Created in the cloud with Saaspose.Words. http://saaspose.com

Configure Postfix Relay with Google Apps  

Recommended Configuration (Google Apps paid accounts)

If you are using a paid version of Google Apps, and you would like to avoid Google rewriting the sender, you must first configure your Google Apps account for IP-based relay by following these instructions to allow relay from your server’s public IP address by any email addresses.

After Google Apps has been configured to allow relay from your server’s public IP address, you may configure postfix with:

relayhost = [smtp-relay.gmail.com]

Alternative Configuration (Google Apps free accounts, Gmail)

The correct SMTP server configuration for the free version of Google Apps and Gmail is:

relayhost = [smtp.gmail.com]:587

Please note that Google will automatically rewrite the sender (FROM) address to match whichever account is used for SMTP authentication (i.e. if you authenticate with eclipse@domain.com, all emails will appear to be sent from that address, regardless of which from address is specified in Eclipse). This is a limitation enforced on Google’s end, so there is no way around this on the Linux server side, other than to use a paid version of Google Apps (please see above) or use a mail relay service like SendGrid.

RHEL7 installation guide for eclipse Operating System Installation

Boot from RHEL 7 media Select “Install Red Hat Enterprise Linux 7.0” and press enter At the Welcome screen, select Continue At the Installation Summary screen (http://cl.ly/image/0R2p1b2H2A0S)

o Select Date & Time (optional, defaults to Eastern)o Select Software Selection

Select Server with GUI (http://cl.ly/image/07252N0E2d01) Select Done

o Select Installation Destination

Select 1st Local Standard Disk (a checkmark will appear) (http://cl.ly/image/0i190m2p2y2P)

Select “I will configure partitioning” (Other Storage Options -> Partitioning) (http://cl.ly/image/1n3W0Y431o30)

Select Done Select “Click here to create them automatically”

(http://cl.ly/image/3p372d3e3d25) Select the root filesystem

Change the capacity to 10GB Select Modify volume group Change the name to “rootvg” Select Save

Select the swap partition Change the capacity to 4GB (http://cl.ly/image/2z0P1r0P1118)

Select the “+” button to add a new mount point Mount point: /esupport Capacity: 4GB Select Done

Select Accept Changes (http://cl.ly/image/0I2t2n261m0q0o Select Network and Hostname

Switch the interface on (Optional: set the static IP address) Set the hostname (e.g. eclipse-customername)

(http://cl.ly/image/1I1q3P3d3t36) Select Done

o Select Begin Installation Select Root Password

o Set the password and confirm it (default: abc123)o Select Done twice

When the installation has completed, select Reboot (http://cl.ly/image/3t3D423n1B2p0 At the Initial Setup screen, select License Information

o Select “I accept the license agreement”o Select Done

Select Finish Configuration o At the Kdump screen, select Forwardo At the Subscription screen, select “No, I prefer to register at a later time”o Select Finish

Select Next and continue selecting Next At the Create a Local Account screen

o Name: eclipseo Username: eclipseo Password: sve978o Select Next until complete

The Cisco VPN Client on Windows 10

Fix Dell Cannot retrieve repository metadata Error Symptom

When running yum update on a RHEL 5 system, the following error is shown:

http://linux.dell.com/repo/hardware/latest/platform_independent/rh50_64/repodata/repomd.xml: [Errno 14] HTTP Error 404: Not FoundTrying other mirror.Error: Cannot retrieve repository metadata (repomd.xml) for repository: dell-omsa-indep. Please verify its path and try again

Cause

Dell discontinued support for RHEL 5 in the latest version of their yum repo, which is enabled by default, but they keep the old copies online.

Fix

Point the Dell repo at an older version:

sed -i 's/latest/Linux_Repository_14.12.00/g' /etc/yum.repos.d/dell-omsa-repository.repo

You may now re-run yum.

Solar Application Blocked by Security Settings Problem

When launching Solar, you receive an “Application Blocked by Security Settings” error message.

Workaround

Add the Eclipse server’s IP address or hostname to Java’s security exception site list by following these steps:

Open the Java control panel:

Launch the Windows Start menuClick on ProgramsFind the Java program listingClick Configure Java to launch the Java Control Panel1

In the “Java Control Panel” window that appears, select the “Security” tab.

