Go to “Kibana/app/fleet/agents”
Click the 3 dots on the host and select uninstall agent.
Select the command to uninstall and run it on the host.
Finally hit the three dots and unenroll agent.
How to the Uninstall Elastic Agent on Linux
Reply
Category Archives: Linux
Add warning for emails from external domains in cPanel/WHM
In this post we are going to setup Exim to add “[External]” to the email subject if it originates from outside of the local domain.
Thanks to Sam for this post. It was extremely helpful.
https://tech.saqr.org/2020/01/for-incoming-email-not-from-our-domain.html
Steps
- Create a new Exim Filter
- Enable Filter
Create an Exim Filter
SSH to the server and create a Exim filter. In cPanel there are in /usr/local/cpanel/etc/exim/sysfilter/options/. You can name the filter what ever you want.
vi /usr/local/cpanel/etc/exim/sysfilter/options/external_email_warningChange “incredigeek.com” to your domain name.
You can also change “[External]” to whatever you want to be prepended to the subject.
if
$header_to: contains "@incredigeek.com>"
and $header_from: does not contain "@incredigeek.com>"
and $header_subject: does not contain "[External]"
then
headers add "Old-Subject: $h_subject:"
headers remove "Subject"
headers add "Subject: [External] $h_old-subject"
headers remove "Old-Subject"
endifSave the file.
Enable Custom Exim Filter
Now log into WHM, go to Service Configuration > Exim Configuration Manager > Basic Editor > Filters
At the bottom of the filters, you should see a new “Custom Filter: external_email_filter”
This is the filter you just created. Make sure it is On, and Save changes.
There you go! Any email you receive now that is from an external domain should now have “[External]”, or whatever you specified, prepended to the subject.
If you run into any errors, try reviewing the panic log to see if there are any syntax errors.
Troubleshooting
You can use tail to follow the panic log to verify you have all the syntax correct.
tail /var/log/exim_paniclog -fFix PowerDNS “Old-style settings syntax not enabled”
The PowerDNS Recursor started supporting YAML for configs in version 5.0.0. YAML is the default as of 5.2.0. You can still use the old config if --enable-old-settings is provided as a command line option when starting PowerDNS. If that option is not being used, and you are using the old config, you will experience the following errors.
msg="Old-style settings syntax not enabled by default anymore. Use YAML or enable with --enable-old-settings on the command line" subsystem="config" level="0" prio="Error" tid="0" ts="1732025541.126" configname="/etc/pdns-recursor/recursor.conf"
msg="YAML config found, but error occurred processing it" error="invalid type: string \"allow-from=127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16", expected struct Recursorsettings at line 17 column 1" subsystem="config" level="0" prio="Error" tid="0" ts="1732025541.817" configname="/etc/pdns-recursor/recursor.conf"
Fortunately, this is an easy fix.
- Convert old config to YAML with
rec_control. - Save as new YAML config.
- Remove old config.
- Start pdns-recursor.
Convert Config to YAML
The rec_control command can convert our old style config to a YAML config. This should automatically pull the default config in /etc/pdns-recursor/recursor.conf.
rec_control show-yamlSave output to /etc/pdns-recursor/recursor.yml
Remove the Old Style Config
We can remove the old config by renaming it, or deleting it.
mv /etc/pdns-recursor/recursor.conf /etc/pdns-recursor/recursor.conf.oldstyleOr
rm /etc/pdns-recursor/recursor.confStart the PowerDNS Recursor
Start the pdns-recursor service using the systemctl command.
sudo systemctl start pdns-recursorVerify there are no errors
sudo systemctl status pdns-recursorFurther Reading.
How to Migrate Email without IMAP credentials
Here are a few ways you can migrate emails without knowing the IMAP credentials.
- Use the Admin Password.
- Migrate emails using SFTP.
- Import/Export using RoundCube?
Use the Admin Password
Some email services allow you to use the administrator password to sign into any email account. This allows you to move emails without knowing the users password.
You can refer to this FAQ on the imapsync website.
https://imapsync.lamiral.info/FAQ.d/FAQ.Admin_Authentication.txt
Migrating Files using SFTP
Disclaimer:
This option will only work if you have ftp/ssh/filesystem access.
