Web Server and DNS on Apple using Homebrew

Installation:

Setup of package manager brew, see for latest https://brew.sh:

• /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

• echo >> /Users/"$USER"/.zprofile
• echo 'eval "$(/usr/local/bin/brew shellenv)"' >> /Users/"$USER"/.zprofile
• eval "$(/usr/local/bin/brew shellenv)"

• echo >> /Users/"$USER"/.zprofile
• echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/"$USER"/.zprofile
• eval "$(/opt/homebrew/bin/brew shellenv)"

Some in newer MacOS missing libs:

• brew install openssl

Install BBEdit from https://www.barebones.com/products/bbedit/index.html

• https://www.marvtherobot.com/multi-user-homebrew/

• sudo chgrp -R admin $(brew --prefix)
• sudo chmod -R g+rwX $(brew --prefix)

Debugging:

Check version and installation:

• brew doctor
• brew --version

Apples command line tools. If not automatically installed  then:

• xcode-select --install

If needed to re-install command tools do this command first to remove previous tools:

• sudo rm -rf /Library/Developer/CommandLineTools

• sudo chown -R "$USER":admin /usr/local
• sudo chown -R "$USER":admin /Library/Caches/Homebrew

You may get an error warning: homebrew-core is a shallow clone. Explanation: This restriction has been made on GitHub's request because updating shallow clones is an extremely expensive operation due to the tree layout and traffic of Homebrew/homebrew-core and Homebrew/homebrew-cask. We don't do this for you automatically to avoid repeatedly performing an expensive unshallow operation in CI systems (which should instead be fixed to not use shallow clones). Sorry for the inconvenience! Therefore, to `brew update`, first run:

• git -C /usr/local/Homebrew/Library/Taps/homebrew/homebrew-core fetch --unshallow

To remove brew alltogether:

• sudo brew services stop --all
  
• /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/uninstall/master/install.sh)"

Maintenance:

To upgrade all installed programs to newest version:

• brew update
• brew upgrade
• brew cleanup
• brew services list
• sudo brew services restart --all

Installation:

• brew install httpd
• sudo brew services start httpd
• sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add $(readlink -f $(which httpd)) --unblockapp $(readlink -f $(which httpd))

Debugging:

In a separate window show dynamically the tail of the error and access logfiles:

• tail -n 1000 -f /usr/local/var/log/httpd/error_log
• tail -n 1000 -f /usr/local/var/log/httpd/access_log

• sudo launchctl unload -w /System/Library/LaunchDaemons/org.apache.httpd.plist
• sudo apachectl stop
• sudo brew services restart httpd

To check what a site is running, if not installed install lynx first:

• brew install lynx
• lynx -dump -head <website> | grep ^Server

Check if deamon is running:

• ps -aef | grep httpd

• sudo apachectl -S

• sudo apachectl configtest

Maintenance:

To restart httpd:

• sudo brew services restart httpd
• sudo apachectl stop
• sudo apachectl -k restart

References:

• https://getgrav.org/blog/macos-ventura-apache-multiple-php-versions
  
• https://getgrav.org/blog/macos-bigsur-apache-multiple-php-versions
• https://getgrav.org/blog/macos-mojave-apache-multiple-php-versions
• https://getgrav.org/blog/macos-mojave-apache-mysql-vhost-apc
• https://getgrav.org/blog/macos-mojave-apache-ssl
• https://certbot.eff.org/lets-encrypt/osx-apache

Installation:

HTTPD config basic edits:

Note, we assume the web site directories to be in public_html in the users home directories and abandon the Apple Sites approach.

• bbedit /usr/local/etc/httpd/httpd.conf

1. Listen 8080 => Listen 80
2. enable ===> LoadModule mpm_event_module lib/httpd/modules/mod_mpm_event.so
3. disable ===> #LoadModule mpm_prefork_module lib/httpd/modules/mod_mpm_prefork.so
4. enable ==> LoadModule deflate_module lib/httpd/modules/mod_deflate.so
5. enable ===> LoadModule http2_module lib/httpd/modules/mod_http2.so
6. enable ==> LoadModule rewrite_module lib/httpd/modules/mod_rewrite.so
7. ServerAdmin root@localhost
8. #ServerName www.example.net:8080 ==> ServerName localhost:80
9. enable ==> Include /usr/local/etc/httpd/extra/httpd-autoindex.conf
10. add ===> Protocols h2 h2c http/1.1
    

Enable full filename display in case of directory index:

• bbedit /usr/local/etc/httpd/extra/httpd-autoindex.conf

add NameWidth=* to the line IndexOptions FancyIndexing HTMLTable VersionSort

1. ===> IndexOptions FancyIndexing HTMLTable VersionSort NameWidth=*

Enable example.net/~user.

• bbedit /usr/local/etc/httpd/httpd.conf

1. enable ==> LoadModule userdir_module lib/httpd/modules/mod_userdir.so
2. enable ==> Include /usr/local/etc/httpd/extra/httpd-userdir.conf

Optionally to enable (reverse) proxies.

