Nerdy Notes

Tunneling vSphere Client in Windows

2012-02-14T11:36:00.000-05:00

Using tunneling over SSH you can forward the multiple ports needed to access the vSphere client used to administrate ESX or ESXi hosts.

Requirements:

SSH jumpbox (from this jumpbox you should have access to the ESX/ESXi machine)
PuTTY or Cygwin

So basically we are binding the following ports: 443, 902, and 903 to our localhost using PuTTy in this tutorial.

Steps:

Open up PuTTy and configure the settings to look as follows where destIP=your destination IP address of the ESX box

ssh -L 443:destIP:443 -L 902:destIP:902 -L 903:destIP:903 user@jumpboxIP

Edit the hosts file in windows C:\Windows\system32\drivers\etc\hosts (this is required as esxi relies on dns name and uses local resolution).

Add the entry:
127.0.0.1 ESXiHostname
Open up vSphere client and login with the hostname of the remote ESX box

Common Errors:
Unable to connect to the MKS: Failed to connect to server :902

Occurs if you are not properly forwarding port 902 903

Customizing an VMware ESXi5 installation disc for unattended install

2012-02-11T09:22:00.010-05:00

This explains the workflow of creating a customized ESXi5 installation disc using a Windows PC. VMware has documentation on this workflow using a linux machine here.

1) Download the ESXi iso.

2) Extract the iso using your favourite iso extractor to c:\esxi. I used 7zip.

3) Create a KS.CFG file in c:\esxi with your Kickstart config. Documentation of ESXi5 kickstart commands is here.

4) Modify c:\esxi\ISOLINUX.CFG. Append "ks=cdrom:/KS.CFG" to APPEND. Your LABEL install should look like this:

LABEL install

KERNEL mboot.c32

APPEND -c boot.cfg ks=cdrom:/KS.CFG

MENU LABEL ESXi-5.0.0-20111104001-custom ^Installer

You can also add multiple LABEL install blocks to specify different KS.CFG files or no kickstart at all.

**When ESXi mounts the CD during setup, all files are capitalized. So even if your kickstart cfg file is ks.cfg you have to put KS.CFG.

Now you have to burn your customized setup onto a disc.

1) Download and extract cdrtools for windows from here.

2) Run this command to create the iso (case senstive):

mkisofs.exe -relaxed-filenames -J -R -o custom_esxi.iso -b ISOLINUX.BIN -c c:\esxi\boot.cfg -no-emul-boot -boot-load-size 4 -boot-info-table c:\esxi

3) Burn custom_esxi.iso to disc with any utility. I used the Windows 7 built-in iso burner.

Common Errors:

Not specifying boot.cfg in mkisofs

kernel= must be set in /boot.cfg

Fatal error: 32 (Syntax)

Using imgburn

“No DEFAULT or UI configuration directive found”

ata-pata.v00 not found

ks.cfg was not capitalized in isolinux.cfg

cannot find kickstart file on cd-rom with path -- /ks.cfg

Using fsutil to Create an Empty File (dd alternative)

2012-02-05T08:46:00.002-05:00

In a previous post we learnt about the dd utility and how we can use that to wipe a drive with zeros.

The dd utility can be used to create a file full of zeroes, but there is also a windows utility built right into fsutil that allows you to do the same thing.

Both of the following examples create an empty file full of zeroes, each with a size of 10GB:

dd
dd if=/dev/zero of=/path/zeroedfile.dd bs=4M count=2560

fsutil
fsutil file createnew zeroedfile.dd 10000000000

Both of these tools can be very useful in testing raw sequential read/write disk performance as well as testing out upload compression.

Jumping Phone Queues

2011-12-14T21:08:00.001-05:00

I've been put on hold many times trying to resolve issues but have found and confirmed working some methods to jump phone queues.

"Most of the software has a "3 mistakes and you're bounced" ruling, so pressing the * key three times should send you to an agent.

