mainesysadmin.com

HowTo – Customize SSL for exchange 2007

Tom — Wed, 06 Jan 2010 16:24:03 +0000

With the client access role in exchange 2007 brought the need to work with and customize ssl for the internal domain activity of the server. If the ssl is not replaced the Outlook clients will provide an ssl warning every time the app is launched. To resolve this here is how you can get a custom ssl cert from your local CA.

For generating a CSR in exchange 2007 I’ve been using this website tool: https://www.digicert.com/easy-csr/exchange2007.htm. You can fill out the small form and then copy/paste the command that was generated into your exchange server’s management shell. If you’re a CLI junky you can reference this bit of code and replace your information in the correct spots:

New-ExchangeCertificate -GenerateRequest -Path c:\exchange_mydomain_com.csr -KeySize 2048 -SubjectName "c=US, s=New York, l=Your City, o=Your Company, ou=Your Department, cn=exchange.mydomain.com" -DomainName exchange, exchange.mydomain.com, autodiscover, autodiscover.mydomain.com -PrivateKeyExportable $True

The CSR will be located here: c:\
Use your local Microsoft CA server and import the csr to generate a new ssl certificate.
Download the new certificate to the c:\ of your exchange server.
Run this command in your exchange management shell to import the certificate.

Import-ExchangeCertificate -path c:\certnew.cer

(where certnew.cer is the location where you downloaded the cer from your CA server)

Following the import the the command will output the thumbprint for the ssl. Use the menu in the top left corner of the exchange management shell (left click once for the menu to appear). Mark and copy the thumbprint, you need this for the next step.
Run this last command to enable the ssl certificate for exchange usage.

Enable-ExchangeCertficate -services IIS, UM, SMTP - thumbprint "paste your thumbprint here"

(If this is just for client access you only need IIS for the service option.)

HowTo – Enable Windows 7 “god mode”

Tom — Tue, 05 Jan 2010 15:17:26 +0000

I was browsing zdnet today and found a useful article. In the new 32 bit version of Windows 7 and previous versions of Vista you can enable a custom control panel anywhere you want and control just about the whole operating system.

Here is the blurb from zdnet:

“Although its name suggests perhaps even grander capabilities, Windows enthusiasts are excited over the discovery of a hidden “GodMode” feature that lets users access all of the operating system’s control panels from within a single folder.

To enter “GodMode,” one need only create a new folder and then rename the folder to the following:

GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

Users are able to have a single place to do everything from changing the look of the mouse pointer to making a new hard-drive partition.”

http://news.zdnet.com/2100-9595_22-378247.html?tag=trunk;content

HowTo – Redirect default or custom IIS7 website to OWA virtual directory

Tom — Thu, 03 Dec 2009 20:12:26 +0000

One of the challenges organizations come across while upgrading from exchange 2003 to 2007 is supporting both environments during the upgrade migration. I had difficulty finding the perfect solution for my IIS redirect issue, but the following technet article supplied the solution:

http://technet.microsoft.com/en-us/library/aa998359.aspx

HowTo – Create legacy OWA(exchange 2003) virtual directories for Exchange 2007

Tom — Wed, 04 Nov 2009 18:36:19 +0000

This is the article from Microsoft that I used on how to create virtual directories for OWA (outlook web access).

http://technet.microsoft.com/en-us/library/bb124811.aspx

http://technet.microsoft.com/en-us/library/bb123752.aspx

These are the commands that I found useful:

New-OWAVirtualDirectory -OwaVersion:Exchange2003or2000 -VirtualDirectoryType Mailboxes -Name "exchange" -WebSiteName "Contoso.com"

New-OWAVirtualDirectory -OwaVersion:Exchange2003or2000 -VirtualDirectoryType PublicFolders -Name "public" -WebSiteName "Contoso.com"

New-OWAVirtualDirectory -OwaVersion:Exchange2003or2000 -VirtualDirectoryType Exchweb -Name "exchweb" -WebSiteName "Contoso.com"

HowTo – Enable SSH for VMware ESXi

Tom — Mon, 19 Oct 2009 14:55:47 +0000

I’m currently using ESXi for a test environment for an exchange upgrade. Through configuration I was looking for a way to extend the capabilities of ESXi and required ssh access. I ran into the following article which I quoted to maintain my own notes, check out the site below:

http://www.yellow-bricks.com/2008/08/10/howto-esxi-and-ssh/

By default this isn’t possible. But there’s a way to get this working, just do the following:

Go to the ESXi console and press alt+F1

Type: unsupported

Enter the root password(No prompt, typing is blindly)

At the prompt type “vi /etc/inetd.conf”

Look for the line that starts with “#ssh” (you can search with pressing “/”)

Remove the “#” (press the “x” if the cursor is on the character)

Save “/etc/inetd.conf” by typing “:wq!”

Restart the management service “/sbin/services.sh restart”

HowTo – Use Vsphere Infrastructure client in Windows 7

Tom — Tue, 29 Sep 2009 15:25:46 +0000

I ran into a great blog posting here: http://www.techhead.co.uk/running-vmware-vsphere-client-on-windows-7 on how to enable the VMware vsphere infrastructure client to run on a Windows 7 pc.

