A Voice from within ......

Monitoring VMware ESXi and vSphere with Nagios

2011-11-07T12:11:00.000-08:00

Requirements

Perl 5.8
Several supporting Perl modules:

Crypt-SSLeay (0.51) [Crypt::SSLeay]
Data-Dumper (2.102) [Data::Dumper]
MethodMaker (2.0.8) [Class::MethodMaker]
XML-LibXML (1.60) [XML::LibXML]
libwww-perl (5.805) [LWP]

This article describes how to monitor a VMWare ESXi or vSphere host with Nagios, using the OP5 Check ESX Plugin written in PERL. The plugin can monitor either a single ESXi/vSphere server or a VirtualCenter/vCenter Server and individual virtual machines. We’ll see here how to monitor an ESXi 4 host.
The following tutorial has been made on a CentOS server, you may have to adapt some paths with other distributions.

Install all the dependencies of Perl SDK.

perl -MCPAN -e shell The above command shall bring you to the perl cpan install CLI. This will allow you to install requirements for Perl. Example: cpan> installCrypt::SSLeay

This article describes how to monitor a VMWare ESXi or vSphere host with Nagios, using the OP5 Check ESX Plugin written in PERL. The plugin can monitor either a single ESXi/vSphere server or a VirtualCenter/vCenter Server and individual virtual machines. We’ll see here how to monitor an ESXi 4 host.

The following tutorial has been made on a CentOS server, you may have to adapt some paths with other distributions.

Installation

The prerequisite for the plugin to work is to install the VMWare Perl SDK available on the manufacturer website.
Download the file on your server, for example in the root directory, untar it and run the installer that way :

# cd /root # tar xvzf VMware-vSphere-Perl-SDK-4.1.0-254719.i386.tar.gz  # cd vmware-vsphere-cli-distrib/ # ./vmware-install.pl

"Creating a new vSphere CLI installer database using the tar4 format.

Installing vSphere CLI.

You must read and accept the vSphere CLI End User License Agreement to continue.
Press enter to display it."

"Read through the License Agreement"

"Do you accept? (yes/no)"

yes

"In which directory do you want to install the executable files?
[/usr/bin]"

"The following Perl modules were found on the system but may be too old to work
with vSphere CLI:

Crypt::SSLeay
Compress::Zlib

The installation of vSphere CLI 4.0.0 build-161974 for Linux
completed successfully. You can decide to remove this software from your system
at any time by invoking the following command:
"/usr/bin/vmware-uninstall-vSphere-CLI.pl".

Enjoy,

--the VMware team"

If ever you're having an issue installing the SDK and complaining about http_proxy, issue the following command:

Run commands before vmware-install.pl:

export http_proxy=

export ftp_proxy=

Download nagios check plugin check_esx3.pl from op5.com

http://www.op5.org/community/plugin-inventory/op5-projects/op5-plugins

Follow the instructions given by the script. Depending on your setup, some PERL dependencies must be installed prior for the SDK to work correctly. When it’s done, we can get the plugin here, and copy it to /usr/lib/nagios/plugins/. Make it executable :

# cd /usr/lib/nagios/plugins/ # chmod a+x check_esx

Take NOTE: change check_esx to check_esx3.pl

Configuration

Now, we can start the real configuration for Nagios. We’ll need a username and password to access the ESXi host, let’s define those Nagios variables in a safe place in /etc/nagios/resource.cfg, so that this information will be hidden from the CGIs :

$USER11$=username $USER12$=password

In this tutorial, we’ll be monitoring these resources : CPU, memory usage, net usage, runtime status and IO/read/write. But some more are available, see the references here. Below are the new commands related to ESXi to add in the /etc/nagios/objects/command.cfg file (these are the ESXi related commands only, NOT the full command.cfg, you may append this at the end of the file) :

# check vmware esxi machine # check cpu define command{         command_name check_esx_cpu         command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER11$ -p $USER12$ -l cpu -s usage -w $ARG1$ -c $ARG2$         }   # check memory usage define command{         command_name check_esx_mem         command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER11$ -p $USER12$ -l mem -s usage -w $ARG1$ -c $ARG2$         }   # check net usage define command{         command_name check_esx_net         command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER11$ -p $USER12$ -l net -s usage -w $ARG1$ -c $ARG2$         }   # check runtime status define command{         command_name check_esx_runtime         command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER11$ -p $USER12$ -l runtime -s status         }   # check io read define command{         command_name check_esx_ioread         command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER11$ -p $USER12$ -l io -s read -w $ARG1$ -c $ARG2$         }   # check io write define command{         command_name check_esx_iowrite         command_line $USER1$/check_esx -H $HOSTADDRESS$ -u $USER11$ -p $USER12$ -l io -s write -w $ARG1$ -c $ARG2$         }

And an example of the configuration for a Nagios host called esxi01 in /etc/nagios/hosts/esxi01.cfg :

# Host esx01 define host{         use                     linux-server         host_name               esxi01         alias                   VMWare ESXi 01         address                 192.168.1.100         }   # Define a service to "ping" the local machine define service{         use                             generic-service         host_name                       esxi01         service_description             PING         check_command                   check_ping!100.0,20%!500.0,60%         }   # VMWare # check cpu define service{         use                             generic-service         host_name                       esxi01         service_description             ESXi CPU Load         check_command                   check_esx_cpu!80!90         }   # check memory usage define service{         use                             generic-service         host_name                       esxi01         service_description             ESXi Memory usage         check_command                   check_esx_mem!80!90         }   # check net define service{         use                             generic-service         host_name                       esxi01         service_description             ESXi Network usage         check_command                   check_esx_net!102400!204800         }   # check runtime status define service{         use                             generic-service         host_name                       esxi01         service_description             ESXi Runtime status         check_command                   check_esx_runtime         }   # check io read define service{         use                             generic-service         host_name                       esxi01         service_description             ESXi IO read         check_command                   check_esx_ioread!40!90         }   # check io write define service{         use                             generic-service         host_name                       esxi01         service_description             ESXi IO write         check_command                   check_esx_iowrite!40!90         }

It’s done. Restart Nagios and wait a while (or re-schedule) for the new resources to be monitored.

NuSOAP WSDL Complex Data

2011-10-18T05:23:00.000-07:00

Source: http://www.koopman.me/2008/01/nusoap-wsdl-service-return-array-of-complex-data/

I’m just getting the code in the post for now… hopefully I’ll have time to come back and document it for you. I am excluding my config.php on purpose, you’ll need to define you’re own constants in there.

 
require_once(“config.php”);
require_once(“nusoap.php”);
 
/*
* This function takes an $email address and returns an array of email addresses
* that are the given email address’s recent contacts from their address book.
*
* @param string $email (the email address of the user)
*  @param string $token (a password that is used for authentication for  use of this function, it is NOT the email users password.)
*/
function getAutocompleteContacts( $email, $num, $token ) {
  if ($token != SOAP_TOKEN)
    return new soap_fault(‘Server’, ”, “Supplied token does not match our records”,”);
 
$email = strtolower(trim($email));
 
if ( ! ereg( ‘^’.email_reg.’$', $email) )
return new soap_fault(‘Client’, ”, “Must supply a valid email address: $email not valid”,”);
 
$aDB = DB::connect( ADDR_DSN );
if ( DB::isError($aDB) ) {
return new soap_fault(‘Server’, ”, ‘Service temporarily unavailable: could not connect to ADDR_DSN DB’,”);
}
$aDB->setFetchMode( DB_FETCHMODE_ASSOC );
 
// REALLY YOU SHOULD DO YOU’RE OWN QUERY, BUT FOR THE SAKE
// OF THIS EXAMPLE, I’M JUST GOING TO INJECT A COUPLE RESULTS:
$result = array();
$result[] = array( ‘contact’ => ‘Chaos Captain’, ‘email’ => ‘choas@sdfusidfousdf.com’);
$result[] = array( ‘contact’ => ‘Joe Joe’, ‘email’ => ‘choas@sdf768sdf798s7df987.com’);
 
return $result;
 
#return new soap_fault(‘Server’, ”, ‘Fallthrough error, should have faulted on invalid type above’,”);
 
}
 
$HTTP_RAW_POST_DATA = isset($HTTP_RAW_POST_DATA) ? $HTTP_RAW_POST_DATA : ”;
$server = new soap_server;
$server->configureWSDL(‘addressbook1′, ‘urn:’.$_SERVER['SCRIPT_URI']);
$server->wsdl->addComplexType(
‘Contact’,
‘complexType’,
‘struct’,
‘all’,
”,
array(
‘contact’ => array(‘name’ => ‘contact’, ‘type’ => ‘xsd:string’),
‘email’ => array(‘name’ => ‘email’, ‘type’ => ‘xsd:string’),
)
);
 
$server->wsdl->addComplexType(
‘ContactArray’,
‘complexType’,
‘array’,
”,
‘SOAP-ENC:Array’,
array(),
array(
array(‘ref’=>’SOAP-ENC:arrayType’,'wsdl:arrayType’=>’tns:Contact[]‘)
),
‘tns:Contact’
);
 
$server->register(‘getAutocompleteContacts’,
array(‘email’ => ‘xsd:string’, ‘num’ => ‘xsd:int’, ‘token’ => ‘xsd:string’), // input parameters
array(‘return’ => ‘tns:ContactArray’),
‘urn:’.$_SERVER['SCRIPT_URI'], // namespace
‘urn:’.$_SERVER['SCRIPT_URI'].”#getAutocompleteContacts”, // soapaction
‘rpc’, // style
‘encoded’, // use
‘Fetch array of address book contacts for use in autocomplete’); // documentation
 
#$server->wsdl->schemaTargetNamespace = $_SERVER['SCRIPT_URI'];
$server->service($HTTP_RAW_POST_DATA);
exit();
?>


Client Code:

require_once(‘config.php’);
require_once(‘nusoap.php’);
 
$client = new soapclient(SOAP_SERVER_WSDL_URL, true);
 
// Check for an error
$err = $client->getError();
if ($err) {
// Display the error
echo ‘Constructor error’ . $err . ‘’;
// At this point, you know the call that follows will fail
}
 
$result = $client->call(‘getAutocompleteContacts’, array(‘email’=>’something@asdf97s9d8f7sdf.com’, ‘num’=>5, ‘token’=>SOAP_TOKEN) );
 
print_r($result);
?>


Result is as follows:

Array
(
[0] => Array
(
[contact] => Chaos Captain
[email] => choas@sdfusidfousdf.com
)
 
[1] => Array
(
[contact] => Joe Joe
[email] => choas@sdf768sdf798s7df987.com
)
 
)

Setup SNMP on an Asterisk server

2011-09-06T07:39:00.000-07:00

Posted on March 1, 2011 by Zeeshan A Zakaria

Today I happened to troubleshoot a server in a remote part of the world, which I had shipped with SNMP and MRTG installed. It was a very wise decision to do this at that time, as it made an important troubleshooting very simple, which otherwise could have wasted days and still yielded no results.

While going over my notes in this regard, I thought to put this information here as well if it could help someone else who is looking to do a similar setup. But you should know that setting up SNMP can be tricky and the following might not work for you.

SNMP – Simple Network Monitoring Protocol, as it name suggests, is a protocol used to monitor various properties of network equipment. These properties are identified by something called OIDs (Object Identifiers) which are long numeric strings and identify various things, like hardware version, time on the device, data flow rate, and tons of other stuff. OIDs and grouped in what is called a MIB (Management Information Base). Asterisk has a list of its own OIDs which provide various pieces of information over the SNMP when requested by a software or hardware which is interested in that information. More on SNMP you can read on the Internet.

The following assumes that you do have SNMP module installed with your asterisk installation. You select this when running the #make menuselect just before the installation of asterisk. See my blog on asterisk installation for more details.
SNMP Setup

Following are the steps which I used on this CentOS 5.3/Asterisk 1.4 machine to setup SNMP:
1 yum install net-snmp-util

Created /etc/snmp/snmpd.conf with the following:

; Add this at the bottom
master agentx
agentXSocket /var/agentx/master
agentXPerms 0660 0550 nobody asterisk

; main configuration of the snmp
com2sec local localhost public
com2sec mynetwork 192.168.1.0/24 public

group notConfigGroup v1 notConfigUser
group notConfigGroup v2c notConfigUser
group MyROGroup v1 local
group MyROGroup v2c local
group MyROGroup v1 mynetwork
group MyROGroup v2c mynetwork

view all included .1 80

access MyROGroup "" any noauth exact all all none

Going into the detail of what all these lines mean is not the goal here, but the words in bold red are the ones which will be specific to your own network. The word ‘public’ is like a password, and almost all SNMP devices come preconfigured with this password. The user is ‘asterisk’, in your setup it might be ‘root’ or some other user.
Asterisk SNMP Config

Now add the following in /etc/asterisk/res_snmp.conf. If the file doesn’t exist, create one:
1 [general]
2 subagent = yes
3 enabled = yes

And now copy the Asterisk related MIB to the SNMP folder:
1 cp /usr/share/doc/asterisk-1.4.22/digium-mib.txt /usr/share/snmp/mibs
2 cp /usr/share/doc/asterisk-1.4.22/asterisk-mib.txt /usr/share/snmp/mibs

It is possible that these files don’t exist on your system, in which case you’ll have to get them from the Internet.

Next do the following:
1 export MIBS=+ASTERISK-MIB
2 chmod 755 /var/agentx
Done

This is all. Now restart asterisk, add snmpd and snmptrapd in chkconfig and start these services as daemons:
1 chkconfig snmpd on
2 chkconfig snmptrapd on
3 service snmpd start
4 service snmptrapd start
Testing it

In order to test if SNMP is properly installed, do the following:
1 snmpwalk -On -c public -v 2c localhost asterisk

and it’ll give you a list of the asterisk related MIBS

Using Wireshark to Troubleshoot VoIP

2011-08-12T06:48:00.000-07:00

Wireshark (also known as ethereal or tethereal) is a "network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network." If you want a definitive answer on what is causing problems with your VoIP calls, you need to learn how to use Wireshark. Thankfully, it's pretty simple for anyone with basic knowledge of networking.

There are two parts to successfully running a network trace: capturing the traffic and viewing the results. I'll go through capturing traffic on different operating systems and viewing the results on a Windows PC using Wireshark.

Capturing traffic on a Linux-based PBX

Assuming you're running CentOS, which is the default for most PBX software, you will need to install the Wireshark package:

yum install wireshark

Run the following commands on your PBX to capture all traffic, SIP (signalling) and RTP (audio), between the PBX and your provider's server into file /root/my.cap. While the capture is running, restart your PBX software so it will attempt to register with your provider. Then attempt an outgoing phone call and an incoming phone call. Type Ctrl-C after running these tests to stop the capture.

tshark host server.provider.com -w /root/my.cap

Run the following command to compress your capture file my.cap into a compressed my.cap.gz file:

gzip /root/my.cap

From your Windows PC, run the following to copy that capture file from your PBX's IP address to your Windows PC's C: drive. You will need to have the pscp program, which is available here. You will be prompted for the PBX's root password. Replace 192.168.1.2 with the IP address of your PBX.

pscp root@192.168.1.2:/root/my.cap.gz c:\

Your capture file is now ready to be viewed from your Windows PC. Run Wireshark and open the capture file (Wireshark can open compressed capture files).