Alternatively, try * #0 or *0"

Paypal: *#0
Works Flawlessly transferred directly to an agent

Other:
0#0#0#
has also been said to work when pressed continuously in succession

As a side note here is a video tutorial on jumping phone queues and generally getting to speak to a representative/agent quickly:

http://www.videojug.com/film/how-to-hack-a-call-center-telephone-system

Creating a WinPE 3.1 USB

2011-11-21T18:50:00.008-05:00

WinPE 3.1 is a MS toolkit for deploying images. (Version 3.1 supports upto Win 7 SP1)

These steps will create a a Windows PE 3.1 Bootable USB with imagex.exe integrated.
imagex.exe will be use to "capture" and "deploy images on machines.

1) Download and install Windows AIK 3.0.
2) Download Windows AIK 3.1. This is a patch to support Windows 7 SP1.
3) Extract Windows AIK 3.1 iso file.
4) Insall AIK 3.1 with the following command. You need to run this in a elevated promp
"xcopy E:\ "C:\Program Files\Windows AIK\Tools\PETools" /ERDY"
where E:\ is the root directory of the ISO image.

5) Follow step 1 & 2 to prepare for a custom WinPE image here.

6) Follow step 3 in the MS doc to add the "WinPE-WDS-Tools" component. This will install the images.exe utility in your WinPE image.

7) Follow step 6 in the MS doc to unmount the image.

8) Follow step 3 in this MS doc to create a WinPE bootable USB.

Capture an image:

1) Boot the computer into the WinPE environment with the WinPE USB you created.

2) run this command: images.exe /capture /compress max "image name"

Deploy an image:

1) Boot the computer into the WinPE environment with the WinPE USB you created.

2) run diskpart.exe to configure your disk partitions and assign drive letter:

diskpart

select disk 0

clean

create primary partition

format quick fs=ntfs

active

assign letter="c"

exit

3) apply the image using imagex.exe: imagex.exe /apply 1 c:

4) setup the system partition for booting: bcdboot.exe c:\Windows

Checking RAM Speed, Size and other BIOS information

2011-07-31T10:02:00.000-04:00

I find myself looking for RAM speed and size quite often at my current workplace. A useful tool included in some flavours of linux is the dmidecode command which will dump a computers DMI table (SMBIOS) to human-readable format. I also gives a ton of other useful information about the BIOS and hardware.

sudo dmidecode --type 17

Also, take a look at this resource site for more information about this BIOS decoding utility and a reference table for what "type" = what hardware or information: http://www.cyberciti.biz/tips/querying-dumping-bios-from-linux-command-prompt.html

IOS Harden Template

2011-07-27T00:33:00.002-04:00

Here's a template I use for Cisco IOS routers. These are basic security best practices for IOS relating to access authentication, logging, system and IP stack tuning to harden IOS. Not included are ACLs and CABAC firewall configs (saving that for another post)

no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service linenumber

boot-start-marker
warm-reboot count 50
boot-end-marker
!
logging buffered 64000 debugging
no logging console

aaa new-model
aaa authentication login default local
aaa authorization exec default local
!****remember to set a user*****

clock timezone EST -5
clock summer-time EDT recurring
no ip source-route
no ip gratuitous-arps
ip options drop
ip cef
ip tcp synwait-time 10

ip dhcp bootp ignore
no ip bootp server
ip port-map ssh port tcp

login block-for 120 attempts 5 within 60
login delay 3
login on-failure log
login on-success log

memory reserve critical 2048
memory free low-watermark processor 4096
memory free low-watermark IO 4096

archive
log config
logging enable
hidekeys

ip tcp path-mtu-discovery

hostname
ip domain name
crypto key generate rsa modulus 4096
ip ssh time-out 60
ip ssh port rotary 1
ip ssh version 2

buffers tune automatic

!int interface
!--- bandwidth
!--- ip verify unicast source reachable-via rx
!--- no ip redirects
!--- no ip proxy-arp
!--- ip route-cache flow

no ip forward-protocol nd
no ip http server
no ip http secure-server

logging history size 500
no cdp run

banner login ^C
******************************************
* Unauthorized access prohibited
******************************************
^C

line con 0
no modem enable
line aux 0
exec-timeout 0 1
no exec
transport output none
line vty 0 4
exec-timeout 10
logging synchronous
rotary 1
transport preferred none
transport input ssh

! Use interval only if allocate isn't supported
scheduler allocate 3000 1000
!scheduler interval 1000

Periodic Table of Videos

2011-06-09T08:31:00.000-04:00

Recently I've been watching some interesting videos describing the common/interesting properties of many of the elements. Normally I wouldn't be so inclined as to look at them on a whim but this great site explains each element in a video and gives you some insight into common properties, uses, and molecular structure of each element or compound.

