{"uuid": "f1fbd699-4fd2-418a-a230-2ae15629765f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-0775", "type": "seen", "source": "https://gist.github.com/datavudeja/ee04a2cdb0c5dfb5a45833f8041e258b", "content": "# Distributions: RHEL_6+7 CentOS_6+7\n##########################################################################\n\n# Standard rsync command\n##########################################################################\n\n- Useful when live cloning servers.\nrsync -avX --one-file-system --hard-links --numeric-ids -e 'ssh -c arcfour' /source dest:/nation\n(remember to run --delete for the last sync)\n\n# Find out the WAN IP address\n##########################################################################\ncurl http://checkip.dyndns.com:8245\n\n# Iptables \n##########################################################################\n\n- Redirect port\niptables -t nat -A PREROUTING -p tcp --dport 587 -j REDIRECT --to-ports 25\n- Redirect incoming port to another host\necho 1 > /proc/sys/net/ipv4/ip_forward\niptables -t nat -A PREROUTING -p tcp -m tcp --dport 587 -j DNAT --to-destination 1.2.3.4:587\niptables -t nat -A POSTROUTING -j MASQUERADE\n\n- Redirect outgoing connections to another host\niptables -t nat -I OUTPUT --dst 1.2.3.4 -p tcp --dport 25 -j DNAT --to-destination 4.5.6.7:25\n\n# \n##########################################################################\n- Find parent PID\nps -o user,pid,ppid,command -ax\n\n- Server stuck in TIME_WAIT all the time?\nnet.ipv4.tcp_fin_timeout=15\nnet.ipv4.tcp_tw_reuse=1\nnet.ipv4.tcp_tw_recycle=1\n\n* Generate heat\nfor cpu in {1..8}; do ( while true; do true; done ) & done\n\n# MySQL stuff\n##########################################################################\n\n* MySQL database sizes (CPU intensive, prefer starting off your MySQL installations with innodb_file_per_table)\nSELECT @schema := table_schema, SUM(data_length+index_length)/1024/1024 AS total_mb FROM information_schema.tables GROUP BY table_schema ORDER BY 2;\n\n* MySQL table sizes:\nSHOW TABLE STATUS order by 'Data_length';\n\n* MySQL which tables using InnoDB:\nSELECT table_schema, table_name FROM INFORMATION_SCHEMA.TABLES WHERE engine = 'innodb';\n\nMySQL kill thead:\nSHOW PROCESSLIST;\nKILL 27;\n\n* Reset MySQL root password (from redhat docs)\nservice mysqld stop\n/usr/bin/mysqld_safe --skip-grant-tables &\nmysql -u root mysql\nmysql> UPDATE user SET Password=PASSWORD('new_password') WHERE user='root';\nmysql> FLUSH PRIVILEGES;\nmysql> exit;\nmysqladmin -u root -pnew_password shutdown\nservice mysqld start\nScan for new LUNs without rebooting\n\n* Instead of doing it manually...\n\necho \"1\" > /sys/class/fc_host/host/issue_lip\n\n* For every hostN:\necho \"- - -\"  >  /sys/class/fc_host/hostX/device/scsi_host/hostX/scan #Fibre\necho \"- - -\" > /sys/class/scsi_host/hostX/scan\n\n...just yum install sg3_utils and run rescan-scsi-bus.sh.\n\n# RPM tips\n##########################################################################\n\n    Which RPM a file belongs to: rpm -qf /etc/rsyslog.conf\n    View RPM contents: rpm -q --filesbypkg -p fiklename.rpm\n    Unzip an RPM: rpm2cpio bash-123.rpm | cpio -idmv\n    List all files an installed package: rpm -ql rsyslog\n    List all files in an RPM: rpm -qlp someapp.rpm\n    Note that you can't guess the effect an RPM can have on a system just based on it's files; you need to also find out the scripts it'd