Linux

Add SNMP To Ubuntu

Leave a comment

I was trying to add an HP printer to the mix and the printer is trying to utilize the service “check_hpjd”. Unfortunately, on my Ubuntu installation, the plugin was not installed in /usr/local/nagios/libexec.

A short amount of research showed that I had failed to install the required SNMP tools to utilize this plugin. And, because I actually installed Nagios and the plugins from the source rather than binaries, the configuration and make checked to see if the required tools would be available before actually installing them.

Long story short, here’s what I ended up doing (apt-get install net-snmp does not work):
apt-get install libsnmp-base libsnmp-python libsnmp15-dbg libsnmp-dev libsnmp-perl libsnmp15 snmp snmpd tkmib

Edit the SNMPD configuration:
mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.org
nano /etc/snmp/snmpd.conf

rocommunity public
syslocation “USA”
syscontact myemail@domain.tld
Save and Close

Edit the SNMPD Daemon:
nano /etc/default/snmpd

Change “SNMPDOPTS=’-Lsd -Lf /dev/null -u snmp -I -smux -p /var/run/snmpd.pid 127.0.0.1′”
To “SNMPDOPTS=’-Lsd -Lf /dev/null -u snmp -I -smux -p /var/run/snmpd.pid -c /etc/snmp/snmpd.conf'”

Restart the SNMPD service:
/etc/init.d/snmpd restart

Test the SNMP:
snmpwalk -v 1 -c public -O e host/IPaddress
You should get some sort of feedback

Linux, Microsoft

Add SSL To Apache2 Ubuntu

Leave a comment

This uses a Microsoft Certificate Authority. If you want a self-signed SSL, check the bottom of the post.

I needed to create a way for end users to go to a site (http://callmanager) and be able to login to their Cisco Callmanager page without receiving any certificate errors. Unfortunately the call manager device was named “imcm1”, and cisco won’t let me create a certificate for anything besides the device name. Our users were trained to use “callmanager” as the name. So I had two options:
1.) Re-Train employees to no longer use the easier to remember “callmanager” name
2.) Utilize an Ubuntu webserver to redirect the users where I want them to be
Obviously I chose the much harder route – well it’s harder technically, but… yes.

Using Ubuntu 10.04.1 LTS x32. I installed LAMP and SSH. This is on a domain (company.local) running windows 2003 and AD. There is a Certificate Authority installed on one of the domain controllers (2003 Enterprise). I use Putty and WinSCP.

Update Ubuntu:
I run everything as root. So su to root.
apt-get update
apt-get upgrade
apt-get dist-upgrade

Create the CSR:
mkdir /etc/apache2/ssl
cd /etc/apache2/ssl
openssl genrsa -out callmanager.key 1024
chmod 640 callmanager.key
openssl req -new -key callmanager.key -out callmanager.csr
Provide your information:

Country Name: US
State: IL
City: Chicago
Organization Name: Company
Organization Unit: IT
Common Name: FQDN_Here! I used “callmanager”, but you may be utilizing “callmanager.domain.local”
Email: blank
Challenge password: blank
Optional company: blank

Copy The Certificate To Your Certificate Authority:
cat callmanager.csr

Copy everything from “—–BEGIN CERTIFICATE REQUEST…” to “…END CERTIFICATE REQUEST—–”
Connect to your certificate authority: http://certificateserver/certsrv. My Win7 would not work with a 2003 Server CA so I had to run it local on the server (http://localhost/certsrv)
Click Request A Certificate
Click advanced certificate request
Choose the middle option (PKCS #10 or PKCS#7)
Paste what you copied above into the Saved Request area
Choose the certificate template “Webserver”
Click submit
Click Download certificate (DER encoding!)

