Daniel Niemczok

Interface ubuntu

2017-12-11T22:53:00.003-08:00

iface enp0s3 inet static

address 10.8.8.57

netmask 255.255.255.0

gateway 10.8.8.8

#dns-search firma.ad

dns-nameservers 8.8.8.8

Inventory Powershell

2017-08-23T06:32:00.002-07:00

Get-Content C:\ps\lista.txt | foreach {

" ======================================== "
" ======================================== "
" "

$ip = $ips = [Net.Dns]::GetHostAddresses("$PSItem") |
Where-Object { $_.AddressFamily -eq 'InterNetwork' } |
Select-Object -Expand IPAddressToString

" 1. = = = = = = = = "
" "
"Badany host to: $PSItem - $ip"

$uptime = Get-WmiObject win32_operatingsystem -ComputerName $PSItem |
select @{n='Nazwa hosta';e={$PSItem.csname}},
@{LABEL='Ostatni restart';EXPRESSION={$_.ConverttoDateTime($_.lastbootuptime)}}
" "
" 2. = = = = = = = = "
" "
" Ostatni restart :"
$uptime
" "
" 3. = = = = = = = = "
" "
"Zajętość dysków maszyny $PSItem : "

Get-CimInstance -ClassName Win32_LogicalDisk -ComputerName $PSItem |
Where-Object DriveType -eq 3 |
Format-Table @{n='Litera dysku';e={$PSItem.DeviceID}},
@{n='Wielkosc dysku(GB)';e={$PSItem.Size / 1GB};formatString='N2'},
@{n='Uzycie %';e={($PSItem.freespace / $PSItem.size)*100};formatString='N2'} -AutoSize

" 4. = = = = = = = = "
" "
" Error dziennika System: "

Get-EventLog -LogName System -EntryType "Error" -Computername "$PSItem" -newest 10 |
Sort-Object TimeGenerated -Descending -ErrorAction SilentlyContinue

" "
" Error dziennika Security : "

Get-EventLog -LogName Security -EntryType "Error" -Computername "$PSItem" -newest 10 |
Sort-Object TimeGenerated -Descending -ErrorAction SilentlyContinue

" 5. = = = = = = = = "
" "
"Uzycie procesora $PSItem :"

Get-Counter -ComputerName $PSItem '\Process(*)\% Processor Time' `
| Select-Object -ExpandProperty countersamples `
| Select-Object -Property instancename, cookedvalue `
| Sort-Object -Property cookedvalue -Descending | Select-Object -First 10 `
| ft InstanceName,@{L='CPU';E={($_.Cookedvalue/100).toString('P')}} -AutoSize

" "
" 6. = = = = = = = = "
" "
" Wokorzystanie pamieci RAM dla $PSItem : "

$os = Get-Ciminstance Win32_OperatingSystem -ComputerName $PSItem
$pctFree = [math]::Round(($os.FreePhysicalMemory/$os.TotalVisibleMemorySize)*100,2)

if ($pctFree -ge 45) {
$Status = "OK"
}
elseif ($pctFree -ge 15 ) {
$Status = "Warning"
}
else {
$Status = "Critical"
}

$os | Select @{Name = "Status";Expression = {$Status}},
@{Name = "Wolna pamiec %"; Expression = {$pctFree}},
@{Name = "Wolna pamiec GB";Expression = {[math]::Round($_.FreePhysicalMemory/1mb,2)}},
@{Name = "Calkowita pamiec GB";Expression = {[int]($_.TotalVisibleMemorySize/1mb)}}
" "
" "

" ======================================== "
" ======================================== "
}

Ustaw uprawnienia hurtowo

2016-03-14T03:57:00.000-07:00

#ustaw acl dla plików takie jak jest dla folderu nadrzednego
$startdir="c:\costam costam\"
Foreach ($file in $(get-childitem $startdir)) {
Write-host $file
$allpath=$startdir +$file
$newacl=get-acl $allpath
Get-childitem $allpath -recurse -include * -force | set-acl -aclobject $newacl
}

Kill process Mssql 2008 R2

2016-01-18T23:00:00.000-08:00

Active monitor sprawdź spid

Kill
Go
Exec sp_who2
Go

Kasowanie starych wersji jądra

2016-01-05T23:11:00.002-08:00

http://linuxinside.pl/2014/02/na-skroty-usuwanie-starych-wersji-kernela/

Na skróty: usuwanie starych wersji kernela

Jeśli na co dzień korzystasz z Ubuntu (lub systemów pochodnych) to prędzej czy później zauważysz, że na partycji systemowej (/) z czasem ubywa miejsca. W dużej mierze jest to spowodowane tym, że stare wersje jądra systemu zostają zachowane „na wszelki wypadek”. Jeżeli nasz system prawidłowo działa na nowym kernelu to możemy się pokusić o usunięcie starych wersji.

Bardzo dobrym programem, który pozwala na wyklikanie całej operacji jest Ubuntu Tweak. W odpowiedniej zakładce możemy wyczyścić nasz system ze zbędnych plików.

Isnieje jednak szybsze i sprawdzone rozwiązanie, które za jednym zamachem usuwa wszystkie wersje kernela poza aktualnie używaną.

Dla pewności możemy najpierw sprawdzić z jakiego jądra aktualnie korzystamy:

uname -r

Następnie wklejamy poniższe polecenie do terminala:

sudo apt-get remove --purge $(dpkg -l 'linux-*' | sed '/^ii/!d;/'"$(uname -r | sed "s/\(.*\)-\([^0-9]\+\)/\1/")"'/d;s/^[^ ]* [^ ]* \([^ ]*\).*/\1/;/[0-9]/!d')

Po przejrzeniu listy plików do usunięcia możemy zatwierdzić całą operację. Gotowe!