execute during the installation: rpm -qp --scripts someapp.rpm or as a trigger: rpm -qp --triggers someapp.rpm. If you don't like the look of the script, but you can still install an RPM bypassing the scripts with rpm --noscripts -ivh someapps.rpm\n    List all config file: rpm -qc rsyslog\n    List dependencies of an installed package: rpm -qR bash\n    List dependencies of an RPM: rpm -qRp someapp.rpm\n    Show info of an installed package: rpm -qi screen\n    Show info of an RPM: rpm -qip someapp.rpm\n    Verify GPG key (assuming you did an rpm --import): rpm -K someapp.rpm\n    Check if a file has been tampered: rpm -Vf /usr/bin/bash or rpm -V bash\n    Check all files (very slow, prone to false positives): rpm -Va\n\n# yum-security (RHEL only, not CentOS)\n##########################################################################\n\n    Summary of the number of security and bugfix updates: yum updateinfo\n    List of advisories with the packages affected: yum updateinfo list\n    Details of a Red Hat advisory: yum updateinfo RHSA-2014:1293\n    List all the updates needed to resolve a CVE: yum updateinfo list --cve=CVE-2013-0775\n    List of security related updates: yum --security list updates\n    Huge ass list of all security update details: yum info-sec\n    Update security related packages only: yum --security update\n    Note that doing a yum --security update would update an affected package to the latest one available in the repositories. As an example, say you have deo-1.3 installed, and there is a security vulnerability fixed in deo-1.4, and a bug fixed in deo-1.5, and a feature added in deo-1.6. A yum --security update deo would push your deo from 1.3 to 1.6. If, instead, you want to update to just the amount required to fix a bug, use update-minimal, which would update deo to 1.4 only:\n    yum update-minimal --security\n    Update packages that fix a bugzilla ID: yum --bz 1011219 update\n    Update packages related to a Red Hat advisory: yum update --advisory=RHSA-2014:0159\n    Update only critical packages (not documented in the man page or red hat docs): yum update --security --sec-severity=Critical\n    Update only important packages (not documented in the man page or red hat docs): yum update --security --sec-severity=Important\n\n# Which processes are responsible for the load:\n##########################################################################\n\nVery few people I've met, even some those working in Red Hat support, realize how the load is calculated, with many thinking it's only based on the CPU usage, and some understanding that disk access is involved too somehow but aren't sure how the numbers work. Simplified, the load is just the average number of processes that are in a running (=CPU intensive), or uninterrupted sleep (=Waiting for I/O) state. So if you run this command several times:\nps -eo stat,pid,ppid,size,pcpu,user,args | grep '^D\\|^R'\nyou can see that the number of processes excluding the ps process represents the load on the system, with 'R' meaning it's using up the CPU, and 'D' probably meaning it's using your disk, though in cases like a stuck NFS or GFS2 mountpoint, just mean that it's stuck in an uninterruptable sleep waiting for I/O.