Convert And Install The Certificate On Ubuntu:
Copy the .cer file (callmanager.cer) to your linux box in the /etc/apache2/ssl directory
chmod 640 callmanager.cer
openssl x509 -in callmanager.cer -inform d -out callmanager.pem
chmod 640 callmanager.pem

Edit Apache To Support SSL:
a2enmod ssl
apache2ctl restart
cp /etc/apache2/sites-available/default-ssl ../sites-enabled/
nano /etc/apache2/sites-enabled/default-ssl
Scroll down to “SSLCertificateFile /etc/ssl…”
Change the location to be /etc/apache2/ssl/callmanager.pem
Then, scroll down to “SSLCertificateKeyFile /etc/ssl…”
Change the location to be /etc/apache2/ssl/callmanager.key

Finish The Redirect:
Under the SSLCertificate edits, I added the following:
ServerName callmanager
Redirect permanent / https://imcm1/
Save the file
apache2ctl restart

Test! Works for me!

Create A Self-Signed Certificate:
Hopefully coming soon.

Linux

Redirect Websites

Leave a comment

Redirect websites using Apache web server!

On the server itself, you can edit the virtualhosts page:
nano /etc/apache2/sites-enabled/000-default

<VirtualHost *:80>
ServerName callmanager
ServerAlias *callmanager
ServerAlias callmanager*
Redirect permanent / https://iocm1/
</VirtualHost>

Or on the webpage itself:

<html>
<head>
<meta http-equiv=”Refresh” Content=”0; URL=http://redirecturl/dir/dir2/”>
</head>
<body>
Link to new page if browser does not support the redirection
</body>
</html>

http://www.yolinux.com/TUTORIALS/ApacheRedirect.html

Networking

Install SSL Certificate on Cisco ASA 5510 SSL VPN

4 Comments

It’s never good practice to have your users get used to seeing “Certificate Invalid” errors on secure sites. I know a lot of IT departments that train their users to just click past the errors. What happens when you enable a Man in the Middle attack? Cain and Abel anyone?

So after we had our load balanced ASA5510’s setup, we purchased some licenses for SSLVPN Users. Unfortunately that means the site must be secured AND have a certificate. The self-signed cert is only good for testing. Production requires an authenticated certificate from a globally trusted CA. For our internal-facing sites we utilize GoDaddy (cheap certs).

Create the CSR:
ASDM for Cisco login
Configuration, then Certificate Management, followed by Identity Certificates
Click Add
Click the radio button Add a new identity certificate
Click New… for a new key pair – I generally name it godaddy12 (vendor+year) and make it 2048 bit
In the Certificate Subject DN, Add the CN (vpn.domain.tld MUST BE FQDN), the OU, the O, the C, the St, and the L as appropriate
Click on the advanced button and make sure the FQDN is the same as the CN you entered before (vpn.domain.tld)
Now click on Add Certificate
Browse to where you want to save your CSR – I save it as ASA5510_12.csr.txt

Godaddy Cert
Purchase the cert and download the certificate using the “other” category. That way you get the CA cert (and intermediary) along with your identity certificate.
Log into your ADSM
Select Configuration
Select Device Management
Expand Certificate Management
Select CA Certificates
Click Add, select the gd_bundle.crt
Then select Identity Certificates
Click on your CSR Request and click the Install button
Select your SITENAME.crt

Now we need to apply these certificates to the SSL Site!
Under Configuration, Device Management still
Expand Advanced
Select SSL Settings
Click on the interface where your SSLVPN terminates (in my case it was outside)
Edit this interface
Select the Primary Enrolled Certificate and Load Balancing Enrolled Certificate (if applicable)
Apply the settings

Test your https://vpnsite
If everything tests OK, save the configuration

Microsoft

Windows PE Vista/7

Leave a comment

I was trying to get back into the Remote Installation Server (RIS) setup and wanted to run sysprep on my newly formatted laptop. I then wanted to take the image and be able to install it on different hardware but maintain the basic software suite I have grown accustomed to.

All of my stuff is running on 7 at this point save for a few virtual XP testing machines.