***VMware released a KB article regarding this error, but the fix remains the same. Please refer to this link for the “official supported resolution”

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1011329

HowTo – Secure GRUB bootloader for VMware ESX and Linux

Tom — Thu, 22 Jan 2009 20:22:01 +0000

Here are a couple of really good reasons on why you need to secure your server’s boot loader regardless if you’re using GRUB or LiLo. In this article I am only going to cover how to configure GRUB.

Preventing Access to Single User Mode — If attackers can boot the system into single user mode, they are logged in automatically as root without being prompted for the root password.
Preventing Access to the GRUB Console — If the machine uses GRUB as its boot loader, an attacker can use the use the GRUB editor interface to change its configuration or to gather information using the cat command.

Now lets go ahead and secure your server/workstation:

ssh to your server host with root access
type: grub to enter the grub console
type: md5crypt to create a md5 encrypted password (document your password unencrypted and encrypted versions)
open your favorite editor or download the files via your favorite ftp app. We need: menu.lst and grub.conf they’re located here: /boot/grub
Add the below line to the top of menu.lst and grub.conf:
password –md5 “your_encrypted_password”
Now add “lock” below each titled o/s choice that you want to prevent from booting without a password.

The method I described above will prevent modification of grub boot options AND only allow you to boot those items that were not password protected with the “lock” command.

I went ahead and manuallly modified menu.lst and grub.conf.

Here is an example of a sample file that you can use as a guide. Replace “your_encrypted_password” with the md5 hash that you generated earlier with the md5crypt command.

grub.conf

I found the following sites useful while writing this article:

http://ubuntuguide.org/wiki/Ubuntu:Edgy/Security

http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/security-guide/s1-wstation-boot-sec.html#S2-WSTATION-BOOTLOADER

http://www.linux.com/feature/53569

HowTo – VMware ESX 3.5 and remote syslog configuration

Tom — Wed, 17 Dec 2008 20:16:46 +0000

SSH over to the ESX server required. You’ll need sudo or root access to complete the following.
To view the file: cat /etc/syslog.conf
To modify the file: vi /etc/syslog.conf (google for vi help if required, i = insert. esc = exit insert mode)
Move to the bottom of the file and add the line in the next step if you want ALL the logs to be sent over to your syslog server.
#syslog server setup
*.* @syslogsrv.mydomain
The first line in the above line is commented out by the # sign, the second line tells all the log files to be sent to “syslogsrv.mydomain”. Use an ip address for the syslog server if you want this to work when your DNS server goes down.
service syslog restart (restarts the syslog service)
esxcfg-firewall -o 514,udp,out,syslog (opens the local firewall to allow remote syslogging)
esxcfg-firewall -l (reloads the new firewall configuration)

HowTo – Disable the system beep from CLI in Ubuntu 8.10

Tom — Tue, 25 Nov 2008 20:03:56 +0000

My previous posting is no longer valid. Gnome has removed the tab for the sounds menu where you can use the gui to disable the system beep. Here’s how you can disable this from the CLI.

sudo rmmod pcspkr

Done deal. If you want your system beep back, well first off…curse you if I sit next to you. Type in the following to enable it:

sudo modprobe pcspkr

got this from: lifehacker (per usual)

VMware HA Agent has an error

Tom — Tue, 18 Nov 2008 17:04:55 +0000

This vague message turned into a nightmare for myself this past Sunday. I was able to get the problem fixed with minimal downtime as the issue only came up during a Sunday maint. window (ironic).

I had patched my ESX hosts to Update2 (patched version) and started receiving the error “VMware HA Agent has an error” in my virtual infrastructure client. First step is to make sure you’re running a compliant version of Virtual Center with your ESX. Ok, Check.

Next check your host files in each esx host located here: /etc/hosts

You should see the default line of 127.0.0.1 for localhost, below there needs to be at least one linewith the host your working on.

192.168.1.103 esx9.yourdomain.com esx9

Over the past 3 years I’ve seen conflicting guidance over the configuration of the host files . In 3.0.2 I was required to enter all my hosts in each host file, but now that seems to be resolved and only requires the local details of the host you’re working with. In short make sure that you can ping your hosts from each host with the FQDN and/or friendly name and you should be all good there.

The next steps were found on some vmtn.net postings, and I lost the URL amongst all my troubleshooting but I saved the resolution. For myself I found the following steps helpful in resolving the problem….

The problem in my situation was specifically around the Virtual Center agents and conflicting versions.

Check the vpxa version on your host: rpm -qa |grep vpxa
That will give you the current version of vpxa that you’re running. eg: VMware-vpxa-2.5.0-104215
Stop the VMware mgmt service: service mgmt-vmware stop
Stop the vpx agent: /etc/init.d/vmware-vpxa stop
The vpx agent error can be ignored (warning: /etc/vmware/vpxa.cfg saved as /etc/vmware/vpxa.cfg.rpmsave)
Remember your vpx version from the first step and use it here to remove the vpx agent.
rpm -e VMware-vpxa-2.5.0-104215
Switch over to your Virtual Center client and remove the host you just modified (guest vms will remain)
Reboot the host (vm’s will go down)
After boot reconnect the host to VC and the latest vpx agent will be intstalled.
Enable HA and the error should disappear.

Luckily my event occurred on a Sunday. This was the first time that the guest vm’s experienced unplanned downtime without being able to vmotion in 3 years. Be careful with those VMware patches!