To reset the secure connection between a workstation and a domain controller.

netdom reset MACHINE /domain:DOMAIN

To see what site your computer think it belongs to

nltest /dsgetsite

Need comes around to fix something quickly. You write a script cuz, it’s better for the computer to do it that you. It’s shite. You know it. The need is covered at that moment, yet the script you wrote keeps on living and producing work!

Given a computer/server, which is considered as a “production server”, and which cannot go down for a dd over netcat, what do you do?

Mirror it. but how? You can’t do it the smart kind. The kind that you’re being told “here’s a machine, i don’t have time to teach you how to make another one like this/the guy that did it left and we got no documentation. How do you do it?

The kind that you’re being told “here’s our mistake,  fix it for us, but do it quickly”.  Ends up as another mistake.

http://www.tuxradar.com/content/command-line-tricks-smart-geeks has some useful tricks. A lot of it is presented as being bash-specific, but isn’t. Also, a lot seems Linux-specific, but isn’t. Lots of useful info for all Unix/Linux admins here. These hints go on and on; hardly any of them are the generic stuff you often see on Ubuntu forums, stumbleupon, and so on.

Every time that I sent an email with an user, the system was displaying the message that could not chdir to the mail directory. I solved following the steps below:

user@linux:~ $ mail blackhole@domain.com
Subject: Test
Sending email to test
.
Cc:
user@linux:~ $ WARNING: RunAsUser for MSP ignored, check group ids (egid=503, want=51)
can not chdir(/var/spool/clientmqueue/): Permission denied
Program mode requires special privileges, e.g., root or TrustedUser.

The group ID 503 was from the user that was logged in and sending the mail. The problem in this system was that it needed setgid set in the sendmail binary file.

root@linux:~ # ls -l /usr/sbin/sendmail.sendmail
-rwxrwxrwx  1 root smmsp 757168 Apr 15  2008 /usr/sbin/sendmail.sendmail

root@anotherlinuxhost:~ # ls -l /usr/sbin/sendmail.sendmail
-rwxr-sr-x  1 root smmsp 757168 Apr 15  2008 /usr/sbin/sendmail.sendmail

root@linux:~ # chmod 2755 /usr/sbin/sendmail.sendmail
root@linux:~ # ls -l /usr/sbin/sendmail.sendmail
-rwxr-sr-x  1 root smmsp 757168 Apr 15  2008 /usr/sbin/sendmail.sendmail

Restarted sendmail and no error message is shown when sending a message.

root@linux:~ # service sendmail restart
Shutting down sm-client:                                   [  OK  ]
Shutting down sendmail:                                    [  OK  ]
Starting sendmail:                                         [  OK  ]
Starting sm-client:                                        [  OK  ]

user@linux:~ $ mail blackhole@domain.com
Subject: Test
Sending email to test
.
Cc:
user@linux:~ $

A nice utility to get some basic information regarding your system is systeminfo.

Simply type systeminfo at the command prompt.

When a disk partition is given format using ext2, ext3 or ext4, the filesystem reserves a 5% of its capacity by default for root-only processes to use. It is done to avoid filesystem fragmentation and to allow system daemons to continue writing to the filesystem even after non-privileged processes can’t. This is a good thing to have by default, but a 5% means 25GB on a 500GB drive and that’s too much.

You can reduce this percentage on the fly, without data loss or corruption, using tune2fs. For example, if you want to reduce the space reserved on your /dev/sda1 partition to a 2%, use this command: tune2fs -m 2 /dev/sda1

On non-root partitions like /home or media drives, no reserved space is needed, so you can free that space using this command (assuming that your home partition is /dev/sda3): tune2fs -m 0 /dev/sda3

NOTE: It is not recommended to free all the reserved space on your / partition.

Yesterday, I finished reading “Pro OpenSolaris. A new Open Source OS for Linux developers and administrators“. It introduces the main differences between OpenSolaris and GNU/Linux (SMF, ZFS, zones and containers, Dtrace, etc). It explains all this things from a GNU/Linux user perspective, so if that’s your case, it will be easy to read for you. I missed some other comparisons between common GNU/Linux commands and their OpenSolaris equivalents, but it would have increased dramatically the number of pages of the book. A nice book to start using OpenSolaris.

On Monday I’ll be starting a new job and one of the perks is that I’ll be working with Sun Solaris 10 again.  I thought I’d take a minute to discourse on the ZFS and why I believe it is such a neat file system.

