Tykwinski
TrueNet, Inc.
P: 610-429-8300

> On Dec 8, 2020, at 4:49 PM, Joaquim Homrighausen <jo...@we...> wrote:
> 
> 
> 
> So, this keeps happening even after upgrading the server to Ubuntu 20.04.1.LTS and Webmin 1.962.
> 
> While Webmin fails, access into the server using SSH works, as does the Webmin web interface, as does outbound network access (i.e. ping <remote host>, and so on). But Webmins internal ICMP/ping "checking code" does not.
> 
> If I re-boot the server, all is well.
> 
> Could it be the number of "ping monitors" (21) that's causing this ... ?
> 
> 
> 
> -joho
> 
> 
> 
> On 2020-11-10 20:29, Joaquim Homrighausen wrote:
>> I seem to have come across a really strange issue with ICMP monitoring or "Ping".
>> On a host running Webmin 1.960 and Ubuntu 18.04.LTS, I get error reports from *all* monitors of the type "Ping", indicating the monitor is down.
>> 
>> It only happens on this particular host.
>> 
> 
> -
> Forwarded by the Webmin mailing list at web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list

Re: [webmin-l] Strange issues with ICMP monitoring

[Joaquim H. <jo...@we...>]

So, this keeps happening even after upgrading the server to Ubuntu 
20.04.1.LTS and Webmin 1.962.

While Webmin fails, access into the server using SSH works, as does the 
Webmin web interface, as does outbound network access (i.e. ping <remote 
host>, and so on). But Webmins internal ICMP/ping "checking code" does not.

If I re-boot the server, all is well.

Could it be the number of "ping monitors" (21) that's causing this ... ?


-joho


On 2020-11-10 20:29, Joaquim Homrighausen wrote:
> I seem to have come across a really strange issue with ICMP monitoring 
> or "Ping".
>
> On a host running Webmin 1.960 and Ubuntu 18.04.LTS, I get error 
> reports from *all* monitors of the type "Ping", indicating the monitor 
> is down.
>
> It only happens on this particular host.
>

Re: [webmin-l] Due to Apple's M1, ARM is in the news again -- which led back to Webmin

[Jamie C. <jca...@we...>]

On 08/Dec/2020 09:40 Liam Proven <lp...@gm...> wrote ..
> I can't remember where this came up in the news recently, but thanks
> to the superb performance figures for macOS on Apple's new ARM Macs,
> naturally people are talking about Linux on ARM, Linux on M1, Amazon's
> Graviton server ARM chip and so on.
> 
> That led to some discussion of Corel's Netwinder, a small inexpensive
> ARM server from the turn of the century.
> 
> What I did not know was that Webmin was part of the inspiration for
> the Netwinder:
> 
> http://www.netwinder.org/arm_info.html
> 
> Sadly Corel did a deal with MS to licence VBA for WordPerfect Office,
> and the terms of the deal included the cancellation of WordPerfect for
> Linux, WordPerfect Office for Linux, Corel LinuxOS and the Netwinder.

Wow, that was a long time ago! I do vaguely remember talking to the Netwinder
folks at the time about Webmin customization and ARM support, which
was pretty simple since almost all of Webmin is in Perl.

 - Jamie

[webmin-l] Due to Apple's M1, ARM is in the news again -- which led back to Webmin

[Liam P. <lp...@gm...>]

I can't remember where this came up in the news recently, but thanks
to the superb performance figures for macOS on Apple's new ARM Macs,
naturally people are talking about Linux on ARM, Linux on M1, Amazon's
Graviton server ARM chip and so on.

That led to some discussion of Corel's Netwinder, a small inexpensive
ARM server from the turn of the century.

What I did not know was that Webmin was part of the inspiration for
the Netwinder:

http://www.netwinder.org/arm_info.html

Sadly Corel did a deal with MS to licence VBA for WordPerfect Office,
and the terms of the deal included the cancellation of WordPerfect for
Linux, WordPerfect Office for Linux, Corel LinuxOS and the Netwinder.