• https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html

In httpd.conf:

• bbedit /usr/local/etc/httpd/httpd.conf

1. enable ==> LoadModule proxy_module lib/httpd/modules/mod_proxy.so
2. enable ==> LoadModule proxy_http_module lib/httpd/modules/mod_proxy_http.so

• bbedit /usr/local/etc/httpd/extra/httpd-vhosts.conf

• Listen 12345
  <VirtualHost *:12345>
      ProxyPass "/" "http://127.0.0.1:12344/"
      ProxyPassReverse "/" "http://127.0.0.1:12344/"
  </VirtualHost>

Or for https:// in the ssl vhost file below to embed traffic in ssl:


Listen 12345
<VirtualHost *:12345>
    ProxyPass "/" "http://127.0.0.1:12346/" retry=1 acquire=3000 timeout=10 Keepalive=On
    ProxyPassReverse "/" "http://127.0.0.1:12346/"
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.net/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.net/privkey.pem
</VirtualHost>

Debugging:

Maintenance:

Installation:

HTTPD config edits enable vhosts:

• bbedit /usr/local/etc/httpd/httpd.conf

1. enable ==> LoadModule vhost_alias_module lib/httpd/modules/mod_vhost_alias.so
2. enable ==> Include /usr/local/etc/httpd/extra/httpd-vhosts.conf

• bbedit /usr/local/etc/httpd/extra/httpd-vhosts.conf

Debugging:

If you hit permission errors:

• chmod -R 755 on each public_html directory.
  
• chmod +x /Users/$(whoami)

Maintenance:

Installation:

• brew install certbot

• sudo certbot certonly --apache  --cert-name le-cert
  

• sudo certbot certonly --apache --cert-name le-cert --staging

• sudo certbot certonly --apache --cert-name le-cert --force-renewal

If pre, post or deploy scripts are needed, those go here:

• /private/etc/letsencrypt/renewal-hooks

• sudo certbot certonly --standalone --pre-hook "apachectl stop" --post-hook "apachectl start" --cert-name le-cert -d example.net -d sub1.example.net -d sub2.example.net -d example2.net ...

or if one first wants to do a number of test runs for debugging:

• sudo certbot certonly --standalone --pre-hook "apachectl stop" --post-hook "apachectl start" --cert-name le-cert -d example.net -d sub1.example.net -d sub2.example.net -d example2.net ... --staging

• sudo certbot certonly --standalone --pre-hook "apachectl stop" --post-hook "apachectl start" --cert-name le-cert -d example.net -d sub1.example.net -d sub2.example.net -d example2.net ... --force-renewal

If pre, post or deploy scripts are needed, those go here:

• /private/etc/letsencrypt/renewal-hooks

• sudo certbot renew

We have to make a launchd plist, see:

• https://gist.github.com/jgillman/8b29c5d75f9fbcf30d55f1a0de535c5d
• https://ericfromcanada.github.io/output/2019/automatic-renewal-lets-encrypt-macos-server.html

Create plist:

• sudo mv com.letsencrypt.renew.plist /Library/LaunchDaemons/com.letsencrypt.renew.plist
• sudo chmod 644 /Library/LaunchDaemons/com.letsencrypt.renew.plist
• sudo chown root:admin /Library/LaunchDaemons/com.letsencrypt.renew.plist
• sudo launchctl load -w /Library/LaunchDaemons/com.letsencrypt.renew.plist
• sudo launchctl list | grep -i letsencrypt

If test runs are needed:

• sudo certbot renew --dry-run

HTTPD edits:

• bbedit /usr/local/etc/httpd/httpd.conf

Uncomment:

• bbedit /usr/local/etc/httpd/extra/httpd-ssl.conf

1. Make sure these parameters have following values:
   • SSLCipherSuite
     
   • SSLProxyCipherSuite TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256
   • SSLProtocol             -all +TLSv1.2 +TLSv1.3
   • SSLProxyProtocol        -all +TLSv1.2 +TLSv1.3
   • SSLHonorCipherOrder   on
   • SSLSessionTickets       off
   • SSLCompression          off
   • SSLOptions +StrictRequire
   • # Add vhost name to log entries:
   • LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
   • LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
2. point the certs at the correct places
   
   • SSLCertificateFile /etc/letsencrypt/live/le-cert/fullchain.pem
   • SSLCertificateKeyFile /etc/letsencrypt/live/le-cert/privkey.pem
3. change listen 8443 ==> listen 443
4. replace everything in the virtual host block including #<VirtualHost _default_:8443> and #</VirtualHost> by:
   
   <VirtualHost *:443>
       DocumentRoot "/usr/local/var/www"
       SSLEngine on
   </VirtualHost>
   
   <VirtualHost *:443>
       DocumentRoot "/Users/example/public_html "
       ServerName example.net
       ServerAlias www.example.net
       SSLEngine on
   </VirtualHost>
   <Directory "/Users/example/public_html ">
       Options Indexes FollowSymLinks
       AllowOverride All
       Require all granted
   </Directory>

The vhost edits:

The idea is that all requests that get through on port 80 or with incorrect url's/domain names end up in: "/usr/local/var/www"
and all requests that come in via https and correct domain names go to the correct webroots of those domains. For that purpose a rewrite rule takes care of redirection. This is in httpd-vhosts.conf
I use the following domain construction for example.net:

*                  catches all (sub)domains for which no other webroot is defined and points to "/usr/local/var/www"
example.net        this goes to the normal webroot of the domain example.net
www.example.net    also goes to the normal webroot of the domain example.net
sub1.example.net   a subdomain of example.net with its own webroot

in httpd-vhosts.conf:

• bbedit /usr/local/etc/httpd/extra/httpd-vhosts.conf

Debugging:

• sudo tail -f -n 1000 /var/log/letsencrypt/letsencrypt.log

To list the certificates:

• sudo certbot certificates

If test runs are needed:

• sudo certbot renew --dry-run

Some more debugging:

• https://letsdebug.net/

The configuration file is at: /etc/letsencrypt/renewal/

Maintenance:

• sudo certbot renew
• sudo certbot certificates

Installation:

• bbedit /usr/local/etc/httpd/httpd.conf

1. enable ==> LoadModule headers_module lib/httpd/modules/mod_headers.so
2. add at the end of the conf file:
   
   <IfModule headers_module>
     header set Strict-Transport-Security "max-age=31536000; preload"
     header set X-XSS-Protection "1; mode=block"
     header set X-Frame-Options "SAMEORIGIN"
     header set X-Content-Type-Options "nosniff"
     header set Referrer-Policy "same-origin"
     header set Content-Security-Policy "form-action 'self' https:; object-src 'self' https:; frame-ancestors 'self' https:; require-trusted-types-for 'script';"
   </IfModule>

Some experimental:
#  header set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
#  header set Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'; frame-ancestors 'self'; require-trusted-types-for 'script';"

References:

• https://wiki.mozilla.org/Security/Server_Side_TLS
• https://bettercrypto.org/
• https://ssl-config.mozilla.org/
• https://internet.nl/

Debugging:

Maintenance:

Installation:

A good web pages header for .html files: for UTF-8:

<!DOCTYPE html>
<html>
<head>
  <meta http-equiv="content-type" content="text/html; charset=utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=0.25, maximum-scale=4.0, user-scalable=yes">
  <style>
  body {color: white; background-color: black; font-family: Helvetica, Arial, sans-serif;}
  a:link {color: lightskyblue; background-color: transparent; text-decoration: underline;}
  a:visited {color: orange; background-color: transparent; text-decoration: underline;;}
  a:hover {color: yellow; background-color: transparent; text-decoration: underline;}
  a:active {color: red; background-color: transparent; text-decoration: underline;}
  </style>
  <title> </title>
</head>
<body>

or for windows-1252:

<!DOCTYPE html>
<html>
<head>
  <meta http-equiv="content-type" content="text/html; charset=windows-1252">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=0.25, maximum-scale=4.0, user-scalable=yes">
  <style>
  body {color: white; background-color: black; font-family: Helvetica, Arial, sans-serif;}
  a:link {color: lightskyblue; background-color: transparent; text-decoration: underline;}
  a:visited {color: orange; background-color: transparent; text-decoration: underline;;}
  a:hover {color: yellow; background-color: transparent; text-decoration: underline;}
  a:active {color: red; background-color: transparent; text-decoration: underline;}
  </style>
  <title> </title>
</head>
<body>

for no cache (hardly ever works :-( , see: https://cristian.sulea.net/blog/disable-browser-caching-with-meta-html-tags/ :

in style:

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0

<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
<meta http-equiv="Pragma" content="no-cache" />
<meta http-equiv="Expires" content="0" />

Debugging:

Maintenance:

Installation:

• brew install bind
• rndc-confgen -a

Edit the conf file:

• bbedit /usr/local/etc/bind/named.conf

directory "/usr/local/var/named";
version "unknown";
rate-limit {
           responses-per-second 10;
};

And create the zone files in:

• /usr/local/var/named/

• sudo brew services start bind
• sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add $(readlink -f $(which named)) --unblockapp $(readlink -f $(which named))

NOTE:
There are problems with bind and macos > 13.7.x:

• https://github.com/Homebrew/homebrew-core/issues/196028
  https://github.com/libuv/libuv/issues/4594

Debugging:

First set up a separate window with tail of logging:

• tail -f -n 1000 /usr/local/var/log/named/named.log

Some checks:

• rndc status
• named-checkconf -z /usr/local/etc/bind/named.conf
• host -t ns example.net

Maintenance:

• rndc sync -clean
• rndc reload
• sudo brew services restart bind
• sudo brew services stop bind

If the server for the domain gets a new ip address:

• on the primary server in /usr/local/etc/named.conf
• change ip address if needed for primary or secondary server entries
  
• change ip address in reverse pointer record entry
• on the primary server in /usr/local/var/named
• in all relevant zone files change the ip addresses
• also in those zone files increase the SOA serial numbers
• refresh the bind server with a bind restart or rndc reload
• at the dns registrar update the glue records
• at each of the secondary name servers in /usr/local/etc/named.conf
• change the appropriate ip addresses to the new values
• refresh the bind server with a bind restart or rndc reload
• request your ISP to update the reverse pointer for the ip addresses.

