Firewall (iptables) rules for Zimbra in CentOS

In my previous posts I have documented how to set up a Raid-5 CentOS system, test that RAID’s reliability, and install Zimbra on said system.

In this post I will go over strengthening the security for your system by editing the default port for SSH access and configuring iptables to only accept traffic on ports required by Zimbra, only from certain IP addresses.

1) To change your SSH server port, edit the following line in /etc/ssh/sshd_config

Port 22

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, “Courier New”, courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }You can change the number to whichever you prefer (I changed mine to 130). In many cases, this will cut down on outside brute force attacks by as much as 99%.

However, one of Zimbra’s services uses the SSH port for access, so if you do change it, you have to also follow the procedure in step 2 to prevent Zimbra from giving you errors when you try to access some details in Administration Console.

2) From: http://www.zimbra.com/forums/administrators/11796-change-port-22-a.html

1. Check /etc/ssh/sshd_config and be sure it’s set to 130 (or the port you’re using)

2. stop/start/restart sshd

Code:

service sshd restart

3. su zimbra

4. Be sure zimbra’s ssh port is set to 130 (or the port you’re using), and change “server.domain.com” in the following code to your full hostname.

Code:

zmprov ms server.domain.com zimbraRemoteManagementPort 130

5. Generate new ssh keys

Code:

cd /opt/zimbra/bin/
./zmsshkeygen

6. Deploy the keys

Code:

./zmupdateauthkeys

To test this, you can check the admin console mail queues area/servers/certificates. If you don’t get any errors, then the port has been changed successfully.

3) Unfortunately, I was too lazy to figure out how iptables works, but you can read about it here:

http://wiki.centos.org/HowTos/Network/IPTables

So basically what I did was take an existing line for allowing access to a port in my iptables file (/etc/sysconfig/iptables):

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

Then, if you want to limit access to that port (the web server port in this case, which lets you access Zimbra’s web mail client) to a specific network, like my school network, you append –s and the network range like so:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -s 130.245.0.0/16 -j ACCEPT

and copy/paste it a whole bunch of times for each port you want to have open for incoming traffic. In nano you can do this by pressing ctrl+k and then ctrl+u a bunch of times, on any line you want to paste.

You can see which ports Zimbra uses here:

http://wiki.zimbra.com/wiki/Ports

It seems to work correctly with just the external access ports enabled in iptables. I’m guessing that’s because all the internal ports are open due to the following line in iptables:

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, “Courier New”, courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }I believe it means that all incoming traffic from the system itself (localhost) is accepted.

Don’t forget to add a rule for the reconfigured SSH port as well, if you happened to change it.

Also, if you want to be able to receive email from anywhere, make sure you don’t add the –s parameter to port 25.

Here’s how my iptables looks after I edited it for Zimbra and SSH access:

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -s 130.245.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 110 -s 130.245.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 130 -s 130.245.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 143 -s 130.245.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -s 130.245.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 993 -s 130.245.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 995 -s 130.245.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 7071 -s 130.245.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -s 129.49.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 110 -s 129.49.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 130 -s 129.49.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 143 -s 129.49.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -s 129.49.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 993 -s 129.49.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 995 -s 129.49.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 7071 -s 129.49.0.0/16 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 130 -s 71.247.43.111 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -s 71.247.43.111 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

Install and Setup Zimbra in CentOS

Zimbra is a suite of tools for Unix/Linux/MacOS systems, which includes a secure mail server, web mail, anti-spam/anti-virus controls, a Web management interface, integrated calendaring, mobile device sync, and more. In many ways, Zimbra is the Unix equivalent to Microsoft Exchange.

In this post, I will be installing Zimbra onto a CentOS virtual machine I created in a previous post. The machine will need at least 1024mb of memory to run the default Zimbra services. I was unable to make it run without errors with any less memory.

1) You will need to install some required packages to proceed with the setup and avoid errors further on:

wget – download utility we will be using to download the latest version of Zimbra Open Source Edition.
postfix – an open-source mail transfer agent (MTA) that routes and delivers electronic mail; installation of Zimbra will fail without this package, according to my professor
ntp – a protocol designed to synchronize the clocks of computers over a network

You can install these packages with the following command:

yum install wget postfix ntp

2) Make sure your time and date are set correctly. You can check time/date by running ‘date’.

If you need to change them you use the same command followed by the current time and date in the format of MMDDhhmm. So for example, if it’s currently April 30 5:55pm, the command would be:

date 04301755

3) Another step that may be important, and that my professor always told the class to complete, is to disable SElinux due to the various errors it may cause considering its stringent security policies. To disable it, use your favorite editor (mine is nano!) and change the SELINUX value in /etc/sysconfig/selinux to the following:

SELINUX=disabled

Then reboot your system.