-- 
Liam Proven – Profile: https://about.me/liamproven
Email: lp...@ci... – gMail/gTalk/gHangouts: lp...@gm...
Twitter/Facebook/LinkedIn/Flickr: lproven – Skype: liamproven
UK: +44 7939-087884 – ČR (+ WhatsApp/Telegram/Signal): +420 702 829 053

[webmin-l] Just a quick heads up...

[<eri...@tr...>]

Just a heads up.
Looks like the full chain isn’t in https://download.webmin.com/

>From Qualys:
1
Sent by server 
download.webmin.com 
Fingerprint SHA256:
b0cb5e8862cb4a3c69c9554567526a034e789295dce0ace02b7e83d9c315d56b
Pin SHA256: LF+viNntupChFQJF+AI05v1WeZ8DVhno5nlKJzwUONw= 
RSA 2048 bits (e 65537) / SHA256withRSA 
2
Extra download 
R3 
Fingerprint SHA256:
730c1bdcd85f57ce5dc0bba733e5f1ba5a925b2a771d640a26f7a454224dad3b
Pin SHA256: jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0= 
RSA 2048 bits (e 65537) / SHA256withRSA 
3
In trust store 
DST Root CA X3   Self-signed 
Fingerprint SHA256:
0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739
Pin SHA256: Vjs8r4z+80wjNcr1YKepWQboSIRi63WsWXhIMN+eWys= 
RSA 2048 bits (e 65537) / SHA1withRSA 
Weak or insecure signature, but no impact on root certificate

This is causing an error on Ubuntu 20.04 Focal apt updates.

Sincerely,

Eric Tykwinski
TrueNet, Inc.
P: 610-429-8300

[webmin-l] Webmin facilitates ease of configuring MTAs/SMTP Servers?

[Turritopsis D. T. En M. <ce...@te...>]

Subject: Webmin facilitates ease of configuring MTAs/SMTP Servers?

Good day from Singapore,

Traditionally MTAs or SMTP servers like sendmail, qmail, exim and 
postfix, etc, are difficult to install and configure manually by hand.

With the use of Webmin GUI interface, is it a lot easier to configure 
MTAs like sendmail, qmail, exim and postfix?

In the past, I had SMTP servers installed and configured by cPanel and 
CentOS Web Panel (CWP) web hosting control panels. It was very easy. I 
never had to meddle with the configuration files of MTAs.

I would like to contemplate installing and configuring MTAs using Webmin 
in the future.

Thank you for developing a web GUI interface for configuring MTAs.

Mr. Turritopsis Dohrnii Teo En Ming, 42 years old as of 2nd December 
2020 Wed, is a TARGETED INDIVIDUAL (TI) living in Singapore.








-----BEGIN EMAIL SIGNATURE-----

The Gospel for all Targeted Individuals (TIs):

[The New York Times] Microwave Weapons Are Prime Suspect in Ills of
U.S. Embassy Workers

Link: 
https://www.nytimes.com/2018/09/01/science/sonic-attack-cuba-microwave.html

********************************************************************************************

Singaporean Targeted Individual Mr. Turritopsis Dohrnii Teo En Ming's 
Academic
Qualifications as at 14 Feb 2019 and refugee seeking attempts at the 
United Nations Refugee Agency Bangkok (21 Mar 2017), in Taiwan (5 Aug 
2019) and Australia (25 Dec 2019 to 9 Jan 2020):

[1] https://tdtemcerts.wordpress.com/

[2] https://tdtemcerts.blogspot.sg/

[3] https://www.scribd.com/user/270125049/Teo-En-Ming

-----END EMAIL SIGNATURE-----

[webmin-l] webmin 1.962 upgrade on FreeBSD

[Dave O. <da...@sy...>]