Installation:

• https://kb.isc.org/docs/aa-00626
• https://kb.isc.org/docs/aa-00711
• https://kb.isc.org/docs/dnssec-key-and-signing-policy
• https://www.sidn.nl/en/news-and-blogs/dnssec-signing-and-key-management-fully-automated
  
• https://www.sidn.nl/en/dnssec/dnssec-signatures-in-bind-named
• https://support.cloudflare.com/hc/en-us/articles/360021111972-Troubleshooting-DNSSEC
• https://shaunc.com/blog/article/migrating-from-autodnssec-to-dnssecpolicy-in-bind~aEpnuMVvmPF7
  

• The primary zone files: edit those to change records, etc.
  • /usr/local/var/named/example.net.zone
• The keys:
  • /usr/local/var/named/keys/
• Bind can automatically sign and will produce intermediate files in the same directory as the zone files.

• mkdir /usr/local/var/named/keys

Then we need to once generate the key for each zone file on the primary DNS server. That can be done with the following commands:

• dnssec-keygen -3 -a ECDSAP256SHA256 -K /usr/local/var/named/keys/ example.net
• dnssec-keygen -3 -a ECDSAP256SHA256 -f KSK -K /usr/local/var/named/keys/ example.net

Enable DNSSEC in named.conf by adding the following configuration directives inside options{ }:

• bbedit  /usr/local/etc/named.conf

• sudo brew services restart bind

Now we need the Delegation Signing records to supply to the parent zone manager. Note, some parent zone managers require the public key and generate the DS themselves. For the DS use dig and dnssec-dsfromkey using a SHA-256 algorithm:

• dig @127.0.0.1 dnskey example.net | dnssec-dsfromkey -2 -f - example.net

For the key alone:

• dig @127.0.0.1 dnskey +multiline example.net
  

Debugging:

• dig DNSKEY example.net @localhost +multiline

• dig A example.net @localhost +noadditional +dnssec +multiline

• dig +trace +noadditional DS example.net @8.8.8.8 | grep DS

• http://dnssec-debugger.verisignlabs.com
• http://dnsviz.net/

Maintenance:

Installation:

Zone file specials examples on MX, DMARC, SPF, CAA

MX

•  @              IN MX      10 smtp.example.net.

SPF

SPF (Sender Policy framework) record to indicate where email from this domain is approved to come from:

• @              IN TXT     "v=spf1 a mx -all"

• @              IN TXT     "v=spf1 -all"

DMARC

r=relaxed, s=strict

• _dmarc      IN TXT     "v=DMARC1; p=none; pct=100; aspf=r; adkim=r; rua=mailto:sysadmin@example.net"

Strict with spf and dkim:

• _dmarc      IN TXT     "v=DMARC1; p=quarantine; pct=100; aspf=s; adkim=s; rua=mailto:sysadmin@example.net"

CAA

• @              IN CAA     128 issue "letsencrypt.org"

Debugging:

Maintenance:

Installation:

Work in progress. Let's Encrypt makes that it needs to be renewed every 3 months, or needs an adapted server certificate. Based on:

1. https://blog.apnic.net/2017/01/06/lets-encrypt-dane/
   • https://www.huque.com/bin/gen_tlsa
     
2. https://www.internetsociety.org/blog/2016/01/lets-encrypt-certificates-for-mail-servers-and-dane-part-1-of-2/
3. https://stats.dnssec-tools.org/
   
4. https://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html
   • https://mail.sys4.de/pipermail/dane-users/2020-September/000579.html
     
5. Van Kruyt: https://kruyt.org/postfix-and-tls-encryption/
6. https://joscor.com/blog/dane-tlsa-tutorial/
7. Randy's method:
   • https://community.letsencrypt.org/t/making-a-dane-tlsa-to-work-with-le/2129
   • openssl x509 -in stuff5.pem -noout -pubkey | openssl rsa -pubin -outform DER | openssl dgst -sha256 -hex | awk '{print "le-ca TLSA 2 1 1", $NF}'
   • wget -q -O - https://letsencrypt.org/certs/2024/e5.pem | openssl x509 -noout -pubkey | openssl rsa -pubin -outform DER | openssl dgst -sha256 -hex | awk '{print "le-ca TLSA 2 1 1", $NF}' 

• https://crt.sh/?q=example.net
• study the current and recent issuer names, CN=<name>.

The current intermediate certificates from LetsEncrypt (see: https://letsencrypt.org/certs/) are:
Active: e5, e6, r10, r11

• https://letsencrypt.org/certs/2024/e5.pem
• https://letsencrypt.org/certs/2024/e6.pem
• https://letsencrypt.org/certs/2024/r10.pem
• https://letsencrypt.org/certs/2024/r11.pem
  

And their der formats:

• https://letsencrypt.org/certs/2024/e5.der
• https://letsencrypt.org/certs/2024/e6.der
• https://letsencrypt.org/certs/2024/r10.der
• https://letsencrypt.org/certs/2024/r11.der

le-ca IN TLSA 2 1 1 2bbad93ab5c79279ec121507f272cbe0c6647a3aae52e22f388afab426b4adba
le-ca IN TLSA 2 1 1 6ddac18698f7f1f7e1c69b9bce420d974ac6f94ca8b2c761701623f99c767dc7
le-ca IN TLSA 2 1 1 3586d4ecf070578cbd27aedce20b964e48bc149faeb9dad72f46b857869172b8
le-ca IN TLSA 2 1 1 d016e1fe311948aca64f2de44ce86c9a51ca041df6103bb52a88eb3f761f57d7