Depending on email volume, you could miss emails that arrive during the transition.
If possible, it is recommended to use something like imapsync.
There could be format issues if the two email servers use different mailbox formats and/or email server software.
Emails are usually stored in the users home directory. Depending on the hosting provider, it could be /mail or ~/mail
You can zip up the mail directory and then unzip on the target server. This would only work if you have access to the filesystem. Create your email accounts before unzipping.
You could transfer the passwd and shadow files to keep the email passwords the same. Again, create the email addresses on the target server first and then either overwrite, or merge the differences between the shadow and passwd files.
For example, on cPanel servers, the mail directory is in ~/mail and the shadow and passwd files are in ~/etc/DOMAIN.COM
If you are logged in as root, you will need to change ~/ to /home/USER/ substituting USER for the actual cPanel user.
Import/Export messages from RoundCube?
You can import and export emails using the RoundCube webmail interface. However, the export is limited to one. message. at. a. time. This could work for a handful of messages, but can get quite tedious if you have a large number of emails.
How to Set up a PowerDNS Recursor
The following are the steps needed to install a PowerDNS recursor on RHEL, Fedora, Rocky Linux, or AlmaLinux
Install from package manager with
yum install pdns-recursor
Allow DNS through Firewall
sudo firewall-cmd --add-service=dns --permanent
Configure the `/etc/pdns-recursor/recursor.conf` file. The local-address is the DNS recursor, the allow-from, are the addresses you would like to allow access to
local-address=192.0.1.2
allow-from=192.0.0.0/16, 10.0.0.0/8
Start and enable the `pdns-recursor` service
systemctl enable --now pdns-recursor
Ansible not working on RockyLinux 8, AlmaLinux 8, RHEL 8
[WARNING]: Unhandled error in Python interpreter discovery for host localhost: Expecting value: line 1
column 1 (char 0)
https://github.com/ansible/ansible/issues/83357
Ansible 2.17 moved to using Python 3.7. This causes issues with systems that use Python 3.6 (i.e., RHEL 8 based distros). Unfortunately, you can’t just upgrade Python either, as 3.6 is used in system tools such as DNF/YUM.
There are two options.
- Upgrade to a RHEL 9 based distribution
- Use Ansible 2.16
Ansible 2.16 should be the default installed version on RHEL 8 based distros.
Migrate CentOS 7 to AlmaLinux 8
The steps are taken from this page https://wiki.almalinux.org/elevate/ELevating-CentOS7-to-AlmaLinux-9.html
To upgrade to AlmaLinux 9, you will need to migrate to AlmaLinux 8 first.
sudo curl -o /etc/yum.repos.d/CentOS-Base.repo https://el7.repo.almalinux.org/centos/CentOS-Base.repo
sudo yum upgrade -y
Once yum finishes, reboot
sudo reboot
Now install elevate-release and leapp packages
sudo yum install -y http://repo.almalinux.org/elevate/elevate-release-latest-el$(rpm --eval %rhel).noarch.rpm
sudo yum install -y leapp-upgrade leapp-data-almalinux
Let’s run a pre upgrade check to see if there are any errors.
sudo leapp preupgrade
If everything checked out ok, proceed with the upgrade.
sudo leapp upgrade
Once finished, reboot.
sudo reboot
Once the system is booted, verify it upgraded.
cat /etc/*release
Problems
https://wiki.almalinux.org/elevate/ELevate-frequent-issues
LUKS
If you are using LUKS and encounter an error, check out the following link.
https://www.it-hure.de/2024/02/update-alma-rhel-with-leapp-and-luks/
You can disable the check with the following command.
rm -rf /usr/share/leapp-repository/repositories/system_upgrade/common/actors/inhibitwhenluks
More space needed on / filesystem
Try setting LEAPP_OVL_SIZE to 4096
export LEAPP_OVL_SIZE=4096Then launch the upgrade with
sudo --preserve-env leapp upgradeYou can also try removing files to create more free space.
https://github.com/oamg/leapp/issues/778
Upgrading to 8.8 (Or 8.4)
For the same reason, we recommend upgrading your CentOS 7 machine to AlmaLinux OS version 8.8. To do so, you need to navigate to the /etc/leapp/files/ directory and edit the leapp_upgrade_repositories.repo to lower the AlmaLinux version in
baseurl/mirrorto 8.8.