If there is a “Exception Site List” section in this window, click on the “Edit Site List…” button.2

In the “Exception Site List” window:

Click the “Add” buttonEnter the Eclipse server’s web start address, including port (e.g. http://172.22.211.10:2080/).Click the “OK” buttonConfirm by clicking “OK” once again.

Finally, click the “OK” button to exit the “Java Control Panel”.

Launch Solar again.

Screencast

For reference, here is a video showing the error and workaround:

FAQ

Q: Why did this error appear suddenly?A: The certificate that was previously used to sign the Solar code expired on 10/26/15, so if you are using an older version of Solar that was signed by the expired certificate, Java’s default security settings will now block it from running.

Q: Is there a way to add an exception to the site list without using the GUI (i.e. for automating the changes across many computers)?A: Yes, you may add the same entry to the text file located at %APPDATA%\..\LocalLow\Sun\Java\Deployment\security\exception.sites. For more information, see Java’s documentation. For information on deploying these changes via group policy, see this article for an example.

1. If you can’t find the control panel, please see this Java support page for more information. [↩]

2. If there is no “Exception Site List” section in this window, slide the “Security Level” indicator from “High” down to “Medium” and click the “OK” button. [↩]

How do I perform a manual rsync backup on Linux? If your system is configured to perform an rsync backup as part of the standard snapshot script, simply run the following command:

at now -f /u2/UTILS/bin/snapsave_linux.sh

To schedule the backup at specific date and time, for example at 11PM today, change now to 23:00.

at 23:00 -f /u2/UTILS/bin/snapsave_linux.sh

This script will suspend your database, take snapshots of the database files and create a full tape backup. You will not see any output in your console session, because the script creates a separate log file under /tmp/snapsave.log.

If you have already created the snapshot filesystem, but you want to perform a separate manual tape backup:

rsync -avz --delete --stats /snap/u2/ /mnt/nas/rsync/

If there are no snapshots present, but no users are on the system and you want to perform a manual rsync backup:

rsync -avz --delete --stats /u2/ /mnt/nas/rsync/

References:How to use the at commandHow to use rsync

Formscape CPU Affinity On servers with more than 2 CPU cores, Formscape may fail to license and start properly until you restrict the service process to run on 2 or fewer CPUs.

To set the CPU affinity:

Open the Windows services window (Start -> Run -> services.msc) Right-click on the “Eclipse Forms” service and select Properties Select the General tab

Click on the Stop button to halt the FormScape service In the Start Parameters field, enter: –a “0 1” Click on the Start button and then on the OK button.

How to Configure the Android VPN Client for IPsec Shared Key VPN To use an Android device to connect to a client-to-site IPsec VPN without having to import a certificate, use shared key authentication. Your device must use Android version 4.0 or above.

Configure the Android VPN Client

1. On the Android device, tap Settings.2. In the Wireless & Networks section, tap More.3. Tap VPN.4. Add the VPN by tapping the plus sign (+) next to VPN.5. On the Edit VPN profile page, configure these settings:

o Name – Enter a name for the VPN connection (e.g., IPsecWithSharedKeys).o Type – Select IPSec Xauth PSK.o Server address – Enter the network address for the VPN service (e.g.,

62.99.0.51).o IPSec identifier – Enter the group policy name that you entered for the IPsec

PSK VPN on the Barracuda Firewall (e.g., IPsecVPN).

o IPSec pre-shared key – Enter the PSK.

Connect to the VPN with the Android Device

After configuring the Android device, you can connect to the IPsec VPN.

1. On the device, navigate to the VPN screen.

2. Tap the name of the VPN that you want to connect to (e.g., IPsecWithSharedKeys).

3. Enter your Username and Password, and then tap Connect.

How do I default or reset a Cisco router? Please see the regular process to reset the password on 1841 Router below,

Connect the console cable to Router 1841 Use the power switch in order to turn off the router, and then turn the router back on

Press Break on the terminal keyboard within 60 seconds of power up in order to put the router into ROMMON

Type confreg 0x2142 at the rommon 1> prompt in order to boot from Flash

This step bypasses the startup configuration where the passwords are stored

Type reset at the rommon 2> prompt.

The router reboots, but ignores the saved configuration.

Type no after each setup question, or press Ctrl-C in order to skip the initial setup procedure.

Type enable at the Router> prompt. You are in enable mode and should see the Router# prompt Type erase start at the Router> prompt. Type configure terminal.