Backup: e7, e8, e9, r12, r13, r14

• https://letsencrypt.org/certs/2024/e7.der
• https://letsencrypt.org/certs/2024/r12.der

• wget -q -O - https://letsencrypt.org/certs/lets-encrypt-e5.der | openssl dgst -sha256 -hex | awk '{print "le-ca IN TLSA 2 1 1", $NF}'
• wget -q -O - https://letsencrypt.org/certs/2024/r10.der | openssl dgst -sha256 -hex | awk '{print "le-ca IN TLSA 2 1 1", $NF}'
• wget -q -O - https://letsencrypt.org/certs/2024/r11.der | openssl dgst -sha256 -hex | awk '{print "le-ca IN TLSA 2 1 1", $NF}'

• rndc reload
• rndc reconfig

Debugging:

Maintenance:

Installation:

Some thoughts about key management and key rotation:

If one goes for one key pair for several domains, one primary domain and several additional domains, all handled by the same mail server:

Assume a scheme of aliases to the prime domain. Do a number of aliases in each additional domain looking like:

$ORIGIN    additional.top.
...
key1._domainkey    IN CNAME key1._domainkey.prime.top.
key2._domainkey    IN CNAME key2._domainkey.prime.top.
key3._domainkey    IN CNAME key3._domainkey.prime.top.
key4._domainkey    IN CNAME key4._domainkey.prime.top.

In the prime domain each of them can point to either a retired or previous or current or a potential next key and rotate through those. so:

$ORIGIN    prime.top.
...
key1._domainkey IN TXT     "v=DKIM1;k=rsa;p="
key2._domainkey IN TXT     "v=DKIM1;k=rsa;p=MIIBIjANB etc etc etc"
key3._domainkey IN TXT     "v=DKIM1;k=rsa;p=HnYukyhgl etc etc etc"
; key4._domainkey IN TXT ==> to be used next time

Assume 4 key entries like this is enough (one previous retired, one old, one current and one to use next).
The to use next is commented out at the prime domain, so that when it gets used it is filled with key, uncommented  and can populate dns without cache issues. The scheme should be enough but can be expanded, and the scheme can still support individual keys per domain later with more editing.

• https://www.m3aawg.org/sites/default/files/m3aawg-dkim-key-rotation-bp-2019-03.pdf

Debugging:

Check for the DKIM record using dig on the same server.

• dig

Maintenance:

Installation:

For explanation see: https://www.uriports.com/blog/mta-sts-explained/
See also RFC 8461

In DNS zone file:

Debugging:

Maintenance:

Installation:

• For email I use MailServe from Cutedge Systems

Here some options to get a higher internet.nl score:

• Van Kruyt: https://kruyt.org/postfix-and-tls-encryption/
• https://tribut.de/blog/secure-your-services-using-sane-cipher-ordering

Debugging:

Maintenance:

Installation:

This procedure and port numbers come from:

• https://superuser.com/questions/1398824/cant-change-port-listen-on-macos-x-mojave-for-built-in-ssh
• http://www.iana.org/assignments/port-numbers

See also:

• https://hackertarget.com/ssh-examples-tunnels/

• ssh 22/udp # SSH Remote Login Protocol
• ssh 22/tcp # SSH Remote Login Protocol

and

• rfb             5900/tcp    vnc-server # VNC Server
• rfb             5900/udp    vnc-server # VNC Server

using the commandline sed commands for server side:

sudo sed -i -e 's+ 22/udp + 12322/udp +g' /etc/services
sudo sed -i -e 's+ 22/tcp + 12322/tcp +g' /etc/services
sudo sed -i -e 's+ 5900/tcp + 12359/tcp +g' /etc/services
sudo sed -i -e 's+ 5900/udp + 12359/udp +g' /etc/services
sudo launchctl unload -w /System/Library/LaunchDaemons/ssh.plist && sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist && sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.screensharing.plist

SSH tunnel for e.g. VNC where the vnc port number is not changed on the server side. Here we assume ssh over port 12345. After this tunnel setup one can use vnc to 127.0.0.1:5901 to reach the other machine:

• ssh -p 12345 -v -L 5901:127.0.0.1:5900 destination
• vnc://127.0.0.1:5901/

Debugging:

Maintenance:

Installation:

Purpose is to tunnel port 445 (SMB) through a ssh tunnel to get past port filtering of some ISP's to allow Apple Timemachine to work to remote servers. This is implemented by creating a network alias to loopback interface in order to have a local tunnel endpoint on port 445 (SMB). Then create keys for ssh if not already there, copy the key(s) to the timemachine server for password-less login. Then create a ssh tunnel from the local alias address to the remote server. The remote disk for backup can then be mounted as a normal smb disk by addressing the local alias address. The procedure:

Create an alias to be able to bind port 445 locally to a tunnel:

• sudo ifconfig lo0 alias 127.0.0.2/32

• ssh-keygen
• ssh -p <port> remoteuser@example.net
• ssh-copy-id -p <port> -i /Users/localuser/.ssh/id_rsa remoteuser@example.net