ZFS is a little different from other file systems like those you might recognize from Windows, Linux, or BSD.  While a tradition file system is bound to a disk, with the exception of RAID volumes, ZFS can span multiple physical devices.  Unlike other file systems, ZFS has integrated mechanisms fostering redundancy.  Where other file systems utilize volume management utilities to handle the addition and modification of physical disks, ZFS dynamically grows, combining available physical devices into conglomerations called zpools.  ZFS is also a 128-bit file system, which means ZFS can support directories containing 256 trillion objects in them.  Staggering.

The consistency of disks has long been a concern of administrators.  For example, if you remove power from a Unix-based machine any data scheduled to be written, but not yet written, to disk would be lost.  In many cases a file system integrity check would resolve this, but ZFS does not handle data in this way.  ZFS either writes data out immediately or not at all – so while you may lose some data if a machine is power cycled suddenly the filesystem, itself, remains intact.  In addition, ZFS also supports modes of redundancy that allow the system to transparently correct data that has become correct without interfering with any applications using that data.  Along with integrated redundancy, ZFS supports in-place snapshots.

Let’s create a pool called “jupiter9″:

Create the pool: zpool create jupiter9 c3t0d0

Create the pool with a mirror (like RAID1): zpool create jupiter9 mirror c3t0d0 c4t0d0

Note that Solaris uses different device names than you might be used to.  In the above example c3t0d0 and c4t0d0 refer to 2 unique physical devices.  Think of them like /dev/sda and /dev/sdb if you’re familar with Linux.  You can use some commands to inspect your pools, as well:

Show pools: zpool list

Monitor a pool every 10 seconds for 1 minute : zpool iostat jupiter9 10 6

Here are some command line examples of how to manipulate a ZFS volume:

Create a filesystem called “marquis” in the pool “jupiter9″:  zfs create jupiter9/marquis

Destroy that same filesystem: zfs destroy jupiter9/marquis

Destory that same filesystem regardless of whether it is in use:  zfs destroy -f jupiter9/marquis

Rename a filesystem: zfs rename jupiter9/marquis jupiter9/duke

Destroy a pool:  zfs destroy jupiter9

Destroy  pool and all of it’s children: zfs destory -R jupiter9

Create a filesystem “melamine” in the pool “jupiter9″ and set a unique mountpoint: zfs create -o mountpoint=/export/particleboard jupiter9/melamine

Note that when you execute “zfs create” and do not specify a mountpoint it will automout the filesystem to /dataset.  You can view your filesystems using the command “zfs list”

This is a very basic introduction to the ZFS and how to perform basic administration.  Expect further detail in the future.

Description: “GreenSQL is an Open Source database firewall used to protect databases from SQL injection attacks. GreenSQL works as a proxy for SQL commands and has built in support for MySQL & PostgreSQL . The logic is based on evaluation of SQL commands using a risk scoring matrix as well as blocking known db administrative commands (DROP, CREATE, etc). GreenSQL is distributed under the GPL license”.

Installation:

• Download its source code from its web.
• install the needed packages: apt-get install libevent-1.4-2 libpcre3 libmysqlclient15off libpq5 libmysqlclient15-dev libevent-dev libpcre3-dev libpcre3 libpq-dev flex g++ bison build-essential
• Uncompress it: tar xvfz greensql-fw_*.tar.gz
• Enter its directory: cd greensql-fw_*
• Build the deb package: ./build.sh
• Install the deb package (as root): cd .. && dpkg -i greensql-fw*.deb
• Answer the questions to connect GreenSQL to your database

Configuration (using Apache):

• Enter GreenSQL directory: cd /usr/share/greensql-fw
• Set the right permissions to templates_c : chgrp -R www-data templates_c && chmod -R 770 templates_c
• Create the file /etc/apache2/conf.d/greensql with the following content(replace [ and ] for angle brackets):
  Alias /greensql /usr/share/greensql-fw
[Directory /greensql]
Order deny,allow
Deny from all
Allow from 127.0.0.1
[/Directory]

• Restart Apache: apache2ctl restart
• Access GreenSQL using your web browser (default user is admin and default password is pwd): http://localhost/greensql
• Change the default admin’s password.
• Edit GreenSQL configuration to fit your needs (reading this might help).

Use:
To use GreenSQL, you have to change the configuration of the applications which connect to your database and point them to the computer where you have installed GreenSQL (localhost in this case) and the port where GreenSQL is running (3305 in my case to proxy my MySQL database). You can test whether it is working connecting to your database and creating a table (it should appear as an alert named “Detected attempt to create database/table/index” in GreenSQL and it should be blocked if you didn’t change the IPS option). Example:
mysql -u root -h 127.0.0.1 -P 3305 -p
CREATE TABLE greensql_test;

Remember: Although you use database firewalls like GreenSQL, you must prevent SQL injection and other database-related attacks by securing and auditing your application’s code.