4) In addition, you may want to turn off your firewall temporarily while installing and setting up Zimbra. I will make a post later about how to configure your firewall so that Zimbra’s required ports are accessible but everything else is secured. To turn off the firewall in CentOS, run:

service iptables stop

5) To find the latest version of Zimbra OSE, visit the following link:

http://www.zimbra.com/downloads/os-downloads.html

I will be using the 32bit x86 version, Red Hat Enterprise Linux 5 (as instructed by my professor). Since I’m installing it on a remote machine, I’m going to use wget to download the software:

wget http://files2.zimbra.com/downloads/6.0.6_GA/zcs-6.0.6_GA_2324.RHEL5.20100406144520.tgz

6) Extract files from the downloaded archive:

 tar -xf zcs-6.0.6_GA_2324.RHEL5.20100406144520.tgz

7) Run the install script with a platform-override argument (since we’re installing on CentOS and not Red Hat) and then follow the instructions by installing whatever external packages the setup tells you are required and selecting options that correspond to your configuration (I used the default option at practically every step):

cd zcs-6.0.6_GA_2324.RHEL5.20100406144520
./install.sh --platform-override

8) If you had any errors during installation, see step 9. Otherwise, if you’ve reached the configuration menu part of the installation, all you’re required to do is to set up the administrator password, as will be denoted by the many * symbols. There are other options you can tinker with if you have more complex needs, but the defaults worked fine for me.

* If you can’t see all the configuration options because the terminal scrolled down too far, you can usually scroll up with the shift+pageup key combination.

9) During installation, I had the following errors:

ERROR: Installation can not proceed.  Please fix your /etc/hosts file

to contain:

127.0.0.1 localhost.localdomain localhost

Zimbra install grants mysql permissions only to localhost and

localhost.localdomain users.  But Fedora/RH installs leave lines such

as these in /etc/hosts:

127.0.0.1     myhost.mydomain.com myhost localhost.localdomain localhost

This causes MySQL to reject users coming from 127.0.0.1 as users from

myhost.mydomain.com.  You can read more details at:

http://bugs.mysql.com/bug.php?id=11822

This error is self-explanatory. Using an editor like vi or nano, edit /etc/hosts to match the error’s suggested fix. Here’s an example of my /etc/hosts file.

127.0.0.1               localhost.localdomain localhost
::1             localhost6.localdomain6 localhost6
130.245.127.62          rsheyd.oslab.cs.sunysb.edu rsheyd

Checking for port conflicts
Port conflict detected: 25 (zimbra-mta)
Port conflicts detected! - Any key to continue

That means that some service is using a port Zimbra needs open for one of its services (in this case zimbra-mta). You can proceed with the installation despite the port conflict, but you will need to fix it later to avoid errors.

After you’ve finished Zimbra installation you can check what ports your system is currently using by running:

netstat -tulpn

In my case, postfix, which I installed earlier as per professor’s instruction, was using port 25. According to him it’s needed for Zimbra to function correctly but should be turned off. I’m not exactly sure how that works, but in any case, to turn it off you have to use the following command.

service postfix stop

And to prevent it from starting the next time you reboot your system, run:

chkconfig postfix off

If you don’t clear up the port conflict, there will be MTA-related errors when you try sending emails in Zimbra.

As a side note, postfix is already included in Zimbra-MTA so you may not need to install it separately to begin with, but I haven’t tried installing Zimbra without it.

*Some people may have sendmail blocking port 25 instead. Apply the same steps to sendmail as I did to postfix.

10) Zimbra has pretty basic spam protection as soon as you install it. In addition, its spam protection improves as you receive mail and mark spam as junk mail, due to heuristics and spam-learning algorithms. Google it if you want to know more =).

However, emails that may contain attachments which may be viruses are NOT filtered out by default. In order to filter out attachment formats which may be malicious you have to access the global settings in your administration console, which is accessed using the ‘admin’ account and the password you set during installation, at hostname:7071. In my case, that was: https://rsheyd.oslab.cs.sunysb.edu:7071/.

In Global Settings there should be an attachments tab, which lists all possible malicious attachment formats. I recommend selecting all of them and adding them to the blacklist since none of them are commonly attached files like PDFs, documents, photos, etc. Most are executable files used to infect a client’s computer with viruses.

In my next post I will talk about restricting access to Zimbra and your CentOS machine with iptables (firewall).

Helpful links:

http://library.linode.com/email/zimbra/install-zimbra-centos-5

http://www.zimbra.com/docs/ne/latest/single_server_install/

* Post any questions in my comments and I’ll try my best to answer them!

Ebert on crying (but not from games)

Was just reading some of Ebert’s responses to comments on his blog post about how Video Games Can Never Be Art:

Ebert: I’ll show you movies that will show you what crying is. Try "Grave of the Fireflies."

