Running VM inside ESXi inside ESXi

 

Under Options: Advanced -> General -> Configuration Parameters (button), I made the following changes:

(add) deploymentPlatform = "vmkernel"

(add) monitor_control.vt32 = "TRUE"

(add) monitor_control.restrict_backdoor = "TRUE"

Windows NTP best guide

http://robsilver.org/ad/demystifying-time-in-a-forest/ 

 

Thing session is missing in document

1. Start->Run cmd.exe
2. net stop w32time
3. w32tm /unregister [ignore error message]
4. w32tm /unregister
5. w32tm /register
6. net start w32time

Adding Ubuntu to the domain and then modifying sudoers to enable a group to gain access

I found this in a couple of different places and decided to put it together into one place. I did this for the linux servers I am managing so that I didn’t have to keep track of usernames and passwords and make sure everything was in sync and got changed when needed. Luckily I am running Ubuntu, which made this even easier:

Here is the process to add a linux machine running ubuntu to a domain:

sudo apt-get update
sudo apt-get install likewise-open
sudo domainjoin-cli join fqdn.of.your.domain Administrator
sudo update-rc.d likewise-open defaults
sudo /etc/init.d/likewise-open start

Now to modify the system to allow any user in a specified group on the domain access to sudo do the following:

sudo visudo

Go down to:
#Members of the Admin group may gain root privileges and do the following:
%(domain)\\(group) ALL=(ALL) ALL

This will allow the members of that group to sudo any command on the system.

/etc/samba/lwiauthd.conf: add line

“winbind use default domain = yes”

sudo /etc/init.d/likewise-open restart

then you can log in as “USER” instead of “DOMAIN\USER”

Installing and Configuring Kerberos, Samba, and Winbind on Ubuntu Server 5

Installing and Configuring Kerberos, Samba, and Winbind on Ubuntu Server 5
Steps
Step 1: Install the Required Packages
Note: Enter Y when asked if you want to install the additional packages
apt-get install krb5-user
apt-get install winbind samba
Step 2: Edit the /etc/krb5.conf File
[logging]
default = FILE10000:/var/log/krb5lib.log
[libdefaults]
ticket_lifetime = 24000
default_realm = DOMAIN.INTERNAL
default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc
default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc
[realms]
DOMAIN.INTERNAL = {
kdc = domainserver.domain.internal
admin_server = domainserver.domain.internal
default_domain = DOMAIN.INTERNAL
}
[domain_realm]
.domain.internal = DOMAIN.INTERNAL
domain.internal = DOMAIN.INTERNAL
Step 3: Edit /etc/samba/smb/conf
Notes: Change the NETBIOS name parameter to be correct for the server. Make a backup copy of the original file!!!
1) Make the edits. The configuration shown is the bare minimum and doesn't share anything.
[global]
security = ads
netbios name = CMHRG02
realm = DOMAIN.INTERNAL
password server = domainserver.domain.internal
workgroup = DOMAIN
idmap uid = 500-10000000
idmap gid = 500-10000000
winbind separator = +
winbind enum users = no
winbind enum groups = no
winbind use default domain = yes
template homedir = /home/%D/%U
template shell = /bin/bash
client use spnego = yes
domain master = no
2) Test the configuration with the testparm command
Step 4: Edit /etc/nsswitch.conf to look like the example below
passwd: compat winbind
group: compat winbind
shadow: compat
hosts: files dns wins
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
Step 5: Modify the PAM settings
1) /etc/pam.d/common-account should contain only the following lines
account sufficient pam_winbind.so
account required pam_unix.so
2) /etc/pam.d/common-auth should contain only the following lines
auth sufficient pam_winbind.so
auth required pam_unix.so nullok_secure use_first_pass
3) Modify the /etc/pam.d/common-password file, so the max parameter is set to 50, similar to the one shown below
password required pam_unix.so nullok obscure min=4 max=50 md5
4) Make sure the /etc/pam.d/common-session file contains the following line
session required pam_mkhomedir.so umask=0022 skel=/etc/skel
Step 6: Make a directory to hold domain user home directories
Note: Use the value you put in the WORKGROUP tag of the /etc/samba/smb.conf file
mkdir /home/DOMAIN
Step 7: Initialize Kerberos
1) kinit domain_admin_account@DOMAIN.INTERNAL
Next check to be sure you got a ticket from the domain controller
2) klist
Step 8: Join the system to the
net ads join -U domainadminuser@DOMAIN.INTERNAL
Step 9: Restart Samba-related Services (Or reboot the server)
Note: The order is important
/etc/init.d/samba stop
/etc/init.d/winbind stop
/etc/init.d/samba start
/etc/init.d/winbind start
Step 10: Restart SSH and Test Connectivity
Note: If you rebooted the server in the previous step, just try and login.
/etc/init.d/ssh restart
ssh useraccount@server
If you can login using your active directory username and password then everything is working!
Step 11: Configure SUDO
1) First create a group in Active Directory called UnixAdmins and add the names of people whom you want to be able to use sudo to admin the server.
2) Next, add the UnixAdmins group to the /etc/sudoers so these users can use sudo
%UnixAdmins ALL=(ALL) ALL
HELPFUL COMMAND LINES
1) List the derived UNIX GID values for Active Directory groups
for gid in $(wbinfo -r <username>); \
do SID=$(wbinfo -G $gid);GROUP=$(wbinfo -s $SID); echo $gid is $GROUP; done
2) See the Active Directory SID for a particular named user
wbinfo –n <username>

PFX to CRT on Apache Server

PFX to CRT on Apache Server

Move your PFX file to the Apache server.  To convert the .pfx file to a  file that your Apache server will understand

Run the following command using OPENSSL:

1. To export the Private key file from the .pfx file
openssl pkcs12 -in filename.p12  -nocerts -out privatekey.key
2. To export the Certificate file from the .pfx file
openssl pkcs12 -in filename.p12 -clcerts -nokeys -out sslcert.crt

filename.p12 (is your existing IIS PFX file)
privatekey.key (is your new exported private key file)
ssl.crt (is your new exported your Entrust SSL certificate)

3. You now need to copy the  files to the locations as described in the httpd.conf
4. To find out where the files should be copied to run this on the httpd.conf

cat httpd.conf | grep SSLCertificateFile  (this will give you the location of where to copy the certificate file)
cat httpd.conf | grep SSLCertificateKeyFile (this will give you the location of where to copy the key file)

5. You will now need to restart apache

Change AD UNIX shell

Dim oContainer
Set  oContainer=GetObject("LDAP://CN=Users,DC=domain,DC=com")
ModifyUsers oContainer
'cleanup
Set oContainer = Nothing
WScript.Echo "Finished"
Sub ModifyUsers(oObject)
Dim oUser
oObject.Filter = Array("user")
For Each oUser in oObject
oUser.Put "LoginShell", "/bin/bash"
oUser.SetInfo
Next
End Sub

Script to zip BES Log files

BES has the ability to automatically purge old log files as a built-in function of BES. You can go to BlackBerry Server Configuration and change how long the server will keep the logs before purging them, but you can't do the same for SMS/PIN/Phone logs.
Regardless, I'm a log junkie. Much like a scale doesn't lie; the logs don't lie ... and I hate to get rid of them; so much that I really have no problem keeping them for a year or more. There is so much value in them, and they really don't take up all the much space if you zip them up ... even in very busy environment. But, if you leave logs as uncompressed text, you could easily see a volume fill up and you'll be out of space wondering what the heck is going on.
That said, to address a few of my desires:
1) To have logs for as long as possible
2) To not waste disk space unnecessarily
3) To make troubleshooting easier
4) To make planning easier (the next time you need an upgrade you can use the data in these logs to backup your claims / requests)

I've put together this mega-simple script which can really be modified to just about anything ... just be gentle with it because if you change things around you could easily be deleting entire file systems instead of just zipping up some aging log files.
Attached is a zip file with 3 files:
zip.exe (duh)
forfiles.exe (command to iterate the zip command)
go.cmd (script that you execute)

... and here is the contents of go.cmd:

@ECHO OFF
REM -- Script to individually zip BES Log files ...
REM -- Place this file along with forfiles.exe and zip.exe in the root directory of your BlackBerry Logs folder
REM -- By Default: C:\Program Files\Research in Motion\BlackBerry Enterprise Server\Logs
REM -- This will zip all TXT files in the current and all sub-directories 10 days old or older
REM -- 4/23/2008 - Updated to delete old files / directories
REM -- Change "-d-90" if you want to delete files at an age different than 90 days
REM -- Uncomment the REM -- lines at the bottom if you actually want it to do deletion

forfiles.exe -p. -s -m*.txt -d-10 -c"zip -m @FILE.zip @FILE"

REM -- forfiles.exe -p. -s -d-90 -m*.txt -c"cmd /c if @ISDIR==FALSE del /q /f @FILE"
REM -- forfiles.exe -p. -s -d-90 -m*.csv -c"cmd /c if @ISDIR==FALSE del /q /f @FILE"
REM -- forfiles.exe -p. -s -d-90 -m*.zip -c"cmd /c if @ISDIR==FALSE del /q /f @FILE"
REM -- forfiles.exe -p. -s -d-90 -m*.* -c"cmd /c if @ISDIR==TRUE rd /q @FILE"

Here's a breakdown of what the command is doing:

forfiles.exe (The forfiles command, to iterate through all the log files)


-p. (The starting point for the filelist. "." means the current working directory that forfiles.exe is located in)


-s (Recurse subdirectories)


-m*.txt (Process all .TXT files)


-d-10 (10 days old or older)


-c"zip -m @FILE.zip @FILE" (The command to execute on each file. @FILE represents the current file being processed. zip -m tells it to zip the file and move the file into the zip, therefore removing the original .TXT file. Then the next time this gets run it won't have to zip the file again.)


Put these 3 files in the root of your BES Logs directory ... by default it is: "C:\Program Files\Research in Motion\BlackBerry Enterprise Server\Logs" and schedule go.cmd as a task to run nightly; you'll keep the last 10 days of logs easily accessible and older logs on the file system, just compressed.


I had thought about having each day zip into a single file, but then the structure of what is there gets modified ... I wanted to keep it simple, keep the directory / file structure as it was, but just compress the files.

Message Edited by AndyDufresne on 09-05-2008 09:08 AM

------------------------------

If you've found a solution through a post; please mark it as a solution.


If someone's was particularly helpful, give them kudo's!.


Get busy living, or get busy dying.


http://blog.port3101.org/hdawg/

Attachments:

ziplogfiles.zip 94 KB

 

Source