Linux

Samba Logging on Ubuntu

Leave a comment

Should work with debian also.
Ubuntu 10.04.4 LTS x32 system fully patched with LAMP, SSH, and Samba already installed
* Installed samba via the webmin interface

Install the local syslog server
apt-get install sysklogd

Edit the syslog server
nano /etc/syslog.conf

local7.* /var/log/samba/log.audit

Save and exit
touch /var/log/samba/log.audit
/etc/init.d/sysklogd restart

Edit Samba to enable the logging
nano /etc/samba/smb.conf

vfs objects = full_audit
full_audit:prefix = %u|%I|%m|%S
full_audit:success = mkdir rename unlink rmdir pwrite
full_audit:failure = none
full_audit:facility = LOCAL7
full_audit:priority = NOTICE

Save and Exit
/etc/init.d/smbd restart

You should now notice the file attempts at /var/log/samba/log.audit

Microsoft, Miscellaneous

Proxmox Mouse Not Working

Leave a comment

I was copying Windows-based machines from VMWare and Hyper-V to proxmox – only the mouse stopped working after I would finish copying. It would get “stuck” in the bottom right hand corner of the screen – I could right-click and get a menu option to pop up, but other than that it was completely useless.

Now I’m a big fan of the command line, but on my windows hosts it’s a ton easier to have mouse control.

So I found this guy’s blog:

VMWare mouse problems – mouse stuck in bottom right corner

Basically do the following:

Open Regedit
HKLM\System\CurrentControlSet\Control\Class\{4D36E96F-E325-11CE-BFC1-08002BE10318}
Find the registry key “UpperFilters”
Remove the word msvmmouf – keep all other entries in there, but tidy up the spaces/returns if necessary
Under this 4D36E96F-E325-11CE-BFC1-08002BE10318 key, see if the other 01, 02, 03 etc folders have any mention of vmware. Delete the entire key if they do (example: highlight 02 and hit delete).
Reboot.
Profit.

I also had to remove a few vmware entries:
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1001354

Delete the following:

HKEY_CLASSES_ROOT\Installer\Features\C2A6F2EFE6910124C940B2B12CF170FE
HKEY_CLASSES_ROOT\Installer\Products\C2A6F2EFE6910124C940B2B12CF170FE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\C2A6F2EFE6910124C940B2B12CF170FE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\C2A6F2EFE6910124C940B2B12CF170FE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\C2A6F2EFE6910124C940B2B12CF170FE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FE2F6A2C-196E-4210-9C04-2B1BC21F07EF}
HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.

I also got a Processr.sys issue (fix found here http://pve.proxmox.com/wiki/Processr.sys):
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS
processr.sys

Edit the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Processor
and
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Intelppm

Find the “Start” key

Change it from the default value (mine was 3) to a “4”

Linux

Show Version of Python

Leave a comment

I needed to know what version of python I was running, so I immediately tried:
python -v

No dice.

What does get me the version:
python
import sys
print sys.version

And then I noticed that as soon as I get into Python the version is displayed. Palmface.

Linux, Networking

Proxmox 2.0RC1 LAN Setup

Leave a comment

Here is my hardware:
3x R610 Servers with 4x onboard broadcom gigabit interfaces and 4x riser intel gigabit interfaces
2x Dell 6224 iSCSI managed L3 switches with 20Gbps stacking cables (iSCSI and Backup)
1x Dell Equalogics SAN (24X 2.5″ 600GB SAS) P4100X
1x Cisco 3560X switches (LAN)

And my situation:
I needed to get the 3 R610 servers to communicate to the SAN LUN(s), a backup network, and the user LAN via the above equipment list. And it needed to be fairly quick – iSCSI over ethernet with bonded gigabit connections quick.

My configuration per proxmox server:
prox_lan_setup.txt
I made it a text document as that’s a lot easier to see.

Unfortunately I learned that Equallogics SAN will not use Bonded connections – they want MPIO. My configuration now has MPIO for iSCSI and LACP (802.3ad) for the LAN.

Linux

Dell OMSA Proxmox R610

1 Comment

Just purchased a new R610 for running Proxmox 2.0RC1, but I needed a way to get OpenManage on there.

I followed a sara.nl link page to get an old version of OMSA installed. It worked great minus the small problem of not having a storage controller available. Apparently the new PERC6i controller requires OMSA 6.3 or higher. Well, I may as well go with 6.5. Fortunately for me, Dell finally released both Ubuntu 10.04 and Debian 6 binaries AND install instructions. I had to alter them a little bit for my prox environment, so here goes:

aptitude update
aptitude full-upgrade
reboot
echo 'deb http://linux.dell.com/repo/community/deb/latest /' | tee -a /etc/apt/sources.list.d/linux.dell.com.sources.list
gpg --keyserver pool.sks-keyservers.net --recv-key E74433E25E3D7775
gpg -a --export E74433E25E3D7775 | apt-key add -
apt-get update --allow-unauthenticated
apt-get install srvadmin-all
service dataeng start
service dsm_om_connsvc start
To get this to auto start on reboot: update-rc.d dsm_om_connsvc defaults
https://ipofserver:1311

Login as root and your root password.

If you receive an error with apt-get update –allow-unauthenticated, all I did was cat /etc/apt/sources.list.d/linux.dell.com.sources.list and then re-run the command.

Microsoft

PCI Audit vs Exchange OWA

Leave a comment

See the previous post for more details on the PCI audit. The Exchange server failed due to accepting SSL v2 certificates. V2 can lead to malformed requests and crap out the system. Unfortunately the audit doesn’t see the IPS/IDS that would block these attacks, or the SPAM filter with 443 forwarding that would also thwart such malformed requests. But I digress.

This *should* work with 2003 and 2008, but I’ve only tested on 2003. The system requires a reboot to verify changes.

Fire up regedit
Navigate to HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0
Under the registry group “Sever”, create a DWORD value named “Enabled” and verify that the value is set to 0x0.

Found this from Joson Zhou.

Linux

PCI Audit vs Ubuntu Server

Leave a comment

I was in the midst of my first ever PCI audit – the company I was doing work for wanted to start taking credit card orders over their website. I thought it would be easy – the website was a wrap-around of the credit card company’s authorization site, so no numbers ever touched the company-owned systems. Unfortunately the security firm required all external facing IP addresses to test. One of those IP addresses pointed to an Ubuntu 10.04.4LTS system that was running Owncloud software on apache (think DAV for multiple users via web interface).

So the PCI audit returns with a giant FAIL. Apache is out of date!

apache2 -v
2.2.14
This version came out in October of 2009.

So I edited the apt sources list to grab a newer file:
nano /etc/apt/sources.list
And added:

deb http://us.archive.ubuntu.com/ubuntu/ oneiric main
deb-src http://us.archive.ubuntu.com/ubuntu/ oneiric main

apt-get update
apt-get install apache2
apache2 -v
2.2.20
This version came out in August of 2010

Run the PCI compliance test again – FAIL. Apparently they require 2.2.21 or higher. The only issues I could find with 2.2.20 deal with mods being enabled that they don’t use, or .htaccess permissions that they also don’t use. OK, so let’s go up another version.

nano /etc/apt/sources.list
Add:

deb http://us.archive.ubuntu.com/ubuntu/ precise main
deb-src http://us.archive.ubuntu.com/ubuntu/ precise main

apt-get update
apt-get install apache2
apache2 -v
2.2.22
This version came out in January of 2012

I verified the site was still working. Make sure you comment out the sources.list precise and oneiric otherwise you’ll have lots of update issues down the road.

Source generator:
http://repogen.simplylinux.ch/generate.php

Ramblings Of An IT Person