How to properly "halt" virtual machine in LXC

While running a number of virtual machines in LXC you might need gracefully shutdown each virtual machine while host reboot. Here is a script (file /usr/local/sbin/lxc-shutdown):

#!/bin/sh

name=$1
timeout=15

if lxc-info -n $name | grep -qs "STOPPED"
then
    echo $name not running...
    exit 0
fi                                           
                                                                               
ssh $name halt &                                                               
#if [ -e /usr/bin/lxc-halt ]; then                                             
#    /usr/bin/lxc-halt -n $name                                                
#else                                                                          
#    ssh $name halt &                                                          
#fi

while [ $timeout -gt 0 ]
do
    timeout=$(($timeout-1));sleep 1
    if lxc-info -n $name | grep -qs "STOPPED"
    then
        exit 0
    fi
done

lxc-stop -n $name
lxc-wait -n $name -s 'STOPPED'

This approach requires root to have password-less ssh login (see more here). So now that you have a script that let you halt gracefully virtual machine, let make few changes to /etc/init.d/lxc (somewhere around line 56):

# ...
    stop)
    log_daemon_msg "Stopping $DESC"
    #action_all "lxc-stop -n"
    # Uncomment below if you need to halt containers 
    # in reverse order
    CONTAINERS=`echo $CONTAINERS | tac -s ' '`
    action_all "lxc-halt"
    ;;
# ...

Use the following two commands to override lxc-shutdown for lxc v0.8+

                                           
update-alternatives --install /usr/bin/lxc-shutdown \                        
   lxc-shutdown /usr/local/sbin/lxc-shutdown 1                                
update-alternatives --set lxc-shutdown \                                     
   /usr/local/sbin/lxc-shutdown

Exim4 SSL/TLS Configuration

Here we are going configure exim4 to use SSL/TLS for incoming connections:

1. First of all let create an exim4 certificate request (see here how to create a certificate authority):

   openssl req -newkey rsa:2048 -keyout exim.key -out exim.csr -days 3650 -nodes
   

2. Now let sign it with our certificate authority:

   openssl ca -out exim.crt -infiles exim.csr
   

3. Here we get two important files: exim.key (that is private key) and exim.crt (x509 certificate file). Let copy them to /etc/exim4
4. Secure certificates:

   chown root:Debian-exim exim.key exim.crt
   chmod g=r,o= exim.key exim.crt
   

5. Enable exim4 daemon listening options for ports 25 and 465 (file /etc/default/exim4):

   SMTPLISTENEROPTIONS='-oX 465:25 -oP /var/run/exim4/exim.pid'
   

6. Turn on SSL/TLS option (new file /etc/exim4/conf.d/main/00_exim4-localmacros):

   MAIN_TLS_ENABLE = true
   

7. Restart exim4 and have a look at log file when you send a test message.

   /etc/init.d/exim4 restart
   echo test | mail -s "ssl/tls test" root@dev.local
   

   Here is what you will see in log file (/var/log/exim4/mainlog):

   ... P=esmtps X=TLS1.0:RSA_AES_256_CBC_SHA1:32 ...
   

   If for some reason you can not see esmtps message in log file it most likely it doesn't use SSL/TLS for local delivery, try from remote machine.

Alternative Certificate Location

You can specify any location for ssl/tls certificate (file /etc/exim4/conf.d/main/00_exim4-localmacros):

MAIN_TLS_CERTIFICATE=/etc/ssl/certs/mail.dev.local-cert.pem
MAIN_TLS_PRIVATEKEY=/etc/ssl/private/mail.dev.local-key.pem

This is useful when you host both SMTP and IMAP services on the same host. Note, group Debian-exim must have read access to both files.

How to generate consistent "random" numbers

Here is an article that explain a way to get consistent "random" number. The problem appears in virtual environments, like lxc, where hostid is the same. The sample below solves this problem by generating "random" number from a network adapter (eth0) MAC address. So here it is (file func/random_sleep)

#!/bin/bash

# 
# random_sleep shift_max rnd_max
#
# shift_max - a number to generate consistent "random"
# number.
# rnd_max - a random number to add
random_sleep()
{
    shift_max=600
    if [ ! -z $1 ]; then shift_max=$1; fi

    rnd_max=60
    if [ ! -z $2 ]; then rnd_max=$2; fi

    # shift is a number betweem 0 and 600
    shift=`/sbin/ifconfig eth0 | /bin/grep HWaddr | \
        /bin/sed -e 's/.*HWaddr //' | /usr/bin/tr -d ':'`
    shift=$((0x$shift%$shift_max))

    # Sleep a random amount of time + shift
    sleep_time=$(($RANDOM % $rnd_max + $shift))

    echo "Sleeping for $sleep_time seconds..."
    /bin/sleep $sleep_time
}

Here is how you can use it:

#!/bin/bash
. /usr/local/sbin/func/random_sleep
# or
# . `dirname $_`/func/random_sleep

random_sleep 300 60

Apache Kerberos Authentication over SSL for SVN

Suppose you already have a web site working over SSL (see here) and you would like add security on top of that, namely use Kerberos for authentication. I assume you saw the following:

• Serving Multiple SVN Repositories with Apache (see here)

How to add CA certificate to Common CA certificates

Debian package ca-certificates installs a number of common CA certificates, well known. Your certificate authority is not there, so you will get a warning messages every time it used by browser, mail client, IM, etc. Here are few simple steps to install your own CA certificate.

apt-get install ca-certificates

Copy CA certificate and reconfigure ca-certificates package:

cp cacert.pem /usr/share/ca-certificates
dpkg-reconfigure ca-certificates

You will be asked "Trust new certificates from certificate authorities?", choose Ask than from the list of activated certificates mark yours. This will rebuild certificates database with your CA certificate.