You can find the videos here http://www.periodicvideos.com/index.htm the site has been recognized by Science Magazine and won the Science Prize for Online Resources in Education (SPORE) to which I believe is well deserved.

Definitely something people interested in science or more specifically chemistry should check out

Media Centre Black Levels

2011-06-08T16:06:00.000-04:00

Some of you may have noticed that the black levels in media centre end up looking a bit grey.

The main reason for this is that Windows intended for media centre to be used on a television monitor which only supports black levels from 16-235. So if you are viewing Media Centre on a computer LCD display which generally support 0-255 black levels you are definitely missing out on some of you blacks and thus lacking quite a bit of contrast in your picture.

I found the solution to the issue at the following website http://www.hack7mc.com/2009/06/fixing-media-centers-poor-black-levels.html which provides a registry edit for Media Centre to change your black levels to 0-255 to give you the full amount of black levels that your monitor supports.

Another option that would be available might be through your video card. Sometimes you will be able to set permanent black levels that will hold for every application you open via your video card settings console.

For example you can change your black level settings from older versions of Catalyst Control Center through some of the display options. You can see instructions on how to do that from the following forum post http://www.avforums.com/forums/home-entertainment-pcs/1372169-guide-how-upscale-dvds-video-using-catalyst-control-centre.html or just reference the following screenshot and find your way there visually :P

Debugging Over Remote SSH Connections (Cisco)

2011-05-01T22:57:00.000-04:00

Terminal monitor - Enables you to display debug and system error messages on the console line through remote connections

dd Progress

2011-05-01T11:23:00.005-04:00

Quick Tip for checking the progress for dd

When you dd is running, open up a new terminal, and run:

ps -aux

to find the process ID (PID) of your dd command, which should be near the bottom. Then use the command:

kill -USR1

which will send show the progress message in your dd window.

Windows 7 Samba Share Issues

2011-04-28T15:38:00.001-04:00

On some Windows 7 installations you may end up not being able to access network shares inbound to the desired machine but can easily connect to an outbound machine. The error looks something like seen above

This issue can be solved in some cases by an edit to the "Local Security Policy" but needs to be done by the administrator.

Windows Key > Type CMD in the search bar > Right Click cmd.exe and "Run As Administrator" > Type "gpedit"

This will bring you to the group policy editor in Windows 7.
From there go to: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options

This will put you in the security policies for your system and the place where you need to make the change for your machine to authenticate to the remote machine successfully.

From here: Look for the "Network Security: LAN Manager Authentication Level" Policy and "right click" and change it from undefined to "Send NTMLv2 responcse only, refuse LM & NTML"

Alternatively
This could just be an issue in which you have not enabled the file sharing or are not on a "Home Network" where sharing is permitted.

If that is the case ensure you change your settings by going to Control Panel > Network and Sharing Center > Change Advanced Sharing Settings.
Then turn on Network Discovery, File and Printer Sharing, and Public Folder Sharing(If you are using public folders for sharing purposes) in your Home Network drop down.

Right Click to Open a Folder in Command Prompt

2011-04-28T15:12:00.004-04:00

If you need to open a command prompt to a folder, you can add a right click option explorer. This lets you quickly open a a command prompt in the folder you choose, having to avoid typing CD and the path to the folder.

Start > Run > regedit
Navigate to "HKEY_LOCAL_MACHINE/Software/Classes/Folder/Shell"
Create new KEY called "Command Prompt"
Change the default string to "Open in cmd"
Create a new KEY called "command"
Change the default string to "cmd.exe /k pushd %1"

You can change "Open in CMD" to anything you want to show up on the right click menu.

Now, when you right click on (not in) a folder in Explorer, a new option will be available to open the folder in command prompt.

Sectors, Clusters and Other Useful Drive information

2011-04-18T18:59:00.002-04:00

I just ran into a utility today that allows you to check your cluster allocation size, sector size, and a bunch of other useful infomration including the location of your Master File Table and how many sectors/clusters are free.

