1. Prepare a certificate
------------------------
either: request a certificate for your elog URL from your web administrator
- the private key must not be password-protected
- the 'common name' must be the URL of your elog server

or: create a self-signed certificate yourself with the OpenSSL package
- as root user, create a self-signed certificate with the command

root@localhost:# openssl req -new -x509 -config /etc/ssl/openssl.cnf -keyout stunnel.pem -out stunnel.pem -days 365 -nodes

- this creates a self-signed certificate (-x509) whith one year validity (-days 365)
  and no password protection for the private key (-nodes)
- private key and certificate are written to the same file, "stunnel.pem"

Answer all questions, making sure that the 'common name' is the URL under which users
are to reach your elog server.

For more information on how to create and/or manage SSL certificates, see e.g.
http://www.ibiblio.org/pub/Linux/docs/HOWTO/SSL-Certificates-HOWTO

Notice: Unless your web administrator can procure a certificate signed by an established
        CA, your elog users will be asked if they want to accept your (unverifiable) certificate
        when connecting to your elog server. This is no problem at all but can lead to
        questions if your users are unsure about this.


2. Adapt the certificate file to stunnel4 conventions
-----------------------------------------------------
The certificate filename must be the MD5 checksum:
- Retrieve the MD5 checksum of your certificate with

root@localhost:# openssl x509 -hash -noout -in stunnel.pem 

abcdefgh

- Rename the certificate file accordingly

root@localhost:# mv stunnel.pem abcdefgh.0

- Move the certificate file to the standard location, e.g. /etc/ssl/certs
- change the permissions of the file to -rw-------
- make sure there is a blank line between
  -----END RSA PRIVATE KEY----- and -----BEGIN CERTIFICATE-----
  and a blank line after
  -----END CERTIFICATE-----
  in your certificate file.


3. Configure stunnel4
---------------------
Install the stunnel4 package (if not already done).
Modify the configuration file (e.g. /etc/stunnel/stunnel.conf, depending on your
distribution):

- general options:
  cert = /etc/ssl/certs/abcdefgh.0    ; put the name of your certificate file here
  debug = 4                           ; otherwise ALL connection attempts will be logged to your syslog
  pid = /var/run/stunnel4/stunnel.pid ; check where the other services write their pid-files, depends 
                                      ; somewhat on the distribution

- comment out all lines containing chroot options
- comment out all CA lines
- comment out all service sections except the HTTPS section, which should look as follows

[https]
accept  = 443       ; i.e. stunnel listens on port 443, the standard https port
connect = 8080      ; and forwards all connections to port 8080 (use the port under which
                    ; your elogd is running here!)
TIMEOUTclose = 0    ; for buggy MS Internet Explorers, see the stunnel4 manpage


Some Linux distributions require that in the file /etc/defaults/stunnel4 the option ENABLED be set
to ENABLED=1. If not, the stunnel will not be started at system bootup.


4. Start the stunnel4 server
----------------------------
root@localhost# stunnel4 /etc/stunnel/stunnel.conf

Your elog should now be accessible via

https://your.elog.server

cert = /etc/ssl/certs/abcdefgh.0
pid = /var/run/stunnel4/stunnel.pid

; Some performance tunings
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1

; Some debugging stuff useful for troubleshooting
debug = 4

; Service-level configuration
[https]
accept  = 443
connect = 8080
TIMEOUTclose = 0

<?xml version="1.0"?>
<!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">

<!--
	Copyright (c) 2005-06-17 Peter Eriksson (peter@ifm.liu.se)

	This manifest can be used to manage an elog daemon using the 
	Solaris SMF subsystem.