The 8.8 repositories are archived. To upgrade to AlmaLinux 8.8, change ‘/etc/leapp/leapp_upgrade_repositories.repo” to the following.
[almalinux8-BaseOS]
name=AlmaLinux 8 - BaseOS
baseurl=https://vault.almalinux.org/8.8/BaseOS/$basearch/os/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
[almalinux8-AppStream]
name=AlmaLinux 8 - AppStream
baseurl=https://vault.almalinux.org/8.8/AppStream/$basearch/os/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
[almalinux8-PowerTools]
name=AlmaLinux 8 - PowerTools
baseurl=https://vault.almalinux.org/8.8/PowerTools/$basearch/os/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
[almalinux8-HighAvailability]
name=AlmaLinux 8 - HighAvailability
baseurl=https://vault.almalinux.org/8.8/HighAvailability/$basearch/os/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
[almalinux8-ResilientStorage]
name=AlmaLinux 8 - ResilientStorage
baseurl=https://vault.almalinux.org/8.8/ResilientStorage/$basearch/os/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
[almalinux8-Extras]
name=AlmaLinux 8 - Extras
baseurl=https://vault.almalinux.org/8.8/extras/$basearch/os/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux
If you have issues, you may consider upgrading to 8.4 first. To do that, change 8.8 to 8.4, and comment out the ResilientStorage section.
GPG Key failing after upgrade
Try importing the AlmaLinux 8 GPG key
rpm --import https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux
https://almalinux.org/blog/2023-12-20-almalinux-8-key-update
Securely Delete Files on Linux
We can use srm to securely delete files on Linux.
Install srm with
sudo apt install secure-delete
We can now securely delete files by running
srm filetodelete.txt
# srm --help
srm v3.1 (c) 1997-2003 by van Hauser / THC <vh@thc.org>
Syntax: srm [-dflrvz] file1 file2 etc.
Options:
-d ignore the two dot special files "." and "..".
-f fast (and insecure mode): no /dev/urandom, no synchronize mode.
-l lessens the security (use twice for total insecure mode).
-r recursive mode, deletes all subdirectories.
-v is verbose mode.
-z last wipe writes zeros instead of random data.
srm does a secure overwrite/rename/delete of the target file(s).
Default is secure mode (38 writes).
You can find updates at http://www.thc.org
Other links for securely erasing drives.
https://www.tomshardware.com/how-to/secure-erase-ssd-or-hard-drive
Top 8 Nmap options
Here are 8 excellent Nmap options, what they do, and why you would use them.
Most of the options can be run together. You will normally want to perform scans with administrator or root privileges.
| Option | What is does | Why you would use | |
| 1. | -sn | No port scan | Helpful for quickly discovering hosts that are up |
| 2. | -iL file.lst | Scan IP addresses in file.lst | Helpful if you already have a list IP addresses to scan |
| 3. | -n | Skip reverse DNS lookup | This can help speed up scanning |
| 4. | -Pn | Pretend host is up | Use when hosts have Ping disabled. e.g. Windows |
| 5. | -O | OS detection | Use to detect OS version |
| 6. | -T4 | Speed up scan | Increases scan speed (Default is -T3) |
| 7. | -A | Aggressive scan options | Shorthand option. Enables OS detection (-O), version Scanning (-sV), script scanning (-sC), and runs a traceroute |
| 8. | -oA filename | Save output to ALL formats | This saves the output to separate files for XML and grepable formats |
Locate large files on Linux
Show size of directories. The -h option prints the size in human readable format.
du -h --max=1 ./
We can use sort and tail to filter and only show the 10 largest files and directories. The -a option shows all files and directories.
du -ah ./ | sort -h | tail -n10
We can use the find command to show all files over xMB. In this case 100MB
fine . -type f -size +100M -print
https://linuxhandbook.com/find-biggest-files-linux
https://linuxize.com/post/find-large-files-in-linux/