The command is:
fsutil fsinfo ntfsinfo C:

The fsutil command requires administrative priviledges so make sure you right click and run as administrator.

For more information on the fsutil command and other options check out as there are quite a few more interesting commands to check out information about your file system.

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/fsutil.mspx?mfr=true

To get more specific into the fsinfo command we used to display the stats follow the links to
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/fsutil.mspx?mfr=true

Looking through the pages I found another useful command for when you need to dismount a hdd and the GUI just isnt working or you dont have access to the eject utility

fsutil volume dismount C:

Seems like a pretty useful command, I'm surprised i hadn't used fsutil before

Edit: One final really cool use of fsutil is creating files of specified size
fsutil file createnew C:\File-100MB.txt 102400000
The above creates a file that is 100MB in size great for testing transfer times or any other useful application

WTV support now available on FFmpeg

2011-03-29T10:58:00.004-04:00

WTV, the recording format used by Windows 7 Media Center, has been added to the list of supported input format to FFmpeg. FFmpeg is a open source project used by a number of other open source project, including VLC and Handbrake. Thus, open source projects relying on FFmpeg will automatically get WTV support when they update their FFmpeg code!

So far, WTV support has been incorporated into the following apps:

VLC v1.1.7
Handbrake Nightly builds: (Verified working on build 2011032801, does not work on 0.95 stable release)

One thing I noticed is that the WTV demuxer crashes when the video or audio stream drops out (which happens from time to time with OTA tv recording.)

Links:
http://web.archiveorange.com/archive/v/yR2T4K0mXHuJVykOy7xB

Runas Privilages

2011-03-14T14:40:00.007-04:00

If you need run a program or explorer under another account (ie local Administrator or another Domain account), you can use the following command:

runas /u:[account] "[program]"

for example:

runas /u:Administrator "notepad.exe"

runas /u:\\Domain\myacount "notepad.exe"

Will allow you to open notepad instance with another set of credentials.

Note: for Windows XP, you can use runas /u:Administrator "explorer.exe /separate" to open another instance of explorer under another account, however this has been removed in Vista and Windows 7.

Create an Inbound Rule to Block Traffic (ICMP)

2011-02-28T16:32:00.000-05:00

I found that my public network settings blocked every other service but ping. As ping can be used to identify which machines are connected on a network it can allow a machine to be subject to many different attacks or DoS.

To configure this go to Control Panel > Windows Firewall > Advanced Settings

On the left navigation bar click "Inbound Rules"

And on the right navigation pane click "New Rule"

Then I clicked "Custom Rule" as I wanted more flexibility in my configuration and also seemed easier to add the rule I wanted to block ICMP.

Select "All Programs"

Select "protocol type" drop-down menu and in my case I selected ICMPv4. You can also select "Customize" to tell it what portions of ICMP you want to block or just block all inbound ICMP messages.

The next window asks you what IP range you want to block for. I just let it block all IP's by not changing anything

Specify an action. Whether to allow or block these messages. I chose block because I don't want these messages to be allowed.

Lastly, the most important part is selecting what network to block these messages on. Whether you want it to be blocked when you have your profile on a public network or a private network or a domain.

I am setting mine up for public network, and domain only so that I still have access to ping at home for troubleshooting.

Finally, Just name the profile and you're done!

DNS, DHCP and Static IP with Ubuntu

2011-02-23T14:03:00.005-05:00

I finished setting up an Ubuntu server a test lab, and quickly learned a few tips for DHCP and static IP addresses.

Setting and Interface for DHCP

If you want to change an interface to use DHCP, edit /etc/network/interfaces making sure you remove the static config

Example:

nano /etc/network interfaces

iface eth0 inet static

address 192.168.0.x
netmask 255.255.255.0
network 192.168.0.x
broadcast 192.168.0.255
gateway 192.168.0.x

iface eth0 inet dhcp

The reverse can be done to change from DHCP to static.

Adding Alternative DNS server

Since DNS servers are handled by the DHCP, I wanted to add an alternative DNS server. Editting the dhclient.conf lets you do this and adding the following the lines to the file.

Example:

nano /etc/dhcp3/dhclient.conf

prepend domain-name-servers 127.0.0.1

or use supersede to replace them.

supersede domain-name-servers 127.0.0.1

Now the your Ubuntu server can run with DHCP with alternative DNS servers.