\nHard soft-reboot a server having IO issues\n\nIt's rare, and I don't know why it happened to me this often, but there are situations where you happen to have a terminal open on a very old test server, and it's RAID controller or I/O completely freezes up which could be fixed by a reboot, but you can't type it reboot or shutdown because that would need to read the disk to find those binaries. So to save you the trouble of accessing the IPMI, you could use this, which doesn't need to read the disk, to reboot:\n\necho 1 > /proc/sys/kernel/sysrq\necho b > /proc/sysrq-trigger\n\n* Hang/freeze a system\nThis is extremely useful, or even crucial, in cluster testing to simulate OS or system freezes\n# echo c > /proc/sysrq-trigger # Freeze system\n\n# UNIX timestamps to normal time & back\n##########################################################################\n\ndate -d @1338636201\ndate --date=\"Wed Aug 22 07:51:04 UTC 2007\" +%s\n\n# Encrypted block device\n##########################################################################\n\ncryptsetup --verbose --verify-passphrase luksFormat /dev/vg_rhel6/LogEncrypted\ncryptsetup luksOpen /dev/vg_rhel6/LogEncrypted encrypted_stuff\nmkfs.ext4 -m 0 /dev/mapper/encrypted_stuff\n/etc/crypttab\n\n        encrypted_stuff /dev/vg_rhel6/LogEncrypted none\n\n/etc/fstab:\n\n        /dev/mapper/encrypted_stuff /mnt/encrypted      ext4    defaults        0 0\n\ncryptsetup luksClose encrypted_stuff\n\n#Rebuild initrd:\n##########################################################################\n\nRHEL 5: cd /boot; mv initrd-2.6.18-238.5.1.el5.img initrd-2.6.18-238.5.1.el5.img.orig ; mkinitrd -f /boot/initrd-$(uname -r).img $(uname -r)\nRHEL 6: dracut -f /boot/initramfs-$(uname -r).img $(uname -r)\nFind the original MD5sum of a binary that was prelinked:\n\nprelink -y --md5 /usr/bin/cifsiostat\nSpeed up ext3/ext4 filesystem at the expense of safety:\n\n* FS Mount options: defaults,noatime,data=writeback,barrier=0,nobh\nNew pc with old kernel boot options\n\nlinux pci=nommconf noapic acpi=off\n\nFix scrolling in GNU screen\n\nEdit /etc/screenrc and append:\ntermcapinfo xterm* ti@:te@\n\n* GNU screen mirror\n\nscreen -S hello #user 1\nscreen -x hello #user 2\n\n* VI backspace for old servers\n\n:set backspace=indent,eol,start\n\n* Random password\ntr -dc A-Za-z0-9 < /dev/urandom | head -c 16 ; echo\n\n# Network clone hard drive\n##########################################################################\n\n* Assuming both machines are booted off a live disc\nnc -l -p 9000 | dd of=/dev/sdx # destination PC\ndd if=/dev/sda | nc 192.168.1.2 9000 # source server\n\n* Though you might want to involve gzip or better yet, lzop if you have it.\n\n* Delete huge number of files on an old server\nfind /path -type f -print0 | xargs -0 rm\n\n* Color BASH prompt\nexport PS1=\"[\\u@\\[\\e[1;31m\\]\\h\\[\\e[0m\\] \\W]$ \"\nRed: 31m, Green: 32m, Blue: 34m\nBASH floating point calcuations\n\n* Use it like calculate \"239422 / 1024\"\n`function calculate() { echo -n `echo scale=2\\; \"$1\" | bc` }`\n\n* BASH write log function\n\nUse it like write_log \"Some text here\"\n\nLOGFILE=/some/where.log\nfunction write_log {\n    echo `date +\"[%d/%b/%Y:%k:%M:%S]\"` $1 >> $LOG\n}\n\n# BASH function to display coloured INFO or ERROR messages\n##########################################################################\n\nfunction printInfo() {\n        if [ -t 1 ] ; then\n                echo -e \"\\e[1m\\e[32mINFO: \\e[0m${1}\"\n        else\n                echo \"INFO: $1\"\n        fi\n}\n# (same thing but with 31m for red)\n\n# SSH client