This is what happens, clicking the "upgrade" button on the main menu

Downloading
http://prdownloads.sourceforge.net/sourceforge/webadmin/webmin-1.962.tar.gz
(179 bytes) ..
Downloading
http://downloads.sourceforge.net/project/webadmin/webmin/1.962/webmin-1.962.
tar.gz (167 bytes) ..
Downloading
https://phoenixnap.dl.sourceforge.net/project/webadmin/webmin/1.962/webmin-1
.962.tar.gz (44.72 MiB) ..
     Received 15.76 KiB (0 %)
     Received 4.47 MiB (10 %)
     Received 8.94 MiB (20 %)
     Received 13.41 MiB (30 %)
     Received 17.89 MiB (40 %)
     Received 22.36 MiB (50 %)
     Received 26.83 MiB (60 %)
     Received 31.31 MiB (70 %)
     Received 35.78 MiB (80 %)
     Received 40.25 MiB (90 %)
     Received 44.72 MiB (100 %)
.. download complete.
Package signature verified successfully.
Running setup.sh script to upgrade Webmin .. Please wait a minute until it
is complete before continuing.
cd: ../../webmin-1.962: No such file or directory


I can manually run the setup.sh script and its fine, just figured it was
looking in the wrong place.

Dave Overton, Owner
SYIX.COM
da...@sy...
530-755-1751

Re: [webmin-l] Nginx

[<sou...@ro...>]

Hi,

We have pretty recently fixed a few related bugs in virtualmin-nginx
module. I would say yes, improved.

Which module(s) are people here using for Nginx?


We recommend using virtualmin-nginx
<https://github.com/virtualmin/virtualmin-nginx> module.

On Mon, 16 Nov 2020 at 17:36, Joaquim Homrighausen <jo...@we...>
wrote:

>
> Did Nginx administration and possibly integration with Virtualmin improve
> in any of the latest releases of Webmin?
>
> Which module(s) are people here using for Nginx?
>
>
> -joho
>
>
> -
> Forwarded by the Webmin mailing list at
> web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>

[webmin-l] Nginx

[Joaquim H. <jo...@we...>]

Did Nginx administration and possibly integration with Virtualmin 
improve in any of the latest releases of Webmin?

Which module(s) are people here using for Nginx?


-joho

[webmin-l] Guide on Renewing SSL Certificate for Apache, Postfix and Dovecot on CentOS 6.8 Linux

[Turritopsis D. T. En M. <teo...@gm...>]

Guide on Renewing SSL Certificate for Apache, Postfix and Dovecot on
CentOS 6.8 Linux
=====================================================================================

Author: Mr. Turritopsis Dohrnii Teo En Ming (TARGETED INDIVIDUAL)

Country: Singapore

Date: 12 November 2020 Thursday Singapore Time

Type of Publication: Plain Text

Document Version: 20201112.01

Generating Certificate Signing Request (CSR) Using OpenSSL command on Linux
===========================================================================

Reference Guide: Generating CSR on Apache + OpenSSL/ModSSL/Nginx + Heroku
Link: https://www.namecheap.com/support/knowledgebase/article.aspx/9446/14/generating-csr-on-apache--opensslmodsslnginx--heroku/#4

# cd /root

# which openssl

# openssl req -new -newkey rsa:2048 -nodes -keyout
teo-en-ming-corp.key -out teo-en-ming-corp.csr

Generating a 2048 bit RSA private key
...............................................................................................................................................................................+++
........................................................................+++
writing new private key to 'teo-en-ming-corp.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:SG
State or Province Name (full name) []:Singapore
Locality Name (eg, city) [Default City]:Singapore
Organization Name (eg, company) [Default Company Ltd]:Teo En Ming Corporation
Organizational Unit Name (eg, section) []:IT Department
Common Name (eg, your name or your server's hostname)
[]:*.teo-en-ming-corp.com.sg (USE WILDCARD!!!)
Email Address []:ce...@te...