Ubuntu mikrofon

2015-12-06T20:57:00.002-08:00

sudo apt-get purge pulseaudio

I restart. A potem w mikserze (nie w gnomowym, ale np. w alsamixer) ustawienie wszystkiego na maksa

Ja bym jeszcze spróbował co ci pokażę

Cytuj:

arecord -l

a później dałbym

Cytuj:

arecord plik

i powiedział kilka zdań do mikrofonu (w miarę możliwości blisko)

Następnie zobaczył czy jest jakiś dzwięk odpalając :

Cytuj:

aplay plik

Simple firewall Ubuntu and Mikrotik

2015-12-04T22:07:00.002-08:00

UBUNTU:


sudo apt-get update

sudo apt-get install iptables-persistent

sudo nano /etc/iptables/rules.v4

/etc/iptables/rules.v4

*filter
# Allow all outgoing, but drop incoming and forwarding packets by default
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# Custom per-protocol chains
:UDP - [0:0]
:TCP - [0:0]
:ICMP - [0:0]

# Acceptable UDP traffic

# Acceptable TCP traffic
-A TCP -p tcp --dport 22 -j ACCEPT

# Acceptable ICMP traffic

# Boilerplate acceptance policy
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT

# Drop invalid packets
-A INPUT -m conntrack --ctstate INVALID -j DROP

# Pass traffic to protocol-specific chains
## Only allow new connections (established and related should already be handled)
## For TCP, additionally only allow new SYN packets since that is the only valid
## method for establishing a new TCP connection
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
-A INPUT -p icmp -m conntrack --ctstate NEW -j ICMP

# Reject anything that's fallen through to this point
## Try to be protocol-specific w/ rejection message
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-proto-unreachable

# Commit the changes
COMMIT

*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT

*security
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT


Test your rules file for syntax errors:

sudo iptables-restore -t < /etc/iptables/rules.v4






ADD rules

sudo iptables-restore < /etc/iptables/rules.v4


If no syntax errors are displayed, reload the firewall to implement the new rule set:

sudo service iptables-persistent reload





Mikrotik



/ ip firewall filter
add chain=input connection-state=established comment="Accept established connections"
add chain=input connection-state=related comment="Accept related connections"
add chain=input connection-state=invalid action=drop comment="Drop invalid connections" 
add chain=input protocol=udp action=accept comment="UDP" disabled=no 
add chain=input protocol=icmp limit=50/5s,2 comment="Allow limited pings" 
add chain=input protocol=icmp action=drop comment="Drop excess pings" 
add chain=input protocol=tcp dst-port=22 comment="SSH for secure shell"
add chain=input protocol=tcp dst-port=8291 comment="winbox" 
# Edit these rules to reflect your actual IP addresses! # 
add chain=input src-address=159.148.172.192/28 comment="From Mikrotikls network" 
add chain=input src-address=10.0.0.0/8 comment="From our private LAN"
# End of Edit #
add chain=input action=log log-prefix="DROP INPUT" comment="Log everything else"
add chain=input action=drop comment="Drop everything else"

Czyszczenie Profili Windows

2015-11-26T02:45:00.001-08:00

To clear user local profile via registry:

Press on Start > Run >Regedit
Navigate to the following registry key :“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList”
Under ProfileList navigate to binary key’s like this: S-1-5-21-3656904587-1668747452-4095529-500
On the right side under ProfileImagePath you’ll see the profile path.
Chose the one with the desired user and delete the long registry key like: “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList”

Sprawdzone też na serwerze terminalowym pod Windows Server 2012 R2

Update ad Z 2008 na 2012

2015-11-04T23:18:00.002-08:00

Update Active Directory z 2008 na 2012

Dodajemy Nowy serwer np. Dc3

Mozna podnieść funkcjonalność Dopiero wtedy gdy pozbędziemy sie starych kontrolerów

raise domain funcional level

rasie forest funcional level

Przenieść role fsmo Na dc3 prawym i operatorska master i wszędzie change

Następnie active directory domains nad trust prawym operations master i change

Następnie regsvr32 schmmgmt.dll

Mmc

Wybieramy w mmc active directory schema

Pamiętaj aby być na nowym dc np. Dc3 prawym operations master o change

Sprawdzamy gdzie pa aktywne role fsmo

Netdom query fsmo

Depromo na starych serwerów Obojętnie który pierwszy

Odinstalowanie rolę And feature active directory domain service Musi przejść prawidłowo opcja "demote"

Aktywację nowych kontrolerów Czyli podniesienie funkcjonalności

!!!! Warto zajrzeć do artykułu transferowaniei przejmowanie ról fsmo narzędziem ntdsutil

Który katalog zajmuje najwięcej w systemie

2015-10-27T23:32:00.000-07:00

- Windows
polecam WinDirStat
- Linux cli
du -m /home | sort -rn

Skrypt - ping adresów IP pobranych z pliku - POWERSHELL

2015-10-23T03:42:00.002-07:00

Plik.csv

127.0.0.1

8.8.8.8

1.1.1.1

----------

$dane = import-csv -patch c:\temp\plik.csv

#plik pierwsza linia wpis IP

#$dane.ip

Foreach ($d in $dane)

{

Ping $d.ip

}

KATALOGI

Set-ExecutionPolicy Unrestricted
$katalogi = dir -name

Foreach ($d in $katalogi)
{
Write-Host $d
xcopy \\MP153\profile\*.* \\MP153\profile\TEST\$d\S200 /E /Y /V
}

Can’t download any updates on windows server 2008 r2

2015-10-20T01:55:00.002-07:00

Can’t download any updates on windows server 2008 r2

customer server running windows server 2008 r2 can not use windows update to check updates or download updates automatically.

1 try to rebuild windows download database

run cmd in administrator privilege then run:

net stop wuauserv
Rename c:\Windows\SoftwareDistribution SoftwareDistribution_OLD
net start wuauserv

2 install KB 947821

for windows 2008 r2 & windows 7: [300MB]

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=914fbc5b-1fba-4bae-a7c3-d2c47c6fcffc&displaylang=en

when start install 947821, it will check windows update settings and correct all things, so it will take a period based on your server and network environment. for this situation it takes about 30mins.

for detail please check http://support.microsoft.com/kb/947821

Fix:
https://support.microsoft.com/pl-pl/gp/windows-update-issues/en-us

Albo użyć narzędzia winfixtool firmy Anvisoft
http://www.anvisoft.com/windows-update-downloader.html

Panel Sterowania jako Administrator

2015-10-19T00:04:00.001-07:00

Jak uruchomić Panel Sterowania jako Administrator

Musisz użyć komendy RUNAS

otwórz menu start
w Windows XP kliknij na przycisku "Uruchom"
w Vista i Win7 możesz to zrobić bezpośrednio w okienku szukania

runas /username:computername\Administrator "rundll32.exe shell32.dll,Control_RunDLL sysdm.cpl"
teraz możesz zmienić nazwę użytkownika, nazwę komputera, wyświetlić "właściwości systemu" itp.
Poniżej lista opcji w których możesz dokonywać zmain:

Change sysdm.cpl to any of the following:

Dostępy – access.cpl
Dodawanie nowych urządzeń – hdwwiz.cpl
Dodanie/Usunięcie nowego oprogramowania – appwiz.cpl
Data/CzasWłaściwości – timedate.cpl
Właściwości – desk.cpl
SzybkieWyszukanie – findfast.cpl
Właściwości Internet – inetcpl.cpl
Właściwości Joystick – joy.cpl
Właściwości Keyboard – main.cpl
Zarządzanie Lokalnymi Urzytkownikami – nusrmgr.cpl
Microsoft Exchange – mlcfg32.cpl
Microsoft Mail Post Office – wgpocpl.cpl
Właściwości Modemu – telephon.cpl
Właściwości Myszy – main.cpl
Właściwości Multimedia – mmsys.cpl
Właściwości Sieci – Ncpa.cpl
Właściwości Haseł – password.cpl
Opcje Zasilania – powercfg.cpl
Opcje Regionalne – intl.cpl
Właściwości Dzwięku – mmsys.cpl
Właściwości Systemu – sysdm.cpl

net use z hasłem

2015-10-01T03:11:00.002-07:00

@echo off
set /p pass=Wpisz haslo:
echo %pass%

net use w: \\(server)\share /user:domena\jkowalski %pass%

Instalacja systemu windows na inny dysk niż C:

2015-09-28T03:51:00.002-07:00

Jak zrobić serwer terminali na dysku M:

http://blog.pcfreak.de/2012/07/19/install-windows-server-2008-r2-to-a-different-drive-letter-then-c/comment-page-1/

WAŻNE !!!!
zapisać plik z kodowaniem Unicode tak aby

type AutoUnattended.xml

wyświetlilo prawidłowo

=========
2 sposób

przygotować plik AutoUnattended.xml i wgwać go do iso instalacyjnego (do głównego folderu)

http://www.winiso.com/support/tutorials/edit-iso.html

IOSTAT, IOTOP, TOP

2015-09-25T02:15:00.001-07:00

http://www.varlog.pl/2010/02/10-narzedzi-ktore-musi-znac-kazdy-administrator/

yum install sysstat

iostat

iostat – jest narzędziem prezentującym wykorzystanie naszych urządzeń blokowych, czyli w praktyce jest to monitorowanie pracy dysków twardych, tzw. I/O. Saturacja dysków twardych jest zjawiskiem bardzo niepożądanym, które automatycznie przekłada się na zwolnienie pracy całego systemu, dzięki iostatowi, możemy szybko się przekonać czy przyczyna naszych problemów leży właśnie w za dużym wykorzystaniu zasobów I/O.

Przykładowe użycie: iostat -x 1

avg–cpu: %user %nice %system %iowait %steal %idle
0,46 0,00 0,08 0,02 0,00 99,44
Device rrqm/s wrqm/s r/s w/s rsec/s wsec/s avgrq–sz avgqu–sz await svctm util
sda 0,09 0,77 0,07 0,23 2,69 7,87 35,74 0,00 4,49 0,84 0,02

W wyniku widzimy dane dla naszego urządzenia ‚sda‚.

rrqm/s – ilość skolejkowanych żądań odczytu z dysku na sekundę
wrqm/s – ilość skolejkowanych żądań zapisu na dysk na sekundę
r/s – ilość odczytów z dysku na sekundę
w/s – ilość zapisów na dysk na sekundę
rsec/s – ilość sektorów czytanych na sekundę
wsec/s – ilość sektorów zapisywanych na sekundę
avgrq–sz – średni rozmiar w sektorach
avgqu–sz – średnia wielkość kolejki oczekujących żądań dostępu do dysku
await – średni czas dostępu do dysku (z uwzględnieniem kolejki) w milisekundach
svctm – średni czas obsługi żądania w milisekundach
%util – procentowe zużycie procesora potrzebne do obsłużenia żądania, jeśli wynosi 100% dochodzi do sytuacji saturacji zasobów

Jeśli wskazania iostata pokazują utylizację na poziomie 80-100% należy znaleźć przyczynę i ją wyeliminować, sytuacja ta oznacza, że nasz procesor spędza głównie czas w oczekiwaniu na dane a nie na ich przetwarzaniu.

iotop

yum install iotop

2 September 2011TipDebian, IO Wait, iostat, iotop, Linux, vmstat

Na jednym z serwerów zauważyłem dziwny wzrost obciążenia. Tzw. LOAD od kilku dni po woli rósł. top pokazywał że dwa rdzenie CPU czekają na dane z dysku – tzw. io wait na poziomie 80~90% ale żaden proces w znaczącym stopniu nie obciążał CPU.
Jest kilka narzędzi (iostat, wmstat), które pozwalają monitorować obciążenie dysków ale ja nie szukałem informacji czy i w jakim stopniu dyski są obciążone – wiedziałem że są. Chciałem dowiedzieć się który proces generuje to obciążenie – by móc go ubić
Przydatny okazał się programik iotop – który działa jak top ale sortuje procesy w zależności od generowanego przez nie obciążenia dysków – właśnie tego szukałem:

Zrzut z programu iotop

Program jest w standardowych repozytoriach Debiana i można go zainstalować w ten sposób:

apt-get install iotop

TOP

TOP 
VIRT - to co mysli ze mam, RES -> tyle ile faktycznie ma,

s-STAN np. z - zombie, przy CPU id-ile proces byl nieuzywany,

wa - io/wait po tym mozna sprawdzic czy nie potrzebujemy szybszego dysku,

hi -> przerwania  
< > - sortowanie albo po lewej albo po prawej kolumnie, 
R -> od najwiekszych do najmniejszych 
1 -> pokazuje ilosc procesorow 
NI - nice, priorytet. Dziala tak ze jak ktos ma wiekszy NICE to ma mniej procesora.

Zeby przyspieszyc np tylko jeden proces nalezy dac komus NIC ujemny. 
r - zmieniamy NICE. Minusowe wartosci da sie robic tylko z konta roota. 
k - killuje 
load avarage -> jak obciazany jest system,

ilosc procesow ktore stoja w jakiejs kolejce do egzekucji.

Kazdy system moze inaczej, powyzej 1-ego juz wiadomo ze jest troche obciazony.

ADD and DEL disc linux no reboot

2015-09-23T01:43:00.005-07:00

Sprawdzamy

dmesg | grep sdb

`# partx -l /dev/sdb`

`# partx -v -a /dev/sdb`

`/dev/mapper# vgscan --mknodes`

lvscan -l

Step # 2: Rescan the SCSI Bus to Add a SCSI Device Without rebooting the VM

A rescan can be issued by typing the following command:

"""W jednej lini

ls /sys/class/scsi_host/ | while read host ;

do echo "- - -" > /sys/class/scsi_host/$host/scan ; done

"""


 fdisk -l
 tail -f /var/log/message

=====================================================

How Do I Delete a Single Device Called /dev/sdc?

In addition to re-scanning the entire bus, a specific device can be added or existing device deleted using the following command:

# echo 1 > /sys/block/devName/device/delete
 # echo 1 > /sys/block/sdc/device/delete

How Do I Add a Single Device Called /dev/sdc?

To add a single device explicitly, use the following syntax:

# echo "scsi add-single-device    " > /proc/scsi/scsi

Where,

: Host
: Bus (Channel)
: Target (Id)
: LUN numbers

For e.g. add /dev/sdc with host # 0, bus # 0, target # 2, and LUN # 0, enter:

# echo "scsi add-single-device 0 0 2 0">/proc/scsi/scsi
 # fdisk -l
 # cat /proc/scsi/scsi

=========================================================

Step #3: Format a New Disk

Now, you can create partition using fdisk and format it using mkfs.ext3 command:

# fdisk /dev/sdc
 # mkfs.ext3 /dev/sdc3

Step #4: Create a Mount Point And Update /etc/fstab

# mkdir /disk3
Open /etc/fstab file, enter:
# vi /etc/fstab
Append as follows:

/dev/sdc3               /disk3           ext3    defaults        1 2

Redhat 7 instalacja,rejestracja

2015-09-17T05:13:00.000-07:00

Update Redhat

yum update

Tworzenie skryptów autostart

Create the file (touch>chmod>edit seems recommended, I don't known why):
touch /etc/systemd/system/activefolder.service
chmod 664 /etc/systemd/system/activefolder.service
vim /etc/systemd/system/activefolder.service

/etc/systemd/system/activefolder.service example:

[Unit]
Description=activefolder

After=network.target

[Service]

WorkingDirectory=/var/www/activefolder/current
ExecStart=/var/www/activefolder/current/script/delayed_job start

Type=forking
PIDFile=/run/activefolder.pid

Environment="RAILS_ENV=production"
#User=httpd
#Group=httpd

 [Install]
WantedBy=default.target

Then:
systemctl daemon-reload
systemctl start name.service

LUB

$ crontab -e
 
 Run a script called /home/vivek/bin/installnetkit.sh
 @reboot       /home/vivek/bin/installnetkit.sh

Start crond automatically at boot time
You also need to enable crond service via sys v / BSD init style system. Under RHEL / CentOS / Fedora, you need to use chkconfig (ntsysv) command to enable crond on boot:

# chkconfig crond on
 ## Commands to start/stop/restart crond ###
 # service crond restart
 # service crond start
 # service crond stop

Rejestracja i subskrypcja

subscription-manager register --username admin-example --password secret --auto-attach

Network

nmcli con mod net-eth0 connection.autoconnect yes

Clustering using sharing of vmdks between virtual machines

2015-09-08T05:47:00.000-07:00

https://communities.vmware.com/blogs/Abhilash_hb/2013/08/25/clustering-using-sharing-of-vmdks-between-virtual-machines

This blog post explains how to share a VMDK between two virtual machines so they can be clustered or any application that needs two machines to share their disks.

Assume there are two VMs that participate in the clustering

Node-01 and Node-02

Create a Virtual disk on Node-01 that has to be shared with Node-02

Add a hard disk by clicking on Add a hardware and select Hard disk and click Next

Select Create a new virtual disk

Must be type Thick Provision Eager Zeroed !!!!!!!!!!!!!!!!!!

Choose SCSI (1:0) which creates a fresh SCSI controller apart from the default one created during virtual machine creation and click Next

Click on Finish

Click on the newly created SCSI controller and change the SCSI Bus sharing option to “Physical”

Click on OK and power ON the machine

Now the newly added disk shows up on the Node-01 machine as /dev/sdb.

We need to add the Virtual disk created on Node-01 to Node-02

Click on Edit Setting of Node-02 machine and select Add hardware and click on hard disk

And click Next

Click on “use an existing virtual disk” and click Next

Browse to the location where Node-01’s VMDK file is present and select it

Confirm the path and click Next

Select SCSI (1:0) which creates a new SCSI controller on Node-02

Review the changes and click Finish

Select the newly created SCSI controller and select Physical under SCSI bus sharing option and click OK

Power on Node-02 and confirm that Node-01’s shared disk is showing up on Node-02

You might want to turn the Multi-writer flag in the advanced options of VM so you can let the machines write to the disk. Follow the below link for the same

VMware KB: Disabling simultaneous write protection provided by VMFS using the multi-writer flag

Note: This might cause some problems while doing vMotion of the machines involved in clustering. So do some research before you do it.

Cluster HAProxy

2015-09-04T03:35:00.001-07:00

Configuring HAProxy and Keepalived - HTTP

Install HAProxy and Keepalived on both ubuntu nodes.

apt-get install haproxy 
apt-get install keepalived

1 2	apt-get install haproxy apt-get install keepalived

Load balancing in HAProxy also requires the ability to bind to an IP address that are nonlocal, meaning that it is not assigned to a device on the local system. Below configuration is added so that floating/shared IP can be assigned to one of the load balancers. Below line get it done.

net.ipv4.ip_nonlocal_bind=1

1	net.ipv4.ip_nonlocal_bind=1

Now you know what’s happening with above lines let’s edit the sysctl.conf.

vim /etc/sysctl.conf

1	vim /etc/sysctl.conf

Add the below lines.

net.ipv4.ip_nonlocal_bind=1

1	net.ipv4.ip_nonlocal_bind=1

To enable the changes made in sysctl.conf you will need to run the command.

root@S-09:~# sysctl -p
net.ipv4.ip_nonlocal_bind = 1

root@S-09:~# sysctl -p

net.ipv4.ip_nonlocal_bind = 1

vi /etc/defaults/haproxy
CONFIG="/etc/haproxy/haproxy.cfg"
ENABLED=1

Now let’s create keepalived.conf file on each instances. All the below Keepalived configurations are explained in the User guide provided by Keepalived and refer this guide as well.

vim /etc/keepalived/keepalived.conf

1	vim /etc/keepalived/keepalived.conf

Add the below configuration on the master node

global_defs {
# Keepalived process identifier
lvs_id haproxy_DH
}
# Script used to check if HAProxy is running
vrrp_script check_haproxy {
script "killall -0 haproxy"
interval 2
weight 2
}
# Virtual interface
# The priority specifies the order in which the assigned interface to take over in a failover
vrrp_instance VI_01 {
state MASTER
interface eth0
virtual_router_id 51
priority 101
# The virtual ip address shared between the two loadbalancers
virtual_ipaddress {
192.168.6.164
}
track_script {
check_haproxy
}
}

global_defs {

# Keepalived process identifier

lvs_id haproxy_DH

}

# Script used to check if HAProxy is running

vrrp_script check_haproxy {

script "killall -0 haproxy"

interval 2

weight 2

}

# Virtual interface

# The priority specifies the order in which the assigned interface to take over in a failover

vrrp_instance VI_01 {

state MASTER

interface eth0

virtual_router_id 51

priority 101

# The virtual ip address shared between the two loadbalancers

virtual_ipaddress {

192.168.6.164

}

track_script {

check_haproxy

}

Add the below configuration on the slave node.

global_defs {
# Keepalived process identifier
lvs_id haproxy_DH_passive
}
# Script used to check if HAProxy is running
vrrp_script check_haproxy {
script "killall -0 haproxy"
interval 2
weight 2
}
# Virtual interface
# The priority specifies the order in which the assigned interface to take over in a failover
vrrp_instance VI_01 {
state SLAVE
interface eth0
virtual_router_id 51
priority 100
# The virtual ip address shared between the two loadbalancers
virtual_ipaddress {
192.168.6.164
}
track_script {
check_haproxy
}
}

global_defs {

# Keepalived process identifier

lvs_id haproxy_DH_passive

}

# Script used to check if HAProxy is running

vrrp_script check_haproxy {

script "killall -0 haproxy"

interval 2

weight 2

}

# Virtual interface

# The priority specifies the order in which the assigned interface to take over in a failover

vrrp_instance VI_01 {

state SLAVE

interface eth0

virtual_router_id 51

priority 100

# The virtual ip address shared between the two loadbalancers

virtual_ipaddress {

192.168.6.164

}

track_script {

check_haproxy

}

Restart Keepalived.

service keepalived start

1	service keepalived start

Now let’s configure HAProxy on both instances. You will have do the below steps on master node as well as slave node.

vim /etc/default/haproxy

1	vim /etc/default/haproxy

set the property ENABLED to 1.

vim /etc/haproxy/haproxy.cfg

1	vim /etc/haproxy/haproxy.cfg

Note that below configurations are as per my requirement.

global
        log 127.0.0.1   local0
        log 127.0.0.1   local1 notice
        #log loghost    local0 info
        maxconn 4096
        #chroot /usr/share/haproxy
        user haproxy
        group haproxy
        daemon
        #debug
        #quiet

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        retries 3
        option redispatch
        maxconn 2000
        contimeout      5000
        clitimeout      50000
        srvtimeout      50000

listen stats 192.168.6.ABC:8989
        mode http
        stats enable
        stats uri /stats
        stats realm HAProxy\ Statistics
        stats auth admin:admin

listen am_cluster 0.0.0.0:80
        mode http
        balance roundrobin
        option httpclose
        option forwardfor
        cookie SERVERNAME insert indirect nocache
        server am-1 192.168.X.ABC:80 cookie s1 check
        server am-2 192.168.Y.ABC:80 cookie s2 check

global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
user haproxy
group haproxy
daemon
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
# Default ciphers to use on SSL-enabled listening sockets.
# For more information, see ciphers(1SSL).
ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL
defaults
log global
mode http
option httplog
option dontlognull
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
frontend haproxy_in
bind *:80
# mode http
default_backend haproxy_out_http
backend haproxy_out_http
mode http
balance roundrobin
#option forwardfor
#http-request set-header X-Forwarded-Port %[dst_port]
#http-request add-header X-Forwarded-Proto https if { ssl_fc }
#option httpchk HEAD / HTTP/1.1\r\nHost:localhost
#cookie SERVERID insert indirect nocache
server web01 212.77.98.9:80 check #cookie s1
server web02 213.180.141.140:80 check #cookie s1
listen stats *:8989
stats enable
stats uri /
stats hide-version
stats auth admin:admin
# jeśli potrzebujesz proxy dla smtp

listen smtp :25
        mode tcp
        option tcplog
        balance roundrobin

        server smtp 192.168.0.1:25 check
        server smtp1 192.168.0.2:25 check

# jeśli potrzebujesz połączenie do RDP

listen rdp :3389
        mode tcp
        option tcplog
        balance rdp-cookie

        server sx01 10.1.1.11:3389 check
        server sx02 10.1.1.12:3389 check

If above configurations are not clear please refer this guide from HAProxy.

Testing

Let’s check whether our configuration has been done correctly. Try executing ip addr on master node. As you can see on the master node 192.168.6.164 IP is assigned.

root@S-08:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:bb:05:06 brd ff:ff:ff:ff:ff:ff
inet 192.168.6.169/28 brd 192.168.6.175 scope global eth0
inet 192.168.6.164/32 scope global eth0
inet6 fe80::250:56ff:febb:506/64 scope link
valid_lft forever preferred_lft forever

root@S-08:~# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 00:50:56:bb:05:06 brd ff:ff:ff:ff:ff:ff

inet 192.168.6.169/28 brd 192.168.6.175 scope global eth0

inet 192.168.6.164/32 scope global eth0

inet6 fe80::250:56ff:febb:506/64 scope link

valid_lft forever preferred_lft forever

Try executing ip addr on slave node.

root@S-09:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:bb:05:08 brd ff:ff:ff:ff:ff:ff
inet 192.168.6.170/28 brd 192.168.6.175 scope global eth0
inet6 fe80::250:56ff:febb:508/64 scope link
valid_lft forever preferred_lft forever

root@S-09:~# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 00:50:56:bb:05:08 brd ff:ff:ff:ff:ff:ff

inet 192.168.6.170/28 brd 192.168.6.175 scope global eth0

inet6 fe80::250:56ff:febb:508/64 scope link

valid_lft forever preferred_lft forever

Let stop the HAProxy on the master node. Now you can see that IP address 192.168.6.164 will be assigned to the salve node. If you start HAproxy instance on the master node IP address 192.168.6.164 will be assigned back to master node. See the O/P below.

root@S-08:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host 
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:bb:05:06 brd ff:ff:ff:ff:ff:ff
inet 192.168.6.169/28 brd 192.168.6.175 scope global eth0
inet6 fe80::250:56ff:febb:506/64 scope link 
valid_lft forever preferred_lft forever

root@S-08:~# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 00:50:56:bb:05:06 brd ff:ff:ff:ff:ff:ff

inet 192.168.6.169/28 brd 192.168.6.175 scope global eth0

inet6 fe80::250:56ff:febb:506/64 scope link

valid_lft forever preferred_lft forever

root@S-09:~# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host 
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:50:56:bb:05:08 brd ff:ff:ff:ff:ff:ff
inet 192.168.6.170/28 brd 192.168.6.175 scope global eth0
inet 192.168.6.164/32 scope global eth0
inet6 fe80::250:56ff:febb:508/64 scope link 
valid_lft forever preferred_lft forever

root@S-09:~# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo

inet6 ::1/128 scope host

valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

link/ether 00:50:56:bb:05:08 brd ff:ff:ff:ff:ff:ff

inet 192.168.6.170/28 brd 192.168.6.175 scope global eth0

inet 192.168.6.164/32 scope global eth0

inet6 fe80::250:56ff:febb:508/64 scope link

valid_lft forever preferred_lft forever

Try http://192.168.6.169:8989/stats or http://192.168.6.170:8989/stats URL to login into statistics report for HAProxy.

Statistics Report for HAProxy

If you have any questions let me know in the comments below. Your feedback is highly appreciated(happy-face).

LVM

2015-08-14T02:34:00.000-07:00

Create

This example creates an LVM logical volume called new_logical_volume that consists of the disks at /dev/sda1, /dev/sdb1, and /dev/sdc1.

5.1.1. Creating the Physical Volumes

[root@tng3-1 ~]# pvcreate /dev/sda1 /dev/sdb1 /dev/sdc1
  Physical volume "/dev/sda1" successfully created
  Physical volume "/dev/sdb1" successfully created
  Physical volume "/dev/sdc1" successfully created

5.1.2. Creating the Volume Group

The following command creates the volume group new_vol_group.

[root@tng3-1 ~]# vgcreate new_vol_group /dev/sda1 /dev/sdb1 /dev/sdc1
  Volume group "new_vol_group" successfully created

You can use the vgs command to display the attributes of the new volume group.

[root@tng3-1 ~]# vgs
  VG            #PV #LV #SN Attr   VSize  VFree
  new_vol_group   3   0   0 wz--n- 51.45G 51.45G

5.1.3. Creating the Logical Volume

The following command creates the logical volume new_logical_volume from the volume group new_vol_group. This example creates a logical volume that uses 2GB of the volume group.

[root@tng3-1 ~]# lvcreate -L2G -n new_logical_volume new_vol_group
  Logical volume "new_logical_volume" created

5.1.4. Creating the File System

The following command creates a GFS file system on the logical volume. np:

[root@tng3-1 ~]# gfs_mkfs -plock_nolock -j 1 /dev/new_vol_group/new_logical_volume
This will destroy any data on /dev/new_vol_group/new_logical_volume.

Are you sure you want to proceed? [y/n] y

Device:                    /dev/new_vol_group/new_logical_volume
Blocksize:                 4096
Filesystem Size:           491460
Journals:                  1
Resource Groups:           8
Locking Protocol:          lock_nolock
Lock Table:

Syncing...
All Done

The following commands mount the logical volume and report the file system disk space usage.

[root@tng3-1 ~]# mount /dev/new_vol_group/new_logical_volume /mnt
[root@tng3-1 ~]# df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/new_vol_group/new_logical_volume
                       1965840        20   1965820   1% /mnt

Rozszerzenie Phisical volume

echo 1 > /sys/block/sdX/device/rescan

[root@centos7 ~]# pvs
  PV         VG           Fmt  Attr PSize   PFree
  /dev/sda2  centos       lvm2 a--   59.51g 64.00m
  /dev/sdb   vol_group_sk lvm2 a--  160.00g 10.00g
[root@centos7 ~]# pvresize /dev/sdb
  Physical volume "/dev/sdb" changed
  1 physical volume(s) resized / 0 physical volume(s) not resized
[root@centos7 ~]# pvs
  PV         VG           Fmt  Attr PSize   PFree
  /dev/sda2  centos       lvm2 a--   59.51g 64.00m
  /dev/sdb   vol_group_sk lvm2 a--  210.00g 60.00g
[root@centos7 ~]#

Rozszerz LVM logical volume

# lvextend -L12G /dev/myvg/homevol
 
 
Najpierw zrób:
e2fsck -f /dev/myvg/homevol/dev/myvg/homevol

ext2/ext3

umount /dev/myvg/homevol/dev/myvg/homevol
   # resize2fs /dev/myvg/homevol         # wykonuj na zamontowanym zasobie 
   # mount /dev/myvg/homevol /home

 umount /dev/myvg/homevol/dev/myvg/homevol
   # ext2resize /dev/myvg/homevol       # wykonuj na zamontowanym zasobie 
   # mount /dev/myvg/homevol /home

 
xfs

mount /dev/myvg/homevol /home

xfs_growfs /home        # wykonuj na zamontowanym zasobie 
 
df -h  
 
 
Rozszerz LVM volume group
 
vgextend new_vol_group /dev/sdd

 Usuń uszkodzony dysk z volume group

# pvs -o+pv_used
Sprawdz zajętość dysków
# pvmove /dev/sdb1
przenieść dane z dysku do wymiany
/dev/sdb1: Moved: 2.0% ...
/dev/sdb1: Moved: 79.2% ...
/dev/sdb1: Moved: 100.0%

# pvs -o+pv_used
Sprawdz zajętość dysków

# vgreduce myvg /dev/sdb1
Wypnij dysk z grupy

Red Hat & Ubuntu reset root password

2015-08-13T04:35:00.000-07:00

REDHAT

- init.d
W Grub Press "e"
linia kernel... Press "e" na końcu space i 1
Enter
Pres "b"
passwd

- system.d
W Grub Press "e"

linia linux16....znajdz
rhgb quite LANG
i zmien na
rhgb quite rd.break LANG
Ctrl + x

Jak wyskoczy Promt #
mount -o remount,rw /sysroot/
chroot /sysroot/
passwd

UBUNTU 14

Albo tryb recovery i potem
mount -o remount,rw /
chroot /

Albo:

Select (highlight) the GRUB boot menu entry you wish to use.
Press e to edit the GRUB boot commands for the selected boot menu entry.
Look near the bottom of the list of commands for lines similar to

linux /boot/vmlinuz-3.2.0-24-generic root=UUID=bc6f8146-1523-46a6-8b\
6a-64b819ccf2b7 ro quiet splash
initrd /boot/initrd.img-3.2.0-24-generic
Change the middle line in (3) by adding the kernel boot parameter single to the end of the line (i.e. after ro quiet splash).

For this example you would change
6a-64b819ccf2b7 ro quiet splash
to
6a-64b819ccf2b7 ro quiet splash single
Press either Ctrl+X or F10 to boot using these kernel options.

Lists all the shared folder permissions or NTFS permissions (PowerShell)

2015-07-13T02:19:00.002-07:00

https://gallery.technet.microsoft.com/scriptcenter/Lists-all-the-shared-5ebb395a

The Default Execution Policy is set to restricted, you can see it by typing:

Get-ExecutionPolicy

You should type the following to make it go to unrestricted mode:

Set-ExecutionPolicy unrestricted

Samba 4

2015-06-22T04:30:00.000-07:00

http://mark.orbum.net/2014/02/22/compiling-samba-4-on-debian-wheezy-active-directory-domain-controllers-ho/
http://sourceforge.net/projects/samba4all/files/4.1.9/Ubuntu%2014.04Sernet4.1.9/
cat /etc/lsb-release

samba-tool domain provision --use-rfc2307 --interactive

samba-tool dns update 10.1.9.14 samba4.ad nginx2 A 192.168.163.10 10.1.9.14 -U Administrator

apt-get install acl attr krb5-user
ignore the kerb details and just accept defaults as will be overwritten later
edit fstab and add user_xattr,acl nano /etc/fstab so you end up with something like the below /dev/mapper/samba1--vg-root / ext4 user_xattr,acl,errors=remount-ro 0 1 https://wiki.samba.org/index.php/OS_Requirements#fstab_2 nano /etc/apt/sources.list.d/samba4-sernet.list paste in my case my account please get your own from https://portal.enterprisesamba.com/ # # SerNet Samba 4.1 Packages # # (ubuntu-trusty) # deb https://USERNAME:ACCESSKEY@download.sernet.de/packages/samba/4.1/ubuntu trusty main deb-src https://USERNAME:ACCESSKEY@download.sernet.de/packages/samba/4.1/ubuntu trusty main Add repo GPG key wget http://ftp.sernet.de/pub/sernet-samba-keyring_1.4_all.deb dpkg -i sernet-samba-keyring_1.4_all.deb apt-get install apt-transport-https apt-get update apt-get install sernet-samba-ad Samba4 has password minimums so we start with Mysamba4 samba-tool domain provision --domain=SAMBA4 --adminpass=Mysamba4 \ --dns-backend=SAMBA_INTERNAL --server-role=dc \ --function-level=2008_R2 --use-xattr=yes \ --use-rfc2307 --realm=SAMBA4.LAN samba-tool domain passwordsettings set --complexity=off samba-tool domain passwordsettings set --min-pwd-length=5 samba-tool user setpassword Administrator changed to samba4 so both sudo and samba password =samba4 nano /etc/default/sernet-samba to change startup mode to ad SAMBA_START_MODE="ad" reboot Add reverse zone for server on local subnet (192.168.1.3 being my server set by dhcp) samba-tool dns zonecreate 192.168.1.3 1.168.192.in-addr.arpa --username=administrator Add ptr for server (3 being IP for 1.168.192 subnet) samba-tool dns add 192.168.1.3 1.168.192.in-addr.arpa 3 PTR SAMBA1.SAMBA4.LAN --username=administrator #Check /etc/samba/smb.conf and change forwarder address to your dns server nano /etc/samba/smb.conf (192.168.1.1 being router dns) ************************************************************* dns forwarder = 192.168.1.1 ************************************************************** #Reload Samba smbcontrol all reload-config #Ok some checks to see if all is ok smbclient -L localhost -U% *********************************************************** root@samba1:~# smbclient -L localhost -U% Domain=[SAMBA4] OS=[Unix] Server=[Samba 4.1.6-SerNet-Debian-7.wheezy] Sharename Type Comment --------- ---- ------- netlogon Disk sysvol Disk IPC$ IPC IPC Service (Samba 4.1.6-SerNet-Debian-7.wheezy) Domain=[SAMBA4] OS=[Unix] Server=[Samba 4.1.6-SerNet-Debian-7.wheezy] Server Comment --------- ------- Workgroup Master --------- ------- ***************************************************************************** smbclient //localhost/netlogon -UAdministrator -c 'ls' ***************************************************************************** root@samba1:~# smbclient //localhost/netlogon -UAdministrator -c 'ls' Enter Administrator's password: Domain=[SAMBA4] OS=[Unix] Server=[Samba 4.1.6-SerNet-Debian-7.wheezy] . D 0 Fri Mar 28 15:12:07 2014 .. D 0 Fri Mar 28 15:12:12 2014 48812 blocks of size 131072. 37202 blocks available ******************************************************************************** host -t SRV _ldap._tcp.samba4.lan. ****************************************************************************** root@samba1:~# host -t SRV _ldap._tcp.samba4.lan. _ldap._tcp.samba4.lan has SRV record 0 100 389 samba1.samba4.lan. ****************************************************************************** host -t SRV _kerberos._udp.samba4.lan. ****************************************************************************** root@samba1:~# host -t SRV _kerberos._udp.samba4.lan. _kerberos._udp.samba4.lan has SRV record 0 100 88 samba1.samba4.lan. ********************************************************************************* host -t A samba1.samba4.lan. ****************************************************************************** root@samba1:~# host -t A samba1.samba4.lan. samba1.samba4.lan has address 192.168.1.8 ****************************************************************************** netstat -tapn | grep samba ****************************************************************************** root@samba1:~# netstat -tapn | grep samba tcp 0 0 0.0.0.0:464 0.0.0.0:* LISTEN 2170/samba tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 2176/samba tcp 0 0 0.0.0.0:88 0.0.0.0:* LISTEN 2170/samba tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 2168/samba tcp 0 0 0.0.0.0:1024 0.0.0.0:* LISTEN 2164/samba tcp 0 0 0.0.0.0:3268 0.0.0.0:* LISTEN 2168/samba tcp 0 0 0.0.0.0:3269 0.0.0.0:* LISTEN 2168/samba tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 2168/samba tcp 0 0 0.0.0.0:135 0.0.0.0:* LISTEN 2164/samba ****************************************************************************** kinit Administrator@SAMBA4.LAN ********************************************************************* Password for Administrator@SAMBA4.LAN: Warning: Your password will expire in 41 days on Sat May 10 01:14:36 2014 ********************************************************************** klist ********************************************************************* root@samba1:~# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: Administrator@SAMBA4.LAN Valid starting Expires Service principal 29/03/14 00:22:41 29/03/14 10:22:41 krbtgt/SAMBA4.LAN@SAMBA4.LAN renew until 30/03/14 00:22:37 ************************************************************************ #If all is not ok the first remove the samba created config and then go back to #samba-tool domain provision .... rm /etc/samba/smb.conf rm -R /var/lib/samba/private/* rm -R /var/lib/samba/sysvol/* Install webmin apt-get install perl libnet-ssleay-perl openssl libauthen-pam-perl libpam-runtime libio-pty-perl apt-show-versions python wget http://prdownloads.sourceforge.net/webadmin/webmin_1.690_all.deb dpkg --install webmin_1.690_all.deb

Ubuntu SSH + AD

2015-06-19T03:14:00.000-07:00

Installing and Configuring Kerberos, Samba, and Winbind on Ubuntu Server 5

Steps

Step 1: Install the Required Packages

Note: Enter Y when asked if you want to install the additional packages

apt-get install krb5-user
apt-get install winbind samba

Step 2: Edit the /etc/krb5.conf File

Code:

[logging]
    default = FILE10000:/var/log/krb5lib.log
[libdefaults]
    ticket_lifetime = 24000
    default_realm = DOMAIN.INTERNAL
    default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc
    default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc
[realms]
    DOMAIN.INTERNAL = {
        kdc = domainserver.domain.internal
        admin_server = domainserver.domain.internal
        default_domain = DOMAIN.INTERNAL
}
[domain_realm]
    .domain.internal = DOMAIN.INTERNAL
    domain.internal = DOMAIN.INTERNAL

Step 3: Edit /etc/samba/smb/conf

Notes: Change the NETBIOS name parameter to be correct for the server. Make a backup copy of the original file!!!

1) Make the edits. The configuration shown is the bare minimum and doesn't share anything.

Code:

[global]
        security = ads
        netbios name = CMHRG02
        realm = DOMAIN.INTERNAL
        password server = domainserver.domain.internal
        workgroup = DOMAIN
        idmap uid = 500-10000000
        idmap gid = 500-10000000
        winbind separator = +
        winbind enum users = no
        winbind enum groups = no
        winbind use default domain = yes
        template homedir = /home/%D/%U
        template shell = /bin/bash
        client use spnego = yes
        domain master = no

2) Test the configuration with the testparm command

Step 4: Edit /etc/nsswitch.conf to look like the example below

Code:

passwd:         compat winbind
group:          compat winbind
shadow:         compat
hosts:          files dns wins
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis

Step 5: Modify the PAM settings

1) /etc/pam.d/common-account should contain only the following lines

Code:

account sufficient pam_winbind.so
account required  pam_unix.so

2) /etc/pam.d/common-auth should contain only the following lines

Code:

auth    sufficient      pam_winbind.so
auth    required        pam_unix.so nullok_secure use_first_pass

3) Modify the /etc/pam.d/common-password file, so the max parameter is set to 50, similar to the one shown below

Code:

password   required   pam_unix.so nullok obscure min=4 max=50 md5

4) Make sure the /etc/pam.d/common-session file contains the following line

Code:

session required        pam_mkhomedir.so umask=0022 skel=/etc/skel

Step 6: Make a directory to hold domain user home directories

Note: Use the value you put in the WORKGROUP tag of the /etc/samba/smb.conf file

Code:

mkdir /home/DOMAIN

Step 7: Initialize Kerberos

1)

Code:

kinit domain_admin_account@DOMAIN.INTERNAL

Next check to be sure you got a ticket from the domain controller

2)

Code:

klist

Step 8: Join the system to the

Code:

net ads join -U domainadminuser@DOMAIN.INTERNAL

Step 9: Restart Samba-related Services (Or reboot the server)

Note: The order is important

Code:

/etc/init.d/samba stop
/etc/init.d/winbind stop
/etc/init.d/samba start
/etc/init.d/winbind start

Step 10: Restart SSH and Test Connectivity

Note: If you rebooted the server in the previous step, just try and login.

Code:

/etc/init.d/ssh restart

ssh useraccount@server

If you can login using your active directory username and password then everything is working!

Step 11: Configure SUDO

1) First create a group in Active Directory called UnixAdmins and add the names of people whom you want to be able to use sudo to admin the server.

2) Next, add the UnixAdmins group to the /etc/sudoers so these users can use sudo

Code:

%UnixAdmins ALL=(ALL) ALL

HELPFUL COMMAND LINES

1) List the derived UNIX GID values for Active Directory groups

Code:

for gid in $(wbinfo -r ); \
do SID=$(wbinfo -G $gid);GROUP=$(wbinfo -s $SID); echo $gid is $GROUP; done

2) See the Active Directory SID for a particular named user

Code:

wbinfo –n