config to avoid timeouts\n##########################################################################\n\n/etc/ssh/ssh_config\n\nServerAliveInterval 10\nServerAliveCountMax 3\n\n# TCP dump for SMTP ASCII chat\n##########################################################################\n\ntcpdump -n -N -A -s 1024 -i eth0 port 25 > out\n\n#md RAID disk replacement\n##########################################################################\n\nAssume /dev/sdb failed:\n\n    cat /proc/mdstat\n    md0 : active raid1 sda1[0] sdb1[2](F)   <---- F means failed\n       12345 blocks [2/1] [U_]  <--- _ means inactive. \n    mdadm --manage /dev/md0 --fail /dev/sdb1\n    mdadm --manage /dev/md0 --remove /dev/sdb1\n    # poweroff and plug the replacement drive. Make sure its sdb, otherwise switch the commands\n\n    # For DOS partitions:\n    sfdisk -d /dev/sda | sfdisk /dev/sdb\n    If it comlains or if the sizes are different, do it manually\n\n    # For GPT partitions:\n    yum install gdisk\n    sgdisk --backup=/root/backups/sda.sgdisk /dev/sda # working drive\n    sgdisk --load-backup=/root/backups/sda.sgdisk /dev/sdx # new drive\n    sgdisk -G /dev/sdx # new drive\n\n    mdadm --manage /dev/md0 --add /dev/sdb1\n    cat /proc/mdstat # wait until sync finishes\n    mv /boot/grub/device.map /boot/grub/device.map.old\n    grub --device-map=/boot/grub/device.map # boot MBR copy\n       find /grub/stage1\n       root (hd1,0)\n       setup (hd1)\n       quit\n\n# MD RAID expand volume\n##########################################################################\n\nHere's how I expanded a RAID5/RAID6 volume:\n\n# Backup your data. Expanding RAID volumes stress the existing drives for a day or more\n\n# Add the drives physically \n\n# Do a check of the existing drives/RAID just in case:\necho check > /sys/block/md0/md/sync_action\ncat /sys/block/md0/md/mismatch_cnt # should be 0\n\n# Check the current situation, make sure all existing drives are active:\ncat /proc/mdstat\nmdadm --detail /dev/mdX\n\n# You can use and even write to the array as it's rebuilding\n# but if you can afford days of downtime on this RAID, you\n# can unmount the filesystem to be extra safe\n\n# Optionally partition your drives if you did so in your previous drives\n\n# Speed up rebuilding by increasing the stripe cache (uses some RAM)\necho 32768 > /sys/block/md0/md/stripe_cache_size\n\n# Add new drives or partitions. You can add multiple drives to md RAIDs at a time.\nmdadm --add /dev/mdX /dev/sdX1\nmdadm --add /dev/mdX /dev/sdY1\n\n# You need to disable write-intent bitmap, if /proc/mdstat mentions 'bitmap:'\nmdadm --grow /dev/mdX --bitmap=none\n\n# You need to know the number of devices you want to end up with (the active devices in mdadm --detail /dev/md0\n# plus the number of new drives you are adding.\n# Keep the optional --backup file somewhere NOT in the RAID array in question (eg. on a USB or /boot)\n# This backup file will only be a few megabytes for a few seconds and is used in case the power fails during a critical stage.\nmdadm --grow --raid-devices=7 --backup-file=/root/mdadm-resize-backup /dev/md0\n\n# Watch the expansion and estimated time to finish with:\ncat /proc/mdstat\n\n# Don't forget to add the write-intent bitmap back on:\nmdadm --grow /dev/mdX --bitmap=internal\n\n# If MD is settled, it's time to expand the filesystem. If you use LVM, do a :\npvresize /dev/mdX\nlvm vgs\nlvextend --size +1.23T /dev/yourVG/yourLV # or --extents 100%FREE\n\n# If you use volume encryption, open the volume with luksOpen and run:\ncryptsetup --verbose resize your_cryptname\n\n# Then finally resize the filesystem with\n# resize2fs -p /dev/...