	Import this manifest using: 

		svccfg -v import elog.xml
	
        Then activate the daemon with:

		svcadm enable site/elog
-->

<service_bundle type='manifest' name='IFM:elog'>

<service
	name='site/elog'
	type='service'
	version='1'>

        <single_instance />

	<!-- Need / & /usr filesystems mounted, /var mounted read/write -->
	<dependency
		name='fs-local'
		type='service'
		grouping='require_all'
		restart_on='none'>
		<service_fmri value='svc:/system/filesystem/local' />
	</dependency>

        <dependency
            name='network-service'
            grouping='require_all'
            restart_on='none'
            type='service'>
                <service_fmri value='svc:/network/service' />
        </dependency>

        <dependency
            name='name-services'
            grouping='require_all'
            restart_on='refresh'
            type='service'>
                <service_fmri value='svc:/milestone/name-services' />
        </dependency>
	
	<exec_method
		type='method'
		name='start'
		exec='/ifm/sbin/elogd -D -c /ifm/etc/elogd.cfg'
		timeout_seconds='60'>
	</exec_method>

	<exec_method
		type='method'
		name='stop'
		exec=':kill'
		timeout_seconds='30'>
	</exec_method>

	<instance name='default' enabled='false' />

	<stability value='Evolving' />

	<template>
		<common_name>
			<loctext xml:lang='C'>
			Electronic Logbook server
			</loctext>
		</common_name>
		<documentation>
			<manpage title='elogd' section='1' manpath='/usr/local/man' />
		</documentation>
	</template>
</service>

</service_bundle>

#!/bin/bash
#
# Makes thumbnails (a jpeg image) from a given set of input files.
# Supported input file types are those supported by 'convert',
# plus PDF.
# Requires convert(1), gs(1) and file(1)
#
# Usage:      make_thumbs [options] [ file1 file2 ... ]
# Author:     Emiliano Gabrielli
# License:    GPL
# Latest Version at http://SuperAlberT.it/download/command_line_scripts/elog/
#
# $Id: make_thumbs,v 1.7 2005/04/14 10:01:37 albert Exp $

function parse_cmdline()
{
	export OPTERR=1
	while getopts "s:q:Vh" "option" ; do
		case "$option" in
		s)
			MAXSIZE=$OPTARG
			;;
		q)
			QUALITY=$OPTARG
			;;
		V)
			echo "$0 version $VERSION by $AUTHOR"
			exit 1
			;;
		h|*)
			echo -e "\nUsage: make_thumb [options] [ file1 file2 ... ]"
			echo -e "Options:\n"\
			        " -s MAXSIZE  the size of the thumbnail to be created\n"\
			        " -q QUALITY  the quality of the JPEG image created\n"\
				    " -V          print version and exit\n"\
				    " -h          print this help and exit\n"
			exit 1
			;;
		esac
	done
}

function make_thumb()
{
	[ ! -z "$1" ] || exit 1
	FILE="$1"

	# Test if file is readable
	if ! [ -r "$FILE" ] ; then
		echo "ERROR in $0: $FILE is not readable."
		exit 1
	fi
	THUMBFILE="$FILE.thumb"
	EXTENSION="`echo \"$FILE\" | sed 's/.*\.\([^.]*\)$/\1/'`"

	# we need this extension in order to instruct 'convert'
	# will be renamed at the end of the job
	JPEGFILE="$THUMBFILE.jpg"
	ROTATE=""

	# PDF needs special handling
	if [[ `file $FILE | grep "PDF document"` ]] ||
	   [[ `file $FILE | grep "PostScript document"` ]]
	then
	    # look if we should rotate
		DEG=`head -200 $FILE | strings | grep "/Rotate " | head -1 | sed -e 's#.*/Rotate \([0-9]\+\).*#\1#'`
		[ ! -z "$DEG" ] && ROTATE="-rotate $DEG"
		# Extract first page and convert: PDF -> PS -> JPEG (needs 'gs' and 'convert')
		gs -q -dNOPAUSE -dBATCH -r75 -dLastPage=1 -sDEVICE=jpeg -sOutputFile=\|cat "$FILE" | \
		convert - $ROTATE -size ${MAXSIZE}x${MAXSIZE} -resize ${MAXSIZE}x${MAXSIZE} -quality $QUALITY +profile "*" "$JPEGFILE" &&
		mv "$JPEGFILE" "$THUMBFILE" &