Didn’t realize his tastes were so varied… And I guess he considers it art then. Thought only Shakespeare and Dickens qualified to him.

————–

Another great one!

Like someone else pointed out, you just don’t get it. Besides, you lost all credibility when you typed,"IMHO". You’re an adult so act like one.

Also, your taste in movies is usually horrid

Ebert: LMAO

Surprisingly English Fortune Cookie

Don’t worry about the world coming to an end. It’s already tomorrow in Australia.

Testing RAID in CentOS

Now that I created a CentOS system with RAID-5 and RAID-1in my previous post, it’s time to test whether the RAID will actually save my system in case of disk failure.

A simple way to simulate a disk failure without actually beating the crap out of one of your disks (which would be especially difficult with the virtual disks in this case) is by using the mdadm utility included in CentOS and other Red Hat-based linux distributions.

1) First, confirm that your RAID includes a spare drive that the system will rebuild the array with and determine which disk is going to “fail” by checking the output of ’cat /proc/mdstat’:

Personalities : [raid6] [raid5] [raid4] [raid1]

md1 : active raid1 sda1[0] sdb1[1] sdc1[2] sdd1[3](S)

      104320 blocks [3/3] [UUU]

md0 : active raid5 sdd2[3](S) sdc2[2] sdb2[1] sda2[0]

      20755456 blocks level 5, 256k chunk, algorithm 2 [3/3] [UUU]

unused devices: <none>

As you can see, I have split each of the 4 disks in my virtual machine (VM) into 2 partitions each – a small RAID-1 partition for /boot and a large raid-5 partition for / (everything else). The (S) next to some of them signifies that that partition is a Spare, to be used in case of disk/partition failure.

2) To simulate disk failure, we will pass ’fail’ argument to one of the partitions:

mdadm /dev/md0 --manage --fail /dev/sdb2

Make sure the partition you’re marking is part of the correct array, or it will just tell you it can’t find it.

The array should automatically start rebuilding at this point. You can check the progress by checking mdstat again:

[root@rsheyd ~]# cat /proc/mdstat

Personalities : [raid6] [raid5] [raid4] [raid1]

md1 : active raid1 sda1[0] sdb1[1] sdc1[2] sdd1[3](S)

      104320 blocks [3/3] [UUU]

md0 : active raid5 sdd2[3] sdc2[2] sdb2[4](F) sda2[0]

      20755456 blocks level 5, 256k chunk, algorithm 2 [3/2] [U_U]

 [>....................]  recovery =  2.6% (278172/10377728) finish=6.0min speed=27817K/sec

unused devices: <none>

3) After you have verified that the array rebuild has completed, you now know your system is safe from virtual hammers! To re-add the virtually destroyed partition back, just run:

mdadm /dev/md0 --manage --remove /dev/sdb2
mdadm /dev/md0 --manage --add /dev/sdb2

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, “Courier New”, courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }You might have to reboot before being able to add the partition back into your array.

Matty Goldberg’s Awesome

I guess I don’t know how much of it is pre-scripted, but go Matty:

www.facebook.com/KIN

It’s some viral ad campaign about this girl meeting people she only knows online.

Installing CentOS 5.4 in VMware

I will be documenting my process in homework #3 for my ISE 311: System Administration class here.

This assignment has three sub-tasks: Linux CentOS and RAID-5 installation, a
Mail and collaboration system setup and configuration, and firewall setup.
They are described in detail below.

The first step is to create a 4-disk virtual machine running CentOS 5.4 in VMware.

1)We will be creating a custom vmware configuration with the following parameters:

Hardware compatibility: Workstation 6.5
Disk image from which OS will be installed: CentOS-5.4-i386-bin-DVD.iso
Guest OS: Linux – Version: Red Hat Enterprise Linux 5 (as instructed by professor)
Name: hw3 (up to the user’s preference)
Processors: one
Memory: 256MB (as instructed by prof)
Network Connection: bridged (to obtain an individual public IP)
SCSI adapter: LSI Logic
Virtual Disk Type/Size: SCSI 10GB
USB, Sound, and Floppy controllers removed (as we will not be needing them)
3 more virtual SCSI 10GB disks added in the Virtual Machine Settings post-vm creation wizard.

2) Prior to installation – as a precaution and to have a clean slate in case this VM breaks – I cloned the created configuration with the independent full clone option. You can also take a snapshot to the same effect.

3) Since I am connected to the VMware server over the internet, I will be using CentOS text install option so latency has a lower effect and graphics aren’t taking up as much bandwidth. This process can be accessed by using “linux text” as your boot option. I had to use an additional option “noapic” due to the VMware’s lacking support for APIC at the present time.

