S/MIME Notes

This post is more for me as I had to google all this and don’t want to go finding things again.

Here’s a link to get a free cert from Comodo: Free S/MIME Cert

Here’s how to set it up in iOS: S/MIME in iOS 5.1

And on Outlook (if you have to).

AirPrint to cups-pdf on Ubuntu

I got the 3rd generation iPad and needed to print some emails – actually to save them as pdf. Easy enough to do on a Mac in Safari, but not an option in iOS 5.1. So, to get AirPrint working with cups-pdf on Ubuntu 10.04.4 LTS.

Avahi

Prior to this, I used airprint-generate.py to get AirPrint working with a regular printer. I manually duplicated the avahi service file for the cups-pdf printer from the regular printer created with the script. I imagine I could have used it again to create a avahi service file for cups-pdf.

/etc/avahi/services/AirPrint-PDF.service
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
 <name replace-wildcards="yes">AirPrint PDF @ server.local</name>
 <service>
 <type>_ipp._tcp</type>
 <subtype>_universal._sub._ipp._tcp</subtype>
 <port>631</port>
 <txt-record>txtvers=1</txt-record>
 <txt-record>qtotal=1</txt-record>
 <txt-record>Transparent=T</txt-record>
 <txt-record>URF=none</txt-record>
 <txt-record>rp=printers/PDF</txt-record>
 <txt-record>note=AirPrint</txt-record>
 <txt-record>product=(GPL Ghostscript)</txt-record>
 <txt-record>printer-state=3</txt-record>
 <txt-record>printer-type=0x80901c</txt-record>
 <txt-record>pdl=application/octet-stream,application/pdf,application/postscript,image/gif,image/jpeg,image/png,image/tiff,text/html,text/plain,application/openofficeps,application/vnd.cups-banner,application/vnd.cups-pdf,application/vnd.cups-postscript</txt-record>
 </service>
</service-group>

Of course, the key entry here, is the cups path to to printer:

<txt-record>rp=printers/PDF</txt-record>

I suppose it could be a path to a different cups server.

Cups-pdf

If not installed, install it on Ubuntu with:

apt-get install cups-pdf

Then, in cd /var/spool/cups-pdf/ we will have to make a link to your home directory. In this tutorial, I am using Dropbox to sync the generated pdfs. So, I created a link to a folder in my Dropbox folder for anonymous pdf files.

ls -la
total 16
drwxr-xr-x 4 root root 4096 2012-03-17 00:48 .
drwxr-xr-x 9 root root 4096 2012-03-17 00:15 ..
lrwxrwxrwx 1 root root 27 2012-03-17 00:38 ANONYMOUS -> /home/<user>/Dropbox/Docs/PDF
drwxrwxrwt 2 root lpadmin 4096 2012-03-17 00:46 ANONYMOUS-orig
drwxr-x--x 2 root lpadmin 4096 2012-03-17 10:32 SPOOL

Also, we need to change some settings in /etc/cups/cups-pdf.conf. Since this server is only for me, I don’t really have to worry about others, so I change the user output destination.

Out ${HOME}/Dropbox/Docs/PDF

I was also forced to change the AnonUser to my own account. Obviously, I would have liked to not have done this, but I had to, to get it to work.

AnonUser <youraccount>

Apparmor

I also had to change apparmor a bit as it wasn’t allowing cups to write files in my user directory.

/etc/apparmor.d/usr.sbin.cupsd

Find the lines with “{HOME}” and “PDF” in them and change to match the desired destination:

@{HOME}/Dropbox/Docs/PDF/ rw,
 @{HOME}/Dropbox/Docs/PDF/* rw,

Once that is done, restart apparmor, cups, and avahi. Log files for cups-pdf are at /var/log/cups/cups-pdf_log.

If you get a error like

[ERROR] failed to set file mode for PDF file (non fatal) (<path>/Test_Page.pdf)

Either you have filesystems permissions or app armor is causing problems.

 

XenServer FAIL

Got in this morning and without warning a host in one of our Xen Clusters fails. Can’t ssh into it, no console yet XenCenter still thinks it’s responding. Attempts to reboot it or migrate a VM off of it time out. So a hard power off of the host and reboot. Boots up but returns without any network interfaces. So, it’s decided to just leave it off and let the other hosts handle the VMs. Plenty of redundancy and resources. There goes my morning. Anyway, here’s the fix:

Ssh into cluster master (assuming the host that went down wasn’t the master. If it was you have bigger problems.)