• ssh -p <port> remoteuser@example.net
• sudo ssh -p <port> -i /Users/localuser/.ssh/id_rsa remoteuser@example.net

• sudo ssh -f -C -N -p <port> -i /Users/localuser/.ssh/id_rsa -L 127.0.0.2:445:127.0.0.1:445 -o ServerAliveCountMax=3 -o ServerAliveInterval=15 -o ExitOnForwardFailure=yes remoteuser@example.net

• brew install ssh
• brew install autossh

Start the tunnel:

• sudo autossh -M 0 -f -C -N -p <port> -i /Users/localuser/.ssh/id_rsa -L 127.0.0.2:445:127.0.0.1:445 -o ServerAliveCountMax=3 -o ServerAliveInterval=15 -o ExitOnForwardFailure=yes remoteuser@example.net

Debugging:

Check if alias is up:

• ifconfig | grep 127

• ps aux | grep tunnel

Unload deamon:

• ifconfig | grep 127
• ps aux | grep ssh

Maintenance:

NOTE: this all works but is not persistent. After a reboot the following needs to be redone:

• sudo ifconfig lo0 alias 127.0.0.2/32
• sudo ssh -f -C -N -p <port> -i /Users/localuser/.ssh/id_rsa -L 127.0.0.2:445:127.0.0.1:445 -o ServerAliveCountMax=3 -o ServerAliveInterval=15 -o ExitOnForwardFailure=yes remoteuser@example.net

Installation:

• sudo mv startup-ssh.sh /usr/local/var/startup-ssh.sh
• sudo chmod +x /usr/local/var/startup-ssh.sh

• sudo mv localhost.startup-ssh.plist /Library/LaunchDaemons/localhost.startup-ssh.plist
• sudo chmod 644 /Library/LaunchDaemons/localhost.startup-ssh.plist
• sudo chown root:admin /Library/LaunchDaemons/localhost.startup-ssh.plist
• sudo launchctl load -w /Library/LaunchDaemons/localhost.startup-ssh.plist

Debugging:

Unload/load and check for deamon:

• sudo launchctl list | grep -i startup-ssh
• ps aux | grep ssh
  
• sudo launchctl unload -w /Library/LaunchDaemons/localhost.startup-ssh.plist
• sudo launchctl load -w /Library/LaunchDaemons/localhost.startup-ssh.plist

Maintenance:

Installation:

There are multiple ways to handle sleep and power settings. One way is pmset, but also systemsetup can set a number of parameters. Here pmset configuration is handled.

• sudo mv startup-power.sh /usr/local/var/startup-power.sh
• sudo chmod +x /usr/local/var/startup-power.sh
• sudo chmod 644 localhost.startup-power.plist
• sudo mv localhost.startup-power.plist /Library/LaunchDaemons/localhost.startup-power.plist
• sudo chown root:admin /Library/LaunchDaemons/localhost.startup-power.plist
• sudo launchctl load -w /Library/LaunchDaemons/localhost.startup-power.plist

Debugging:

Unload/load and check for deamon:

• sudo launchctl list | grep -i startup-power
• sudo launchctl unload -w /Library/LaunchDaemons/localhost.startup-power.plist
• sudo launchctl load -w /Library/LaunchDaemons/localhost.startup-power.plist

Restore to defaults:

• sudo pmset restoredefaults

Maintenance:

Alternative, to be checked:

• sudo systemsetup -setcomputersleep Never
• man systemsetup

Installation:

Here are TimeMachine cli commands to start up, stop, get info, etc. The info comes from:

• https://www.macworld.com/article/2033804/control-time-machine-from-the-command-line.html

• man tmutil

• sudo tmutil enable
• sudo tmutil disable

To get the status of anything going on or progressing:

• tmutil status

• tmutil startbackup

• tmutil stopbackup

• sudo tmutil disablelocal
• sudo tmutil enablelocal

• sudo tmutil addexclusion <path of folder/file to exclude>

• tmutil destinationinfo

• tmutil removedestination ......

• tmutil setdestination volume_name

• tmutil listbackups

Debugging:

This procedure is to correct errors like: "Time Machine completed a verification of your backups. To improve reliability, Time Machine must create a new backup for you.". It may or may not work. The procedures come from:

• http://www.garth.org/archives/2011,08,27,169,fix-time-machine-sparsebundle-nas-based-backup-errors.html
• https://apple.stackexchange.com/questions/18482/repair-time-machine-sparsebundle-that-will-no-longer-mount
• https://swissmacuser.ch/hfs-volume-data-recovery-diskutility-could-not-mount-error-49153/
  

• sudo chflags -R nouchg   <the backup bundle>
• sudo hdiutil attach -nomount -noverify -noautofsck <the backup bundle>

If you have apfs:

• sudo fsck_apfs -o -v -s   /dev/diskXs2
• if you get the “Operation not permitted” Error, give the terminal.app full disk access in the preferences privacy panel.
  

if you have hfs:

• sudo fsck_hfs -c 2g -drfy /dev/diskXs2
• if you get the “Operation not permitted” Error, give the terminal.app full disk access in the preferences privacy panel.