\n# or\n# mount ... && xfs_growfs /dev/...\n\nMD RAID unwanted spare\n\nIf you have an /proc/mdstat output similar to:\n\nmd2 : inactive sda4[0](S)\n      1897733208 blocks super 1.2\n\nafter a power failure, and it's not letting you mount the drive or even re-add the missing drive, try deactivating and re-activating the RAID:\nmdadm --stop /dev/md2\nmdadm -A /dev/md2\nGrep match IP address\n\n'[[:digit:]]{1,3}\\.[[:digit:]]{1,3}\\.[[:digit:]]{1,3}\\.[[:digit:]]{1,3}'\n\n# Tune NFS 3 mounts\n##########################################################################\n\nmount -o rsize=32768,wsize=32768,nfsvers=3,tcp,async server:/mnt/stuff /mnt/nfs\nSpeed up SSH transfers\n\nssh -c arcfour ...\nscp -c arcfour ...\nSSH masters\n\nThis is useful, in that it allows you to log in to a server without a password if you've authenticated once in an existing session.\nAdd this to your ~/.ssh/config:\n\nHost *\nControlMaster auto\nControlPath ~/.ssh/master-%r@%h:%p\n\nNote that if your main session closes, all other sessions would disconnect.\nHP servers: find the RAID status\n\nhpacucli (or hpssacli)\ncontroller all show config\nCheck an HP server's temperature and fan status\n\nhpasmcli\nshow server\nshow temp\nshow powersupply\nHP RAID add spare\n\nhpacucli (or hpssacli)\ncontroller all show config\ncontroller slot=1 array all add spares=1I:1:9\nHP expand RAID5 with new disk (needs battery backed cache\n\nhpacucli (or hpssacli)\ncontroller all show config detail (check if there's a battery/flash module)\ncontroller slot=1 array A add drives=1I:1:9\ncontroller all show config (until the transforming % is gone)\ncontroller slot=1 ld 1 modify size=max\nYou will need to reboot if it's RHEL5. RHEL6 may have a /sys rescan option. Then fdisk, pvcreate, vgextend, lvresize & resize2fs.\nHP create a new logical drive & expand LVM\n\nhpacucli (or hpssacli)\ncontroller all show config\ncontroller slot=0 create type=ld drives=2I:1:6,2I:1:7 raid=1\nfdisk /dev/cciss/c0d1\n...\n\n# HP RAID controller SMART info\n##########################################################################\n\nRHEL5: smartctl -a -d cciss,0 /dev/cciss/c0d0\nRHEL6: smartctl -a -d cciss,1 /dev/sg0\nCheck IBM/Adaptec RAID controller info\n\n/usr/StorMan/arcconf GETCONFIG 1 AL\n/usr/StorMan/arcconf getlogs 1 EVENT tabular\n\n# Create an IBM/Adaptec RAID logical drive\n##########################################################################\n\nRead the docs; it's quite confusing. Get the ID of the new drives with:\n/usr/StorMan/arcconf GETCONFIG 1 PD\nThe unallocated ones will have a \"State\" of \"Ready\". then see the \"Reported Channel,Device\" line, and ignore the numbers in the brackets.\nThen create the logitcal drive, the syntax is:\narcconf CREATE  LOGICALDRIVE [Options]    [Channel# ID#]\nso, for example, to create a logical drive with RAID 1:\narcconf CREATE 1 LOGICALDRIVE NAME NewDrives WCACHE WBB MAX 1 0 4 0 5\nwith the drives being underlined.\n(The RAID level can be set to simple_volume, which will just be one drive. That can later be convered to a RAID1 drive once you get a matching pair)\nExpanding an old IBM/Adaptec RAID 5 volume\n\nSimilar to the above steps.