Startup problems with php-fpm and ldap user backend on Debian

Startup problems with php-fpm and ldap user backend on Debian

Do you use php-fpm together with an ldap backend for user authentication, then you probably have seen this message in your boot logs:

[26-Sep-2019 14:58:34] ERROR: [pool XXXXXX] cannot get uid for user 'XXXXXXXX'

When using the php5.6-fpm / php7.x-fpm versions of the PHP fpm process can cause startup problems, when the users are provided via the nslcd service.

The reason is, that the ldap user backend is starting after the php fpm process(es)

Fortunately this is easy to solve, just edit your /etc/init.d/php7.3-fpm init script and add the user backend service(s) to the Required-Start section

It looks like this:
# Required-Start:    $remote_fs $network

So to add nslcd (and recommended nscd too) results in this line

# Required-Start:    $remote_fs $network nslcd nscd


To enable the new dependencies of your service starts, just disable the service and reenable it.

systemctl disable php7.3-fpm 
systemctl enable php7.3-fpm

After this, you can reboot your server and the fpm processes should startup just fine
 

Chromium 75.0.3770.xx does submit html forms twice

When you have customers which use chromium on Ubuntu 18.04 LTS, then you might see duplicate form posts in your applications.

This is a very nasty bug introduced somewhere between the 74.0.3729.169 and 75.0.3770.80 releases.
Here a few references to the problem, which seems to be still "work in progress"

• https://stackoverflow.com/questions/56488687/duplicate-requests-after-chrome-update-to-version-75-0-3770-80-official-build
   
• https://bugs.chromium.org/p/chromium/issues/detail?id=977882
   
• https://support.google.com/chrome/thread/8616084?hl=en

 This does not help the customers, since we need a solution now, and not in a few days/weeks.

On ubuntu the simplest is to roll back to the last working version 74.0.3729.169

How to do this:

Login in the console of your system(s) and do this:

cd /tmp
rm chromium-*

wget -q http://launchpadlibrarian.net/424897539/chromium-browser_74.0.3729.169-0ubuntu0.18.04.1_amd64.deb
wget -q http://launchpadlibrarian.net/424897541/chromium-codecs-ffmpeg-extra_74.0.3729.169-0ubuntu0.18.04.1_amd64.deb
wget -q http://launchpadlibrarian.net/424897535/chromium-browser-l10n_74.0.3729.169-0ubuntu0.18.04.1_all.deb


dpkg -i chromium-*.deb
rm chromium-*
 
apt-mark hold chromium-browser
apt-mark hold chromium-browser-l10n
apt-mark hold chromium-codecs-ffmpeg-extra


This installs the 74er version and prevents future upgrades to install bad versions.
Of course once a working 75 or 76 release is available, you have to unhold the packages

Generate one page PDF calendars with entries

Generating a on epage pdf calendar isn't that difficult.
Just draw the month grid and put the entries into the corresponding matrix at the correct places.

But wait, is it that easy?

- What do you do when the number of entries in one grid cell use more space than is available?

To solve this problem in php, I did just write a class which handles this problem.
The PdfCalendarBuilder library hosted on github solves this problem in two ways:

- First it trys to resize the row heights, to distribute the free height across the rows, so everything still fits on one page
- The secon option, if the content is still too large, is to reduce the font size of the entries until everything has place on the same page

Both features can be de/activated independently of each other, but best results are done when both remain activated.

There are still a few things to work out in the library, such as handling entries which span days or things like full-day events which should be rendered differently.

But the basic stuff already works fine, even with event categories and legends.
It also does not matter what paper siez you choose, just modify the font sizes as you need them, the defaults are good for A4 paper.

And to help you integrate it in your own projects, the whoche whole library is licensed under the Apache 2.0 license.
But please send back enhancements, error reports or other ideas to the project page.

Monitor letsencrypt certificates with Zabbix

Monitor letsenrcypt certificates with Zabbix

Letsenrcypt is a great free system to automatically provide ssl/tls certificates for your website(s)
Zabbix is a great free system to monitor your IT infrastructure

One of the main features of Zabbix is the ability to extend it with any kind of monitoring scripts.
So when you do use letsencrypt certificates, you can also monitor them from Zabbix.

There exists a template you can add to the Zabbix server, and the required config and script files you place on the agents.

These can be found here.

It provides these features:
- Autodiscovery of all active letsencrypt certificates
- Monitor the lifetime of the certificates
- Trigger when the certificates are about to expire (Which means your auro renew does not work correctly)
- Monitor the certbot version
- Triggers when certbor version is below 0.28

The certbot version is important, since all certbot versions below 0.28 don't support the ACME-2.0 standard which is required by letsencrypt since the 13-february 2019.

Whith this you can relax about your ssl certificates, you won't have customers calling you in the morning, that their website(s) have an invalid/expired certificate.

You can even enhance the ssl monitoring with more Zabbix templates from here.
These allow you to monitor also ftps/imaps/smtps/pop3s and other TLS/SSL secured connections.

We use these in our own environment, to make sure everything runs smoothly and that we are warned of potential problems before the customers notice them.

Java ffmpeg wrapper jave

Java ffmpeg wrapper

In the last months we did some major enhancements in the jave library which can be used from java to analyze/convert audio and video files with the use of ffmpeg.

The project homepage can be found here https://github.com/a-schild/jave2

The main changes as to the original package are:
- Support for Windwos 32+64 bit
- Support for Linux 32+64 bit
- Support for OS-X 64bit
- Upgraded to ffmpeg 4.x (From 3.x)
- Enhanced output parsing
- Added options for running the encoding/decoding as a separate thread
- Added to maven central for simpler usage
- Many smaller enhancements

The project was initially started by Carlo Pelliccia at http://www.sauronsoftware.it/projects/jave/

You are welcome to contribute to the project with ideas and code.
You can use the github page for this.