Use /etc/init.d/networking restart to apply the changes for the DHCP and DNS right away.

Handbrake encoding for iPhone 4

2011-02-21T15:14:00.013-05:00

Adding to Brad's HandBrakeCLI post, I optimized the conversion profiles for iPhone 4 for quality, speed of rendering.

For high speed encoding, use these parameters. It takes about 1/2 playback length to encode on a 4 core i7 920 Processor. It will do a single pass encoding at 600kb/s.

HandBrakeCLI -i input.mov -o output.mp4 -C 4 -e x264 -b 600 -a 1 -E faac -B 128 -6 dpl2 -R 48 -D 0.0 -f mp4 -X 960 --modulus 16 -x cabac=1:ref=8:bframes=16:b-adapt=1:me=hex:subme=9:trellis=1:partitions=all:direct=auto

For high quality encoding, the following parameters uses 2 pass encoding for higher picture quality at the expense of encoding time (about equal to playback length). Again, this encodes at for 600kb/s.

HandBrakeCLI -i input.mkv -o output.mp4 -C 4 -e x264 -2 -T -b 600 -a 1 -E faac -B 128 -6 stereo -R 48 -D 0.0 -f mp4 -X 960 --modulus 16 -x cabac=1:ref=8:bframes=16:b-adapt=1:me=umh:subme=10:trellis=2:partitions=all:direct=auto

For more information about h.264 parameters and how they affect quality and speed, see this:
http://www.mplayerhq.hu/DOCS/HTML/en/menc-feat-x264.html

Cron Overlap Locking

2011-02-21T15:08:00.001-05:00

Lets say you have a cron job set to run every hour.
Lets assume this job takes longer than an hour to actually complete.

What happens when that initial cron job runs again?
It overlaps and starts running a new instance of the script you wanted to execute making a big mess and unpredictable results.

Here's how to fix that issue with cron job locking:

Step 1: Download and Install Steve Friedl's lockrun utility
From a sudoers terminal prompt issue the following command to download the utility
wget http://www.unixwiz.net/tools/lockrun.c
This utility basically does all the hard work of creating and checking lockfiles when you're running cronjobs. All you need to do is specify the lockfile and the script.

Step 2: Build this C program using gcc compiler
gcc lockrun.c -o lockrun

Step 3: Move this program to a better place
sudo cp lockrun /usr/local/bin

Step 4: Using lockrun in crontab entries
sudo nano /etc/crontab

Make a manual entry to the crontab (Mine is set to run every 5 minutes on the 5's)
*/5 * * * * root /usr/local/bin/lockrun --lockfile=/var/run/mp4.lockrun -- /usr/local/bin/./mp4

I have set the script for my root user to run a script called mp4 in the /usr/local/bin directory every 5 minutes
The lockrun utility is run before this with the modifiers telling it where to store the lockfile it will use to check if the script is running as well as the script that is tied to the lockfile

As an important side note on the lockrun website:
Be sure to place the lockfile in a directory that only that user has the rights to, and not in /tmp (as this Tech Tip has previously suggested). If a different user has the ability to write to the directory, s/he could create a symbolic link from the target lockfile to some system file that uses locks the same way, and get the cron job to foul up the locking.

Note: If you have any issues with the lockrun program please visit the originating website for this tool http://www.unixwiz.net/tools/lockrun.html

For more information on creating crontabs for different repetition periods see the following:
http://en.wikipedia.org/wiki/Cron#Examples

Windows Vista/7 Printer deployment via GPP

2011-02-12T12:07:00.005-05:00

If you're deploying printers via Group Policy Preference under users configuration, you'll find that printers are not installing when users login. Windows would also log the following error

"preference item in the '[USER] Default User Policy' Group Policy object did not apply because it failed with error code '0x80070005 Access is denied"

There are 2 things you need to do to resolve this:

1) Modify "Point and Print" restrictions to allow users to install network printers without elevating to admin privileges. In XP, this is the default behavior, but in Windows Vista and above, Windows must have admin privileges to install printer drivers from the printer server.

To add allow users on Windows Vista/7 to you must change these settings under GRO
>Computer Configuration/Policies/Administrative Templates/Printer/Print and Point Restrictions
>"Do not show warning or elevation prompt" for installling and updating drivers.

