Block frequent spamming IP by fail2ban with iptables

1. install fail2ban
2. Modify jail.conf

[postfix-iptables]


enabled  = true
filter   = postfix
action   = iptables[name=Postfix, port=smtp, protocol=tcp]
           sendmail[name=Postfix, dest=alertmailaddress@yourdomain.com]
logpath  = /var/log/maillog
bantime  = 3600
findtime = 300
maxretry = 3

3. Modify postfix.conf

failregex = reject: RCPT from (.*)\[<HOST>\]: 554

            reject: RCPT from (.*)\[<HOST>\]: 550

            reject: RCPT from (.*)\[<HOST>\]: 450

4. Done.

PS: Just find a very good piece of modification for blocking repeaters

http://stuffphilwrites.com/2013/03/permanently-ban-repeat-offenders-fail2ban/

Virtualization vcpu-provisioning best practice

A nice one to read

http://www.the-little-things.net/blog/2012/03/22/virtualization-vcpu-provisioning-best-practices/


bcdedit /set detecthal yes

how-to-shrink-a-thin-vmdk-on-esxi-5-0

http://boerlowie.wordpress.com/2012/09/06/how-to-shrink-a-thin-vmdk-on-esxi-5-0/

squid cache settings

cache_mem 512 MB
maximum_object_size_in_memory 32 KB
memory_replacement_policy heap GDSF
cache_replacement_policy heap LFUDA
cache_dir ufs /var/spool/squid 10240 16 256

Make a USB Boot ThinClient with VPN for any PC by using Ubuntu and VMware View Client

1. Install a Ubuntu on a USB according to official guideline
http://www.ubuntu.com/download/help/create-a-usb-stick-on-windows

2. Boot that USB on a PC that with Internet Connection

3. Open Terminal and Execute following commands

echo "deb http://archive.canonical.com/ubuntu/ quantal partner" >> /etc/apt/sources.list.d/canonical_partner.list

4. Open /etc/apt/source.list using vi or your favorite editor
Add  "universe" at the end of all source list.
Save it.

5. Execute the following command in Terminal

sudo apt-get update
sudo apt-get install network-manager-vpnc vmware-view-client
sudo apt-get remove ubiquity

6. Setup your VPN connection using network manager (Just the same menu where you connect WIFI)

7. Done.

Trendmicro OfficeScan Block Domino Server Port 80

When Domino HTTP Server started, it report this error even no process is listening port 80. Actually it is caused by Trendmicro

HTTP Server: Error - Unable to Bind port 80, port may be in use or user needs net_privaddr privilege 

1. Open the Registry Editor on the domino server.
2. Important: Always back up the whole registry before making any modifications.
3. Navigate to HKLM\SOFTWARE\TrendMicro\NSC\TmProxy\WhiteList
4. Click Edit > New > Key and then name the key "Domino".
5. Under this new key, create a string value (Edit > New > String Value) named "ProcessImageName". Set the value to "nhttp.exe".
6. Restart OfficeScan.

HRSP ARP Issue

Recently, I help my sibling company to setup HSRP configuration

1 Cisco 2921 connecting 2 Cisco 3650.

It works normally without any problem at the very beginning.

Later, user reports that Windows 2008 report duplicate IP after rebooting or re-enable network adapter.

After a serious a research, I got the following findings.
1. ping to unused ip address will got TTL expire.
2. traceroute to unused ip address will loop between that 3 Cisco device.
3. all unused ip address in Cisco 3650 arp table will map to ether-channel mac address.

After digging a 2 weeks about this problem, finally I found an article on the web. It said Cisco has made some changes on IOS after 12.8 which I need to add "no ip proxy-arp" on both 3650 uplink to 2921.