Install Zabbix agent on FreeNAS 11.x

There is no official Zabbix Agent binary for FreeNAS, so it has to be compiled from source on another machine. There are several options to do so, I decided to just spin up a FreeBSD Vagrant VM to build the binary.
This post is based on the post from [1] with some enhancements 

For more recent howto see here

Vagrant VM

Setup VM & Build Environment

1. Create Vagrantfile:

   Vagrant.configure("2") do |config|
     config.vm.box = "freebsd/FreeBSD-11.1-STABLE"
     config.vm.base_mac = "000000123456"
   end
   

2. Start VM: vagrant up
3. Enter VM: vagrant ssh
4. Install dependecies:

   sudo pkg install -y curl autoconf automake gettext gcc pcre
   

Compile Zabbix Agent

1. Download source: https://www.zabbix.com/download_sources#tab:40LTS

2. curl -fsSL "https://sourceforge.net/projects/zabbix/files/ZABBIX%20Latest%20Stable/3.4.14/zabbix-3.4.14.tar.gz/download" | tar zxvf -
   cd zabbix-3.4.14

   curl -fsSL "https://sourceforge.net/projects/zabbix/files/ZABBIX%20Latest%20Stable/4.0.3/zabbix-4.0.3.tar.gz/download" | tar zxvf -

   cd zabbix-4.0.9

3. Build with TLS support for encryption:

   ./configure --enable-agent --with-openssl --enable-ipv6
   sudo make install
   

4. Transfer compiled binary to FreeNAS system:

   scp /usr/local/sbin/zabbix_agentd root@$FREENAS_IP:/usr/local/sbin/
   

5. Leave VM: exit
6. Destroy VM (optional): vagrant destroy

FreeNAS

After the zabbix_agentd binary is transferred to the FreeNAS system, it’s time to SSH into it to configure the agent.

Zabbix Agent Configuration

1. Add user:

   pw groupadd zabbix
   pw useradd zabbix -c "Daemon user for Zabbix agent" -d /nonexistent -s /usr/sbin/nologin -w no -g zabbix 

   Create zabbix user and group via WebUI, otherwise they won't suvive a reboot

2. Create /etc/zabbix_agentd.conf:

   Server=$ZABBIX_SERVER_IP
   ServerActive=$ZABBIX_SERVER_IP
   Hostname=$ZABBIX_AGENT_HOSTNAME
   LogFile=/tmp/zabbix_agentd.log
   

Daemon Configuration

1. Enable daemon:

   echo 'zabbix_agentd_enable="YES"' >> /etc/rc.conf
   

2. Create /etc/rc.d/zabbix_agentd:

   #!/bin/sh
   
   # PROVIDE: zabbix_agentd
   # REQUIRE: DAEMON
   # KEYWORD: shutdown
   #
   # Add the following lines to /etc/rc.conf.local or /etc/rc.conf to
   # enable zabbix_agentd:
   #
   # zabbix_agentd_enable (bool): Set to NO by default.  Set it to YES to
   #         enable zabbix_agentd.
   #
   
   . /etc/rc.subr
   
   name="zabbix_agentd"
   rcvar=zabbix_agentd_enable
   start_precmd="zabbix_precmd"
   required_files="/etc/zabbix_agentd.conf"
   
   # read configuration and set defaultsc
   load_rc_config "$name"
   : ${zabbix_agentd_enable="NO"}
   #: ${zabbix_agentd_pre:=/etc/${name}.pre.sh}
   
   zabbix_agentd_conf="/etc/zabbix_agentd.conf"
   
   if [ ! -z "$zabbix_agentd_conf" ] ; then
     zabbix_agentd_flags="${zabbix_agentd_flags} -c ${zabbix_agentd_conf}"
     required_files=${zabbix_agentd_conf}
   fi
   
   zabbix_precmd()
   {
     if [ ! -z "$zabbix_agentd_pre" ] ; then
       if [ -e $zabbix_agentd_pre ] ; then
         . $zabbix_agentd_pre
       fi
     fi
   }
   
   command="/usr/local/sbin/${name}"
   
   run_rc_command "$1"  run_rc_command "$1"
   

3. Make executable:

   chmod +x /etc/rc.d/zabbix_agentd
   

4. Start daemon:

   /etc/rc.d/zabbix_agentd start
   

5. Make config files persistent and survive reboots:

   cp /etc/rc.conf /conf/base/etc/
   cp /etc/rc.d/zabbix_agentd /conf/base/etc/rc.d/
   cp /etc/zabbix_agentd.* /conf/base/etc/

Exit vagrant

in the ssh sesion type: exit

vagrant destroy

 Zabbix configuration

Use the template from the zabbix wiki for the host monitoring

http://zabbix.org/wiki/File:Template_OS_FreeNAS.xml

---

1. https://docs.j7k6.org/freenas-zabbix-agent/
2. https://blag.nullteilerfrei.de/2016/11/26/zabbix-3-0-agent-on-freebsd/
3. https://www.haphazard.io/blog/install-nagios-nrpe-on-freenas/

Updated LDAP server for Innovaphone

Updated LDAP server for Innovaphone devices

Last year we did publish our small ldap server as opensource on git hub.
In the past months we did many enhancements, which added text search capability, more number fields and better support for varios DECT platforms.

If you already use it, we strongly suggest that you upgrade to the new 2.2 release.

If you are providing a hosted environment for your clients, then we have a closed source version of the same software, which can handle tenants for your different clients. Just contact info@aarboard.ch for a quote.