4) CentOS 5.4 setup:

Pick your preferred language and input methods.
Setup may ask you to initialize the hard disks to create new partition tables which would in turn erase all data on them – this is fine as I am working with empty disks to begin with.
Since I am making a RAID-5 (RAID-1 for /boot partition) system, during the partitioning step I will be creating a custom layout.
- I will be using sda1, sdb1, sdc1, and sdd1 for a 100MB /boot ext3 RAID-1 partition, with 1 acting as a spare.
- I will be using sda2, sdb2, sdc2, and sdd2 for a 20GB / ext3 RAID-5 partition, with 1 acting as a spare.
GRUB will be my boot loader.
For most steps the default option suffices.
I configured my eth0 network interface as well, with ‘activate on boot’ and ‘IPv4 support’. I left IPv6 disabled since I wont be using it for anything and there’s no reason to make my system any more complicated than it has to be. All students are assigned their own hostname based on their username. I checked the IP set for my username by pinging the hostname on the VMware server, and used that to manually configure eth0. Running ‘ifconfig’ showed me some of the other network attributes I needed in the setup.
While many packages would be useful in my system, the size of my system is one of the details graded in the homework, so I deselected all the software to make for a quicker install and a smaller system. I can install all required packages individually later.

5) That’s it! Once the newly installed CentOS boots, configure your networking interface (for most that involves editing /etc/sysconfig/network-scripts/ifcfg-eth0 if you haven’t configured the networking interface during the installation process) and run ‘yum update’ to make sure the system is up to date.

* From this point on, I recommend using SSH to connect to your virtual machine as it should both be more responsive than running VMware workstation remotely, and allow for clipboard functionality. My SSH client of choice is putty (since I run Windows).

* To see how to test if RAID is working correctly, see my next post about this homework.

contrib/.htaccess… error installing Bugzilla

I ran into a very annoying problem while working on hw2 for my System Administration class, specifically during installation of Bugzilla on a barebones Fedora 12 virtual machine.

After running ./checksetup.pl in /usr/share/bugzilla, the following error sprung up:

Creating contrib/.htaccess...
No such file or directory at Bugzilla/Install/Filesystem.pm line 485, <DATA> line 228.

I was unable to find anything about it online, but it turned out to be a very simple solution of either creating a contrib directory in /usr/share/bugzilla:

mkdir contrib

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, “Courier New”, courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }Or creating a symbolic link as my professor suggested on the mailing list:

ln -s . contrib

.csharpcode, .csharpcode pre
{
font-size: small;
color: black;
font-family: consolas, “Courier New”, courier, monospace;
background-color: #ffffff;
/*white-space: pre;*/
}
.csharpcode pre { margin: 0em; }
.csharpcode .rem { color: #008000; }
.csharpcode .kwrd { color: #0000ff; }
.csharpcode .str { color: #006080; }
.csharpcode .op { color: #0000c0; }
.csharpcode .preproc { color: #cc6633; }
.csharpcode .asp { background-color: #ffff00; }
.csharpcode .html { color: #800000; }
.csharpcode .attr { color: #ff0000; }
.csharpcode .alt
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.csharpcode .lnum { color: #606060; }And then re-running the checksetup.pl script. I didn’t try the symbolic link but I have no reason to believe my professor is wrong =).

Transfer iPhone Voice Memos via Email

If you’re like me, you may have run into some issues running iTunes (my favorite one was in which Apple’s recommended solution was to reinstall Windows to use iTunes again). Or maybe you dislike the way iTunes messes up your music library.

Unfortunately, if you use the voice recorder for interviews and personal reminders, but use a program like mediamonkey to manage the music on it, iTunes wont let you download the voice memos onto your computer without erasing the entire device first.

However, there is a way to get the memos without having to resort to ~~illegal~~ (legal as of july 2010!) jailbreaking your iphone:

1) Open up the Voice Recorder app.

2) In your list of memos, click on the round blue arrow button next to the voice memo you’re interested in transferring to a computer.

3) Then, if you click the Share button, you can email yourself the memo!

The emailed memos are limited to a length of 2 minutes, but you can at least send them in segments.

This may not seem all that complex, but I wasn’t aware that the option existed, so perhaps someone else who has a similar dilemma will find this solution.

Day 1

I’m going to write a journal about my adventures in Oblivion.

———–

I woke up in a prison cell today. I’m not sure why I’m here or what my crime is, but hopefully I wont be here for long. Especially because my neighbor seems to be a real dick. Keeps telling me that I’m going to go mad and that the guards are going to cut my throat just to stop my ranting. If he continues however, he’s the one who’s going to have to worry about throats being cut.

There are still bones from the last prisoner in this cell. What a shitty prison.