Capturing traffic on a Windows PC

If you have a Windows PC on the same network as your Voice over IP adapter, you can use it to capture all traffic between the adapter and your provider. Since a network switch isolates the traffic on each port, you cannot capture another device's traffic from your PC (unless it supports port mirroring). Instead, the easiest way to capture traffic on your local network is to get a cheap Ethernet hub. A hub repeats all traffic coming into one port on all of the other ports. This means any device plugged into a hub can view the traffic to/from every other device on the same hub.

Plug your hub into your router and your PC and adapter into the hub, as shown below:

Tip: A more advanced method of capturing traffic would be to plug the hub into your cable modem, so it sits between the modem and router. However, anything else you plug into the hub (like the PC running Wireshark) will be unprotected and open to all traffic from the Internet.

Start Wireshark and click on Capture Options. This will allow us to select the proper network card to capture traffic from, the host to capture traffic to/from (your provider's gateway) and a place to save the capture file. You must run the capture in "promiscuous" mode, which means Wireshark will "look" at any traffic it sees on the network, not just traffic to/from the host it's running on (your PC).

While the capture is running, reboot your adapter so it will attempt to re-register with your provider. Also, attempt to make an incoming and outgoing call. After running these tests, click on the "Stop the running live capture" button. Your capture will already be loaded for viewing.

Reading and understanding a VoIP traffic capture

Now that you've captured the traffic between your adapter (or PBX) and your provider, you have enough information to figure out what is causing the problem. For most people, the easiest thing to do now is send the capture file to your provider. An experienced technical support agent will be able to immediately tell you what is causing the problem and how to fix it. As I mentioned in an earlier post (VoIP, no dial tone, missed calls & port forwarding), there's a 90% chance the the problem is your router.

Tip: Unless you have significant networking experience, stop here and send the capture to your provider. It will be tremendously helpful to them in troubleshooting the issue and you can save yourself a few hours of time.

If you'd like to dig into the details and see exactly what is happening, then continue on. When you open your capture file, you'll see a split-screen with each Ethernet frame on the top, a user-readable drill-down of the contents in the middle, and the raw data on the bottom.

A working SIP REGISTER conversation

Scroll down in the top panel until you reach the first REGISTER attempt from your adapter to your provider. Select the frame and in the middle window, right-click on the "Session Initiation Protocol" section and pick "Expand Subtrees". Find the line starting with "Call-ID", right-click on it, and select Apply as Filter > Selected. The Filter box above the first window pane will now show something like "sip.Call-ID == "5b1c8fdb-90c4f2a3@10.0.1.100"", meaning only the frames that contain that Call-ID will be shown. This makes it easier to filter out one conversation from a capture that may have a lot of extraneous traffic. This is what a proper REGISTER attempt will look like:

Your adapter will attempt to register, but it doesn't send any Authorization data the first time. The provider will respond with a 401 Unauthorized and will include information such as the realm, nonce, algorithm values. The adapter will then use these values, along with your SIP password, to form an encrypted response which it will use when re-registering. Since the second register attempt has Authorization information, the provider will accept the registration and reply with a 200 OK.

You can dig into each SIP request and response to see exactly how the registration conversation works. Now that you know what a working REGISTER conversation looks like, you can identify one that is broken.

A broken SIP REGISTER conversation

The most common cause for an adapter not being able to register is a router/firewall issue. If the provider's 401 Unauthorized response never makes it back to the device, it can never properly send Authorization information to the provider to register.

As you can see in the registration attempt above, the adapter never gets the 401 Unauthorized, so it keeps trying without success. If your provider was looking at a trace from their end, they'd see a 401 Unauthorized being sent, but no REGISTER with an Authorization section, clearly indicating that the 401 was being blocked by the router/firewall.

Working outgoing & incoming calls

Most providers configure their adapters to only play a dial-tone when the adapter is registered. Therefore, once you are registered, you will probably have no issues making an outbound call. Also, an outbound call is a connection initiated from your private network, so there are usually no firewall issues to deal with either.

An outgoing call is initiated by an INVITE request sent from your adapter to the provider. The provider will reply with a 100 Trying and a 407 Proxy Authentication Required. This is similar to the 401 Unauthorized during the REGISTER request, except with a Proxy-Authenticate section instead of an Authorization section. Your adapter will re-send the INVITE with your credentials. The provider will respond with a 100 Trying, 183 Session Progress (which will cause you to hear ringing), and 200 OK when the call is answered. Your adapter will acknowledge the answer and the conversation will begin. Finally, when one of the sides hangs up, a few BYE messages will be sent and acknowledged.

Tip: You may not see this exact sequence of events, depending on how your provider handles the call and if it's actually answered. A busy or invalid number will return different responses than a 200 OK.

A working incoming call looks similar to an outgoing call, with INVITEs, 100s, 183s, and 200s.

Broken outgoing & incoming call

It's rare to have an issue with outgoing calls if you have a dial-tone. However, a capture will show what's going wrong if you do.

If you're not receiving incoming calls at all, chances are you won't see anything on the capture, which is still useful information! A common problem is that you will receive incoming calls for a few minutes after your adapter is first powered on (and registers), but then your incoming calls don't ring through. If you can capture this entire sequence (register, successful incoming call, failed incoming call 15 minutes later), it will clearly demonstrate that there is a router/firewall issue.

Analyzing calls with Wireshark

Wireshark has telephony-specific features that may come in handy for troubleshooting VoIP calls. After opening your capture file, go to Telephony > VoIP Calls. Wireshark will automatically detect all of the calls in your capture.

You can then click "Prepare Filter" to easily view just the frames associated with a particular call, click "Flow" to see the conversation between your adapter and provider, or click "Player" to listen to one or both sides of the conversation in the capture.

Also, you can go to Telephony > RTP > Show All Streams. Select an RTP stream (the audio from one side of a phone call), click Find Reverse, click on Analyze. You can now see and graph statistics like how many RTP packets were lost or the max and mean jitter.

Finally, if you want to cut/paste a UDP SIP conversation into a support ticket with your provider, you can right-click on one of the frames in the conversation and select Follow UDP Stream. Change the radio button to ASCII before copying or saving the data.

Conclusion

Now that you know how to capture and analyze your Voice over IP traffic using Wireshark, you have the ability to do some troubleshooting on your own that goes beyond rebooting the adapter. However, as I've mentioned before, sometimes it's far easier and faster to let your provider take over after you've provided them with a helpful capture showing the problem.

Please don't take this as an opportunity to hassle your provider over issues that don't cause any noticeable problems in your phone calls. There will be jitter; there will be dropped RTP packets. That is the nature of voice over IP and there are numerous methods of ensuring voice quality despite these network-level problems. Your provider is focused on providing you with clear phone calls, not on optimizing the statistics generated by Wireshark.

If you're interested in the inner-workings of voice over IP and SIP, there's no better way to dig in than running a Wireshark capture and figuring out exactly what is going on.

Install 64 Bit Package via Yum

2011-07-20T08:51:00.001-07:00

I had a task to install Ralus (Backup_exec agent) on linux. I had an issue where there is incompatibility issue on the c compiler. I had to install a compiler that works with the Ralus. I did yum install on a certain package as follows:

yum install libstdc++.so.5

The above command did install the compat-libstdc++-33-3.2.3-61 but still the Ralus didn't work. Until I realized that I am running 64 bit machine so I had to do force install of 64 bit of the compat-libstdc package.

yum install compat-libstdc++-33-3.2.3-61.x86_64

So the lesson here if ever there is a necessity or something happened where it didn't download and install the package in 64 bit, do as follows:

yum install packagename.x86_64

And you should be good.

Hope you find this helpful. Thanks, Cheers and God Bless!!!

Someday

2011-06-06T10:57:00.000-07:00

I don’t know how much longer

That I have to put up with everything

I’ve been hiding all the truth inside my heart

Everytime we meet

Everytime you turn face to me

Though I look indifferent

Do you know how much i have to force myself?

Can you hear my heart calling for you, loving you?

But I can’t open my heart for anyone to know

Can you hear it?

My heart keeps waiting there for you

Waiting for you open it

and hope you will realize..

Someday

Though I love you

Though I feel

but deep down inside, I don’t dare to tell you

Everytime we meet

Everytime you turn face to me

Though I look indifferent

Do you know how much i have to force myself?

Can you hear my heart calling for you, loving you?

But I can’t open my heart for anyone to know

Can you hear it?

My heart keeps waiting there for you

Waiting for you open it

and hope you will realize..

Someday

Can you hear my heart calling for you, loving you?

But I can’t open my heart for anyone to know

Can you hear it?

My heart keeps waiting there for you

Waiting for you open it

And I hope you will realize

That this person loves you

Please I hope you will know

Someday

Compiling the Linux Kernel – CentOS

2011-05-06T12:42:00.000-07:00

Steps:

#yum -y install kernel-devel kernel-headers

#yum -y groupinstall “Development-Tools”

#cd /usr/src

#wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.30.2.tar.bz2

#tar -jxvf linux-2.6.30.2.tar.bz2

#cd /usr/src/linux-2.6.30.2/

#make menuconfig

#make clean

*#make dep (is no more necessary)

#make bzImage

#make modules

#make modules_install

#make install

*make install will copy the files: System.map, vmlinuz and the initial ram disk initrd-2.6.30.2.img to /boot. It will also add the lines you will need on grub, now just restart your computer and choose the new kernel on the grub screen.

Have Fun !!!

Setting up SendMail as SMTP Relay Server

2011-04-29T12:51:00.000-07:00

Here are the steps to take in order to use Sendmail as SMTP relay server:

By default relay on sendmail is disabled.

So when you do relay on it by doing telnet

220 nagios.gowireless.net ESMTP Sendmail 8.13.8/8.13.8; Fri, 29 Apr 2011 11:59:2
3 -0700
HELO
501 5.0.0 HELO requires domain address
MAIL FROM:test@test.com
250 2.1.0 test@test.com... Sender ok
relaying denied

So to allow relay on SendMail do as follows:

1. First allow the sendmail to listen to all at port 25. (Allow incoming smtp connections)

- Edit /etc/mail/sendmail.mc

Change...

DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl

To..

DAEMON_OPTIONS(`Port=smtp, Name=MTA')dnl

- save it

and then do

make -C /etc/mail

- restart sendmail service

service sendmail restart

2. Allow or open port 25 on the firewall.

3. Now we will include IP based authentication

- Edit /etc/mail/access and add the IP / IP block to allow relay from

Connect:localhost.localdomain RELAY
Connect:localhost RELAY
Connect:127.0.0.1 RELAY
Connect:10.1 RELAY
Connect:1.1 RELAY

- save it

- then recompile the access.db

makemap hash /etc/mail/access.db < /etc/mail/access

- then do restart sendmail

4. To test do as follow from a different pc

telnet 10.1.10.13 25
220 nagios.gowireless.net ESMTP Sendmail 8.13.8/8.13.8; Fri, 29 Apr 2011 11:59:2
3 -0700
HELO
501 5.0.0 HELO requires domain address
MAIL FROM:test@test.com
250 2.1.0 test@test.com... Sender ok
RCPT TO:rowell.rufino@gowireless.com
250 2.1.5 rowell.rufino@gowireless.com... Recipient ok
DATA
354 Enter mail, end with "." on a line by itself
testing
.
250 2.0.0 p3TIxNH1002876 Message accepted for delivery
quit
221 2.0.0 nagios.gowireless.net closing connection

Hopefully you find this helpful. Thanks. Take Care and God Bless!!!

Setting Up Mail Server on Linux

2011-04-08T08:34:00.000-07:00

There came a time where I was asked by my boss to setup a Mail server for a certain client. At first I was astounded because I am not sure how to do it. But thankfully I found some helpful sites that guided me to establish a complete Email Server. In this blog I wanted to share them with you to help those who would like to setup their own Mail server.

The mail server that I have setup is composed of the following components:

- a Linux OS (preferably Red Hat Enterprise or CentOS)
- Dovecot for IMAP / POP3
- Postfix for SMTP
- ClamAV for antivirus
- SpamAssassin
- MailScanner

How to install SMTP, POP3, IMAP and Webmail service

Postfix will be providing the SMTP service, Dovecot will provide the POP3 and IMAP service, while Apache and SquirrelMail will provide the Webmail service.

The following are the steps we will take on setting up the mail server:

1. How to install and setup Postfix SMTP server.
2. How to install and setup Dovecot POP3 and IMAP server.
3. Configure Postfix SMTP Authentication using Dovecot SASL.
4. How to install and setup SquirrelMail WebMail.
5. How to configure the firewall.

How to install and setup Postfix SMTP server

We need to install 2 packages here namely:

- postfix and system-switch-mail

To do so, issue the following command:

# yum install postfix system-switch-mail

By default the MTA on Linux is sendmail so we need to switch from sendmail to postfix. Use the system-switch-mail tool to switch to postfix.

Configure Postfix

1. Edit the postfix configuration file.

# vi /etc/postfix/main.cf

Find the following keys and change its values as follows

inet_interfaces = all mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain home_mailbox = Maildir/

Make sure that all mail_spool_directory lines are commented out. Otherwise, it will override the setting in the home_mailbox line above.

2. Restart postfix service

# service postfix restart

Test Postfix

1. For testing purposes, create a linux user.

# useradd johndoe

Sample postfix session. Replace johndoe with any valid user account. The dot after the line test is a command that should be typed in.

2. Perform testing.

[root@mail ~]# telnet localhost smtp Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. 220 mail.acme.local ESMTP Postfix ehlo localhost 250-mail.acme.local 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN mail from: 250 2.1.0 Ok rcpt to: 250 2.1.5 Ok data 354 End data with . test . 250 2.0.0 Ok: queued as 9729067C17 quit 221 2.0.0 Bye Connection closed by foreign host. [root@mail ~]#

To check if the mail indeed exists

[root@mail ~]# cd /home/johndoe/Maildir/new [root@mail new]# ls 1185669817.Vfd00I18012M795756.mail.acme.local [root@mail new]# cat 1185669817.Vfd00I18012M795756.mail.acme.local

Don’t worry, you don’t have to type in the whole filename above. Just type in the first few characters say 118 then press Tab to activate automatic completion.

From johndoe@mail.acme.local  Thu Feb 22 21:48:28 2007 Return-Path:  X-Original-To: johndoe Delivered-To: johndoe@mail.acme.local Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])         by mail.acme.local (Postfix) with SMTP id 9729067C17         for ; Thu, 22 Feb 2007 21:48:26 -0500 (EST) Message-Id: <20070222134827.9729067C17@mail.acme.local> Date: Thu, 22 Feb 2007 21:48:26 -0500 (EST) From: johndoe@mail.acme.local To: undisclosed-recipients:;  test  [root@mail mail]#

If you encounter any problems, check the log file at /var/log/maillog.