	# Else it must be one of the following: postscript, JPEG, GIF, TIFF, RS
	elif [[ `file $FILE | grep "\(JPEG\|GIF\|PNG\|TIFF\) image data"` ]] ||
		 [[ "$EXTENSION" == "rs" ]]   || [[ "$EXTENSION" == "RS" ]]
	then
		convert -size ${MAXSIZE}x${MAXSIZE} "$FILE" -resize ${MAXSIZE}x${MAXSIZE} -quality $QUALITY +profile "*" "$JPEGFILE" &&
		mv "$JPEGFILE" "$THUMBFILE" &
	fi
}


AUTHOR="Emiliano 'AlberT' Gabrielli"
VERSION="0.2.0"
MAXSIZE=600   # default value
QUALITY=70    # default value

parse_cmdline $@
shift `expr $OPTIND - 1`

for file in "$@" ; do
	make_thumb $file
done

# vim:ai:ts=4:sw=4:

### Here be things to make the elogd daemon invisibly secure under an
### Apache SSL proxy virtual host.  Arrrrrr!
### ----This config file be mostly written by Jonathan Hanson, 11/23/04
### ----With some help from a few old salts on the net.



### This be the first instance of SSL in our setup, so the SSL module
### Must be called.  This can be commented out if it don't put wind in
### your sails.
LoadModule ssl_module modules/mod_ssl.so

### Ahoy, ye scurvy land dogs! Listen to the SSL port (443) or may the
### sea beasts take ye!
Listen 443

### Make a virtual host at the default server name, and assign it port 443.
<VirtualHost _default_:443>
	### Here be standard configuration for the Virtual Host
	ServerAdmin your_e-mail_address
	ServerName _default_:443
	RequestHeader set Front-End-Https "On"
	
	### This be the path to the elog directory 
	### (This didn't seem to make any difference, but it be a good
	###  idea nonetheless)
	DocumentRoot /usr/local/elog
	
	### Here be the setup for the SSL component of the Virtual Host
	SSLEngine On
	SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
	SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.pem
	
	### Here be the setup options for the Proxy module
	ProxyRequests Off
	ProxyPreserveHost On
	
	### This be the root of the new Virtual Host, and it should be
	### redirected to the port the elogd server is listening to 
	### (8079 on our poop deck).
	<Location />
		ProxyPass http://your.host.name:8079/
		ProxyPassReverse http://your.host.name:8079/
		SSLRequireSSL
	</Location>

	### Shiver me timbers!  A firewall can be laid across the elog
	### port to hinder direct access from the outside world to the elog
	### daemon.  This'll make the scurvy wretches come in through the apache
	### proxy virtual host, and batten down the hatches on the elog in general.

</VirtualHost>



### Our previous elog configuration was at http://your.host.name:8080 and some of our
### users made static HTML links to other posts in their posts and email.  They be sleeping 
### in Davy Jones's locker in the briney deep now, but we be needing to make these posts 
### backward-compatible.  We be changing the port Elogd listens to (as above) to 8079, and
### then we be using another new virtual host at port 8080 to redirect to the new SSL URL.
### So it appears to the landlubbers outside as if a normal elog server is listening to port
### 8080, but in reality it be a Virtual Host redirecting through the other SSL virtual host
### which then be passing it on to the port the elog server really be listening to.
### If ye not be needing this backwards compatability, the following section can be made
### to walk the plank.

### I won't be telling ye twice, ye slimy bilge rat!  Pay attention to what 
### used to be the old elog port(8080).
Listen 8080

<VirtualHost _default_:8080>
	### Here be standard configuration for the Virtual Host
	ServerAdmin your_e-mail_address
	ServerName _default_:8080
		
	### This be the path to the html directory 
	### (This didn't seem to make any difference, but it be a good
	###  idea nonetheless)
	DocumentRoot /httpd/html
	
	### Here be the dark magic of mod_rewrite.  Quake in your boots ye dogs!
	<IfModule mod_rewrite.c>
		RewriteEngine On
		RewriteRule ^/(.*) https://your.host.name/$1 [NC,R=301,L]
	</IfModule>
	