Type config-register #config-register 0x2102 Type write memory  Type reload

– See more at: https://supportforums.cisco.com/discussion/11607366/how-reset-cisco-router-1841-password#sthash.keYSGsUX.dpuf

RHEL 6 Installation Guide for Eclipse Configure RAID arrays Boot from RHEL6 image Press ENTER to start the installer Select Basic Storage Devices -> Next -> Re-Initialize All Enter the hostname, for example: eclipse-customername Select ‘Configure Network -> eth0 -> Edit -> IPv4 Settings tab -> Method: Manual ->

Add Enter IP address, netmask, gateway, DNS server -> Apply -> Close Select the closest city to the server’s final physical location Enter root password -> Use Anyway Select Create Custom Layout Select the OS (rootvg) disk array -> double-click or use the arrow to move it under Install

Target Devices -> Next Select the OS array (/dev/sda) -> Create -> Standard Partition -> Create -> Mount

point: /boot -> Allowable drives: /dev/sda -> Size: 200MB -> OK Select the OS array (/dev/sda) -> Create -> LVM Physical Volume -> Create -> Type:

physical volume (LVM) -> Allowable drives: /dev/sda -> Size: Fill to maximum -> OK

Select the OS LVM PV (/dev/sda2) -> Create -> LVM Volume Group -> Create -Volume Group Name: rootvg

Add -> Mount point: / -> Name: root -> Size: 30720 (30GB) -> OK Add -> Mount point: /esupport -> Name: esupport -> Size: 4096 (4GB) -> OK Add -> File System Type: swap -> Name: swap -> Size: 4096 (4GB) -> OK

o swap sized based on the amount of system RAM:o 4-16 GB RAM = 4096 MBo 16-64 GB RAM = 8192 MBo 64-256 GB RAM = 16384 MB

Continue, accepting defaults until you reach the software selection screen Select Minimal Install -> Next After the installation process has completed, reboot

GHOST glibc Security Alert January 2015 Summary

Epicor has been made aware of a critical vulnerability in the glibc library, which has been assigned CVE-2015-0235 and is commonly referred to as ‘GHOST’. All versions of glibc shipped with all variants of Red Hat Enterprise Linux are affected.

GHOST is a ‘buffer overflow’ bug affecting the gethostbyname() and gethostbyname2() function calls in the glibc library. This vulnerability allows a remote attacker that is able to make an application call to either of these functions to execute arbitrary code with the permissions of the user running the application.

The gethostbyname() function calls are used for DNS resolving, which is a very common event. To exploit this vulnerability, an attacker must trigger a buffer overflow by supplying an invalid hostname argument to an application that performs a DNS resolution.

Checking Vulnerability

The easiest way to check for the vulnerability is to run the the Red Hat Access Lab’s “glibc (GHOST) Detector” script:

curl -s http://kb.eclipseinc.com/repo/GHOST-test.sh | bash

If the server is vulnerable, you will see output similar to:

Installed glibc version(s)- glibc-2.5-42.i686: vulnerable- glibc-2.5-42.x86_64: vulnerable

This system is vulnerable to CVE-2015-0235. <https://access.redhat.com/security/cve/CVE-2015-0235>

Please refer to <https://access.redhat.com/articles/1332213> for remediation steps

If the server is not vulnerable, you will see output similar to:

Installed glibc version(s)- glibc-2.5-123.el5_11.1.x86_64: not vulnerable- glibc-2.5-123.el5_11.1.i686: not vulnerable

Resolution

Update RHEL to patch the affected libraries:

yum -y update glibc nscd

Double-check that the patches have been applied by running the detection script again:

curl -s http://kb.eclipseinc.com/repo/GHOST-test.sh | bash

Reboot the server to finish applying the patches:

reboot

Troubleshooting

If you receive an error when attempting to run yum, it could be because your Red Hat subscription has expired. In this case, we’ve setup a package repository for you, which you can use by running the following commands:

curl -s -o /etc/yum.repos.d/eclipse.repo http://kb.eclipseinc.com/repo/eclipse.repoyum -y update glibc nscd

If you receive an error similar to “Public key for glibc-headers-2.5-123.el5_11.1.x86_64.rpm is not installed”, then it means your Red Hat software is very much out of date, and you’ll need to first update some other packages:

curl -s -o /usr/share/rhn/RHNS-CA-CERT http://kb.eclipseinc.com/repo/RHNS-CA-CERTcurl -s -o /etc/yum.repos.d/eclipse.repo http://kb.eclipseinc.com/repo/eclipse.repoyum --nogpgcheck -y update rhn*rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-releaseyum -y update glibc nscd

Frequently Asked Questions

Q: I installed the patch, and now the script says my server is “not vulnerable”. Do I still need to reboot my server?A: Yes.