How to install and setup Dovecot POP3 and IMAP server

1. To install dovecot:

# yum install dovecot

Configure Dovecot

1. Edit the dovecot configuration file

# vi /etc/dovecot.conf

Find the following keys and change its values as follows

protocols = pop3 pop3s imap imaps mail_location = maildir:~/Maildir/ pop3_uidl_format = %08Xu%08Xv imap_client_workarounds = delay-newmail outlook-idle netscape-eoh pop3_client_workarounds = outlook-no-nuls oe-ns-eoh

2. Start Dovecot server

# service dovecot start

Test Dovecot

Sample dovecot session. Replace johndoe and password with any valid user name and password.

root@mail ~]# telnet localhost pop3 +OK dovecot ready. user johndoe +OK pass password +OK Logged in. list +OK 1 messages: 1 622 . retr 1 +OK 622 octets Return-Path:  X-Original-To: johndoe Delivered-To: johndoe@mail.acme.local Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])         by mail.acme.local (Postfix) with SMTP id 9729067C17         for ; Thu, 22 Feb 2007 09:06:37 -0500 (EST) Message-Id: <20070222140640.9729067C17@mail.acme.local> Date: Thu, 22 Feb 2007 09:06:37 -0500 (EST) From: johndoe@mail.acme.local To: undisclosed-recipients:; X-IMAPbase: 1172153557 1 Status: O X-UID: 1 Content-Length: 5 X-Keywords:   test . quit +OK Logging out. Connection closed by foreign host. [root@mail ~]#

Configure Postfix SMTP Authentication using Dovecot SASL

SMTP Authentication (SMTP Auth) provides an access control mechanism that can be used to allow legitimate users to relay mail while denying relay service to unauthorized users, such as spammers.

Thanks to the new SASL support in Dovecot 1.0 and the new Dovecot SASL support in Postfix 2.3, setting up SMTP authentication is now easier. Instead of setting up two separate authentication for Postfix and Dovecot, we can now just setup the authentication in Dovecot and just let Postfix talk to Dovecot.

Configure Postfix and Dovecot

1. Edit the file /etc/dovecot.conf and make sure your auth default section has the lines below.

auth default {    socket listen {     client {    path = /var/spool/postfix/private/auth    mode = 0660    user = postfix    group = postfix     }   }    mechanisms = plain login }

2. Edit /etc/postfix/main.cf, find the keys below and change its values as follows or add it at the bottom of the file if the key (the word before the = sign) cannot be found.

mynetworks = 127.0.0.0/8 smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions =  permit_mynetworks,      permit_sasl_authenticated, reject_unauth_destination broken_sasl_auth_clients = yes

The first line says trust only localhost, meaning only localhost can send email outside the network (relay). The last line is there to support old clients like Microsoft Outlook Express 4.0 and Microsoft Exchange 5.0 just in case someone is still using it.

3. Restart the Dovecot and Postfix service. But if you installed MailScanner, restart MailScanner instead of Postfix.

Test Postfix

Sample postfix session

[root@mail ~]# telnet mail smtp

Replace mail with the name of your server. We should not use localhost since localhost is a trusted client ip address. And make sure the domain name you specified does not resolve to 127.0.0.1 which is the IP address of localhost.

Trying 192.168.0.1... Connected to mail.acme.local (192.168.0.1). Escape character is '^]'. 220 mail.acme.local ESMTP Postfix ehlo localhost 250-mail.acme.local 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-AUTH LOGIN PLAIN 250-AUTH=LOGIN PLAIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN

Note the new 250-AUTH lines.

mail from: 250 2.1.0 Ok rcpt to: 554 5.7.1 : Relay access denied

It works, now to check if we can send it after authenticating.

auth plain AGpvaG5kb2UAcGFzc3dvcmQ= 235 2.0.0 Authentication successful rcpt to: 250 2.1.5 Ok quit 221 2.0.0 Bye Connection closed by foreign host. [root@mail ~]#

The gibberish text after AUTH PLAIN is the base64 encoded value of the user name johndoe and password password. You can generate your own base64 text using the form below.

http://www.linuxmail.info/postfix-smtp-auth-dovecot-sasl/

How to install and setup SquirrelMail WebMail.

SquirrelMail is an open source standards-based webmail package written in PHP. When installed, SquirrelMail is ready out of the box. All it needs is an installed web server like Apache, SMTP server like Postfix, and IMAP server like Dovecot.

1. Get the latest stable release of Squirrelmail

# cd /usr/src

# wget http://www.squirrelmail.org/countdl.php?fileurl=http%3A%2F%2Fprdownloads.sourceforge.net%2Fsquirrelmail%2Fsquirrelmail-1.4.21.tar.gz

# tar xvzf squirrelmail-1.4.21.tar.gz

# mv squirrelmail-1.4.21 /usr/local/squirrelmail

Prepare SquirrelMail directories

Make sure to change "nogroup" to whatever group Apache will be running as. You can check what that is by looking at the value of the "Group" setting in your Apache main configuration file (probably /etc/httpd/conf/httpd.conf).

# mkdir /usr/local/squirrelmail # cd /usr/local/squirrelmail # mkdir data temp # chgrp nogroup data temp # chmod 0730 data temp

Unpack SquirrelMail

# cd /usr/local/squirrelmail # tar --bzip2 -xvf /usr/local/src/downloads/squirrelmail-1.4.17.tar.bz2 # mv squirrelmail-1.4.17 www

Configure SquirrelMail

Run the SquirrelMail configuration utility.

# cd /usr/local/squirrelmail # www/configure

Select the "D" option and then configure SquirrelMail with the "uw" preset. Also make sure to set the data and attachment directory settings ("/usr/local/squirrelmail/data" and "/usr/local/squirrelmail/temp" respectively) under "4. General Options". Make any other changes as you see fit, select "S" to save and then "Q" to quit.

Configure access to SquirrelMail in Apache

Modify your main Apache configuration file (typically /etc/httpd/conf/httpd.conf) by adding the following:

"Alias /squirrelmail /usr/local/squirrelmail/www    Options None   AllowOverride None   DirectoryIndex index.php   Order Allow,Deny   Allow from all     Deny from all     Allow from all     Allow from all     Allow from all     Allow from all     Allow from all     Order Deny,Allow   Deny from All   Allow from 127   Allow from 10   Allow from 192     Order Deny,Allow   Deny from All   Allow from 127   Allow from 10   Allow from 192 "

Restart apache

Reference:
http://www.linuxmail.info/squirrelmail-webmail-setup-howto-in-centos-5/
http://squirrelmail.org/docs/admin/admin-3.html#ss3.2

How to set 100% table height

2011-01-27T08:02:00.000-08:00

One of the suggestions I have read across the web that really works for me on table layout, is setting the table height. This is useful most specially if you are dealing with nested tables where you want the table inside to maximize the height of the cell. In order to do this, you must make use of style property of table. Here is how:

table width="100%" border="1" style="height: 100%;"

Hopefully you find this tip useful. Thank you. Take care and God Bless!!!

Automated Backup Script Using tar and FTP

2011-01-18T13:29:00.000-08:00


I am posting here a script I made to automate backup via tar ang FTP. I hope that you may find this helpful. In the next post, I will try to explain each entries on the script. Thanks, take care and God Bless!!!

#!/bin/bash
# A Simple (Poor Man) disk based backup script
# Will backup all user home directories in seperate archives
# as a single /home backup file can be quite large and unwieldly.
# Does not need to be modified if users are added/deleted

# Step - 1 Create Timestamp and set up variables and functions
# BUDTSTAMP = Backup Date/Time Stamp
BUTDSTAMP=$(date +%Y%m%d)

# variable holding directories containing files to backup eg: BACKUPTHESE="/home /root /etc"
BACKUPTHESE="/var/www/html/adldap"

# Backup base  place the back up base

B_BASE="/trynga"

cd $B_BASE

mkdir $B_BASE/vol
mkdir $B_BASE/vol/backup
mkdir $B_BASE/vol/backup/daily
mkdir $B_BASE/vol/backup/yesterday
mkdir $B_BASE/vol/backup/database

#directory containing today's backup
BKUPDIR="$B_BASE/vol/backup/daily"
#directory containing yesterday's backup
YDBKUPDIR="$B_BASE/vol/backup/yesterday"
#directory containing the day before yesterday's backup
DBBKUPDIR="$B_BASE/vol/backup/daybefore"
# DATABASE BACKUP DIR
DATABASEBACKUP="$B_BASE/vol/backup/database"
NCFTP="/usr/local/bin"

# device to monitor upon backup
DEVICE="/"

# recipient to send the backup report
#EMAILADD="backupadmin"
EMAILADD="rowell@mindragon.com"

# FTP SetUP
FTPS="192.168.1.118"
FTPU="rowell"
FTPP="mdi2005!"
NOW=$(date +"%d-%m-%Y")
BACKUP="$B_BASE/vol/backup/daily"
FTPD="serbackupfiles"

### MySQL Setup ###
MUSER="root"
MPASS="mdi2009!"
MHOST="localhost"
MYSQL="$(which mysql)"
MYSQLDUMP="$(which mysqldump)"
GZIP="$(which gzip)"

# log files
LOG="/var/log/mail.txt"
ERRORLOG="/var/log/ERROR.txt"

# tag for backup file name
TAG="OpenSERbackup"

# function that quits and logs on error
exiterror()
{
# use this function by supplying $LINENO as first arg
echo "Fatal error caused by line ${1} of ${0}" >> $ERRORLOG
mail $EMAILADD -s "Backup Job ERROR" -v < $ERRORLOG
mail $EMAILADD -s "Backup Job Report" -v < $LOG
exit 1
}

# Step - 2 Start Email Message To Be Sent

# Remove mail message from previous backup
# I do this at the beginning of the script instead of the end
# in case the mail does not send for whatever reason or
# I need to debug it

rm $LOG > /dev/null 2>&1
echo "System Backup $BUTDSTAMP" >> $LOG

# The email sends a user friendly note showing the start and
# end time/dates. This is important so you can compare logs
# and see if a backup ran ok.

echo "Backup Began $(date)" >> $LOG

# Step - 3 Rotate Backups
# Simple three backupset rotation, keeps only last three
# Use directory /vol/backup as an example, make sure you change this path
# to fit your local settings. Have three directories in /vol/backup named daily,
# yesterday and daybefore.
# Make sure /vol/backup is on a different disk (preferably a different machine)
# than the files you are backing up

#looks specifically for backup files in case other files are kept in these directories
#for bkfile in $DBBKUPDIR/*; do
#echo $bkfile | grep $TAG >/dev/null &&
#(rm $bkfile || exiterror $LINENO )
#done
for bkfile in $YDBKUPDIR/*; do
echo $bkfile | grep $TAG >/dev/null &&
#(mv $bkfile $DBBKUPDIR/ || exiterror $LINENO )
(rm $bkfile || exiterror $LINENO )
done
for bkfile in $BKUPDIR/*; do
echo $bkfile | grep $TAG >/dev/null &&
(mv $bkfile $YDBKUPDIR/ || exiterror $LINENO )
done

# Step - 4 Archive Home Directories
# Creates a seperate tar file for each directory in the directories in $BACKUPTHESE


# change to dir to backup. Check in case cd failed for some reason.
cd $BACKUPTHIS || exiterror $LINENO
#backup all files listed in BACKUPTHESE
#for DIRTOBACKUP in $BACKUPTHESE; do
#for FOLDERNAME in $DIRTOBACKUP/*
#do
# Archives are created in the format someuser-$TAG-datetime.tar.gz
# basename is used here so as not to include absolute paths
# -p preserves permissions
#echo -e "-------------------\n>>>taring ${FOLDERNAME}\n\n" >> $LOG
#tar -czvpf ${BKUPDIR}/$( basename $FOLDERNAME )-${TAG}-${BUTDSTAMP}.tar.gz ${FOLDERNAME} >> $LOG || exiterror $LINENO
#done
#done

for FOLDERNAME in $BACKUPTHESE; do
echo -e "-------------------\n>>>taring ${FOLDERNAME}\n\n" >> $LOG
#tar -czvpf ${BKUPDIR}/$( basename $FOLDERNAME )-${TAG}-${BUTDSTAMP}.tar.gz ${FOLDERNAME} >> $LOG || exiterror $LINENO
tar -czvpf ${BKUPDIR}/$( basename $FOLDERNAME )-${TAG}-${BUTDSTAMP}.tar.gz ${FOLDERNAME} > /dev/null 2>&1  || exiterror $LINENO
done

# For MySQL backup database
echo -e "------------------\n>>>>back up the database\n\n" >> $LOG
### Start MySQL Backup ###
# Get all databases name

#mkdir $BACKUP/$NOW
mkdir $DATABASEBACKUP/$NOW

DBS="$($MYSQL -u $MUSER -h $MHOST -p$MPASS -Bse 'show databases')"
echo "$DBS \n\n " >> $LOG
for db in $DBS
do
#FILE=$BACKUP/mysql-$db.$NOW-$(date +"%T").gz
FILE=$DATABASEBACKUP/$NOW/mysql-$db.${BUTDSTAMP}.gz
$MYSQLDUMP -u $MUSER -h $MHOST -p$MPASS $db | $GZIP -9 > $FILE
done

# Step - 5 FTP backup start

echo -e "------------------\n>>>>Transfer backups to FTP server\n\n" >> $LOG

# not yet done Do an an FTP back up
# set the settings for FTP

### Dump backup using FTP ###
#Start FTP backup using ncftp
RETVAL=`$NCFTP/ncftp -u"$FTPU" -p"$FTPP" $FTPS <<EOF
mkdir $FTPD
mkdir $FTPD/$NOW
cd $FTPD/$NOW
lcd $BACKUP
mput *
lcd $DATABASEBACKUP/$NOW
mput *
quit
EOF`

echo -e "$RETVAL \n\n"  >> $LOG

##### Let us use a a different version
#mkdir $FTPD
#mkdir $FTPD/$NOW
#ncftpput -m -z -u "$FTPU" -p "$FTPP" $FTPS


# Step - 6 Finish Email Report and Send

echo "Backup ended $(date)" >> $LOG

# df -h includes a human readable disk usage report of the media that /vol/backup
# is mounted on. Good to now if your backup disk is running out of space.
# Of course /dev/hdb1 is the device I use, modify it for your local settings

df -h $DEVICE >> $LOG
mail $EMAILADD -s "Backup Job Report" -v < $LOG

# Step - 7 All Done

Installing and setting up phpPgAdmin

2009-08-29T05:00:00.000-07:00

In this blog, I'll discuss on how to setup phpPgAdmin. But before going any further where can phpPgAdmin be used? PhpPgAdmin is a counter part of phpMyAdmin. If phpMyAdmin is the web admin user interface managing MySQL server then phpPgAdmin is for PostgreSQL. PhpPgAdmin was created to ease the administration of PostgreSQL. Below are the requirements needed to build the admin.

Requirements:

- PHP installed
- PostgreSQL installed (for instruction on how to install postgreSQL server see http://www.designmagick.com/article/2/Starting-Out/Installing-PostgreSQL)

- if you are running CentOS distro or the like then you can just do yum to install all of these needed packages.

Note: by default the installation of Postgres creates user postgres with no password (postgres by default is the superuser for PostgreSQL).

Here are the steps to take to be able to make phpPgAdmin running:

1. Download phpPgAdmin

# cd /usr/src/
# wget http://downloads.sourceforge.net/project/phppgadmin/phpPgAdmin%20%5Bstable%5D/phpPgAdmin-4.2.2/phpPgAdmin-4.2.2.tar.gz?use_mirror=nchc

2. Extract the package

# tar xvzf phpPgAdmin-4.2.2.tar.gz

3. Rename the folder and move folder to the web server document root (assuming your document root is at /var/www/html)

# mv phpPgAdmin-4.2.2 /var/www/html/phpPgAdmin

4. You should be able to browse phpPgAdmin on browser

http://xxx.xxx.xxx.xxx/phpPgAdmin/

5. Notice that what ever you put you always get "Login Failed". To correct that edit config.inc.php (located at /var/www/html/phpPgAdmin/conf/config.inc.php), set $conf['extra_login_security'] to false for now.

from

$conf['extra_login_security'] = true;

to

$conf['extra_login_security'] = false;

6. Do also the changes as follow on config.inc.php

from

$conf['servers'][0]['host'] = '';

to

$conf['servers'][0]['host'] = 'localhost'; // this is to allow tcp login

7. Now login to phpPgAdmin using username postgres without password

8. Create a user with password. (Another admin since it is advisable to use other super user account to avoid hack).

9. Once a new admin user has been created. Logout from the phpPgAdmin.

10. Edit the postgreSQL configuration (pg_hba.conf) to set md5 authentication for all connecting client via tcp. (By default all created user are trusted even without authentication). Do the changes as follow.