• sudo fsck_hfs -c 2g -p /dev/diskXs2
  
• sudo fsck_hfs -c 2g -drfy /dev/diskXs2

To scan for bad blocks:

• sudo fsck_hfs -S /dev/diskXs2

• sudo hdiutil detach /dev/diskXs2

• bbedit <the backup bundle>/com.apple.TimeMachine.MachineID.plist

• sudo tail -f -n 1000 /var/log/fsck_hfs.log
• log show --predicate 'subsystem == "com.apple.TimeMachine"' --info | grep 'upd: (' | cut -c 1-19,140-999

Sometimes a lock on the sparse bundle seems to block mounting the image. Disabling and re-enabling sharing on the server also seems to fail, even after reboot. What worked was stopping and starting the smbd plist:
Quote: Today I've been really logging everything and watching the system constantly and found that if I kill SMB and restart it then everything works again, including unlocking the sharing pane. I use:

• sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.smbd.plist
• sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.smbd.plist

Maintenance:

Installation:

See:

• https://dortania.github.io/OpenCore-Legacy-Patcher/
• https://dortania.github.io/OpenCore-Legacy-Patcher/START.html
• https://github.com/dortania/OpenCore-Legacy-Patcher/blob/main/SOURCE.md

Debugging:

If GUI is not possible:

sudo /Applications/OpenCore-Patcher.app/Contents/MacOS/OpenCore-Patcher --patch_sys_vol

sudo /Applications/OpenCore-Patcher.app/Contents/MacOS/OpenCore-Patcher -h

usage: OpenCore-Patcher [-h] [--build] [--verbose] [--debug_oc] [--debug_kext] [--hide_picker]
                        [--disable_sip] [--disable_smb] [--vault] [--support_all] [--firewire]
                        [--disable_tb] [--force_surplus] [--model MODEL] [--disk DISK]
                        [--smbios_spoof SMBIOS_SPOOF] [--nvme] [--wlan] [--moderate_smbios]
                        [--patch_sys_vol] [--unpatch_sys_vol] [--validate] [--gui_patch]
                        [--gui_unpatch] [--auto_patch] [--update_installed]

options:
  -h, --help            show this help message and exit
  --build               Build OpenCore
  --verbose             Enable verbose boot
  --debug_oc            Enable OpenCore DEBUG
  --debug_kext          Enable kext DEBUG
  --hide_picker         Hide OpenCore picker
  --disable_sip         Disable SIP
  --disable_smb         Disable SecureBootModel
  --vault               Enable OpenCore Vaulting
  --support_all         Allow OpenCore on natively supported Models
  --firewire            Enable FireWire Booting
  --nvme                Enable NVMe Booting
  --wlan                Enable Wake on WLAN support
  --moderate_smbios     Moderate SMBIOS Patching
  --disable_tb          Disable Thunderbolt on 2013-2014 MacBook Pros
  --force_surplus       Force SurPlus in all newer OSes
  --model MODEL         Set custom model
  --disk DISK           Specifies disk to install to
  --smbios_spoof SMBIOS_SPOOF
                        Set SMBIOS patching mode
  --patch_sys_vol       Patches root volume
  --unpatch_sys_vol     Unpatches root volume, EXPERIMENTAL
  --validate            Runs Validation Tests for CI
  --gui_patch           Starts GUI in Root Patcher
  --gui_unpatch         Starts GUI in Root Unpatcher
  --auto_patch          Check if patches are needed and prompt user
  --update_installed    Prompt user to finish updating via GUI

Maintenance:

Installation:

Resolving Trusted Execution Problems

see: https://developer.apple.com/forums/thread/706442

see: https://www.reddit.com/r/mac/comments/11hiuyl/firewall_options_macos_not_saving_after_closing/

Debugging:

Maintenance:

Installation:

Debugging:

How to solve the error: "Apple Calendar Can’t Save Event to Exchange":

See: https://michaelkummer.com/tech/apple/macos-calendar-exchange/

• Quit Calendar application (Command + Q)
• Quit Apple Mail
• Open Activity Monitor (through Spotlight or Launchpad)
• Search for "Calendar" and quit all the relevant processes
• Open Finder and navigate to ~/Library/Calendars
• Double-check Activity Monitor to make sure no Calendar-related processes are running
• Delete cache files
• Relaunch Calendar

How to solve sync errors with O365:

sudo launchctl stop com.apple.CalendarAgent
sudo launchctl start com.apple.CalendarAgent

sudo pkill -9 -i calendar

Maintenance:

Installation:

See:

• https://fasterdata.es.net/performance-testing/network-troubleshooting-tools/

Debugging:

iperf

Server:

• iperf -s -i 4 -w 3M

• iperf -i 4 -t 1000 -N -w 3M -l 1M -c [servername]

iperf3

Server:

• iperf3 -s -i 5

• iperf3 -i 4 -t 1000 -N -w 3M -l 1M -c [servername]

nuttcp

On the server:

• nuttcp -S

• nuttcp [servername]

Maintenance:

Installation:

See:

