Multiple IP addresses on Debian

Quick post. If you have multiple IP addresses (i.e. a range) assigned to you server, and you want to listen on all of them (i.e. multiple SSL sites), then rather than using the ancient eth0:1 syntax, you can hack /etc/network/interfaces to use iproute2 properly.

Assuming the IP, with the extra range of (yes these extra ranges often ignore class-boundries):

auto eth0
iface eth0 inet static
    # Extra IPs:
    post-up for last in `seq 110 118`; do ip addr add 10.5.4.$last/32 dev $IFACE; done || true
    pre-down for ip in `ip addr show dev $IFACE | sed -n ‘s@.* inet \([0-9.]*/32\) .*@\1@ p’`; do ip addr del $ip dev $IFACE; done || true

Yes, it’s ugly as shit, but I can’t think of a neater way to do it.

Update: Better solution

Automated backups to external disk

I remember somebody asking how to do this on the CLUG lists a while back. But here’s the problem:

You’ve got an automated backup system, but you want offsite backups. DVDs are too small, external hard drives are the only option. You want the user to be able to plug in the firewire disk, have the backup start automatically, and let them know when it’s done.

Here’s how I implemented it:

The backups are implemented with backup-manager, they backup into /mnt/backup-tmp/

The external hard drive connects by firewire. Running udevinfo -a -p /sys/block/sdd on it showed me it’s ID:


I created this UDEV rule file /etc/udev/rules.d/local-backup.rules:

ATTRS{ieee1394_id}=="0090a9787b339de6:1:0", SYMLINK="backupdisk", RUN+="/usr/local/sbin/"

And the relevant fstab entry:

/dev/backupdisk /mnt/backup-disk vfat   sync                    0       0

And the backup script /usr/local/sbin/

#!/bin/sh -e


logger "Backup disk detected"

# Test for expired locks
if [ -e "$LOCKFILE" ]; then
  if ! kill -0 `cat "$LOCKFILE"`; then
    rm "$LOCKFILE"

lockfile -r0 "$LOCKFILE"
echo $$ > "$LOCKFILE"

sleep 5s

logger "Backup to external begun"

mount /mnt/backup-disk
rsync -a /mnt/backup-tmp/ /mnt/backup-disk/
umount /mnt/backup-disk

beep -l 1000 -f 3000 -r 5
echo -e "You can disconnect the disk now.\nThank you.\n\nThe backup System." | mail -s "Backup completed" the-secretary@email.address

logger "Backup to external completed"

BIOS Flashing with memdisk

I’ve just discovered memdisk. It’s part of the syslinux package on Debian/Ubuntu, and hides in /usr/lib/syslinux/memdisk.

Memdisk lets you boot a floppy image, via grub or pxelinux. In this modern era of computers without floppy drives, it means you can do BIOS updates without having to go through the whole procedure of turning a floppy image into a bootable CD.

In PXELINUX, the config file would look like this:

DEFAULT memdisk initrd=FILENAME.img

In Grub, like this:

title     Bios Flash
kernel    /boot/memdisk
initrd    /boot/FILENAME.img

Thanks ThinkWiki for the idea.

Caveat emptor: apparently some flash tools don’t like memdisk, so YMMV

Dovecot shared mailboxes (the correct way)

I’ve just implemented shared mailboxes in dovecot (which rocks, btw). It isn’t difficult, but I don’t think it’s very well documented

The preferred way to do this is with IMAP Namespaces. My natural approach would be to create something like a Maildir tree /srv/mail/shared, and make this the “public” namespace. Then set filesystem permissions on subtrees of that, to define who can see what. Unfortunately, dovecot uses strict Maildir++, and won’t let you create mailboxes inside each other (on the filesystem) /Foo/Bar is stored as a Maildir called .Foo.Bar, so subtrees don’t exist, so this isn’t an option. The up-comming dbox format should allow something like this, but it isn’t usable yet.

My solution was to create multiple namespaces. One for each shared mailbox. Users are given permission to use them via file-system permissions (i.e. group membership), example:

# Default namespace, needed if you add namespaces
namespace private {
    prefix =
    separator = /
    index = yes
# Office inbox, available to receptionists, office managers, and directors:
namespace public {
   prefix = office/
   separator = /
   location = maildir:/srv/mail/office/.Maildir:CONTROL=~/.Maildir/control/office:INDEX=~/.Maildir/index/office
   hidden = no
# Umask for shared folders
umask = 0007

Setting CONTROL and INDEX mean that dovecot’s metadata is stored in the user’s personal Maildir, so users who don’t have permission to see the shared mailbox don’t get errors.

The permissions of the mailbox should be done as follows:

# touch /srv/mail/office/dovecot-shared
# chown -R /srv/mail/office
# find /srv/mail/office -type d -print0 | xargs -0 chmod 2770
# find /srv/mail/office -type f -print0 | xargs -0 chmod 660

If you want a common subscription list, you have to manually symlink:

# ln -s /srv/mail/office/subscriptions ~luser/.Maildir/control/office/

Seems to work well. (at least with thunderbird)

s_client's R "feature"

I’ve just spent a few hours brain-haemorrhaging over why my new Postfix server wasn’t allowing me to enter “RCPT TO:” over a STARTTLS connection. Instead it would renegotiate the TLS.

Eventually I found an e-mail by Wietse Venema saying:

Victor Duchovni:
> On Mon, Jan 22, 2007 at 04:31:12PM -0500, Wietse Venema wrote: 
> > RCPT TO:<postmaster>
> You got bit by the "s_client" "R" feature... try "rcpt to:" lower case,
> then it hangs up.

What utter brain damage, a non-transparent SSL client program.

Read this and be warned — we are all stupid, in the eyes of the truly mad s_client

Syndicate content