You MUST have the AIK (automated installation kit) installed! http://www.microsoft.com/downloads/en/details.aspx?FamilyId=94BB6E34-D890-4932-81A5-5B50C657DE08&displaylang=en
http://www.microsoft.com/downloads/en/confirmation.aspx?familyid=696DD665-9F76-4177-A811-39C26D3B3B34&displaylang=en

Then follow along: (I grabbed all this from http://technet.microsoft.com/en-us/library/dd744537%28WS.10%29.aspx)
Start, All Programs, Microsoft Windows AIK, Right-click on Windows PE Tools Command Prompt and select Run As Administrator.
copype.cmd x86 c:\winpe_x86
copy c:\winpe_x86\winpe.wim c:\winpe_x86\ISO\sources\boot.wim
Dism /Mount-Wim /Wimfile:c:\winpe_x86\ISO\sources\boot.wim /index:1 /MountDir:C:\winpe_x86\mount
copy c:\winpe_x86\ISO\bootmgr c:\winpe_x86\mount
mkdir c:\winpe_x86\mount\boot
xcopy /cherky C:\winpe_x86\ISO\boot C:\winpe_x86\mount\boot\

copy "c:\program files\Windows AIK\Tools\x86\ImageX.exe" c:\winpe_x86\mount
Del c:\winpe_x86\mount\boot\BCD
Bcdedit /createstore c:\winpe_x86\mount\boot\BCD
Bcdedit /store c:\winpe_x86\mount\boot\BCD -create {bootmgr} /d "Boot Manager"
Bcdedit /store c:\winpe_x86\mount\boot\BCD -set {bootmgr} device boot
Bcdedit /store c:\winpe_x86\mount\boot\BCD -create /d "WINPE" -application osloader
The last command returns a GUID value. Substitute this value for in the following examples.
Bcdedit /store c:\winpe_x86\mount\boot\BCD -set GUID osdevice boot
Bcdedit /store c:\winpe_x86\mount\boot\BCD -set GUID device boot
Bcdedit /store c:\winpe_x86\mount\boot\BCD -set GUID path \windows\system32\winload.exe
Bcdedit /store c:\winpe_x86\mount\boot\BCD -set GUID systemroot \windows
Bcdedit /store c:\winpe_x86\mount\boot\BCD -set GUID winpe yes
Bcdedit /store c:\winpe_x86\mount\boot\BCD -displayorder GUID -addlast
oscdimg -n -m -o -bc:\winpe_x86\etfsboot.com c:\winpe_x86\mount c:\winpe_x86\winpe_x86.iso

Then burn the ISO (located in c:\winpe_x86\) to a CD. Now we’re done creating the PE environment.

I went on to run sysprep:
C:\windows\system32\sysprep\sysprep.exe

Enter System Out-of-Box Experience OOBE
Generalize
Quit

It took roughly 10 minutes to run the Sysprep cleanup.
And then booted off my CD (64bit in my case, so just change the appropriate x86 to amd64)

imagex /capture d: d:\data.wim "Drive D"

Microsoft

Server 2003 NTP Domain Controller

Leave a comment

I was starting to notice that a few of the servers had different times on them. I only noticed because my desktop clock was different from my phone clock, and the phone system was pointing to my Ubuntu NTP server as it’s time server (which in turn is pointing to ntp.ubuntu.com I believe).

So, 2 domain controllers had the exact same time, 1 had a different time, and yet another still had another different time:
DC1 10:01:05
DC2 10:01:42
DC3 10:00:00 (PDC)
DC4 10:00:00

Not good. So the PDC was being read only by the newest of the domain controllers. So the other two were setup incorrectly. It’s never a good idea to have multiple domain controllers with different time on the clocks. That leads to a bunch of issues. Let’s find out how to fix and why it is wrong.