You need to connect to a System Controller (SC) to manage a domain in a Sun Fire E12K, E15K, E20K or E25K. It has the System Management Services (SMS) software that allows you to control the domains.

To view the console, you use /opt/SUNWSMS/bin/console -d <domain letter or domain name> but I was having the error message “Exclusive session is in use, disconnecting”.

sms-svc@sc0:/ $ console -d domain06
Trying to connect…
Connected to Domain Server.

Exclusive session is in use, disconnecting.

I asked to a friend why I was having this problem and he said that I needed to kill the other session.

sms-svc@sc0:/ $ w
9:24am  up 76 day(s),  3:53,  2 users,  load average: 0.91, 2.04, 1.52
User     tty           login@  idle   JCPU   PCPU  what
root     pts/1         9:08am     9                console -d domain06
root     pts/2         9:19am                      w

I found out which PID is running the console, then killed it.

sms-svc@sc0:/ $ ps -ef | grep consol
root  3127     1  0   Sep 19 console  0:00 /usr/lib/saf/ttymon -g -h -p sc0-01-vix console login:  -T sun -d /dev/console
sms-svc 11229 11182  0 09:24:18 pts/2    0:00 grep consol
sms-svc  5492 5398  0 09:09:23 pts/1    0:00 console -d domain06

sms-svc@sc0:/ $ kill 5492

Worked as expected:

sms-svc@sc0:/ $ /opt/SUNWSMS/bin/console -d domain06
Trying to connect…
Connected to Domain Server.
Your console is in exclusive mode now.

Thanks to network admins at Bharti and Hurricane Electric, RTT to HE’s IPv6 tunnel server at HK PoP is reduced. Yippee!!

+-(abbe@chateau:pts/0)---------------------------------------------------------------------------------------------(~)-+
+-(130:20:44:%)-- traceroute -I 216.218.221.6                                                            --(Sun,Dec06)-+
traceroute to 216.218.221.6 (216.218.221.6), 64 hops max, 72 byte packets
 1  ABTS-North-Static-018.230.160.122.airtelbroadband.in (122.160.230.18)  41.593 ms  44.970 ms  52.979 ms
 2  ABTS-North-Static-021.230.160.122.airtelbroadband.in (122.160.230.21)  41.596 ms  44.188 ms  45.308 ms
 3  rasBTNLDel-static-174.215.56.202.mantraonline.com (202.56.215.174)  44.376 ms  44.404 ms  45.537 ms
 4  125.19.22.145 (125.19.22.145)  45.105 ms  42.097 ms  43.629 ms
 5  AES-Static-013.36.144.59.airtel.in (59.144.36.13)  150.993 ms  155.188 ms  154.701 ms
 6  hurricaneelectric-RGE.hkix.net (202.40.161.158)  165.843 ms  158.931 ms  164.889 ms
 7  tserv20.hkg1.ipv6.he.net (216.218.221.6)  158.572 ms  154.562 ms  154.215 ms
+-(abbe@chateau:pts/0)---------------------------------------------------------------------------------------------(~)-+
+-(130:20:45:%)-- ping6  www.google.com                                                                  --(Sun,Dec06)-+
PING6(56=40+8+8 bytes) 2001:470:f803:8000::1 --> 2001:4860:c004::68
16 bytes from 2001:4860:c004::68, icmp_seq=0 hlim=58 time=179.801 ms
16 bytes from 2001:4860:c004::68, icmp_seq=1 hlim=58 time=181.696 ms
16 bytes from 2001:4860:c004::68, icmp_seq=2 hlim=58 time=179.953 ms
16 bytes from 2001:4860:c004::68, icmp_seq=3 hlim=58 time=179.401 ms
^C
--- www.l.google.com ping6 statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 179.401/180.213/181.696/0.880 ms

Description: “Rootkit scanner is scanning tool to ensure you for about 99.9%* you’re clean of nasty tools. This tool scans for rootkits, backdoors and local exploits by running tests like:

Rootkit Hunter is released as GPL licensed project and free for everyone to use“.

Installation:

• Download the latest version from its web.
• Uncompress it: tar xvfz rkhunter-*.tar.gz
• Enter its directory: cd rkhunter-*
• Install it (as root): ./installer.sh --layout /usr/local --install

Use:

• To run it (as root): rkhunter --sk -c
• To check its rsults: less /var/log/rkhunter.log

To obtain valid results, be aware of false positives (check warnings twice) and keep it updated. Remember: security is a process, not a state.

After having a lot of problems migrating old contact forms over to a Rackspace server running Plesk, here’s a reliable way to send mail using PHPMailer:


require('inc/phpmailer/class.phpmailer.php');