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

# mkdir teo-en-ming

# mv teo-en-ming-corp.csr teo-en-ming-corp.key teo-en-ming/

# cd teo-en-ming

[ro...@ma... teo-en-ming]# ls -al
total 16
drwxr-xr-x   2 root root 4096 Nov 11 11:43 .
dr-xr-x---. 14 root root 4096 Nov 11 11:43 ..
-rw-r--r--   1 root root 1119 Nov 11 11:42 teo-en-ming-corp.csr
-rw-r--r--   1 root root 1708 Nov 11 11:42 teo-en-ming-corp.key

# cat teo-en-ming-corp.csr (Display Certificate Signing Request)

-----BEGIN CERTIFICATE REQUEST-----

-----END CERTIFICATE REQUEST-----

# cat teo-en-ming-corp.key (Display Private/Secret Key)

-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----

Result from AlphaSSL Portal
============================

Congratulations!
Your order has been placed successfully.
Your order number is :
You'll need to copy the following Domain Verification Code and place
it in a text file called "gsdv.txt" which you'll then need to put in
one of the approved locations
Meta Tag : <meta name="_globalsign-domain-verification" content="" />

http://teo-en-ming-corp.com.sg/.well-known/pki-validation/gsdv.txt

https://teo-en-ming-corp.com.sg/.well-known/pki-validation/gsdv.txt

To complete the URL Verification, close the browser. Open the SSL
Configuration Link in new browser and click on "Complete Url
Verification".

End of Result from AlphaSSL Portal
==================================

Domain Verification for SSL Certificate
=======================================

# cd /home/teo-en-ming-corp/public_html

# mkdir .well-known

# cd .well-known

# mkdir pki-validation

# cd pki-validation/

Edit gsdv.txt.

# nano gsdv.txt

<meta name="_globalsign-domain-verification" content="" />

Begin Email from AlphaSSL
=========================

Email Subject: : Your SSL Certificate for *.teo-en-ming-corp.com.sg
has been issued

-------------------------------------------------------------------------------
Please note that this email is automatically sent from a noreply mailbox.
To contact AlphaSSL please use the Contact Details at the footer of this email.
-------------------------------------------------------------------------------


Dear Turritopsis Dohrnii Teo En Ming,

Your AlphaSSL Certificate has now been issued and is ready to be
installed. Your SSL Certificate can be found at the bottom of this
email.


CERTIFICATE DETAILS
--------------------------------------------------
Order Number:
Common Name:  *.teo-en-ming-corp.com.sg


INSTALLING YOUR CERTIFICATE
----------------------------------------------------
Your SSL Certificate and Intermediate Certificate must be installed on
your server.

Please note that as of March 31st 2014, SHA-256 will become the
default hashing algorithm used unless SHA-1 was selected during the
ordering process.

You can find guides on installing your certificate with the Support
Center online at:  http://www.alphassl.com/support


QUICK INSTALLATION GUIDE
----------------------------------------------------
1) Using a text editor, copy the SSL Certificate text from the bottom
of this email (including the -----BEGIN CERTIFICATE-----  and -----END
CERTIFICATE----- lines) and save it to a file such as yourdomain.txt

2) Retrieve the Intermediate Certificate (selecting SHA-1 or SHA-256
as appropriate) from the Support Center at:
https://www.alphassl.com/support/install-root-certificate.html

3) Using a text editor, copy the Intermediate Certificate text
(including the ----BEGIN CERTIFICATE----- and -----END
CERTIFICATE----- lines) and save it to a file such as
intermediate_domain_ca.txt

4) Copy these .txt files to your server and then rename them with .crt
extensions

5) Install the Intermediate and SSL Certificates

6) Restart your server

7) To test for installation errors please use our SSL Configuration
Checker located at https://sslcheck.globalsign.com/en_US

8) Install your Site Seal with the instructions show at:
http://www.alphassl.com/support/ssl-site-seal.html

9) We suggest you back-up your SSL Certificate and Private Key pair
and keep it safe, all IIS users can use the Export Wizard

We hope that your application process was quick and easy and you have
enjoyed the AlphaSSL experience.


Thank you for choosing AlphaSSL, if you have any questions or issues
please do not hesitate to contact us.

CONTACT US
--------------------------------------------------
For Sales, Technical Support & Account Queries:
W: http://www.alphassl.com/support
E: su...@al...
T: US Toll Free: 877 SSLALPHA (+1 877 775 2574) | Fax: 720 528 8160
T: EU: +44 1622 766 700 | Fax: +44 1622 662 255

---------------------------------------------------
LOW COST. TRUSTED BY ALL BROWSERS. SSL MADE EASY.
---------------------------------------------------


YOUR SSL CERTIFICATE
--------------------------------------------------
(Formatted for the majority of web server software including IIS and
Apache based servers):

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

End of Email from AlphaSSL
===========================

# cd /root/teo-en-ming

# nano teo-en-ming-corp.crt (Saving the SSL Certificate/Public Key)

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

# nano intermediate_domain_ca.crt (Saving the intermediate CA certificate)

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

Installing SSL Certificate on Postfix SMTP Server
=================================================

Backup the Postfix configuration files first before you modify anything.

# cd /etc/postfix

# cp main.cf main.teoenming

# cp master.cf master.teoenming

Reference Guide: Installing and configuring SSL on Postfix/Dovecot mail server
Link: https://www.namecheap.com/support/knowledgebase/article.aspx/9795/69/installing-and-configuring-ssl-on-postfixdovecot-mail-server

Copy the public and private key over from /root/teo-en-ming to /etc/postfix.

# cd /root/teo-en-ming/

# cp * /etc/postfix

# cd /etc/postfix

Edit the Postfix configuration file.

# nano main.cf

smtpd_tls_cert_file = /etc/postfix/teo-en-ming-corp.crt
smtpd_tls_key_file = /etc/postfix/teo-en-ming-corp.key
smtpd_tls_CAfile = /etc/postfix/intermedia_domain_ca.crt

***Please note that the previous IT support company did not enable
SSL/TLS for SMTP Server.***

Restart the Postfix SMTP Server.

# service postfix restart

Installing SSL Certificate on Dovecot IMAP and POP3 Incoming Mail Server
=========================================================================

Backup the auxiliary Dovecot configuration file first before you
modify anything.

# cd /etc/dovecot/conf.d

# cp 10-ssl.conf 10-ssl.teoenming

Begin Redundant/Useless Section
===============================

Please do not follow the instructions in this section.

# cd /etc/pki/dovecot/certs

# cp /root/teo-en-ming/teo-en-ming-corp.crt .

# cd /etc/pki/dovecot/private/

# cp /root/teo-en-ming/teo-en-ming-corp.key .

# cd /etc/dovecot/conf.d

Edit 10-ssl.conf.

# nano 10-ssl.conf

ssl_cert = </etc/pki/dovecot/certs/teo-en-ming-corp.crt
ssl_key = </etc/pki/dovecot/private/teo-en-ming-corp.key

End of Redundant/Useless Section
================================

Backup the Main Dovecot configuration file before you modify anything.

# cd /etc/dovecot

# cp dovecot.conf dovecot.conf.teoenming

Modify the Main Dovecot Configuration file.

# nano dovecot.conf

local_name teo-en-ming-corp.com.sg {
ssl_cert = </home/teo-en-ming-corp/teo-en-ming-corp.crt
ssl_key = </home/teo-en-ming-corp/teo-en-ming-corp.key
  ssl_ca = </home/teo-en-ming-corp/intermediate_domain_ca.crt
}
local_name www.teo-en-ming-corp.com.sg {
ssl_cert = </home/teo-en-ming-corp/teo-en-ming-corp.crt
ssl_key = </home/teo-en-ming-corp/teo-en-ming-corp.key
  ssl_ca = </home/teo-en-ming-corp/intermediate_domain_ca.crt
}
local_name autoconfig.teo-en-ming-corp.com.sg {
ssl_cert = </home/teo-en-ming-corp/teo-en-ming-corp.crt
ssl_key = </home/teo-en-ming-corp/teo-en-ming-corp.key
  ssl_ca = </home/teo-en-ming-corp/intermediate_domain_ca.crt
}
local_name autodiscover.teo-en-ming-corp.com.sg {
ssl_cert = </home/teo-en-ming-corp/teo-en-ming-corp.crt
ssl_key = </home/teo-en-ming-corp/teo-en-ming-corp.key
  ssl_ca = </home/teo-en-ming-corp/intermediate_domain_ca.crt
}

Restart the Dovecot IMAP and POP3 Incoming Mail Server.