2) Ensure that printers are being installed using the user security context. For some reason, user GPP printers are installed under the SYSTEM context, which means the installation can't communicate to the print server to download drivers, thus installation fails. More about GPP security context here.

In the "common" tab of each printer in GPP, check "Run in logged-on user's security context (user policy option)"

Now your GPP deployed printers should install properly.

Cisco IOS IKE pre-shared key error message

2011-02-11T16:35:00.004-05:00

I found out if your IPSec tunnel's preshared key is wrong on Cisco IOS routers, the message that it shows is:

%CRYPTO-4-IKMP_BAD_MESSAGE: IKE message from 173.33.140.143 failed it ^s sanity check or is malformed

Talk about cryptic messages! Not very helpful, but now you know if you see that message, check your preshared keys!

Multiple iOS Backups

2011-02-08T19:22:00.001-05:00

By default iTunes only takes 1 backup per device. There is no configuration in iTunes at the moment to configure multiple backups for the same device which can cause an inconvenience.

Here is how to create multiple backups for your iOS device in iTunes this works for every device

Step 1: Locate the Backup Folder
For windows this is located in C:\Users\(username)\AppData\Roaming\Apple Computer\MobileSync\Backup
There will be a bunch of files with random names in them. The ones that are date stamped at the end in the formay yyyymmdd are backups that iTunes created when you did some kind of upgrade of your iOS device.

Step 2: Make a copy of the backup folder
Copy whichever folder is the last backup for your device (easily done by checking in windows explorer for the last modified data). If you still cant tell which one it is go into the Info.plist file and check what backup it is there (more on that later)

Rename the folder to something more descriptive and put a date on it so you know when you created it

Step 3: Edit the Info.plist file so iTunes will be able to tell you which backup is which
Open the Info.plist file located in the backup folder you just copied. Locate the string tag just below the key tag for Display Name and edit it to your chosing.

Change the following:
<key>Device Name</key>
<string>iPhone Name or Title</string>
<key>Display Name</key>
<string>iPhone Name or Title</string>

To something that looks like this:
<key>Device Name</key>
<string>iPhone Name or Title</string>
<key>Display Name</key>
<string>New iPhone Name or Title - YYYY-MM-DD</string>

Step 4: Save the file

Now you can restore from multiple backups in iTunes and your backups will be named descriptively.

Digital TV Signal Strength

2010-12-22T13:27:00.000-05:00

If you are starting to get into receiving free High Definition TV over the air then there are some good tools for you to check what signals you are getting in your area and how strong these signals are. You will be able to determine what lengths or how easy it would be to get these signals using these two websites.

TV Fool: This tool allows you to see in a graph of which direction the signal is coming from as well as a signal strength graph.

This is a great way to dynamically see where the signals are coming from and at what strength these channels are.

They also have maps and guides as to how high your antenna needs to be in order to get the signal and what measures you need to use in order to improve your signal.

Another cool feature is the maps they provide to show you the coverage areas of various signals. Using Google maps you will be able to see if the signal you want covers the area you live in.

Below you can see the coverage area map of Global Television: Callsign CIII

Another resource is:

remotecentral: This provides an idea of the signal quality and the relative feedback of users who are getting the signal.

It also shows antenna directions and the strength rating of each antenna. Though not quite as visual or as detailed as tvfool it is still a good resource to find out what channels you should be getting in your area and which direction you should be pointing your antenna to.

Patching ESXi single host

2010-12-20T16:41:00.005-05:00

For ESXi 4.0 and below, patching can be done with vSphere Host Update Utility.

For ESXi 4.1, vSphere Host Update Utility is no longer supported. Patch using command line:

1) Download patch bundles from VMware's support website: www.vmware.com/patch/download/

2) Upload the patch bundles to your datastore. (You can use vSphere client to do this.)

3) Put the ESXi host into maintenance mode.

4) SSH into the ESXi box. This blog shows how to enable SSH on ESXi 4.1.

5) CD to the datastore and use esxupdate --bundle to patch ESXi:
cd /vmfs/volumes/datastore0/patches
esxupdate --bundle ./ESXi410-201011001.zip update