Format RDX Cartridges for Linux To format an RDX (e.g. Dell RD1000) drive cartridge for Linux for use with Eclipse backups:

Identify the drive’s device name (e.g. /dev/sdc) using the following command:

lsscsi

After you’ve identified the proper device, format the partition (e.g. /dev/sdc1):

CAUTION: This will destroy all data on the specified partition, so make sure you’ve identified the correct partition before proceeding.

mkfs -t ext3 -v -L RD1000 /dev/sdX1

Mount the drive:

mount /mnt/rd1000

Create the rsync directory:

mkdir -p /mnt/rd1000/rsync

The drive cartridge is now ready for use.

POODLE SSLv3 Security Alert October 2014 Summary

Epicor has been keeping apprised of a vulnerability in the SSL 3.0 protocol, which has been assigned CVE-2014-3566. All implementations of SSL 3.0 are affected.

POODLE stands for Padding Oracle On Downgraded Legacy Encryption. This vulnerability allows a man-in-the-middle attacker to decrypt ciphertext using a padding oracle side-channel attack. POODLE affects older standards of encryption, specifically Secure Socket Layer (SSL) version 3.0. It does not affect the newer encryption mechanism known as Transport Layer Security (TLS).

Because it’s a vulnerability in the protocol, not a bug in the implementation, there is no “patch,” so SSLv3 should be disabled in all client and server software.

Epicor’s Response

There are functions of the Eclipse server software that initiate HTTPS connections to external servers (e.g. for credit card processing). Those connections previously allowed SSLv3, so we

have updated the code to explicitly require TLS connections. The patch (DNV616) can be applied manually, or it will be included by default in the customer’s next point upgrade.

We have also reviewed the Eclipse application server and confirmed that SSLv3 is already disabled in the release, which uses TLS by default.

Recommended Customer Actions

We recommend that customers request the patch or a point upgrade to a release of Eclipse with SSLv3 client functionality disabled.

We also recommend that any customers running external web servers (e.g. web commerce, mobile) disable SSLv3 on IIS using Microsoft’s “fix it” tool.

FAQ

Q. How can I verify that my Solar application server (or any other secure web service) is not vulnerable?A. Run the command below:

openssl s_client -connect HOSTNAMEORIPADDRESS:PORT -ssl3

For example, the following output, run against a the Solar application server running on the local server, shows that the service is not vulnerable:

[root@rs6k ~]# openssl s_client -connect localhost:2443 -ssl3CONNECTED(00000003)25211:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:284:

How do I disable reverse DNS for telnet sessions? Sometimes you will see Eclipse hang because of an invalid DNS server when logging into e-term.

You can disable reverse DNS lookups for all incoming telnet connections by putting this as the first uncommented line in /etc/hosts.allow

in.telnetd: ALL

 

How do i disable reverse DNS for telnet sessions on my Linux server?

How do I display shell command history with date and time under UNIX or Linux operating systems? If the HISTTIMEFORMAT is set, the time stamp information associated with each history entry is written to the history file, marked with the history comment character. 

Defining the environment variable as follows:

[root@hostname ~]# HISTTIMEFORMAT=”%m/%d/%y %T “

 

Where,  %d – Day  %m – Month  %y – Year  %T – Time

To see history type: history

[root@hostname ~]# history

How do I add or delete contacts under my Epicor support account? In order to add or delete contacts, you must have System Admin privileges in (iSupport).  Then follow these steps:

1)    When you first enter our site, you are presented with the following screen.  At the top of this screen, you will see “My account”.  Click on this:

2)    Click on either of these User Maintenance choices:

3)    Select one of the options below:

4)    If you select “Assign Permissions”, the following screen appears where you can select the level of authority for each user:

Bash Security Alert September 2014

SummaryA security vulnerability in the bash shell, the command-line shell used by the Linux operating system, could leave systems running those operating systems open to exploitation by specially crafted attacks.

Epicor’s Response

We have reviewed the Eclipse software and verified that none of our products are directly affected by this vulnerability.

