AWS Lambda to delete aws snapshots which are more than 2

import boto3
import datetime


def lambda_handler(event, context):
    client = boto3.client('rds')
    response = client.describe_db_instances()
    for dba in response['DBInstances']:
    snapshots = client.describe_db_snapshots(DBInstanceIdentifier=dba['DBInstanceIdentifier'], MaxRecords=50,SnapshotType='manual')['DBSnapshots']
    print(dba['DBInstanceIdentifier']+' '+str(len(snapshots)))
    snapshots.sort(key=getDate,reverse=True)
    if len(snapshots) > 2:
        num=0
        for eachsnap in snapshots:
            num=num+1
            if num>2:
                print('deleting '+ eachsnap['DBSnapshotIdentifier'])
                client.delete_db_snapshot(DBSnapshotIdentifier=eachsnap['DBSnapshotIdentifier'])
               
def getDate(ele):
    return ele['SnapshotCreateTime']

AWS Lambda to create a RDS Sanpshot

import boto3
import datetime

def lambda_handler(event, context):
    client = boto3.client('rds')
    response = client.describe_db_instances()
    for dba in response['DBInstances']:
      backup_name = 'backup-' + (dba['DBInstanceIdentifier'] + '-%s') % datetime.datetime.now().strftime("%y-%m-%d-%H-%M")
      client.create_db_snapshot(
              DBInstanceIdentifier=dba['DBInstanceIdentifier'],
              DBSnapshotIdentifier= backup_name,
              Tags=[
                  {
                      'Key': 'BackupType',
                      'Value': 'long-term'
                  },
              ]
          )
      print(backup_name+ "Snapshot Created")

Mount s3 bucket

Linux

1. Add below policy to IAM role

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket"],
"Resource": ["arn:aws:s3:::"]
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
],
"Resource": ["arn:aws:s3:::/*"]
}
]
}

2. wget https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/s3fs/s3fs-1.74.tar.gz
3. tar -zxvf s3fs-1.74.tar.gz
4. sudo yum install gcc libstdc++devel gcc-c++ fuse fuse-devel curl-devel libxm12-devel openssl-devel mailcap
5. cd s3fs-1.74
6. sudo yum install libxml2-devel
7. ./configure --prefix=/usr
8. make
9. make install
10. s3fs -o iam_role=""

Ubuntu:

11. Add below policy to IAM role

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket"],
"Resource": ["arn:aws:s3:::"]
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
],
"Resource": ["arn:aws:s3:::/*"]
}
]
}

12. wget https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/s3fs/s3fs-1.74.tar.gz
13. tar -zxvf s3fs-1.74.tar.gz
14. sudo apt-get install build-essential libcurl4-openssl-dev libxml2-dev mime-support
15. sudo apt-get install libfuse-dev libcurl4-openssl-dev libxml++2.6-dev libssl-dev
16. cd s3fs-1.74
17. ./configure --prefix=/usr
18. make
19. make install
20. s3fs -o iam_role=""

Iredmail Could not save new password. Encryption function missing

It's a bug of iRedMail, the latest Roundcubemail-1.2.0 changed sample config file of its password plugin, this causes iRedMail didn't correctly configure path of 'doveadm' command. Please fix it by following steps below:

*) Open file /opt/www/roundcubemail/plugins/password/config.inc.php, search parameter name "password_dovecotpw". Like this:

$config['password_dovecotpw'] =

*) You will find duplicate parameters, remove one of them, and make sure the remained one is set to:
$config['password_dovecotpw'] = '/usr/bin/doveadm pw';

Aws IAM Policy for S3 Bucket to put/get/list/delete

{
"Version": "2012-10-17",
"Id": "Policy1470210411143",
"Statement": [
{
"Sid": "Stmt123432456644",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::12345678903:user/amaresh"
},
"Action": [
"s3:DeleteObject",
"s3:GetObject",
"s3:ListBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::iam.sample.bucket",
"arn:aws:s3:::iam.sample.bucket/*"
]
}
]
}

Policy to restrict S3 bucket access to specific IP addresses

http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html

http://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html


{
"Id": "Policy1470283588127",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt12345674345788",
"Action": "s3:*",
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::iam.sample.bucket",
"arn:aws:s3:::iam.sample.bucket/*"
],
"Condition": {
"NotIpAddress": {
"aws:SourceIp": "183.82.101.68/27"
}
},
"Principal": "*"
}
]
}

Aws IAM Policy for user to start/stop Ec2 instance

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html


{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt14435321355",
"Action": [
"ec2:DescribeInstances"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:StopInstances",
"ec2:StartInstances"
],
"Resource": [
"arn:aws:ec2:us-east-1:1234567890:instance/i-1234567890abcder"
]
f
]
}
Action::
The action is the specific API action for which you are granting or denying permission
http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_Operations.html
ec2:DescribeInstances -> allows user to view only instances
ec2:Describe* -> allows user to view all resources

setting dkim record for multiple domains iredmail

From Source
http://www.iredmail.org/docs/sign.dkim.signature.for.new.domain.html

on RHEL/CentOS: it's /etc/amavisd/amavisd.conf.
on Debian/Ubuntu: it's /etc/amavis/conf.d/50-user.