\n/usr/StorMan/arcconf GETCONFIG 1 AL\n\nwhere \"1\" is your controller number, probably 1. In the display, the unallocated physical drives will have a \"State\" of \"Ready\". note down the the \"Reported Channel,Device\" line for each drive, and ignore the numbers in the brackets.\nY\nou need to first initialize the drive, if you don't, you can get an error about there being not enough space on the disk when trying to expand. Double and triple check the drive pair number (Reported channel + device), and initialize the drive:\n/usr/StorMan/arcconf TASK START 1 DEVICE 0 9 initialize\nAfter that's done, get the \"Logical device number\" from the \"GETCONFIG\" output. Then type the expansion command; the syntax is:\n/usr/StorMan/arcconf MODIFY  FROM  TO   [old CHANNEL# DRIVE#] [old CHANNEL# DRIVE#] [old CHANNEL# DRIVE#] [new CHANNEL# DRIVE#]\n should be the size in megabytes, or just use MAX.\nAs you can see, the command isn't about putting just the drive you want to add, you have to include the old drives too. If you miss one, the drive will be deleted from the array causing all sorts of trouble. This is an example run in one of my expansions, don't copy it word for word:\n#/usr/StorMan/arcconf MODIFY 1 FROM 0 TO MAX 5 0 0 0 1 0 3 0 2\nCheck your MegaRAID status with MegaCli\n\n    Logical drive status: MegaCli64 -LDInfo -Lall -aALL\n    Physical drives: MegaCli64 -PDList -aALL\n    Battery status: MegaCli64 -AdpBbuCmd -aAll\n    Controller info: MegaCli64 -AdpAllInfo -aALL\n\n# Adding a MegaRAID array\n##########################################################################\n\nAdd the drives physically, and look at MegaCli64 -PDList -aALL. Pay close attention to the \"Firmware state\". \"Online, Spin Up\" are used drives and should not be touched. Keep track of the Enclosure Device ID (just before the drive details) and the Slot number of drives that have the firmware status of \"Unconfigured (good)\". Also make sure you know the adapter (hopefully you will only have one adapter which would simplify things, find out with MegaCli64 -PDList -aALL | grep Adap).\n\nThe drive syntax is enclosureID:slot. So to create an array with two drives in RAID1 on adapter 0, type:\nMegaCli64 -CfgLdAdd -r1'[252:5,252:6]' -a0\nFor RAID 5, just replace r1 with r5.\nQuickly benchmark write performance\n\ndd of=bigfile if=/dev/zero bs=1M count=4000 oflag=direct,sync conv=fsync,sync\nCache might still be involved.\nQuickly benchmark single core encryption performance\n\nopenssl speed\nrsync over ssh chroot\n\nIt's easy to set up an SFTP chroot, but not obvious what to do when you need rsync to work too. Here's a quick way to set it up for a secure transfer (assuming you have a recent version of SSHd that supports ChrootDirectory):\nAdd this to /etc/ssh/sshd_config :\n\nMatch User rsyncuser\n   X11Forwarding no\n   AllowTcpForwarding no\n   ChrootDirectory /home/rsyncuser\n\nThen set up the user and chroot:\n\nUSER=rsyncuser\nadduser $USER\nmkdir -p /home/$USER/{usr/bin,lib64,bin,share}\nchown root:root /home/$USER\nchown $USER:$USER /home/$USER/share\ncp -av /bin/bash /home/$USER/bin\ncp -av /usr/bin/rsync /home/$USER/usr/bin\n\nThen either just copy/hardlink everything in /lib64 to /home/rsyncuser/lib64, or selectively copy (with cp -L) libraries that are actually used by bin/bash and usr/bin/rsync by using the output of ldd.