• https://github.com/homebridge/homebridge/wiki/Install-Homebridge-on-macOS

• brew install node.js

• node -v
• npm -v

• sudo npm install -g --unsafe-perm homebridge homebridge-config-ui-x

• npm audit fix
• npm i --package-lock-only
• sudo hb-service install

• sudo launchctl unload -w /Library/LaunchDaemons/com.homebridge.server.plist
• sudo launchctl load -w /Library/LaunchDaemons/com.homebridge.server.plist

• npm uninstall -g homebridge

Debugging:

If the underlying node.js software is upgraded by brew, the homebridge will fail after restart. The correct procedure:

• sudo hb-service stop
• sudo launchctl unload -w /Library/LaunchDaemons/com.homebridge.server.plist
• sudo launchctl load -w /Library/LaunchDaemons/com.homebridge.server.plist
• sudo hb-service start

Oter usefull commands:

• Restart Command         sudo hb-service restart
• Stop Command             sudo hb-service stop
• Start Command             sudo hb-service start
• View Logs Command    hb-service logs

Maintenance:

Installation:

• After a brew upgrade some services may not work. One difficult to diagnose problem may be the firewall settings in MacOSX. It blocks by default incoming connections on unsigned bin's and executables need to be added in the list in the System Preferences Firewall settings. Also note that just putting there the /usr/local/bin/executable will not work since brew puts aliasses (links) there. Follow the link to the real bin. Same for /usr/local/sbin .
• Somehow launchd has a different or incomplete PATH environment. Caused certbot renew to initially fail.
• System upgrade using cli:
• to get a list of available updates:
• softwareupdate -l
• to update a specific package:
• softwareupdate -i NAME
• to update all:
• softwareupdate -i -a
• for hlep:
• softwareupdate -h
• for configuration data
• softwareupdate -l --include-config-data
• and
• softwareupdate -i --include-config-data NAME
  
• System version info:
• Show Apple hardware and software configuration:
• system_profiler
• Show Mac OS X operating system version:
• sw_vers
• Print just the value of the ProductName property:
  
• sw_vers -productName
• Display the value of the ProductVersion property
• sw_vers -productVersion
• Display the build version:
  
• sw_vers -buildVersion
  
• If the mac is using lots of processes to index for SpotLight, to turn indexing off:
• sudo mdutil -a -i off
• and on:
  
• sudo mdutil -a -i on
  
• If you use screensharing and end the session, the target screen typically goes dark and locks. If you want the screen to stay on, then <see https://discussions.apple.com/thread/7345064>:
• sudo defaults write /Library/Preferences/com.apple.RemoteManagement RestoreMachineState -bool NO
• A mac that is protected with filevault may not reboot gracefully because a password is needed to access the startup disc. A way to do a reboot is:
• sudo fdesetup authrestart
• if you need to log out another user:
  • ps awwwwux | grep loginwindow
  • kill the pid of that user with:
  • sudo kill -9 [pid]
• Support files can be found HERE.
• SSH plus Screensharing
  • ssh -p 22 -N -L 5999:localhost:5900 user@example.net
  • vnc://localhost:5999
• If you have screensharing on a different port number to reload screensharing with the new port number:
• sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.screensharing.plist &&  sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.screensharing.plist
  
• Starting/stopping remote desktop. The commands in this article https://support.apple.com/en-us/HT201710  work with Apple Remote Desktop 3.2 and later. Here are commands that you can use:
  • Restart the ARD Agent and helper:
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -restart -agent
  • Turn on Remote Desktop Sharing, allow access for all users, and enable the menu extra:
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -allUsers -privs -all -clientopts -setmenuextra -menuextra yes
  • Turn on Remote Desktop Sharing, allow access for specified users:
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -specifiedUsers
  • You must use the -configure, -access, and -privs options in a separate command to specify the set of users and their access privileges. For example, this command is for users with the short names "teacher" and "student." It gives them access to observe (but not control) the computer, and to send text messages:
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users teacher,student -access -on -privs -ControlObserve -ObserveOnly -TextMessages
  • Unlike other kickstart options, you can’t combine the allowAccessFor options with other kickstart options. You must use it as in the last two samples above. You might have to call kickstart more than once to finish a computer’s setup. Remove access privileges for specified users ("student" in this example):
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users student -access -off
  • Disable ARD Agent and remove access privileges for all users:
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off
• Shell need to change from bash to zsh now:
  • The default interactive shell is now zsh. To update your account to use zsh, please run `chsh -s /bin/zsh`. For more details, please visit https://support.apple.com/kb/HT208050.
    • cp .bash_profile .zshrc
    • chsh -s /bin/zsh
  • restart terminal
    • brew doctor
• How to get into a home router management interface:
• TP-Link
• http://tplinkwifi.net
  
• NetGear
• http://routerlogin.net
• Routing
• lsof -i -P
• netstat -rn
• The principles/info/utilities here:
• http://www.sustworks.com/site/prod_ipnrx_help/html/AlternateRouteHelp.html
• http://www.macosxhints.com/article.php?story=20050214200529336&query=setup
• http://developer.apple.com/documentation/Darwin/Reference/ManPages/man8/routed.8.html
• If an app is not signed to run, like SeaMonkey:
• codesign --deep --sign - /Applications/SeaMonkey.app
  

Debugging:

Maintenance: