All posts by bsdman

Currently working as an IT Manager. Worked for an OIT company as a Network Engineer in 2011. Worked for a Medical IT company as the Network Administrator 2009-2011. Worked as the Senior Systems Administrator at a computer reseller from 2005-2009. Worked as a Computer Consultant for several small companies from 2007-2009. Worked as a Computer Technician at a computer reseller from 2002-2004.

Check Database Sizes with PowerShell

Exchange 2007 check the database size with a powershell ps command.

I found this from Mike Pfeiffer’s Blog – thanks Mike.

Get-MailboxDatabase | foreach-object {add-member -inputobject $_ -membertype noteproperty -name mailboxdbsizeinGB -value ([math]::Round(([int64](get-wmiobject cim_datafile -computername $_.server -filter ('name=''' + $_.edbfilepath.pathname.replace("\","\\") + '''')).filesize / 1GB),2)) -passthru} | Sort-Object mailboxdbsizeinGB -Descending | format-table identity,mailboxdbsizeinGB

Syslog Log ASA VPN AnyConnect

I was recently tasked with logging when users would connect and disconnect from the VPN – I believe the intent is to keep track of hours, but it was proposed as a way to keep track of users in terms of security violations. Either way I needed to come up with a solution.

Here was the setup and results:
ASA5510 with anyconnect VPN licensing
Windows RADIUS (via ISA Services) for authentication
All ASA connect requests were logged via the eventviewer on the Windows RADIUS server
Disconnects or timeouts were not logged on the server

So I had half of the equation, just needed to capture and log the disconnects as well.

Unfortunately, the RADIUS only requires authentication. There was no “hey please give me permission to disconnect” going on. Lucky for me I also have a kiwi syslog server running on the premises. Kiwi free, in case you’re wondering.

So just set the ASA to send syslog data to your syslog server, and parse out the following Message IDs (for your anyconnect client. Other clients including ipsec will have different numbers)
722022: Connect
722023: Disconnect

Exchange 2007 Error Updating Free/Busy Information

Exchange 2007 server was getting error eventID 8207:

Error updating public folder with free/busy information on virtual machine SERVERNAME. The error number is 0x80004005.

This is generally caused when you upgraded from 2000/2003 and didn’t put in replicas for the old email groups.
You can find out by opening the powershell and running the following:
Get-PublicFolder -Identity "\NON_IPM_SUBTREE\SCHEDULE+ FREE BUSY" -Recurse | fl name,Replicas

In my case I got

Well I had my Back-End Admins group (the one from exchange 2003) had a Replicas {} listed. The screen shot shows what it *should* look like.

To fix, just copy the FB information to your current public folder database:
Set-PublicFolder -Identity "\NON_IPM_SUBTREE\SCHEDULE+ FREE BUSY\EX:/o=lkj/ou=Back-End Admins" -replicas "EXCHANGESERVER\Second Storage Group\Public Folder Database"

And then, if you’re not a patient person, run outlook via the following:
outlook.exe /cleanfreebusy

Exmerge Exchange 2007

I know it’s 2012 and I’m writing about a server from 2007. It’s still fairly relevant. Exchange 2010 has some different functionality, so keep that in mind. I also know that we don’t use exmerge in post-2003 exchange environments. But I like the terminology.

Basically I had a user delete all of their calendar items and they were not showing up in the recover deleted items section of outlook. Good thing I had a backup. Bad thing was the database their email was on grew to 81GB. Worse thing was the email server and the backup server were connected by a measly 20mbps pipe.

Fast forward 11 hours and I had a copy of my EDB file on my exchange server. So now what?

Create a folder called C:\exch_recovery (or anything you want, just be sure to change the directories in the following commands)
Open the Exchange PowerShell. PowerShell is required as a recovery database is not visible by general users. It helps if you’re an exchange/domain/enterprise admin in this case.

Create the storage group for recovery
New-StorageGroup -Server SERVERNAME -LogFolderPath c:\exch_recovery -SystemFolderPath C:\exch_recovery -Name rsg -Recovery

I’m assuming you’re trying to recover something from your original Mailbox Database, otherwise change the mailbox name as appropriate.
Copy your BACKUP edb into the C:\exch_recovery\ directory.

Make sure that the database is in “clean shutdown” mode.
eseutil /mh path/to/edb/file.edb

If not in a clean shutdown mode, and you have the log files required, run the following (assuming the log files start with E01):
eseutil /r "e01" /l C:\path\to\log\files\directory /d C:\path\to\edb\file\directory

Now tell Exchange about this database
New-MailboxDatabase -MailboxDatabaseToRecover "Mailbox Database" -StorageGroup SERVERNAME\rsg -EdbFilePath "C:\exch_recovery\Mailbox Database.edb"

Allow your database to be restored
Set-MailboxDatabase -Identity "SERVERNAME\rsg\Mailbox Database" -AllowFileRestore:$TRUE

As this database is still hidden, run the following to mount it
Mount-Database -Identity "SERVERNAME\rsg\mailbox database"

The restore-mailbox command will merge the mail from the recovery database into the current database automatically. If the user does not exist, there will obviously be no merge and only a copy will occur
Restore-Mailbox -Identity "JOHN SMITH" -RsgDatabase "SERVERNAME\rsg\mailbox database"

Optional Cleanup
Remove-MailboxDatabase -Identity "SERVERNAME\rsg\mailbox database"
Remove-Storagegroup -Identity "SERVERNAME\rsg"

Is this the best way? Probably not, but it worked for me. The user now has their calendar items again and lost NO MAIL.

SNMP Daemon Ubuntu

Ubuntu 10.04.3 LTS x32 fully patched.

I needed to install SNMP so my cacti installation could work with graphing. And I thought I had already installed SNMP on the server I was testing against.

Testing from cacti:
snmpwalk -v 1 -c public IPOFSERVER

Timeout: No Response from IPOFSERVER

OK, so let me see if the process is running:
ps aux | grep snmp

root 439193 0.0 0.0 3884 616 pts/0 S+ 09:59 0:00 grep snmp

Well, looks like I need to install it:
apt-get install snmpd

The installation auto-starts the snmpd service with the default configuration file. I verified it was working with ps aux again, and the snmpd service is running under the snmp user.
On the local machine I could now run snmpwalk:
snmpwalk -v 1 -c public localhost
Which retrieved the information I wanted. Unfortunately I still could not run snmpwalk from the cacti server. Doh!

Edit the snmpd.conf file if you want a different community or RO/RW rights:
nano /etc/snmp/snmpd.conf

Otherwise, just edit the default snmpd configuration:
nano /etc/default/snmpd
Change the following line:

SNMPDOPTS=’-Lsd -Lf /dev/null -u snmp -I -smux -p /var/run/snmpd.pid 127.0.0.1′

To:

SNMPDOPTS=’-Lsd -Lf /dev/null -u snmp -I -smux -p /var/run/snmpd.pid -c /etc/snmp/snmpd.conf’

Save and quit

Restart the snmpd service:
/etc/init.d/snmpd restart

Test again:
snmpwalk -v 1 -c public IPOFSERVER

Profit.

Sudoers Ubuntu Commands

I needed to find an easy, and fairly secure, way to allow a user to login on a website and display their current user’s disk usage. Generally I just navigate to the user’s home directory and run
du -hc
But in this case I needed it to work from the web.

By default, Ubuntu runs apache as www-data. Enter sudoers. My editor’s file is nano.
visudo
Add the following to the bottom of the file:
www-data ALL=NOPASSWD: /usr/bin/du, /usr/bin/ls, other/command
Save and quit

Now your www-data user can run those commands by running sudo command. And it will not allow the user to sudo any other commands.

My PHP page is as follows:
echo exec("sudo du -hc /mnt/ | grep " . $_SESSION["valid_user"] . "| awk '{print $1}'") . " Disk Space Used
";

Obviously the SESSION variable comes from a login page, but it’s a pretty good start for me.

NTP on RHEL

I know there is a GUI for RHEL, but I still prefer to do these things via a command line.

RHEL Setup NTPd

To simply set the time to the time server (correct time one-off), use the following command:
/usr/sbin/ntpdate IP_or_ADDR_of_NTP_Server

In my case it was this command and this result:

-bash-3.2# /usr/sbin/ntpdate 10.4.0.253
18 Jan 08:16:02 ntpdate[13347]: step time server 10.4.0.253 offset 756.199630 sec

As you can see, this server was off by over 12 minutes!

If you want to edit the NTP Servers List:
nano (or vi) /etc/ntpd.conf
Add the specific time server you require
/sbin/service ntpd restart