\n\nTest it by SSHing into the box as $USER, and making sure bash works with no commands except rsync. You should then be able rsync as usual to /share:\nrsync -av ./ rsyncuser@yourserver.com:/share\nMake iptraf ignore SSH traffic\n\niptraf is really useful when trying to figure out what's taking up the bandwidth, but it wastes a lot of bandwidth trying to show the byte usage of the SSH session (which causes it to update, and use more SSH traffic to show up in iptraf).\nIgnoring SSH is quite tricky unless you know how; the key is that by default applying an empty filter will make it show nothing; so you need to have an explicit rule to show all traffic in the end :\n- Go to Filters -> IP -> Make sure there aren't any filters already in Edit filter.\n- Define a new filter-> Ignore SSH.\n- Press A to add to list. Make the IP address & widcard mask 0.0.0.0 on both destination & source. Source port is 0 to 0, destination port is 22 (or 2251) to 0. Then make sure you put a 'Y' in All IP and TCP. Then put 'E' in Include/Exclude. Enter to accept.\n- Press A to add to list again. Make everything 0.0.0.0 or 'Y', and make sure it's the default 'I' for include.\n- You then need to apply the filter.\nIf you ever edit the filter, it won't apply automatically. You have to detch and apply the filter again.\nSOCKS proxy with SSH\n\nYou may already know of ssh -D 33333 server1 , which creates a dynamic SOCKS proxy on your local machine which you can use in firefox to browse the network from server1's perspective.\nHowever, if you need more than just a browser, like say ssh or some app, you can use tsocks, which is in EPEL. Create a /etc/tsocks.conf in your machine with:\n\nserver = 127.0.0.1\nserver_port = 33333\n\nThen just use: tsocks yourApp . Eg. tsocks ssh 192.168.113.1\nStandard IMAPSYNC command\n\n(ext3/4) Because of how much imapsync gobbles up inodes, unless you have a huge (>600GB) /tmp, you may first want to create a separate imapsync folder, either in an existing large (>600GB) mount point, or in a new temporary logical volume formatted to maximize inodes with mkfs.ext4 -m 0 -i 4096 /dev/yourdevice.\n\nYou don't need everyone's password if your mail server supports imap admin accounts (like Zimbra, Cyrus, Dovecot, etc). Use something like this script:\n\n#!/bin/bash\n\nUSER=\"$1\"\nTMPDIR=\"/mnt/mailstore/imapsync\"\n\nSOURCE_IP=\"192.168.0.6\"\nSOURCE_PORT=\"143\"\nSOURCE_ADMIN_USER=\"admin\"\nSOURCE_ADMIN_PASSWORD=\"yourpass\"\n\nDESTINATION_IP=\"127.0.0.1\"\nDESTINATION_PORT=\"143\"\nDESTINATION_ADMIN_USER=\"admin\"\nDESTINATION_ADMIN_PASSWORD=\"yourpass\"\n\nif [[ \"$USER\" != *@* ]]; then\n        echo \"Usage: imapsync_user.sh username@domain\"\n        exit 2\nfi\n\nif [ ! -d \"$TMPDIR\" ]; then\n        echo \"Error: $TMPDIR does not exist\"\n        exit 2\nfi\n\n/root/apps/imapsync-master/imapsync --nolog --tmpdir $TMPDIR --usecache --useuid --nofoldersizes --nofoldersizesatend  --subscribe --syncinternaldates\\\n        --host1 $SOURCE_IP --port1 $SOURCE_PORT --user1 $USER --authuser1 $SOURCE_ADMIN_USER --password1 \"$SOURCE_ADMIN_PASSWORD\" \\\n        --host2 $DESTINATION_IP --port2 $DESTINATION_PORT --user2 $USER --authuser2 $DESTINATION_ADMIN_USER --password2 $DESTINATION_ADMIN_PASSWORD --delete2 --expunge2 | grep \"^-\"\n\nIf you are imapsyncing from Google, you need everyone's password, and can use:\n\n#!