Find the failed host uuid.
xe host-list

then see what VMs were running on it.
xe vm-list resident-on=<UUID> is-control-domain=false

may not need the is-control-domain part

For each VM that is in purgatory, force poweroff
xe vm-reset-powerstate uuid=<UUID> –force

See what disk are attached
xe vm-disk-list vm=<VMNAME>

And the SR (storage repo) they are on
xe vdi-list uuid=<UUID of SR>

At this point you could restart the VM in Xen but likely you will get a “VDI is not available” error, so forget the offending VDI(s)

xe vdi-forget uuid=<UUID>

Scan the SR to find them
xe sr-scan uuid=<UUID of SR>

After you rescan the SR, you will/should have blank VDIs with no info. From previous commands you can re-populate names and description.

You likely will have to fsck the disks, You could attach them to a utiliity VM and fsck them, but usually they will fsck fine on reboot.

Via: http://virtualben.blogspot.com/2011/04/vdi-is-not-available-xenserver-56-fp1.html

Using AIDE on Ubuntu

If you try AIDE on ubuntu and get:

aide --init
Couldn't open file /var/lib/aide/please-dont-call-aide-without-parameters/\
 aide.db.new for writing

Its not broken, its just that the ubuntu flavor has some wrappers and a cron script that runs it daily (no custom cron script to make like I thought I would have to). Simply run:

aideinit

Then sit back and wait for it to run through its auto generate conf file located at /var/lib/aide/aide.conf.autogenerated

Also, check the README to learn about the Debian additions.

 zcat /usr/share/doc/aide-common/README.Debian.gz | less

Tip for scripting using ssh keys

Always put the path to the key you are using in the script. I’ve spent about a week fixing a script where it would grab the root user’s ssh keys since I sudo to root to run it and it should have been running as another user. Example:

scp -v -i /path/to/key file user@host:/path

Troubles with SMBD after updating Solaris OS

Recent experience with samba on Solaris shows an issue with SMBD and WINS after an update. svcs-xv will show it in a maintenance state:

svcs -vx
svc:/network/wins:default (MS Win. domain naming daemon)
 State: maintenance since August  8, 2011  8:38:35 AM EDT
Reason: Start method failed repeatedly, last exited with status 1.
   See: http://sun.com/msg/SMF-8000-KS
   See: named(1m)
   See: smb.conf(4)
   See: /var/svc/log/network-wins:default.log
Impact: This service is not running.

svc:/network/samba:default (SMB file server)
 State: maintenance since August  8, 2011  8:38:34 AM EDT
Reason: Start method failed repeatedly, last exited with status 1.
   See: http://sun.com/msg/SMF-8000-KS
   See: smbd(1m)
   See: smb.conf(4)
   See: /var/svc/log/network-samba:default.log
Impact: This service is not running.

Sometimes, /var/samba/log will show you the problem, sometimes it won’t. The issue is that it can’t find the smb.conf file in /etc/samba/. Just check for a simlink in there to the /etc/sfw/smb.conf file. I don’t know why Solaris upgrades remove the symlink. Nor do I know why a fresh install of Solaris has it set up this way to begin with and updates break it. But the fix is pretty simple:

svcadm disable svc:/network/samba:default
svcadm disable svc:/network/wins:default

cd /etc/samba/
ln -s /etc/sfw/smb.conf .

svcadm clear svc:/network/samba:default
svcadm clear svc:/network/wins:default

svcadm enable svc:/network/samba:default
svcadm enable svc:/network/wins:default

svcs -vx

Disable Lion Mail Animations

I like animations for sending mail in Lion but an old MacBook struggles sometimes – especially when in fullscreen mode (and Safari, Crashplan, and Reeder running). Here’s how to disable them. Not sure if I’ll do it just yet, but maybe some day.

defaults write com.apple.Mail DisableReplyAnimations -bool YES
defaults write com.apple.Mail DisableSendAnimations -bool YES

And to turn animations back on.

defaults write com.apple.Mail DisableReplyAnimations -bool NO
defaults write com.apple.Mail DisableSendAnimations -bool NO

Source

Resuminator

From Erica Sadun at TUAW, Here’s a great tool and quick primer to help manage Lion’s Window Resume feature on a per app basis.

Source: Dear Aunt TUAW: Help me fine-tune session window restores

Hidden Recovery Partitions in Lion

To enable the Debug menu in Disk Utility do the following:

defaults write com.apple.DiskUtility DUDebugMenuEnabled 1

This will allow you to see the Recovery partition on your Lion-installed drives and see the GUID Partition hidden partition which is what makes the GUID partition.

Source: CNET

No Library Folder

Started using Lion and found out they hid the ~/Library folder from the user – even an administrator! Fix it with:

chflags nohidden ~/Library