Use existing DKIM key for new mail domain

if you already have a working DKIM and valid DKIM DNS record, it's ok to use this existing DKIM key to sign emails sent by other hosted mail domains. This way, you don't need to ask your customer who owns this new domain to add DKIM DNS record.

• Find below setting in Amavisd config file amavisd.conf:

dkim_key('mydomain.com', "dkim", "/var/lib/dkim/mydomain.com.pem");

@dkim_signature_options_bysender_maps = ( {
    ...
    "mydomain.com"  => { d => "mydomain.com", a => 'rsa-sha256', ttl => 10*24*3600 },
    ...
});

Add one line in @dkim_signature_options_bysender_maps, after "mydomain.com" line like below:

@dkim_signature_options_bysender_maps = ( {
    ...
    "mydomain.com"  => { d => "mydomain.com", a => 'rsa-sha256', ttl => 10*24*3600 },
    "new_domain.com"  => { d => "mydomain.com", a => 'rsa-sha256', ttl => 10*24*3600 },
    ...
});

• Restart Amavisd service.

Generate new DKIM key for new mail domain

If you or your customer prefer to use their own DKIM key, you can generate a new DKIM key and ask your customer to add DKIM DNS record. Refer to our tutorial to add DKIM DNS record.

• Generate new DKIM key (key length 1024) for new domain.

# amavisd-new genrsa /var/lib/dkim/new_domain.com.pem 1024

Note

• on different Linux/BSD distributions, the command may be amavisd.
• on RHEL/CentOS, you must specify the config file on command line like this:

# amavisd -c /etc/amavisd/amavisd.conf genrsa /var/lib/dkim/new_domain.com.pem

• Not all DNS vendors support 2048-bit key length as TXT type record, so iRedMail generates the key in 1024-bit. If you want to use 2048-bit instead, please specify the key length on command line:

# amavisd -c /etc/amavisd/amavisd.conf genrsa /var/lib/dkim/new_domain.com.pem 2048

• Find below setting in Amavisd config file amavisd.conf:

dkim_key('mydomain.com', "dkim", "/var/lib/dkim/mydomain.com.pem");

Add one line after above line like below:

dkim_key('new_domain.com', "dkim", "/var/lib/dkim/new_domain.com.pem");

• Find below setting in Amavisd config file amavisd.conf:

@dkim_signature_options_bysender_maps = ( {
    ...
    "mydomain.com"  => { d => "mydomain.com", a => 'rsa-sha256', ttl => 10*24*3600 },
    ...
});

Add one line after "mydomain.com" line like below:

@dkim_signature_options_bysender_maps = ( {
    ...
    "mydomain.com"  => { d => "mydomain.com", a => 'rsa-sha256', ttl => 10*24*3600 },
    "new_domain.com"  => { d => "new_domain.com", a => 'rsa-sha256', ttl => 10*24*3600 },
    ...
});

• Restart Amavisd service.

Again, don't forget to add DKIM DNS record for this new domain. The value of DKIM record can be checked with command below:

# amavisd-new showkeys

After added DKIM DNS record, please verify it with command:

# amavisd-new testkeys

Note: DNS vendor usually cache DNS records for 2 hours, so if above command shows "invalid" instead of "pass", you should try again later.

Use one DKIM key for all mail domains

For compatibility with dkim_milter the signing domain can include a '*' as a wildcard - this is not recommended as this way amavisd could produce signatures which have no corresponding public key published in DNS. The proper way is to have one dkim_key entry for each mail domain.

If you still want to try this, please follow below steps:

• Find below setting in Amavisd config file amavisd.conf:

dkim_key('mydomain.com', "dkim", "/var/lib/dkim/mydomain.com.pem");

• Replace it by below line:

dkim_key('*', "dkim", "/var/lib/dkim/mydomain.com.pem");

• Restart Amavisd serivce.

With above setting, all outbound emails with be signed with this dkim key. And Amavisd will show a warning message when start amavisd service:

dkim: wildcard in signing domain (key#1, *), may produce unverifiable signatures with no published public key, avoid!