/bin/bash\n\nUSER=\"$1\"\nPASSWORD=\"$2\"\nTMPDIR=\"/opt/imapsync\"\n\nSOURCE_IP=\"imap.googlemail.com\"\nSOURCE_PORT=\"993\"\n\nDESTINATION_IP=\"127.0.0.1\"\nDESTINATION_PORT=\"143\"\nDESTINATION_ADMIN_USER=\"admin\"\nDESTINATION_ADMIN_PASSWORD=\"xxx\"\n\nif [[ \"$USER\" != *@* || -z \"$PASSWORD\" ]]; then\n        echo \"Usage: imapsync_user.sh username@domain password\"\n        exit 2\nfi\nif [ ! -d \"$TMPDIR\" ]; then\n        echo \"Error: $TMPDIR does not exist\"\n        exit 2\nfi\n\n# Gmail has a 2500 MB per day limit, so download 2GB at most, and run this script every day\n\n/root/apps/imapsync-master/imapsync --nolog --tmpdir $TMPDIR --usecache --useuid --nofoldersizes --nofoldersizesatend  --subscribe --syncinternaldates \\\n        --host1 $SOURCE_IP --port1 $SOURCE_PORT --user1 $USER --password1 \"$PASSWORD\" --ssl1 \\\n        --host2 $DESTINATION_IP --port2 $DESTINATION_PORT --user2 $USER --authuser2 $DESTINATION_ADMIN_USER --password2 $DESTINATION_ADMIN_PASSWORD \\\n        --skipcrossduplicates --folderlast \"[Gmail]/All Mail\" --noexpungeaftereach --exitwhenover 2000000000 \\\n        --delete2 --expunge2\n\nYou can then have a script to go through a user list to run the above script like:\n\n#!/bin/bash\n\ntrap \"exit\" INT\n\nINPUT=\"priority-list\"\n\nTOTAL=$(wc -l $INPUT | cut -d ' ' -f 1)\nCURRENT=1\n\nwhile read user; do\n        echo \"Currently in $CURRENT of $TOTAL, working on $user...\"\n        /root/scripts/migration/imapsync_user.sh $user\n        let CURRENT=CURRENT+1\ndone < $INPUT\n\nIf you're running zimbra, be sure to\ntelnet IMAP\n\nx login rizvir thepass\nx LIST \"\" \"*\"\nx SELECT INBOX\nx IDLE\ndone\nx logout\n\ntelnet SMTP with AUTH\n\nYou need the base64 version of the username and password; you can convert it using:\n\nperl -MMIME::Base64 -e 'print encode_base64(\"username\\@domain.com\");'\nperl -MMIME::Base64 -e 'print encode_base64(\"thepass\");'\n\nBe sure to escape special perl characters like @ and $.\n\nEHLO test.com\nAUTH LOGIN\n\n\nMAIL FROM: rizvir@rizvir.com\nRCPT TO: some@where.com\nDATA\nFrom: rizvir@rizvir.com\nTo: some@where.com\nSubject: Test\n\nJust a test\n.\n\ntelnet SMTP with TLS\n\nopenssl s_client -ign_eof -starttls smtp -crlf -connect mail.thedomain.com:25\nThen use the standard SMTP chat in the previous point.\ntelnet POP3/IMAP with SSL\n\nopenssl s_client -connect mail.thedomain.com:995 -crlf\n```\nZimbra stuff\n\nSearch & export email with a certain criteria:\nzmmailbox -z -m theuser@domain.com -t 0 getRestURL '//?fmt=tgz&query=tocc:\"ma-friend@gmail.com\" after:\"01/03/13\"' > mails.tar.gz\nDate format is in mm/dd/yy. -t 0 is to disable any timeouts\n\nTo import:\nzmmailbox -z -m theuser@domain.com -t 0 postRestURL '//?fmt=tgz&resolve=skip' mails.tar.gz\n\nThe REST resolve variable can be skip (ignore duplcates), modify (presumably changes existing items on conflicts), replace (presumbly delete and re-add things that conflicts), and finally the most dangerous one, reset, which deletes the entire folder (or the whole mailbox if you are restoring anything in the root).\n\nMove messages older than X date to a (created) folder called oldmail (it's limited to 1000 search results, so repeat this in a loop until all are done):\nzmmailbox -z -m theuser@domain.com search -t message -l 1000 \"in:/Inbox (before:04/15/09)\" | awk '{ print \"mm \" $2 \" /oldmail\"}' | tail -n +5 | head -n -1 > /tmp/zmmailbox-move\nzmmailbox -z -m theuser@domain.com < /tmp/zmmailbox-move", "creation_timestamp": "2026-09-29T13:52:23.000000Z"}