# vi /var/lib/pgsql/data/pg_hba.conf

from

host all all 127.0.0.1 255.255.255.255 trust

to

host all postgres 127.0.0.1 255.255.255.255 trust
host all all 127.0.0.1 255.255.255.255 md5

save the file and restart postgresql

# service postgresql restart

11. Edit again the config.inc.php and do the changes as follow:

# vi /var/www/html/conf/config.inc.php

from

$conf['extra_login_security'] = false;

to

$conf['extra_login_security'] = true;

12. Now you should be able to login using the new admin account created with password. Postgres super user will always be denied to login on phpPgAdmin for security reason.

All should be working fine from this point. You now have a running phpPgAdmin. I hope this helps for those who are establishing their PostgreSQL web admin. Cheers, Take care and God Bless!!!!

Doing FTP in PHP

2009-08-18T05:41:00.000-07:00

I had an issue during a development of one of my projects. One of the modules deals with FTP'ing files from one server to another. My script was able to login with no issues but I wondered why it was not able to write or ftp_put anything. I googled for few hours finding out how to overcome this issue that I have and came over with these links...

http://www.php.net/manual/en/function.ftp-pasv.php
http://us.php.net/manual/en/function.ftp-put.php#73168

Both of these links tell that you have to use ftp_pasv to set the ftp connection in passive mode. Meaning the ftp connection will be initiated from the client instead from the server. Also take note that ftp_pasv should be done immediately after calling the ftp_login.

Here is the comment I read there which gave or shed me the light for succesfully getting around with my problem.

"

If you are having timeouts uploading a file, even very small files, you might have a look at ftp_pasv()

And don't forget to do it after your ftp_login();"

The sample code below shows how to do it.

 $file = 'somefile.txt';
$remote_file = 'readme.txt';

// set up basic connection
$conn_id = ftp_connect($ftp_server);

// login with username and password
$login_result = ftp_login($conn_id, $ftp_user_name, $ftp_user_pass);

// turn passive mode on
ftp_pasv($conn_id, true);

// upload a file
if (ftp_put($conn_id, $remote_file, $file, FTP_ASCII)) {
 echo "successfully uploaded $file\n";
} else {
 echo "There was a problem while uploading $file\n";
}

// close the connection
ftp_close($conn_id);
?>

I hope this experience that I had and I shared with you will help you out fixing issues doing FTP in PHP. Thanks, Cheers and God Bless!!!!

Silky Heart

2009-08-04T18:10:00.000-07:00

Every hour of the day
Whenever I think about you
This impatient feelings
Just overflow

It would be easier if I just tell you that I love you
But when you appear in front of me
my personality stands up and interferes

I can usually pull through with my assertiveness
That's just the way I am
But no matter how hard I try, I can't break the wall that's between us

I want you to realize my feelings
That's why I always gaze at you with the message of...
"I love you"
With all of my courage!

My heart made of silk feels like it's about to rip apart
After meeting you, I finally realized
That I'm really clumsy when it comes to love
My scars from love that I've almost forgotten
Have started to ache all of a sudden
someday, like how I normally would...
I must tell you that I love you, or
else I'll become even weaker

If I say ‘I love you’, then I can be at ease
The truth is, even though I know that
When I sound it out, you seem to leave me

I wonder, what do you think
Of me?
At our current distance we’re merely friends, right?

I just might be whitewashing it
But I don’t want to get hurt, it’s just that alone…
Or so I persuaded myself
And I just ran away

If my flimsy silky heart
Gets hurt this time, then I’m sure
I won’t be able to love anyone ever again
The splitting sound that echoes in my chest
Is at the bottom of my memories, I’m sure
The sewing kit that I forgot to put away
On that day should be around somewhere…

I’m going to meet you now

2009-06-22T21:48:00.000-07:00

Within the people I simply brush by
I wanted to find more than anyone
The eyes welled up with tears, that voice
I only want to hold you
If I miss you and call out to you my dear
Wherever I may be, it is for you

I’m calling your name again
Because I’m like this
Because your are the one I love
I’m going to see you again
A love deeper than my tears

The lamp on the street where we
First spoke shines a light on my heart
Evething that catches my eyes,everything
Are memories that remind me of you
If I tell you that I’ve gotten too really like you
Will you feel unsettled? I wonder

I’m calling your name again
Because I’m like this
Because you are the one I love
I’m going to see you again
A love deeper than my tears

With only you
No matter how many things
Even if I’m reborn
Will you feel insettled? I wonder

I love you more than anyone
Inside my heart,
Because you live in my heart
I’m going to meet you now
Bringing along the promise of forever
I’m so happy to be loving you

Hikbi ng Pusong Umaasa

2009-06-12T21:06:00.001-07:00

alam kong mahirap pero kailangang gawin
di ko alam kung matatagalan ko at mapaninindigan ang nais ko
ang lumayo sa kanya at limutin na ng tuluyan ang nararamdaman ko
marahil ito yung tamang paraan, marahil ito ang solusyon

marahil panahon na para limutin ang lahat
ang mga panahon na nangarap akong maging kami kahit minsan
dahil alam ko naman ang katotohanang di magkakatotoo ang panaginip ko
ang panaginip na minsan ay nagbigay ng kahit kunting ngiti sa puso ko

sadya sigurong ganito pero sa katagalan makakalimutan ko rin sya
kahit mahirap kakayanin dahil kailangan
kailangan na akong magising sa katotothan at harapin ang realidad ng buhay

Pero di pa rin titigil ang pusong ito na umasa kahit pasaglit saglit lang
Pero pagod na rin ang pusong ito, pagod na itong isipan ko sa mga ilusyon
Pagod na rin ako sa kakaasa .....

Kainis lang

2009-06-11T01:19:00.000-07:00

Naiinis ako di ko alam kung ano ba dapat kong gawin
Masyado na ba akong naiinip sa pagdating nya
Masyado na ba akong matagal naghihintay
Di ko alam kung bulag ba ako manhid o kung anuman
baka naman nasa paligid lang sya pero ayokong tingnan
baka naman matagal na pala syang nasa paligid
Pero nagbubulag bulagan lang ako
Masyado lang ba akong takot na makita ko sya
O masyado lang akong nadala sa nangyari sa nakaraan
pero ayoko mawalan ng pag asa sa buhay
ayokong sayangin ung natitira kong pag asa na makita sya
ganito ba ako kabulag at di ko makita kung nasan sya
di ko alam nandito na ba sya sa paligid ko
O kailangan ko po syang hanapin
Wla akong clue na nakikita eh
O tanga lang ako na obvious ng nasa paligid
Pero nag mamaang ma angan lang ako
ewan ko ba ano ba dapat kong gawin
napaka gulo di ko maintindihan
palibhasa di ko pa nararanasan ung magmahal at mahalin ka
ewan ko ang gulo ano
kainis kasi napaka torpe ko
tapos parang wala pa kong ganon katatag na confidence sa sarili
baka kasi ung hinahanap ng mga babae sa paligid ko
ung mga alam mo na ung mga guwapo ung mga pang matinee idol baga
ayoko naman na tumandang binata
nakakatakot din, pero eto naman akong engot
wla namang magawang aksyon kung anong gagawin
kakainis lang ng konti pero minsan
ayoko ng paniwalaan pa ung nararamdaman ko
baka makuryente na nman ako
tapos haun uuwi na naman luhaan
kainis kung pwde lang sana lagi sure ball
pero hindi rin eh

Connecting Two Asterisk via IAX2 with VPN

2009-05-21T04:24:00.001-07:00

On my previous blog I discussed how to install and set up OpenVPN. Now will take a look on how we could be able to use VPN to

connect Asterisk vi IAX2 servers.

1. Assuming this scenario

The OpenVPN server(Asterisk A) is at 10.8.0.1
The OpenVPN client(Asterisk B) is at 10.8.0.10

(At server B)

Add an entry on the iax.conf like this

[MdPhone2]
type=friend
auth=plaintext
username=MdPhil2
secret=md2004
context=incoming
canreinvite=yes
host=10.8.0.1
disallow=all
allow=ulaw
jitterbuffer=yes

(At server A)
[MdPhil2]
type=friend
auth=plaintext
username=MdPhone2
secret=md2004
context=MDI-Phones
canreinvite=no
host=10.8.0.10
host=dynamic
disallow=all
allow=ulaw
qualify=4000

2. Next add this on your dialplan route

(At server B)

exten => _1XX,1,Answer()
exten => _1XX,2,Dial(IAX2/MdPhil2@MdPhone2/${EXTEN}@MDI-Phones)
exten => _1XX,3,Hangup

(At server A)
exten => _1XX,1,Answer()
exten => _1XX,2,Dial(IAX2/MdPhone2@MdPhil2/${EXTEN}@incoming,90,t)
exten => _1XX,3,Hangup

3. Go to the asterisk console

/usr/sbin/asterisk -r

Issue command:

iax2 reload

dialplan reload

And you are done. You have now Asterisk with IAX2 connection via VPN.

Hope you find this useful. Thanks, Cheers and God Bless!!!

Securing Your VOIP Connections with VPN (Installation and SetUp of OpenVPN)

2009-05-21T04:08:00.000-07:00

In this tutorial I'll be discussing on how to install and setup OpenVPN.

What is VPN anyway? VPN stands for Virtual Private Network. It is a network within a network. A VPN allows the creation of a virtual network that can use other networks (e.g. the public internet) for transport. VPNs often encrypt any data they send over the transport network. In other words data being transmitted of WAN is encrypted thus it is secured.

For the instruction on how to install Asterisk, kindly refer to my other tutorials on this blog (http://consciencespeaks.blogspot.com/2009/01/asterisk-installation.html).

Before getting any further we will first discuss a quick start on how to setup the OpenVPN. So here are the steps:

1. Install the OpenVPN package. You may have it via yum or you can have it from source.

yum install openvpn

2. Copy configuration files.

#cp -r /usr/share/doc/openvpn-2.0.9/easy-rsa/ /etc/openvpn/
#cp /usr/share/doc/openvpn-2.0.9/sample-config-files/server.conf /etc/openvpn/

3. Make all the files under directory easy-rsa executables

chmod -R 755 /etc/openvpn/easy-rsa

4. CA configuration

cd /etc/openvpn/easy-rsa/
vi vars

then scroll down to the bottom, edit as you like.

export KEY_COUNTRY=US
export KEY_PROVINCE=CA
export KEY_CITY=CALIFORNIA
export KEY_ORG=”LINUX”
export KEY_EMAIL=”rowell@mindragon.com”

#. ./vars (note a space between . . )
#./clean-all

5. Build CA

#./build-ca

Generating a 1024 bit RSA private key
………………………++++++
…………………….++++++
writing new private key to ‘ca.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:
State or Province Name (full name) [VIC]:
Locality Name (eg, city) [MELBOURNE]:
Organization Name (eg, company) [THROXVPN]:
Organizational Unit Name (eg, section) []:Throx
Common Name (eg, your name or your server’s hostname) []:throx.net
Email Address [name@mail.com]:

Some information above already entered in step 4, hust hit enter and go to next line.

6. Next we will build the server key and certificate

./build-key-server asteriskus

7. Building Diffie Hellman

#./build-dh

Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time

(Wait until it finished)

8. Next edit the server.conf to point all the generated files to the proper path. Take note that the keys and certificate are located at /etc/openvpn/easy-rsa/keys

you should have something like this:

port 1194
proto udp
dev tun
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/asteriskus.crt
key easy-rsa/keys/asteriskus.key
dh easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd ; note we will need this so as to have a fix IP address for each connecting vpn clients

Save the file

9. Next we will generate the key and certificate for our connecting clients.

./build-key asteriskph

Here you will be asked somewhat similat to what we had at step 5 but assigned a different "Common Name" for this / each client. Say for instance I assigned this as with common name asteriskph. (we will use this later on)

We will have the following files

asteriskph.crt, asteriskph.key, asteriskph.csr

10. Now create a directory ccd so as to have

/etc/openvpn/ccd

then under that directory create a file with filename equal to the Common Name of cert of the connectiong client (which we created at step 9.

so

vi /etc/openvpn/ccd/asteriskph

then add this entry

ifconfig-push 10.8.0.10 10.8.0.11 ; in this case the client will have an IP address of 10.8.0.10 everytime it connects to VPN

11. Now you can start the openvpn by issuing

/sbin/service openvpn start

12. Be sure to open up the port 1194 on the firewall to allow connections

Next will set up the VPN at the client side.

1. Download and install OpenVPN at the client side

2. Copy the client key, csr and crt and ca.crt from the OpenVPN server to the client server.

3. Copy the client configuration file

cp /usr/share/doc/openvpn-2.0.9/sample-config-files/client.conf /etc/openvpn/

4. create keys directory under openvpn folder so as to have /etc/openvpn/keys

copy or move all the client's key, crt and ca.crt to that folder

5. Edit the client.conf

You must have something like this:

client
dev tun
proto udp
remote XXX.XXX.XXX.XXX 1194 ; here the IP of the remote (OpenVPN server)

6. Then you may now start the openvpn client

/sbin/service openvpn start

7. In order to verify that your vpn client is running, issue

/sbin/ifconfig

and you should have something like:

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.10 P-t-P:10.8.0.11 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:4774 errors:0 dropped:0 overruns:0 frame:0
TX packets:4759 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:876230 (855.6 KiB) TX bytes:884454 (863.7 KiB)

if you want to verify also of that of server you can issue the same command and something like above should show up.

Of course to verify further ping the other server using the VPN IP address assigned. (e.g. ping 10.8.0.1 it should have reply...)

[rowell@MDPHAsterisk openvpn]$ ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=202 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=203 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=204 ms

Now you have a running OpenVPN. Hope you find this stuffs useful. Thanks, Cheers and God Bless!!!

The Return of the OpenSER (OpenSIPs)

2009-05-19T03:43:00.001-07:00

It has been long while that I've been silent on doing stuffs about OpenSER, ahm I mean OpenSIPs. Ok since there were lot of changes and progress happened with this project and I was not able to keep an eye on this, well let us start from the very beginning. From the point of where we should suppose to start and yes it's about installation.

Alright to begin with,

1. Install all the Linux packages/dependencies needed (please refer to my old blog on this http://consciencespeaks.blogspot.com/2008/06/getting-started-with-openser.html).