</VirtualHost>

### In the end, elog be reachable through either https://your.host.name/ 
### or http://your.host.name:8080/ , though the latter will be rewritten
### to the former as soon as the request be made.  This be satisfying our 
### needs for backwards compatbility with old URLs, while ensuring modern 
### secure SSL support.  Beware matey, recognize that we also had to change
### the port that elog listens to, and then add a URL line in the elogd.cfg
### file:
###      port = 8079
###      URL = https://your.host.name/
### Also a firewall was brought up and told to allow through only ports 
### 80(html), 443(SSL), and 8080(the elog stand-in) and of course any other 
### ports ye may need for other applications.

#!/usr/bin/perl -w

=head1 NAME

doelog - save a mime message to elog

=head1 SYNOPSIS

    doelog <mime-msg-file> <mime-msg-file> ...
    
    someprocess | doelog -

=head1 DESCRIPTION

Takes one or more files from the command line that contain MIME
messages, and explodes their contents out into /tmp.  The parts
are sent to elog as attachments.

Modified mimeexplode of the MIME::Tools in perl


This was written as an example of the MIME:: modules in the
MIME-parser package I wrote.  It may prove useful as a quick-and-dirty
way of splitting a MIME message if you need to decode something, and
you don't have a MIME mail reader on hand.

=head1 COMMAND LINE OPTIONS

None yet.  

=head1 AUTHOR

sak@essc.psu.edu

=cut

BEGIN { unshift @INC, ".." }    # to test MIME:: stuff before installing it!

require 5.001;

use strict;
use vars qw($Msgno $cmd);

use MIME::Parser;
use Getopt::Std;

## these should be options too?
## base elog cmd
$cmd = "~/elog -h localhost -p 8080 ";

#------------------------------------------------------------
# dump_entity - dump an entity's file info
#------------------------------------------------------------
sub dump_entity {
    my $ent = shift;
    my @parts = $ent->parts;
    my $file;
    
    die "too many attachments\n" if ($#parts>10);

    if (@parts) {        # multipart...
	map { dump_entity($_) } @parts;
    }
    else {               # single part...append to elog cmd
	$file = $ent->bodyhandle->path;
	$cmd .= "-f \"$file\" ";
##	print $cmd, "\n";
##	print "    Part: ", $ent->bodyhandle->path, 
##	      " (", scalar($ent->head->mime_type), ")\n";
    }
}

#------------------------------------------------------------
# main
#------------------------------------------------------------
sub main {
    my $file;
    my $entity;
    my $subject;
    my $logbook;
    our($opt_l);

    # Sanity:
    ## (-w ".") or die "cwd not writable, you naughty boy...";

    ## check if user wants a particular logbook
    ## fix to add host and port?
    getopts('l:');
    if($opt_l) { $logbook=$opt_l;} else {$logbook="emails";}
    $cmd .= "-l $logbook ";
    
    # Go through messages:
    @ARGV or unshift @ARGV, "-";
    while (defined($file = shift @ARGV)) {


	# Create a new parser object:
	my $parser = new MIME::Parser;
    
	# Optional: set up parameters that will affect how it extracts 
	#   documents from the input stream:
	$parser->output_under("/tmp");
    
	# Parse an input stream:
	open FILE, $file or die "couldn't open $file";
	$entity = $parser->read(\*FILE) or 
	    print STDERR "Couldn't parse MIME in $file; continuing...\n";
	close FILE;

	## get the subject, assumes all logbooks have a subject 
	## attribute - not necessarily true.  Mine do...
	chomp($subject = $entity->head->get('Subject', 0));
	$cmd .= "-a subject=\"$subject\" ";
	print $cmd, "\n";

	# Congratulations: you now have a (possibly multipart) MIME entity!
	dump_entity($entity) if $entity;
	### $entity->dump_skeleton if $entity;
	### print $cmd, "\n";
	exec $cmd;
    }
    1;
}

exit (&main ? 0 : -1);
#------------------------------------------------------------
1;