Check what NTP each DC is fetching information from:

Open a command prompt on any of the domain controllers.
w32tm /monitor /domain:DOMAIN_NAME_HERE

If on a workgroup, you can use the following:
net time /querysntp

If your PDC is not on the correct time, change the what NTP your server is fetching information from:

w32tm /config /manualpeerlist:IP_ADDRESS_OF_NTP_SERVER /syncfromflags:manual /reliable:yes /update

Update your other Servers/DCs to fetch NTP data from your PDC:

On your other servers, open a command prompt.
w32tm /config /manualpeerlist:IP_OF_PDC,0x8 /syncfromflags:MANUAL
net stop w32time
net start w32time
w32tm /resync

/update will allow you to not need to net stop/start the w32time service. I put both in here for my personal reference.

0x8 flag – send request as client mode
0x4 flag – send request as symmetricactive mode
0x2 flag – use as fallback only
0x1 flag – use a special polling interval

** EDIT 9/18/2015 **
Replaced my aging Ubuntu 12.04LTS (an upgrade from 8.04 to 10.04) with a CentOS7.x box for the primary NTP. Noticed that the managed phone clocks were about 2 minutes off from our desktop clocks. The phones were set incorrectly and I had our provider fix, but we were still about 60 seconds off from where we wanted to be.

The replacement server had the same IP, but did NOT have the proper restrict (restrict 10.0.0.0 mask 255.0.0.0) appropriate for our environment. Fixed and service ntpd restart.

Still no love. On the PDC I ran
w32tm /query /peers
And received a State: Pending
Ended up rewriting the manualpeerlist
w32tm /config /manualpeerlist:"10.0.0.254 0.us.pool.ntp.org" /reliable:yes /update
w32tm /resync
w32tm /query /peers
State: Active

Computer Hardware, Linux, Networking

Asus O!Play HDP-R1

Leave a comment

I purchased an OPlay about a year ago. It’s been great – uses less power than my former HTPC AND the wife likes the ability to navigate via remote only better than my keyboard/mouse/remote combo from before. She (and I) misses the XBMC interface though. That interface is MUCH better than the ASUS one. But who can complain about 14 watts of power and the size of the unit?

So why the post? I was having problems playing Bluray ISO rips. DVD ISO’s played just fine. Bluray m2ts files played just fine. Bluray ISOs would skip quite a bit in terms of the video – audio was always working via the HDMI connection. The odd part was the same files would play just fine over the external USB powered Hard Drive without skipping.

Hardware:
2.5GHz Pentium Dual-Core
1024MB DDR2 PC6400
4X 1.5TB 5400RPM SATA in RAID5 (about 4.2TB usable)
FreeNAS 0.7.1
Gigabit Layer 3 switch

I had set the freenas settings as follows:
Send/Receive buffers were set to 65535
Large read/write was set to on
MTU was set to 9216 (jumbo frames)

Still it was skipping. Since it didn’t happen on the external drive, I assumed that the network was to blame. After a little bit of research I found out that Samba is not nearly as awesome as NFS.

So, turn on NFS on your freenas:

Path of /mnt/raid/Multimedia with Network of 192.168.1.0/24 in my case

Then, telnet to your OPlay and make a few minor settings:

Open Putty
Telnet to the OPlay
Login as “root”
mkdir -p /tmp/ramfs/volumes/core
mount -t nfs -o intr,nfsvers=3,rsize=32768,wsize=32768,hard,udp,nolock 192.168.1.234:/mnt/raid/Multimedia /tmp/ramfs/volumes/core

If you get an error, you did something wrong. Obviously change the IP:/directories to be that of your environment.

If it works, move onto making this a startup script.

cp /usr/local/etc/rcS rcS.old
vi /usr/local/etc/rcS
Scroll down to the end of the file, then press “i”
#Mount NFS
mkdir -p /tmp/ramfs/volumes/core
sleep 15
mount -t nfs -o intr,nfsvers=3,rsize=32768,wsize=32768,hard,udp,nolock 192.168.1.234:/mnt/raid/Multimedia /tmp/ramfs/volumes/core
Press “esc”
Type “:wq” and then hit enter

You should now see your NFS share on your OPlay’s local disk area! Yay!
AND no more skipping issues! YESSSS

I’m running firmware 1.28 NTSC.

Ramblings Of An IT Person