2. Get the latest source package of OpenSIPs (currently it's 1.5.x series)

wget http://opensips.org/pub/opensips/1.5.0/src/opensips-1.5.0-tls_src.tar.gz

3. Unzip and extract the files

tar xvzf opensips-1.5.0-tls_src.tar.gz

4. cd to the source directory

cd opensips-1.5.0-tls

5. Do following for compilation and installation

make clean
make all
make install ; it seems to be simplified ah ;-) by default everything will be installed at /usr/local

6. Now edit first openserctlrc

vi /usr/local/etc/opensips/opensipsctlrc

uncomment the line that says

DBENGINE=MYSQL

7. Now we can create the database for the OpenSIPs

/usr/local/sbin/opensipsdbctl create

; this will prompt for mysql root password

*Note that upon execution of this command it will create 2 users for OpenSIPs

; by default the mysql database user created is:

username: opensips
password: opensipsrw

8. Now edit opensips.cfg

vi /usr/local/etc/opensips/opensips.cfg

uncomment all lines in configuration file opensips.cfg which are related to
authentication:
- loadmodule "/usr/lib/opensips/modules/db_mysql.so"
- loadmodule "/usr/lib/opensips/modules/auth.so"
- loadmodule "/usr/lib/opensips/modules/auth_db.so"
- modparam("usrloc", "db_mode", 2)
- modparam("auth", "calculate_ha1", yes)
- modparam("auth_db", "password_column", "password")
- if (!www_authorize("sip.org", "subscriber")) {
www_challenge("sip.org", "0");
break;

Make sure you change the two sip.org instances in the above config, to your
domain, or realm. In my case, I changed this to 192.168.2.235 which was the
IP address of this box.

Also, be sure to comment out the following line:

modparam("usrloc", "db_mode", 0)

9. Now let us copy the init script so as to start OpenSIPs as service ( such as starting it at boot). Copy the openser.init which can be found on the base directory of the OpenSIPs source. In my case it is at /usr/src

cp /usr/src/opensips-1.5.0-tls/packaging/rpm/opensips.init /etc/init.d/openser

chmod 755 /etc/init.d/opensips
/sbin/chkconfig --add opensips

also before you start the openser correct the path of its service execution

vi /etc/init.d/opensips

change the following line

osips=/usr/sbin/opensips

with this one since we installed the binaries on path /usr/local

osips=/usr/local/sbin/opensips

10. Now you can start OpenSIPs service

/sbin/service opensips start

To check if it is running issue

ps aux|grep opensips

you should see something like this

root 4210 0.3 0.6 43048 3548 ? S 21:21 0:00 /usr/local/sbin/opensips -P /var/run/opensips.pid
root 4214 0.0 0.2 43048 1216 ? S 21:21 0:00 /usr/local/sbin/opensips -P /var/run/opensips.pid
root 4217 0.0 0.2 43048 1140 ? S 21:21 0:00 /usr/local/sbin/opensips -P /var/run/opensips.pid

11. To test we will create user / SIP account to test our set up. We can do this by using the opensipsctl tool

/usr/local/sbin/opensipsctl add mytest 'abc123!@#'

*Note you might encounter problem once you issued the command above and complaining for the SIP_DOMAiN. To fix that,
issue the command as follows:

export SIP_DOMAIN=192.168.2.235

Now re issue the command for adding new user / SIP account

12. Test it by registering a softphone and filling up the phone's registration info's. You should be able to register already.

Here are some more helpful links:

http://opensips.svn.sourceforge.net/viewvc/opensips/trunk/INSTALL

Hope you find these stuffs useful. Thanks, Cheers and God Bless!!!!

Gumising sa katotohanan

2009-05-14T01:57:00.000-07:00

I have to admit to myself na wla syang nararamdaman para sakin
It's all illusion that I am trying to portray
Everything is a false belief
Everything is just a dream and fantasy

Tama na ang ilusyon I have to face the truth
Kailangan na akong mabuhay sa katotohanang di sya para sakin
And there will be no chance para maging kami

Napakahibang ko at nagpapaloko ako sa sarili kong ilusyon
As if everything may come into reality
Pero hinde eh
Enough is enough for all these insanity
For making myself to believe in the story telling I have in mind

I am just hurting myself to realize that everything is just form of my imagination
Kahibangang kailangan ng tigilan
It is too much ... sobra na ang sakit...
Ayoko ng umasa sa isang istoryang wla rin namang katuturan

Ayoko ko ng mamuhay sa mundong puro pangarap na lng
Let's stop this craziness, it's all worthless and futile
Isara mo na ang telon ng pagkukunwari
Ilibing ang damdamin na wla rin namang kapupuntahan

Tma na ang ilusyon
Gumising ka......

Ngiti

2009-05-12T02:27:00.001-07:00

Minamasdan kita
Nang hindi mo alam
Pinapangarap kong ikaw ay akin
Mapupulang labi
At matinkad mong ngiti
Umaabot hanggang sa langit

Huwag ka lang titingin sa akin
At baka matunaw ang puso kong sabik

Sa iyong ngiti ako'y nahuhumaling
At sa tuwing ikaw ay gagalaw
Ang mundo ko'y tumitigil
Para lang sayo
Ang awit ng aking puso
Sana'y mapansin mo rin
Ang lihim kong pagtingin

Minamahal kita ng di mo alam
Huwag ka sanang magagalit
Tinamaan yata talaga ang aking puso
Na dati akala ko'y manhid

Hindi pa rin makalapit
Inuunahan ng kaba sa aking dibdib

Sa iyong ngiti ako'y nahuhumaling
At sa tuwing ikaw ay lalapit
Ang mundo ko'y tumitigil
Ang pangalan mo sinisigaw ng puso
Sana'y madama mo rin
Ang lihim kong pagtingin

Sa iyong ngiti ako'y nahuhumaling
(Sa iyong ngiti)
Sa tuwing ikaw ay gagalaw
Ang mundo ko'y tumitigil
Para lang sa'yo...
(Para lang sa'yo ang awit ng aking puso)
Sana ay mapansin mo rin...
Ang lihim kong pagtingin
Sa iyong ngiti...

Lihim na Pagtingin

2009-05-12T02:22:00.000-07:00

nahihiya akong aminin ang nararamdaman ko sayo
di ko alam kung dapat ko bang ipagtapat sa yo
O habang buhay ko na lng na itatago

May bahagi sa puso ko na gusto ng magsalita
Pero tikom ang bibig ko at halos wlang masabi
Pilit na kinukubli ang tunay na nararamdaman
Damdamin na matagal ng naghihintay ng pagkakataon
Damdamin na umaasang magmahal at mahalin din

Masaya akong araw araw kang pagmasdan
Pero Masakit din dahil hanggang tanaw lang ang kaya kong magawa
Umaasang darating ang araw na magkakalakas din ng loob
Umaasang Magkakaroon din ng tapang balang araw

Pero sa bawat pagkakataong ninais kong humakbang
Di man lng ako makakilos at makapagsalita
Para akong binuhasan ng yelo
Para akong inawitan ng adarna at naging bato
Wlang imik at tanging mga biro lng ang kayang sambitin

Hindi ko alam kung bakit at parang may takot na pumipigil
Takot na baka sa pagkakataong malaman mo
Doon na mag iiba ang lahat
Takot na sa pagkakataong masambit ng aking labi
Ang mga bagay na tunay na nilalaman nito
Iyon na ang magiging hudyat ng katapusan

Mga pangarap na bigla na lang maglalaho na parang bula
Mga panaginip na madalas kong himlayan ng mga pangarap
Mga pangarap na minsa'y nanaginip na maging tayo man lng

Enabling JSON on you PHP-Apache

2009-03-20T21:30:00.000-07:00

Here are the steps to take to enable JSON on PHP. These instructions are specific for Linux OS.

1. Install Pear

yum install php-pear

2. Install PHP-devel

yum install php-devel ; for phpize

3. Install json extension

pecl install json ;or
pear install json

4. Edit php.ini and add on extension list

extension=json.so

5. Save this and restart Apache

And you're done. You now have json enabled on your LAMP server.

Hope you find these useful. Thanks, CHeers and God Bless!!!!

Setting up a scheduler in Linux (Cron Jobs: Crontab tutorial)

2009-02-06T22:26:00.000-08:00

There are cases wherein we have to execute a command or a script say for daily basis for some maintenance purposes. In Linux there is a way that we could do it. It is through crontab (a cron job).

Assuming that we want to execute a command. Say we want to reset and resync our clock time with NTP server pool.

a.) Set up for scheduling command

The first thing to do is to locate the complete path of the command. So for our example let us locate where the complete path for ntpdate command is. Issue this command:

# whereis ntpdate

This will show you the different paths like this:

ntpdate: /usr/sbin/ntpdate /usr/share/man/man8/ntpdate.8.gz

Just take note of the bin or sbin path of the command. So in our case it is /usr/sbin/ntpdate.

b.) for scripts here's the set up

First create your script. If it is a shell script then on the first line of code you must have this. For other scripts like PHP just google out there and surely you will find many.

#!/bin/sh

Save your script. Set the file permission to 775 by issuing:

# chmod 775 (script)

Take note of the path where you saved the script we need this later on.

Next we'll open the crontab file by issuing this command.

# crontab -e

The flag 'e' signifies editing of the crontab file.

Once you're prompted on a file like this

~
~
~
~
"/tmp/crontab.XXXXtkRgpi" 7L, 546C

Press 'i' or insert key then you can start writing your schedules. When you are done. Just press escape key then press colon then 'w' and 'q' (:wq (a vi editor way of saving remember..)).

Before we proceed let me just discuss the format of the syntax that you will be enterring here.

* * * * * /complete/path/to/script/(command / filename of script to execute)

Example

*/1 * * * * /usr/sbin/ntpdate north-america.pool.ntp.org > /dev/null 2>&1

Let me explain...

the first * denotes minute (it can be from 0 - 59) minute
the second * denotes hour (military time 0 - 23) hour
the third is day of month (1 - 31)
4th is month (1 - 12)
5th the last one is day of week (0 - 6) 0 = Sunday

Say you want a schedule everyday at 12 midnight... here is an example

0 0 * * * /complete/path/to/script/(command / filename of script to execute)

If you want to execute per minute, here is how

*/1 * * * * /usr/sbin/ntpdate north-america.pool.ntp.org > /dev/null 2>&1

To list your current active cron jobs, issue:

# crontab -l

I hope you find these stuffs useful. Thanks, Cheers and God Bless!!!

Fixed PHP compile error: Note that the MySQL client library is not bundled anymore!

2009-02-05T01:52:00.000-08:00

Just a note that is worth be reminded for all CentOS version 5 users. One of the issues being encountered on compiling PHP with MySQL is the error:

Note that the MySQL client library is not bundled anymore!

Now how are you going to fix this?? Here's how.

On your configure command just locate or point the mysql lib base dir in my case it is on /usr

so just do ./configure --with-mysql=/usr

That will resolve your problem.

Hope this helps. Thanks, Cheers and God Bless!!

Hardening PHP (Protecting your PHP from Flaws)

2009-02-05T00:47:00.000-08:00

There are rumors going on out there that PHP has some pitfalls. This could lead up to some security risk most especially if you have a PHP application dealing with the outside world. To avoid this, some nice guys out there developed a 'guardian angel' for PHP. The guardian angel I am referring into is the suhosin. Yes suhosin is a korean word which mean 'guardian angel'. It is a PHP extension the secures PHP from its pitfalls or vulnerability.

I will discuss here on how to have this cool stuff on your PHP settings.

1. First download the suhosin signature key. Goto /usr/src then issue this command

# wget http://www.hardened-php.net/hardened-php-signature-key.asc

2. Import it into the GNU Privacy Guard

# gpg --import < hardened-php-signature-key.asc

3. Download the suhosin source

# wget http://download.suhosin.org/suhosin-0.9.27.tgz

4. Unpack the package

# tar xvzf suhosin-0.9.27.tgz

5. cd suhosin-0.9.27

6. After getting into the suhosin directory, issue the following

# phpize
# ./configure
# make
# make install

7. The library suhosin.so is most likely installed on /usr/src/suhosin-0.9.27/modules or it can be on /usr/local/lib/php/extensions/no-debug-non-zts-20060613/suhosin.so

8. copy the suhosin.so to /usr/local/lib/php/extensions that is if you have installed php from source. Check other resources if you did not.

# cp /usr/src/suhosin-0.9.27/modules/suhosin.so /usr/local/lib/php/extensions

9. Open the php.ini

# vi /usr/local/lib/php.ini

10. Set the following parameters on php.ini

extension_dir = "/usr/local/lib/php/extensions/"

extension=suhosin.so

11. save it then restart apache

12. You should now see the suhosin among the enabled extension on your PHP. Check on the phpinfo for this.

Hope you find these info useful. Cheers, Thanks and God Bless!!!!

Smart Host: Relaying Mails from Sendmail to Gmail

2009-02-03T00:03:00.000-08:00

There are cases wherein the mails that are being sent from server does not arrive at the recipient's inbox. One possible cause is that the mail was considered a spam. One solution that can be done, dealing with this issue, is to relay the emails to a trusted SMTP host say like Gmail. How are we going to do it here is how.

First you need to have sendmail a native MTA for Linux. Here are the packages you need to have

- sendmail
- senmail-cf
- sendmail-devel

All of these packages can be installed via yum.

Next enable the smart host feature on sendmail. Open the sendmail configuration file.

vi /etc/mail/sendmail.mc

Change this:

dnl define(`SMART_HOST',`smtp.gmail.com')dnl

to:

define(`SMART_HOST',`smtp.gmail.com')dnl

Next add this entry before the entry of smart host.

FEATURE(`authinfo',`hash /etc/mail/auth/client-info')dnl

If you don't have an /etc/mail/auth directory, as root, create one like this:

# mkdir -p /etc/mail/auth
# chmod 700 /etc/mail/auth

You won't have the next client-info files so you'll have to create it (with you favorite Unix editor). Change the permissions on the client-info file like this:

# chmod 600 client-info

So using my user_id@gmail.com email ID and password I made the following entry in /etc/mail/auth/client-info:

# cat /etc/mail/auth/client-info
AuthInfo:smtp.gmail.com "U:smmsp" "I:user_id" "P:password" "M:PLAIN"
AuthInfo:smtp.gmail.com:587 "U:smmsp" "I:user_id" "P:password" "M:PLAIN"

Yes, password is plain text. It is possible to encode the password but I don't have those instructions here.

Remember to replace user_id with your Gmail email ID (your email addresse without the @gmail.com) and password with your email password. Also make sure that the client-info file has a

How to compile it into a db file:

# cd /etc/mail/auth
# makemap -r hash client-info.db <> sendmail.cf

And lastly restart sendmail:

# /sbin/service sendmail restart

Now you can test it....

Hope you find this useful. Thanks, Cheers and God Bless!!!!

Some Linux Network Configurations and Files

2009-02-02T19:08:00.000-08:00

I just wanted to list some of the common files or configurations in Linux for networking.

NETWORK Stuff

1.) /etc/sysconfig/network
-this one contains the hostname configuration of the machine so if you want to change the machine hostname do it here
- Sometimes the GATEWAY is configured here

2.) /etc/sysconfig/network-scripts/ifcfg-eth#

Ex. ifcfg-eth0 means eth0 , ifcfg-eth1 means eth1 or ethernet 1 or NIC 1
- the Network / LAN configuration of the machine where its IP is configured
- ifcfg-eth0:0 when there is a colon it means it is a virtual ethernet

3.) /etc/hosts
-local base bind or name service to resolve hostname

4.) /etc/resolv.conf
- DNS settings of the local machine

Fixing Error "cannot open shared object file: No such file or directory"

2009-01-29T20:39:00.000-08:00

There are instances during our installation that a shared object, commonly on .so files, cannot be openned or located. To fix this issue here are the steps to take.

1. locate the .so or object file that cannot be opened

locate (objectname).so

Ex. locate libmp4.so

-you will get the path

/usr/local/lib/libmp4.so.0

2. Take note of its path

3. Open ld.so.conf, usually it is on /etc/ld.so.conf

vi /etc/ld.so.conf

4. Add at the end the path of the shared object

include ld.so.conf.d/*.conf
/usr/local/lib/

5. Save it then issue this command

/sbin/ldconfig

-- You're done

Hope you find this helpful. Thanks and God Bless!!!

Setting up a LAMP Server

2009-01-29T02:16:00.000-08:00

It is a common task for Linux System Administrators to set up and to establish a web server. On Linux Systems it is common to have Linux, Apache, MySQL and PHP for production. In this tutorial I'll show you on how to set up LAMP with the latest Httpd (Apache), MySQL, and PHP. Here I'll be using CentOS 4.7.

Actually you can have a LAMP running Apache 2.0, PHP 5.1 and MySQL 5.0 on CentOS 4/RH4 easily with yum. How?
Here it is:

To install apache 2.0
yum --enablerepo=centosplus install httpd
To install mysql 5.1
yum --enablerepo=centosplus install mysql mysql-server
To install PHP 5.1
yum --enablerepo=centosplus install php

Then you are done you have a CentOS 4.x running Apache 2.0 MySQL 5.1 and PHP 5.1. Hmmm quite nice isn't it.

But how about if you really insist to have the latest. Well then here is how.

Of course you have to remove all the old Apache, PHP and MySQL instances. Here's how to do it.

1. First check if they are currently installed
rpm -qa|grep httpd ;to check if Apache is installed
rpm -qa|grep mysql ; to check if mysql is installed
rpm -qa|grep php ; to check if php is installed

2. If they are installed then remove them
yum remove httpd
yum remove mysql
yum remove php

3. Remove the remaining traces or dependencies of it
rpm -qa|grep php

you will see here like

php-common
php-pdo

remove them via

rpm -e php-common php-pdo

do the same thing on httpd and mysql

rpm -qa|grep (packagename)

then remove remaining traces

rpm -e (packagename)

4. Once all is clean we can start downloading all the latest packages for our new LAMP

Installing Apache

1. Goto /usr/src

cd /usr/src

1. Get the latest apache server say 2.2.x

wget http://apache.mirrors.biblionix.com/httpd/httpd-2.2.11.tar.gz

2. Extract it

tar xvzf httpd-2.2.11.tar.gz

3. cd httpd-2.2.11

4. then under the httpd folder do the following

./configure
make
make install

By default the apache is installed at /usr/local/apache2 folder

5. Set the necessary configuration you want for your web server

vi /usr/local/apache2/conf/httpd.conf

in my case I set my document root on /var/www/html
to avoid directoy listing do this
On directory directive you will see this

Options Indexes FollowSymLinks

make it like this

Options -Indexes FollowSymLinks

well enough on httpd configurations we'll have more on our next discussions to follow

6. To make the httd start at boot, we'll put it on Linux services. How?

- copy first the apachectl script from the httpd folder

cp /usr/local/apache2/bin/apachectl /etc/init.d/httpd

- we put it on under init.d since all start up scripts are under this folder and being executed upon boot

- we're not done yet. Open httpd startup script.

vi /etc/init.d/httpd

- Add the following entries after the second line

# chkconfig: - 85 15
# description: Apache Web server

- let us add it on the Linux services

/sbin/chkconfig --add httpd

- then set it to start on running levels 345

/sbin/chkconfig --level 345 httpd on

- check if it is set well

/sbin/chkconfig --list|grep httpd

- you should see this

httpd 0:off 1:off 2:off 3:on 4:on 5:on 6:off

7. Now start the httpd service by

/sbin/service httpd start

8. to check if it is running

/sbin/service httpd status (only works for apache installed via rpm or yum)

or do

ps aux|grep httpd (works for all so just do this in our case)

- you should see either of the following

root 27093 0.0 0.1 4108 1808 ? Ss 14:31 0:00 /usr/local/apache2/bin/httpd -k start
apache 27114 0.0 0.1 4108 1640 ? S 14:32 0:00 /usr/local/apache2/bin/httpd -k start
apache 27115 0.0 0.1 4108 1300 ? S 14:32 0:00 /usr/local/apache2/bin/httpd -k start
apache 27116 0.0 0.1 4120 1648 ? S 14:32 0:00 /usr/local/apache2/bin/httpd -k start
apache 27117 0.0 0.1 4108 1648 ? S 14:32 0:00 /usr/local/apache2/bin/httpd -k start
apache 27118 0.0 0.1 4108 1300 ? S 14:32 0:00 /usr/local/apache2/bin/httpd -k start
apache 27119 0.0 0.1 4108 1300 ? S 14:32 0:00 /usr/local/apache2/bin/httpd -k start

-- now you have a running Apache server version 2.2

Installing MySQL

We'll do the RPM way of installing this one.

1. First you have to know what version of CentOS you have and what platform are you working in with.
- to know what platform are you working with issue the command

uname -i ; this will display or echo the platfrom in my case its i386

- to know what OS version are you running with open this file or just do cat

cat /etc/redhat-release ; this will display the OS version in my case it's CentOS release 4.7 (Final)

2. Since we're running i386 platform and version 4.x CentOS we'll download the necessary MySQL rpm packages suitable to this platfrom. In this case it is x86 or Red Hat Enterprise Linux 4 RPM (x86) downloads. Here are the things we need.

- MySQL-server-community-5.1.30-0.rhel4.i386.rpm
- MySQL-client-community-5.1.30-0.rhel4.i386.rpm
- MySQL-devel-community-5.1.30-0.rhel4.i386.rpm
- MySQL-shared-community-5.1.30-0.rhel4.i386.rpm

- so let's download them

wget http://(Mirror-linkname)/(rpmpackagename)

3. Once all neede packages are downloaded we can now install them. Issue the following command

- to install each of the packages issue this

rpm -ivh (packagename)

Ex. rpm -ivh MySQL-server-community-5.1.30-0.rhel4.i386.rpm

4. Then ensure that mysql service can start at boot.

/sbin/chkconfig --list|grep mysql

- you should see this

mysql 0:off 1:off 2:on 3:on 4:on 5:on 6:off

- if it is not then make sure it runs / start on run level 345

/sbin/chkconfig --level 345 mysql on

5. Start MySQL service

/sbin/service mysql start

6. By default MySQL root has no password so just set its password say by installing first phpMyAdmin then reset password there or just go using the mysqladmin or mysql console command to reset password.

-- Now you have a running MySQL server version 5.1.x

Installation of PHP

Before we proceed on installing PHP we need the following to be installed first. These packages are known and commonly used on web development such as XML, web service and others

- curl (compile from source or you can do yum)
- curl-devel (if you did yum on curl)
- zlib (compile from source or do yum)
- libxml2 (compile from source or do yum)
- libxml2-devel (if you did yum on libxml2)
- openssl (you can do yum on this one)
- libpng (do yum here)
- libpng-devel (do yum here)
- gd (do yum)
- gd-devel (do yum)

Once all of these package are installed we can proceed on php installation.

1. Get the latest PHP packages from php.net

2. Goto /usr/src

3. Extract it there

4. cd php-5.x/

5. then issue this

./configure --with-mysql --enable-soap --with-apxs2=/usr/local/apache2/bin/apxs --enable-ftp --with-curl --with-curlwrappers --with-zlib --with-gettext --with-gd

make

make install

6. You now have installed PHP 5.x

7. There are things to verify to make PHP5 really running. How? Create you phpinfo.

8. If phpinfo is not displaying any content at all then there must have any problem on the httpd configuration. Here are the things that you should ensure to have on you httpd.conf

LoadModule php5_module modules/libphp5.so ; by default this is placed by PHP installer

DirectoryIndex index.php index.html

AddType application/x-httpd-php .php

AddHandler php5-script .php

AddType text/html .shtml .php

9. Save your changes on the httpd.conf and restart apache.

10. Check again your phpinfo it should display the current PHP and apache settings.

11. By the way sometimes php.ini is not set up so just copy the php.ini to the configuration path check phpinfo for the right path

- on phpinfo you will see

Configuration File (php.ini) Path /usr/local/lib

- copy the recommended php.ini settings

cp /usr/src/php-5.X/php.ini-recommended /usr/local/lib/php.ini

-by the way you should always restart your Apache service after saving any changes you applied on php.ini.

=== Now you have the latest LAMP running.

Hope you find these useful. Thanks, Cheers and God Bless!!!

Local Channel in Asterisk

2009-01-29T02:14:00.000-08:00

Local channel in asterisk is usually use to connect two or more call legs. It is usually done via Manager API, AGI or thru a call file dumped on /var/spool/asterisk/outgoing/

If you're going to call Local channel and want to monitor its call durations use the '/n' flag.

Here it is

Local/extension@context[/n]

Here is an example, a snippet of a script

fputs($socket, "Channel: Local/1$number@wakeout/n\r\n");
fputs($socket, "Context: wakeout\r\n");
fputs($socket, "Exten: waketest\r\n");
fputs($socket, "Priority: 1\r\n");

This is important most especially for billing purposes.

Hope you find this helpful. Thanks, CHeers and God Bless!!!

Resolve False Hangup Detection on TDM400 on Asterisk

2009-01-27T18:51:00.000-08:00

One of the issue I have encountered on digium card specifically TDM is the hangup detection. Some indications that you have this problem are: 1.) Random hangups 2.) Incoming calls still get through even if the outside caller has already hangup. Here are the possible solutions that can be done with it.

Set the following entries on your chan_dahdi.conf (that is if it is dahdi if not it is zapata.conf)

; first is the polarity switching
; most of the countries supports polarity reversal whenever answer or hangup happens

hanguponpolarityswitch = yes
answeronpolarityswitch = yes

;detect busy
busydetect = yes
;count the busy tones
busycount = 6
;set call progess works in mine
callprogress = yes
; set progress zone
progzone=ph ; in my case it's Philippines

After that you have to restart Asterisk for the changes to take effect. Then test the result.

I do hope you find these helpful. Thanks, Cheers and God Bless!!!!

Basics Sometimes are forgotten (Fixing few Windows issue)

2009-01-24T00:51:00.000-08:00

I was really upset when I found my workstation not booting up. I just learned that my workstation got a virus. It was infected when I plug my USB drive. The worst is I don't have any anti-virus on my workstation. By the way the workstation that I have at the office is Windows based. Then I don't have any idea what to do next since my workstation does not resume or load the login window. A co-worker of mine told me of this basics. He told me that I can load back or boot my windows workstation on the last working configuration. Hmmmm I didn't know that. So here was what he suggested me to do.

1. Reboot / reset the windows machine
2. Upon boot press repeatedly the F8 to go to the advance windows menu configuration
3. Select "Last Working Configuration"
4. Then you're done...

But if ever you have to repair the windows OS then you have to use an installation CD to fix your problem.

1. Reset your machine
2. Upon booting press repeatedly the delete button to goto the BIOS settings
3. Select to boot first on the CD-ROM
4. Then there you go ...

Hope you find this helpful. Cheers and God Bless!!!!

Protecting Your Linux Systems

2009-01-24T00:48:00.000-08:00

ALthough Linux is said to be a very secured OS. It is still highly recommended to install applications that will enhance its security and integrity. There are many kinds of threats out there that could really trip up a system. To name few are virus, rootkits, brute force attack and etc.

Here are some softwares that you can install on your Linux system and few of them are must to have.

- Netfilter's IPTables (firewall) ; of course you should enable it and set your rules
- fail2ban ; need this if ever there are ports / services that will be openned to the public say ssh
- chkrootkit ; this one is like a check up of the Linux files integrity
- clamav (optional) - this one is an anti virus but actually Linux sometimes does not require it

Ok those are just few that I know you can have on your system.

Hope you find this brief discussion helpful. Cheers and God Bless!!!

Asterisk DTMF Issue Fixed

2009-01-23T01:15:00.000-08:00

One of the issues that is known with Asterisk is the reliability on how it handles DTMF. By the way what is DTMF. DTMF in layman's term is touch tone. This are the digits being dialed. We usually encounter this when we call a customer service where we're asked to dial a certain option. Say "Press 1 for sales .....".

One problem that I encountered on this was how poorly the Asterisk server accepts DTMF or send DTMF. Actually this is not an Asterisk issue but the way how the Asterisk is configured.

Is there a resolution to it? Well, there is.

Here's are some notes and how.

There are 4 modes where asterisk can handle DTMF. We have rfc2833, info, inband and auto. Among these modes, based on majority suggestions out there, it is recommended to use RFC2833.RFC2833 is said to work perfectly with asterisk. By the way RFC2833 is an out-of-band DTMF mode.

To set Asterisk to use RFC2833 then set on the configuration files (sip.conf, iax.conf and chan_dahdi (I am not sure here...)) and look for this option.

dtmfmode=(mode)

Set it to:

dtmfmode = rfc2833
rfc2833compensate = yes
relaxdmtf = no ; should be no because setting it to yes cause talkoff

then reload the module say 'sip reload'

Another suggestion is to use:

dtmfmode=auto

Here Asterisk will use RFC2833 first as its default way of relaying DMTF. If the remote side does not suppor it, then it will switch to Inband mode. But a note on this. If you plan to use this mode, make sure that you are only using ulaw codec as the Inband mode is very problematic on non ulaw codec.

Personally I recommend just using the RFC2833 as your mode for DTMF handling because it is proven to work perfectly and reliably on Asterisk. It is your choice to use auto also.

Hope this discussion will be helpful. Cheers and God Bless!!!!

PHP Native Session Handling

2009-01-20T22:02:00.001-08:00

#native php session handling

// initializes session handling in php
session_start();

// assign and set session variables
$_SESSION['varname'] = 'value';

// unset a certain variable
unset($_SESSION['varname']);

// free all session variables
session_unset();

// terminate or kill session handling
session_destroy();

Asterisk Installation

2009-01-13T20:24:00.000-08:00

Asterisk is known to be the leading open source IP PBX. It has been the best choice alternative to expensive and proprietary

type of PBX server. What's nice about Asterisk is that it is open source and it is free!!! When we say open source this

software has been made by collaborating ideas of different developers around the globe. So expect the cool stuff that can be

done with it. The other nice thing about it, is that it is customizable, flexible and cross platform.

Asterisk can be obtained from various sources. You can have it in a installable CD (ISO) or you could have it from other

communities out there who have developed friendly UI where you could tweak the server easily. If I were to ask I would prefer

to have it from source. Why? Cause templated Asterisk though user friendly can't be extended the way you wish it.

So let us have the Asterisk (raw) and install it on Linux (preferably CentOS).

Before you can compile Asterisk you need the following stuffs on Linux.

Linux Requirements

GCC 3.x
ncurses-devel
libtermcap-devel
Kernel Development Headers
Kernel Development Headers (SMP)
GCC C++ 3.x
bison
OpenSSL (optional)
newt-devel (optional)
zlib-devel (optional)
libtool (optional; recommended)
GNU make (version 3.80 or higher)
libnewt

Here is how we can have them

Install command

yum install -y gcc
yum install -y ncurses-devel
yum install -y libtermcap-devel
yum install -y kernel-devel
yum install -y kernel-smp-devel
yum install -y gcc-c++
yum install -y bison
yum install -y openssl-devel
yum install -y newt-devel
yum install -y zlib-devel
yum install -y libtool
yum install -y make
yum install -y libnewt

Once done we can get the sources from asterisk.org using wget.

# wget http://downloads.digium.com/pub/libpri/releases/libpri(version)tar.gz
# wget http://downloads.digium.com/pub/libpri/releases/dahdi-linux(version)tar.gz
# wget http://downloads.digium.com/pub/libpri/releases/dahdi-tools(version)tar.gz
# wget http://downloads.digium.com/pub/libpri/releases/asterisk(version)tar.gz
# wget http://downloads.digium.com/pub/libpri/releases/asterisk-addons(version)tar.gz

then extract each of the packages

# tar xvzf (packagename)

then compile each packages

for libri and dahdi-linux

# make
# make install

for dahdi-tools

# ./configure
# make
# make install
# make config

for asterisk

# ./configure
# make menuselect ;this is optional but when run just save the default settings, in my case I used to issue it to check out the different options available
# make
# make install
# make samples
# make config

for asterisk-addons (this is important if you want to have some applications like DB, WakeUp Call, streaming audio/video)
# ./configure
# make
# make install
# make samples

To start asterisk the first time (for debugging purposes)

/usr/sbin/asterisk -vvvvgc

If you did not receive any errors stop asterisk and then start asterisk the normal way

/sbin/service asterisk start

to enter the asterisk console issue this command

for root

asterisk -r

for non-root

/usr/sbin/asterisk -r

Now you have a running Asterisk IP PBX

Note: If you want to recompile asterisk say you want to upgrade then recompile asterisk-addons after that as well because sometimes a recompiled asterisk will not load the asterisk-addons module.

BTW there are also other addons / extensions available out there that works with Asterisk like the app_conference (an alternative for MeetMe, capable for doing video conferencing), app_mp4 from sip.fontventa (for recording mp4 video)

Hope you find these helpful. Thanks, Cheers and God Bless!!!!

Mounting Linux Share via CIFS

2008-12-18T00:33:00.000-08:00

In this tutorial, I'll discuss on how to mount shared folder under Linux via CIFS. First, let us list the packages or things needed to get us started. Here are they:

For the server:

- kernel that supports CIFS (Most Linux Distro's come with this)
- Samba server

For the client
- kernel that supports also CIFS
- Samba client (optional)

Next, we have to consider what ports to be openned for the mount to work. Here are they all of which are tcp:

- 2049 or nfs
- 53
- 445
- 139

Once the said ports are openned we can now proceed on the installation

On the server side:

1. First install Samba

yum install samba

2. start samba

/sbin/service smb start

3. Then we'll add a new samba user

smbpasswd -a smbuser1

;this will prompt for password so take note of this

4. create the folder to share

mkdir /home/smbusershare

5. edit samba configuration file locate at /etc/samba/smb.conf

vi /etc/samba/smb.conf

6. Add an entry like this

[sharename]
path = /home/smbusershare
read only = no
valid users = smbuser1

7. Restart Samba

/sbin/service smb restart

On the client side:

1. Follow the first 2 steps on the server side procedure.

2. Create the mounting point

mkdir /home/client/mnt

3. Mount the filesystem via CIFS. Issue this command:

mount -t cifs //server ip/sharename /home/client/mnt -o username=smbuser1,password=password

4. It should now map the mounted filesystem

5. To check

either issue

df -h

you should see like this

Filesystem Size Used Avail Use% Mounted on
/dev/hda3 73G 2.2G 67G 4% /
/dev/hda1 244M 18M 213M 8% /boot
none 506M 0 506M 0% /dev/shm
//server ip/sharename 36G 17G 18G 48% /home/client/mnt

or check /etc/mtab

vi /etc/mtab

you should see this entry

//server ip/sharename /home/client/mnt cifs rw,mand 0 0

6. To mount it at boot just add the complete command for mounting at /etc/rc.local

Hope you find this discussion helpful. Thanks!!! Cheers and God Bless!!!!

Creating Default Firewall on Linux using IPTables

2008-11-24T19:34:00.000-08:00

Firewall is very important and a must for every servers as this secures the box from any intruders that might want to breach or hack your server. One way that you could put up your default firewall rules in IPtables is via system-config-securitylevel-tui. It is a dos-based like UI that allows you to specify what ports are to be opened. Off course you have to do this only for creating your default firewall but to add up more security you have to use the iptables command line options.

So once you have defined you're open ports and rules via the UI. There's one more thing to do with it. The default rule created by the system-tui is not completely secured at all. There is a slight bug on it.
Try to issue this command:

/sbin/iptables -L

If you will notice the first two lines on the firewall rule RH-Firewall-1-INPUT chain,
you will see there duplicate entry

ACCEPT all -- anywhere anywhere ;this is needed for the server's services
ACCEPT all -- anywhere anywhere ; this is the hole

This one is a hole in the firewall as it allows others to enter/ to access your box from anywhere (like in ssh). To avoid this security breach/security risk, we will delete the other entry.

To do so, first you have to identify the line number in which the duplicate occurs by issuing:

/sbin/iptables -L --line-number

Take note of the line number.

Then we can now delete it. Say the duplicate occurred on line 2, we then issue the command:

/sbin/iptables -D RH-Firewall-1-INPUT 2

Then save your firewall

/sbin/service iptables save

Now you're box has a secured default firewall rulings.

Hope you find it useful. Thanks, Cheers and God Bless!!!!!

Securing FTP server on Linux

2008-11-07T01:33:00.001-08:00

Securing Linux FTP Server

On my previous blog I've shown on how to set up a FTP server. But the default settings that are in a default installation are

not that tight or secured yet. To mention few, one of the risk is that the default settings allow anonymous logins. Another

is that the user can navigate anywhere on the server.

On this blog I'll show you on how to make your FTP server more secured.

a.) Disallow anonymous logins

1. First is to disallow anonymous logins. To do this, open the vsftpd.conf using any text editor.

vi /etc/vsftpd/vsftpd.conf

2. Change

anonymous_enable=YES

TO
anonymous_enable=NO

3. Then restart vsftpd

if sudoer

/sbin/service vsftpd restart

if root

service vsftpd restart

b.) Never allow your ftp users to navigate on other folders except the one he owns

1. Comment this line on vsftpd.conf

from:
chroot_list_file=/etc/vsftpd.chroot_list
to:
#chroot_list_file=/etc/vsftpd.chroot_list

2. Set the following settings:

chroot_local_user=YES
chroot_list_enable=NO

3. Then finally restart the vsftpd for the changes to take effect

Here is a link of other settings you can play with:

http://vsftpd.beasts.org/vsftpd_conf.html

Hope you find this helpful. Cheers!!!! and God Bless!!!!!

INSTALLATION and SET UP of FTP Server on Linux

2008-11-07T00:51:00.001-08:00

On this blog I'll be showing you the steps on how to set up FTP Server in Linux specifically for CentOS/RedHat distro.

For this tutorial I'll be using VSFTP for our FTP server although you can choose to install other FTP server like ProFTP and

others.

What is VSFTPD by the way. VSFTPD is a very secure and fast FTP server for Linux. This is the reason why I chose it to be the

one to discuss in here. So let's get started.

1. First download the VSFTPD package and install it. In my case I just did it via yum

yum install vsftpd

2. Now once the vsftpd has been successfully installed, we can now start the vsftpd service. No worries the default

configuration settings of vsftpd are good to make the FTP server up and running. (But we'll do few more tweaks later on)

3. To start vsftpd issue

if sudoer

/sbin/service vsftpd start

if root

service vsftpd start

4. But don't forget to allow the necessary ports for FTP service. The following are the ports needed to be openned for FTP

Port no. Details
21 ftp port
20 ftp-data port (use for active mode FTP connection)
50000 - 50004 ftp-data (for passive mode) Note: it can be any port higher than 1024

5. Now we're going to add an FTP user

First add new group where FTP members will be in

groupadd ftp-users

6. Make directory from where FTP users will upload download anything

mkdir /home/ftp-docs

7. If the directory has been created or if a directory is already existing just set the permission and owner privileges

chmod /home/ftp-docs
chown root:ftp-users /home/ftp-docs

8. Then we'll add the ftp user

useradd -g ftp-users -d /home/ftp-docs user1
passwd user1

9. Now we can login to the FTP server via the user1 credentials we made. (You may use any FTP software client such like

Filezilla, WinSCP, ProFTP and others)

CHeers!!! And God Bless!!!!

PHP: Always have Return on function

2008-10-28T22:25:00.000-07:00

I had once experienced and almost freaked out locating a bug on my script, just to find out that it was just a no returning value or return on my function. The lesson I've learned here is to always use return inside functions even if it does not have to return something. This is a good programming practice to exercise. As much as possible use return();

Let me give some examples where the function will immediately return to the line from which it was called. Here are they:

(1) Use echo
function helloworld()
{
// scripts....
echo "hello World";
}

(2) Return boolean value (just if necessary)
function helloworld()
{
// scripts......

return true;
// or false
}

(3) if function will not return anything then just use return
function helloworld()
{
// scripts....
return;
}

Hope it helps everyone. Thanks and God Bless us all!!!!!

Installation of Bind and WMBind on Linux (A Draft)

2008-10-15T02:44:00.000-07:00

INstallation of Bind (DNS Server) and WMBind

1.) Install first Bind
# yum install bind

2.) On CentOS 4.x there are default named.conf installed but not on CentOS 5.x

so for CentOS 5 either
a.) Copy the sample config from CentOS 4
b.) Copy the samples at /usr/share/bind/.... or locate name.conf.sample or sample folder

Firewall concern

Allow the ffg: ports

953 both udp and tcp
53 both udp and tcp

3.) Once the bind is installed, download and install Wmbind package
4.) make sure to read and follow what's on README on this package (espescially about the apache user)
a.) adding apache on group named
gpasswd -a apache named

5.) Enable mod rewrite on Apache by setting the following:

;From
AllowOverride None
;To
AllowOverride All

then restart apache

6.) Now see to it that named.conf and rndc.conf do have similar rndc-key values like as follows:

rndc.conf

key "rndc-key" {
algorithm hmac-md5;
secret "j2gS+6XTSeycPM8A+Fe5Tg==";
};

options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};

named.conf

key rndc-key {
algorithm hmac-md5;
secret "j2gS+6XTSeycPM8A+Fe5Tg==";
};

controls {
inet 127.0.0.1 allow { localhost; } keys { rndc-key; };
inet 192.168.2.3 port 953 allow { 192.168.2.0; } keys { rndc-key; };
};

Restart named by
/sbin/service named restart

also make sure that the rndc.conf and rndckeys are readable by group named where apache is a member.

Mailap na Panahon ng Pag-ibig

2008-07-02T18:08:00.001-07:00

marahil di pa panahon ng tagsibol
maaaring di pa ito ang tinakdang oras
maaring iba ang binubulong ng hangin
at wari'y may ibang laan para sa akin

panahon na siguro para kita'y limutin
ito na siguro ang tamang araw, ang tamang hudyat
upang ang puso ko'y tuluyan ko nang talikuran

ngunit sadya yatang mapagbiro ang tadhana
na tila di kayang manindigan ng aking dibdib
patuloy na sumisigaw ang damdamin
di ko mapigilan, di ko maipinid

mahirap man na tanggapin
ngunit sadyang ganito ang tinakda ng tadhana
upang ako'y magpatuloy sa lakad ng buhay
patuloy na maglakbay
at baka sakaling may makikitang liwanag

humayo ka aking mahal
humayo ka sa landas ng yong kaligayahan
tupdin mo ang sinisigaw ng yong puso
pakinggan mo ang binubulong ng yong dibdib

masaya ako na makita kitang masaya
lumilipad ng mataas at matayog
lumipad ka lng aking irog... lumipad ka...
patuloy kitang pagmamasdan sa kalangitan

kahit malayo ka na't halos di na makita
kahit malayo na at matakpan ng mga ulap
aasa at aasa akong masisilayan kang muli
kahit isang hibla ng pakpak ang saki'y bumalik

wag mo sana akong lilimutin
kahit man lng sana sa akin panaginip ay ako'y bisitahin
dalangin kong ikaw ay maging maligaya
maging maayos ka sayong patutunguhan

at kung sakali man na ika'y mahapo
kung sa pagkakataon ika'y maubusan ng lakas
at hindi mo na halos maikampay ang yong pakpak
bumalik ka lng at ako sa yo'y naghihintay..

Ang Maling Pagsinta

2008-07-01T01:11:00.001-07:00

alam ko naman na may mahal ka ng iba
pero ewan ko ba, bakit pilit pa rin
ikaw ang hanap ng puso
kahit ilang beses yatang sabihan ko ang aking sarili
na tama na eh lalo naman nahuhulog ang loob ko sayo
pinipiplit ko na limutin ka at ibaon na lng sa limot ang lahat
pero sadya yatang tinarak ni kupido ang puso ko at di na makaiwas pa
lubha yata akong tinamaan sayo
ewan ko ba, matagal ko na rin di naranasan ang umibig
kahit alam kong iba na ang laman ng isip mo
ikaw pa rin ang sinisigaw at tinitibok ng aking puso
di ko hinahangad na suklian mo ang pag-ibig na alay ko
makita lng kita bawat araw na ika'y masaya
malaking kiliti na ang nagagawa nito sa puso ko
makita ko lng ang kislap ng yong mata
ang ganda ng yong ngiti
labis na ang kagalakan hatid sakin
mhal na nga yata kita
pero ako yatat mahina ang loob n sabihin ito sayo
pero bakit ko pa nga ba sasabihin kung ang atensyon at pandinig moy
nasa piling na ng iba
para yatang sumisigaw lng ang damdamin ko sa ilang
umaasa na may tutugon may makaririnig
di man tayo laan sa isat isa
malaking bahagi na ng buhay ko ay binigyan mo ng kulay
mahal na nga yata kita
di ka man mapasa akin
kahit man lng sana sa panaginip ay maging tayo
sapat na sakin ang malamang ikaw kasama ko
sapat na ikay namamasdan ko
mapuno man ako ng luha sa tuwing kasama mo sya
puso koy di magbabago
patuloy akong magmamahal sa yo

"aking anghel
ang maganda kong anghel
ang nagliliwanag kong anghel
ang walang katulad na si ____
mahal ko ang anghel na ito
kung pwede lng babaliin ko na ang pakpak ng aking anghel para lagi lng syang nsa tabi ko
pero magiging makasarili naman ako
.......lumipad ka aking anghel....
lumipad ka ng mataas at malayo.......
at su tuwing kailangan mo lng magpahinga...
bumalik ka lng,... bumalik ka lng sakin
dahil mahal kita .... mahal kita..."

So In Love

2008-07-01T00:36:00.000-07:00

Spring, summer, fall & winter dreams.
Those are shinning like a star
They keep whispering,
"I'm so in love with you"

Spring, summer, fall & winter love
It is breezing to my heart and it keeps telling,
"I'll make you rainbow smile"

I remember when we were angels,
when we dreamed about us
All my days were happy
just like a snowy Christmas
I wish i'd have them always.

Every step I make writes a story
It is full of the heart
feeling love of my life and
missing friends of my time
I wish i'd have them all. ?