# service dovecot restart

Verify SSL Certificate of Email Server
======================================

Reference Guide: How to verify that SSL for IMAP/POP3/SMTP works and a
proper SSL certificate is in use
Link: https://support.plesk.com/hc/en-us/articles/213961665-How-to-verify-that-SSL-for-IMAP-POP3-SMTP-works-and-a-proper-SSL-certificate-is-in-use

[1] https://www.sslshopper.com/ssl-checker.html#hostname=smtp.gmail.com:465

[2] https://ssl-tools.net/mailservers

[3] IMAPS test: openssl s_client -showcerts -connect
mail.teo-en-ming-corp.com.sg:993 -servername
mail.teo-en-ming-corp.com.sg

CONNECTED(00000003)
depth=2 C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
verify return:1
depth=1 C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2
verify return:1
depth=0 CN = *.teo-en-ming-corp.com.sg
verify return:1
---
Certificate chain
 0 s:/CN=*.teo-en-ming-corp.com.sg
   i:/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----
 1 s:/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
   i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----
---
Server certificate
subject=/CN=*.teo-en-ming-corp.com.sg
issuer=/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
---
No client certificate CA names sent
---
SSL handshake has read 2961 bytes and written 632 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES256-SHA256
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:


    Start Time: 1605161631
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE
IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot ready.

[4] POP3S test: openssl s_client -showcerts -connect
mail.teo-en-ming-corp.com.sg:995 -servername
mail.teo-en-ming-corp.com.sg

CONNECTED(00000003)
depth=2 C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
verify return:1
depth=1 C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2
verify return:1
depth=0 CN = *.teo-en-ming-corp.com.sg
verify return:1
---
Certificate chain
 0 s:/CN=*.teo-en-ming-corp.com.sg
   i:/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----
 1 s:/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
   i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----
---
Server certificate
subject=/CN=*.teo-en-ming-corp.com.sg
issuer=/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
---
No client certificate CA names sent
---
SSL handshake has read 2961 bytes and written 632 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES256-SHA256
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:


    Start Time: 1605161905
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
+OK Dovecot ready.

[5] SMTPS Port 465 test: openssl s_client -showcerts -connect
mail.teo-en-ming-corp.com.sg:465 -servername
mail.teo-en-ming-corp.com.sg

socket: Connection timed out
connect:errno=110

[6] SMTPS Port 587 test: openssl s_client -starttls smtp -showcerts
-connect mail.teo-en-ming-corp.com.sg:587 -servername
mail.teo-en-ming-corp.com.sg

CONNECTED(00000003)
140575970621256:error:140770FC:SSL
routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:769:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 278 bytes and written 309 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

Installing SSL Certificate on Apache Web Server
===============================================

Backup the auxiliary Apache web server configuration file before you
modify anything.

# cd /etc/httpd/conf.d

# cp ssl.conf ssl.teoenming

Begin Redundant/Useless Section
===============================

Please do not follow the instructions in this section.

# /etc/pki/tls/certs

# cp /root/teo-en-ming/teo-en-ming-corp.crt .

# /etc/pki/tls/private

# cp /root/teo-en-ming/teo-en-ming-corp.key .

# cd /etc/httpd/conf.d

Edit ssl.conf.

# nano ssl.conf

SSLCertificateFile /etc/pki/tls/certs/teo-en-ming-corp.crt

SSLCertificateKeyFile /etc/pki/tls/private/teo-en-ming-corp.key

Verify all Apache web server configuration files are correct.

# httpd -t

Restart Apache web server.

# service httpd restart

End of Redundant/Useless Section
=================================

Copy the public and private key over.

# cd /home/teo-en-ming-corp

# cp /root/teo-en-ming/* .

Backup the Main Apache web server configuration file before you modify anything.

# cd /etc/httpd/conf

# cp httpd.conf httpd.teoenming

Edit the Main Apache web server configuration file.

# nano httpd.conf

SSLCertificateFile /home/teo-en-ming-corp/teo-en-ming-corp.crt
SSLCertificateKeyFile /home/teo-en-ming-corp/teo-en-ming-corp.key
SSLCACertificateFile /home/teo-en-ming-corp/intermediate_domain_ca.crt

Verify that your Apache web server configuration files are all correct.