Customer Action

While the Eclipse software is not directly affected by this vulnerability, we highly recommend that our customers take the following actions to safeguard their servers:

1. Install the updated bash software update as soon as possible, using the command

yum update bash

2. Do not make the Linux server directly accessible on the Internet. Use a VPN to remotely access the server.

3. Continue to install Red Hat software updates on a regular basis.

For more information, please read the following articles on Red Hat’s website:

Bash specially-crafted environment variables code injection attack Frequently Asked Questions about the Shellshock Bash flaws Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-

2014-6271, CVE-2014-7169) Security Advisory Important: bash security update   Advisory: RHSA-2014:1306-1

FAQ

Q: Are web services that indirectly access the Linux database server affected?

A. No. Eclipse doesn’t use the affected Apache web server on Linux. Web services that use fastcgi (e.g. WOE, Web Integration) that run on the Windows IGATE server access the UniVerse SOCKET server, which isn’t affected. Web services that access JBoss on the database server (e.g. POD, JM) aren’t affected.

Q. The yum update tool is not working. Can I manually install the updated bash software?

A. Yes, you may use one of the alternative mirrors below:

For servers running RHEL 5:

rpm -Uvh http://f.cl.ly/items/0v0V430R0b3a3j3M4344/bash-3.2-33.el5_11.4.x86_64.rpm

For servers running RHEL 6:

rpm -Uvh http://f.cl.ly/items/3p083T2f1j3b191x423d/bash-4.1.2-15.el6_5.2.x86_64.rpm

Q. How do I test to see if my server is vulnerable?

A. Run this command:

env x='() { :;}; echo vulnerable' bash -c 'echo this is a test'

If you see the word “vulnerable” echoed back, then your system needs to be updated. If you only see “this is a test,” then your system has been patched.

IP your new Red Hat Linux server 1. Login to the server using root for the username and abc123 for the password

2. On Linux command prompt IP address is assigned by a network configuration window. This window can be invoked by selecting network configuration sub menu form setup command

3. This will launch a new window select network configuration

4. Now a new window will show you all available LAN card select your LAN card ( if you don’t see any LAN card here mean you don’t have install driver).  Choose the network card you want to set (usually eth0)

5. Assign IP in this box and click ok

6. Click on ok, quit and again quit to come back on root prompt. Whatever change you made in network configuration will not take place till you restart the LAN card

7. Now type service network restart from the prompt (see below)

8. Type ifconfig to confirm settings have changed

Upgrading from RHEL 5 to 6 Here are answers to some common questions regarding upgrades from RHEL 5 to 6:

When I update the software using “yum,” will it upgrade me to the newest version?

It will only update you to the latest “minor” version (e.g. 5.9 to 5.10). It will not upgrade you to a new major version (e.g. 5.9 to 6.5).

Why would I want to upgrade to RHEL 6?

If you are on RHEL 5, you may stay on RHEL 5. Red Hat will provide technical support and updates for RHEL 5 until 3/31/17, and UniVerse will support it through 11.2.

If you are on RHEL 5, but you are moving to a new server, we recommend that you use the opportunity to migrate to RHEL 6 on the new server.

Can I perform an “in place” upgrade from RHEL 5 to 6?

No. Here’s Red Hat’s policy on “in place” upgrades:

Red Hat does not support in-place upgrades between any major versions of Red Hat Enterprise Linux. A major version is denoted by a whole number version change. For example, Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.5 are both major versions of Red Hat Enterprise Linux.In-place upgrades across major releases do not preserve all system settings, services or custom configurations. Consequently, Red Hat strongly recommends fresh installations when upgrading from one major version to another.

The recommended procedure is to perform a clean installation of RHEL 6, followed by clean installations of the Eclipse software packages (e.g. UniVerse, VSI-FAX), and finally restore the OS configuration data (e.g. users, passwords, printers, email relay settings) and database.

For more information, see these Red Hat articles:

Red Hat Enterprise Linux 6 Installation Guide Does Red Hat support upgrades between major versions of Red Hat Enterprise Linux?

I need to upgrade to RHEL 6 for another reason. Can Eclipse help?

If you need to upgrade from RHEL 5 to 6 for some reason (e.g. backup software requires RHEL 6), and you are not moving to a new server, the Eclipse team can help with the upgrade process. Please contact your account manager for more information.