In Spring, summer, fall & winter days.
We've been sharing all the hearts
Love shines in my eyes
Love just won't fade away

If you'd all the way show me the world
Where I will stay in love
All my days will be white
Just like a snowy Christmas
You're just all I need.

Wanderer's Love

2008-06-23T19:17:00.000-07:00

It has been long while that my heart beats not
It has been so long that my love wanders
I've been searching for you everywhere
Till I find myself staring at you

I never noticed you before
But every now and then
In everyday I see you face to face
You seems to get prettier each day

Let me tell you how beautiful you are
Let me express how truly I love you
I love to see every details that you do
The way you talk, the way you smile
It's making me crazy as I get near you

Couldn't explain how I feel when I see you
How I wish you could be the right one
That my heart has been praying for
But I am too reluctant to tell you
How much I always dream of you

Route Calls from Openser to Asterisk

2008-06-06T20:32:00.000-07:00

Last time we talked about on how to install and set up the OpenSER and to make it work. Now we're going to discuss on how are we going to integrate OpenSER with the Powerful Asterisk PBX. By the way, why do we need to integrate it anyway? OpenSER is just use as a SIP Proxy, SIP Server and can only communicate using SIP protocol and has no way to access such as PSTN lines. Another thing to mention is that it doesn't have that rich features just like what a PBX could offer. This is the point where Asterisk comes into the scene.

Now let's prepare things first for the Asterisk.

1. Create the SIP trunk where the OpenSER will connect to the Asterisk Server. We can do this in 2 ways.
Either we register the Asterisk server as a SIP UA to OpenSER or we will statically declare a SIP trunk to the Asterisk Server. So we will choose the latter.

Edit sip.conf using your favorite text editor (for me it's vi)

# vi /etc/asterisk/sip.conf

[openser]
type=friend
context=incoming
host=192.168.2.235 ; replace this with the IP address of your SIP server (OpenSER)
fromdomain=192.168.2.235 ; same thing here
insecure=port,invite

# vi /etc/asterisk/extensions.conf

[incoming]

exten => 205,1,Dial(SIP/205,60) ; note that the UA 205 is registered on the Asterisk server not on the OpenSER
exten => 205,n,Hangup

Offcourse you have to reload asterisk so the changes would take effect then

2. Alright now it's time to tweak our OpenSER.

# vi /usr/local/etc/openser/openser.cfg

;note that we're using the default configuration of openser ( we'll discuss on our future tutorial on how to make use of the sipwise wizard )

;look for this line

if (is_method("INVITE")) {
setflag(1); # do accouting

}

;make it like this one

if (is_method("INVITE")) {
setflag(1); # do accouting

if (uri=~"sip:205@192.168.2.235")
{
route(2);
}

}

Hey what does this stuff mean??

Let me explain everytime a SIP UA initiate a call it sends an INVITE message sending also the uri being requested in our case it is "sip:205@192.168.2.235". Again change the IP here with the IP of your SIP server. Here I've used static value '205' but you can actually make use of pattern matching here say for instance all numbers beginning with 1 followed by 1 or 2 we can represent this by "sip:1[1-2]@192.168.235"

What's the next stuff?

route(2) ====> this one refer to a routing block which contains lines of rules

so we have to add at the end of the file the following to define our route(2). Here's how?

route[2] {

rewritehostport("192.168.2.2:5060"); # change the IP here with the IP of your Asterisk Server
t_relay();
exit;
}

3. Offcourse you have to reload or restart OpenSER

4. Now you're done and let us test the things that we have done.

register a SIP UA to Asterisk Server with username 205
register a SIP UA to OpenSER with username of what you like (Please refer to my previous tutorial on how to add new UA subscriber)

Using your phone registered to OpenSER dial 205.....

It should now ring the local extension registered on your Asterisk Server. :-)

5. Same principle I guess to use if you want to route your PSTN calls from OpenSER to your Asterisk PBX which is capable to access PSTN network.

Okey that's all for this tutorial. I just hope that you find it useful.

CHeers!!!!!! Take Care and God Bless!!!!

Getting Started with OpenSER: INSTALLATION OF OpenSER on Linux ( CentOS )

2008-06-03T21:56:00.000-07:00

INSTALLATION OF OpenSER on Linux ( CentOS )

1. First install the following dependencies that will be needed to compile OpenSER sources:

- bison
- flex
- mysql
- mysql-devel
- subversion (if you intend to use subversion to get its sources

*you can install the said sources via tarballs or rpms or via yum which I did :-)

2. Now get the source OpenSER package ( I get the latest one which is 1.3.x)

svn co http://openser.svn.sourceforge.net/svnroot/openser/branches/1.3 sip-server

or via

wget http://www.openser.org/pub/openser/latest/src/openser-1.3.2-tls_src.tar.gz

3. Unzip and extract the files

tar xvzf openser-1.3.2-tls_src.tar.gz

4. cd to the source directory

cd openser-1.3.2-tls

5. Do following for compilation and installation

make clean
make all include_modules="mysql"
make prefix=/usr/local install include_modules="mysql"

6. Now edit first openserctlrc

vi /usr/local/etc/openser/openserctlrc

uncomment the line that says

DBENGINE=MYSQL

7. Now we can create the database for the OpenSER

/usr/local/sbin/openserdbctl create

*Note that upon execution of this command it will create 2 users for OpenSER

8. Now we wil edit first the openser.cfg to enable MySQL support.

vi /usr/local/etc/opernser.cfg

You will have to uncomment the following lines:

- loadmodule "/usr/lib/openser/modules/mysql.so"

- loadmodule "/usr/lib/openser/modules/auth.so"

- loadmodule "/usr/lib/openser/modules/auth_db.so"

- modparam("usrloc", "db_mode", 2)

- modparam("auth", "calculate_ha1", yes)

- modparam("auth_db", "password_column", "password")

- if (!www_authorize("sip.org", "subscriber")) {
- www_challenge("sip.org", "0");
- break;
- };

Make sure you change the two sip.org instances in the above config, to your
domain, or realm. In my case, I changed this to 192.168.2.235 which was the
IP address of this box.

Also, be sure to comment out the following line:

modparam("usrloc", "db_mode", 0)

9. Now let us copy the init script so as to start OpenSER as service ( such as starting it at boot). Copy the openser.init which can be found on the base directory of the OpenSER source. In my case I installed the source on root directory

cp /root/openser-1.3.2-tls/packaging/rpm/openser.init /etc/init.d/openser
chmod 755 /etc/init.d/openser
/sbin/chkconfig --add openser

also before you start the openser correct the path of its service execution

vi /etc/init.d/openser

change the following line

oser=/usr/sbin/openser

with this one since we installed the binaries on path /usr/local

oser=/usr/local/sbin/openser

10. Now you can start the openser service

/sbin/service openser start

11. To test we will create user / SIP account to test our set up. We can do this by using the openserctl tool

openserctl add test testpasswd test@192.168.2.235

*Note you might encounter problem once you issued the command above and complaining for the SIP_DOMAiN. To fix that,
issue the command as follows:

export SIP_DOMAIN=192.168.2.235

Now re issue the command for adding new user / SIP account

12. Test it by registering a softphone and filling up the phone's registration info's. You should be able to register already.

"Now you have a working SIP Server". Actually I am still exploring it too..... I'll give you some more additional infos whatever turns out during my studied on this software. I am more familiar with tweaking Asterisk not this one. But I heard that using Asterisk/OpenSER tandem is great for offering VOIP services.

Okey that' all for this tutorial hope this help for those who are just about to start with SER/OpenSER. Cheers to all!!!! And God Bless!!!!! :-)

Here are some more helpful links:

http://www.openser.org/dokuwiki/doku.php/install:openser-from-svn
http://www.openser.org/mos/view/-OpenSER-Installation-Notes/
http://www.oldskoolphreak.com/tfiles/voip/beginners_openser.txt

Anime Nostalgia

2008-04-11T23:59:00.000-07:00

It's nice to remember, reminiscing our childhood days. Specially those cartoons that we used to catch and to watch every episodes.
I still remember then when I was in elementary I used to come early so that not even a single episode could be missed.

Well there were many cartoon series that I could still remember and sometimes they linger on my memories.

Some of these cartoons are cedie (ang munting prinsipe), The Dog of Landers (sad ending huhuhuhuh), Blink ( the blue pony who tried to help a young boy to have his father back sad ending too), Julio at Julia (ang kambal ng tadhana) and their quest to go to mainland to save their parents, thunderjet - somehow my favorite ( just have a centimental value on me don't dare to know what it is), Cinderella (a nice love story cartoon series), Remi, Peter Pan, I forgot the title about Artemian and the three musketeers, Sarah (ang munting prinsesa) and too many to mention or maybe these were just some that still stayed on my contention hehehhe (memory gap??!!!).

"Tahakin ang landas ng kalawakan
Iwagayway ang bandila ng makata
Pagdating ng araw ng digmaan
Tungo sa dulo ng kalawakan
Dugo't mga kamatayan para sa'ting kalayaan
Bangon sa pagkakagupili
Hanggang sa ating kalayaan"

"Ako si Blink
sa lahat ng oras nariyan
....." I forgot it hrrrrr

"Si Julio at Julia Kambal ng tadhana
Di susuko sa pagsubok"

"Maglalakbay ako patungo sa kawalan
upang makamtan ko pangarap sa buhay
susuungin ko itong kadiliman
makita ko lamang ang liwanag ng katarungan
chen chen chen......"

"Humayo ka kaibigang Tom Sawyer
maglakbay kung saan mo man naisin"

"Ngunit hanggang kailan hanggang kailan
ito mananatiling panaginip
isang monghang walang pangalan
sabik na akong ikaw ay makilala ko"

"Aking ina mahal kong ina
pagmamahal mo aking ina
yakap mo sa akin hinahanap ko
init ng pag-ibig kumot ng bunso
sa gitna ng pagkakahimbing yakap mo ang gigising..."

Haaayyyy :-( this is just an indication that I am getting old already. Anyways nice to reminisce isn't it???

Ang bunga ng walang magawa

2008-04-10T02:25:00.001-07:00

wla na naman akong magawa
basa ng basa ng email na ilang beses ng binasa
nag iisip ng magagawa
pam patid ng inip sa walang magawa
ayun nag search about dun sa bida ng hana kimi ng Japan
maganda pala at cute sya pero bata pa
nag search na naman at nag type ng "nice thing to do when bored"
heheheh nakakatawa ung mga nakapost
me top ten pa silang nilagay
puro naman kalokohan hahahha
ganito talaga meron talaga akong dapat gagawin
pero parang ayaw ko pang gawin
katatapos lng kasi nung isang project
pero ang alam ko me pinapagwa pa tong boss ko
ung UI daw na para ma iset ung date ng mga holiday nila
gagawin ko sana kaya lng ayoko naman galawin ung nagawa ko na
stable na un at gumagana
gusto ko muna sanang gawin to dito sa test server
ung test server naman patay di naka on
tinanggal pa dun sa puwesto nya
wla tuloy akong mpaggawaan at mapagtestingan
bago ko iapply dun sa pixelgate nang sa ganoon
e tested na dito bago ko i apply dun
so far kasi gumagana na at stable
delikado naman na dun ako maggagalaw ng mga scripts ko
baka me madamay pa ayos na nga ung sa taas eh
dagdag na feature na lng na request ni Sir J
pero sabi ko nga e sa test server muna
so far oks na oks ung Pixelgate sa ngayon
pag siguro na ayos na ni Sir Eric ung test server
at gumagana na ulit pwede na ako balik sa mga tasks
nandun kasi lahat ung dapat kong mga gagawin
ung Pixelgate server new features saka Video IVR
pero so far stable at secured naman lahat
kaya petiks muna tayo at mag relax
mga 2 araw pa lng naman na nabakante ako sa mga task
pero bugbog naman ako ng mga tasks for the past months
ngayon ko lng yata naransan na maging idle ulit
hehhee kaya basa basa muna
malay natin baka marami pa tayong mapulot sa pagbabasa
hay eto na naman search ng mga tips for boredom
heheheh pero oks din kasi nagawa ko naman ung mga trabaho ko
so I guess just to restore my strength that was used up on previous tasks
gusto ko sana na mag browse ng mga pics
pero I can be seen from my Boss's desk hehehe di pwede
gusto ko rin sanang makinig ng music o mga prieching
pero wala naman akong headset :-(
hehehhehe :-) basta ok naman sa alright so far
till next tasks ulit hehehheheheh

I'm Yours

2008-04-09T23:27:00.000-07:00

Who am I?That the Lord of all the earth,Would care to know my name,Would care to feel my hurt.?
Who am I?
That the bright and morning star,
Would choose to light the way,
For my ever wandering heart.

Bridge:
Not because of who I am,
But because of what you've done.
Not because of what I've done,
But because of who you are.

Chorus:
I am a flower quickly fading,
Here today and gone tomorrow,
A wave tossed in the ocean,
A vapor in the wind.
Still you hear me when I'm calling,
Lord, you catch me when I'm falling,
And you've told me who I am.
I am yours.
I am yours.

Who am I?
That the eyes that see my sin
Would look on me with love
And watch me rise again.
Who am I?
That the voice that calmed the sea,
Would call out through the rain,
And calm the storm in me.

Bridge&Chorus 2x

I am yours.

Whom shall I fear?
Whom shall I fear?
'Cause I am yours.
I am yours.

Chain Letters

2008-04-09T23:19:00.000-07:00

How foolish are those who believe on chain letters
Believing on this is as if believing on devil's lies
Sometimes they make use of Holy Images just to make people believe
No one can predetermine our fate nor our future except God
And who so ever is the source of this foolishness shall perish
For he/she fools every single person for believing on this kind of insanity

My friends do not bear on these false beliefs
Nor be persuaded by their mischievousness
Break the chain of those messages
Life and death can not be dictated by just a letter made by man's hand
Focus on your faith, do not be disturbed by the mess of other's letter
The curse that they are telling on will all fall back on them
the Lord sees all hidden and bad desire of humans
Put all your trust in Him cause He cares for you

Paghihintay ...

2008-04-09T22:58:00.000-07:00

hindi ko alam kung kailan ka darating
pero pilit pa rin akong maghihintay
di ko alam kung saan at kailan
pero umaasa pa rin ako na balang araw
makakadaupang palad din tayo
maraming taon na ang lumilipas
at dumarating na ako sa edad
pero di pa rin nawawalan ng pag asa
alam kong naririnig mo ang aking tinig
kahit di ko alam kung sino ka
kahit di ko alam kung kailan at saan
maghihintay ako...maghihintay ako
kahit abutin na akong ng paglubog ng araw
datnan man ako ng katandaan
aasa at aasa akong darating ka
laging laman ng aking panaginip ang yong mukha
sigaw ng aking puso'y ikaw ang hanap
kahit na madalas akong naglalakbay sa ilang
Pag-asang makita ay nagbibigay lakas
2 taon na lng.... 2 taon na lng....
bago maupos ang aking buhay
na tila kandilang malapit ng mawalan ng liwanag
matagal na panahon na
pero wla ka pa rin
Ayokong bumitiw sa natitirang pag-asa na meron ako
Hahanapin kita kahit saan ka pa magmula
Di ako titigil di ako susuko
Puso ko'y di mahihimlay hanggat di ito mamahinga sa piling mo
Hanggat nabubuhay pa ako hanggat sumisikat pa ang bawat umaga
Wlang hanggan ako'y maghihintay