# httpd -t

Restart Apache web server.

# service httpd restart

Configuring SSL Certificate inside Webmin
=========================================

Login to https://mail.teo-en-ming-corp.com.sg:10101

Username: root
Password: <CENSORED>

You can also configure SSL Certificate using Webmin. I will publish a
guide on this in the future.

Also, 16 screenshots will be published in the future.

End of Guide
============




-----BEGIN EMAIL SIGNATURE-----

The Gospel for all Targeted Individuals (TIs):

[The New York Times] Microwave Weapons Are Prime Suspect in Ills of
U.S. Embassy Workers

Link: https://www.nytimes.com/2018/09/01/science/sonic-attack-cuba-microwave.html

********************************************************************************************

Singaporean Targeted Individual Mr. Turritopsis Dohrnii Teo En Ming's Academic
Qualifications as at 14 Feb 2019 and refugee seeking attempts at the
United Nations Refugee Agency Bangkok (21 Mar 2017), in Taiwan (5 Aug
2019) and Australia (25 Dec 2019 to 9 Jan 2020):

[1] https://tdtemcerts.wordpress.com/

[2] https://tdtemcerts.blogspot.sg/

[3] https://www.scribd.com/user/270125049/Teo-En-Ming

-----END EMAIL SIGNATURE-----

[webmin-l] Strange issues with ICMP monitoring

[Joaquim H. <jo...@we...>]

Hello, hope everyone is safe from the stuff that's going on.


I seem to have come across a really strange issue with ICMP monitoring 
or "Ping".

On a host running Webmin 1.960 and Ubuntu 18.04.LTS, I get error reports 
from *all* monitors of the type "Ping", indicating the monitor is down.

It only happens on this particular host.

What's strange is that other monitors, like HTTP/WEB (80/443) monitors 
all work, even those to the same hosts. Doing a check with mtr -r -c 10 
<host> from the Webmin host to any of the failing monitored hosts, 
everything looks good.

If I do a "manual" ping, using "ping <host>", everything looks good.

Re-starting Webmin does not help. Doing a "shutdown -r now" on the 
Webmin host works.

Time to wait for response is set to 10s.

I've tried using both hostnames and IP-addresses, no difference. All 
hostnames resolve to IPv4 addresses only.

I would really like to nail this odd behavior ... is there any way I can 
configure some more debug output from Webmin monitors?

There are no weird entries in /var/webmin/webmin.log

The only "error looking" entries in /var/webmin/miniserv.error I can see 
are these, but they don't appear to be related to this issue:


[06/Nov/2020:00:30:50 +0200] IPv6 support cannot be enabled without the 
Socket6 perl module
[06/Nov/2020:00:30:50 +0200] Using MD5 module Digest::MD5
[06/Nov/2020:00:30:50 +0200] Using SHA512 module Crypt::SHA
[06/Nov/2020:00:30:50 +0200] PAM authentication enabled
Use of uninitialized value in numeric ne (!=) at 
/usr/share/webmin/bind8/bind8-lib.pl line 2406.
[08/Nov/2020:20:55:12 +0200] miniserv.pl started
[08/Nov/2020:20:55:12 +0200] IPv6 support cannot be enabled without the 
Socket6 perl module
[08/Nov/2020:20:55:12 +0200] Using MD5 module Digest::MD5
[08/Nov/2020:20:55:12 +0200] Using SHA512 module Crypt::SHA
[08/Nov/2020:20:55:12 +0200] PAM authentication enabled
Use of uninitialized value in numeric ne (!=) at 
/usr/share/webmin/bind8/bind8-lib.pl line 2406.
[10/Nov/2020:21:22:06 +0200] miniserv.pl started
[10/Nov/2020:21:22:06 +0200] IPv6 support cannot be enabled without the 
Socket6 perl module
[10/Nov/2020:21:22:06 +0200] Using MD5 module Digest::MD5
[10/Nov/2020:21:22:06 +0200] Using SHA512 module Crypt::SHA
[10/Nov/2020:21:22:06 +0200] PAM authentication enabled



-joho