List all Users and Groups in Domain

Using LDIFDE

From the support tools we can find LDIFDE.exe, which is a tool for bulk import and export of Active Directory Objects. You can use LDIFDE to import new user records into the directory, or export specific information on specific users into a text file. LDIFDE defaults to export mode (reading From the Directory). When you add the -i option it can be used to write changes into the Directory. Also, if you want to export and extract only specific details, such as the user name, title and login name for all the users in a specific OU (Organizational Unit), you can run the following command:

ldifde -f C:\ldif\ExportUsers.ldf –s SERVERNAME -d "OU=YourOUname,dc=YourDomainName,dc=com" -p subtree -r "(objectClass=User)" -l "cn,givenName,Title,SamAccountName"

Enabling Multiple Remote Desktop Sessions in Windows XP Professional and Media Center Edition 2005

If you have ever used a real remote computer system like Citrix, then you have probably been craving multiple Remote Desktop sessions since you first fired up Windows XP Professional and/or Media Center Edition. Here is a HACK (translated: USE AT YOUR OWN RISK), to enable multiple Remote Desktop sessions on your XP Pro or MCE 2005 box:

NOTE: You will have to have knowledge of the Windows operating system and more specifically the Windows Registry. If you have no experience with the registry, then I would recommend you find someone who does or leave these alone. I do not make any kind of warranty that this will work for you or your friends. This is provided for entertainment purposes only. Don’t call me if your computer stops working. Got it?

Print these directions so that you have them to work from.
Restart your computer in Safe Mode - Follow this link to learn how to restart Windows XP in Safe Mode
Turn off/disable Remote Desktop Connection (RDC) and Terminal Services
Right click My Computer
Select Properties
Click on the Remote tab at the top of the window
UNCHECK the box next to, “Allow users to connect remotely to this computer“
Click OK
Go to Start -> Control Panel -> Administrative Tools -> Services
Find Terminal Services in the list
Right click on Terminal Services and click Properties
In the Startup Type box, select Disabled
Click OK to close the window
Next you will replace the current version of the Terminal Services DLL (termsrv.dll) with an unrestricted version from a previous release of Terminal Services.
Here is a copy of the Terminal Services DLL - Save it to your Desktop or other suitable location
Using a file manager like Windows Explorer open C:\Windows\system32\dllcache
Rename the file termsrv.dll to termsrv_dll.bak or whatever you would like.
Copy the downloaded termsrv.dll file (the one you just downloaded from the web) to C:\Windows\system32\dllcache
Open the C:\Windows\system32 folder
Delete the file termsrv.dll in C:\Windows\system32
Now we can edit the Windows Registry to enable more than one RDP connection. Go to Start -> Run and type regedit - Hopefully you knew that already
Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core
Add a DWORD Key named EnableConcurrentSessions and give it a value of 1
Close the Registry Editor window
Go to Start -> Run and type gpedit.msc to run the Group Policy Editor
Browse to Computer Configuration -> Administrative Templates -> Windows Components -> Terminal Services and double click Limit number of connections
Select the Enabled button and enter the number of connections you would like to enable….at least 2.
Restart Windows
Right click My Computer and select Properties.
Click on the Remote tab at the top of the window
CHECK the box next to, “Allow users to connect remotely to this computer“
Click OK
Go to Start -> Control Panel ->Administrative Tools -> Services. Select Terminal Services from the list and double click it or right-click -> Properties. Set the Startup Type to Manual.

Restart Windows/Computer
You should be good to go

Bulk delete from Postfix queue

To delete a message in Postfix queue, I normally find out the message id first from “postqueue -p” (or simply “mailq”) command. Once the message id is known, I simply issue the following command to delete that particular message (assume the message id is BA4491827DE):

# postsuper -d BA4491827DE

If there is only one message to delete, I can live with that. However, when there’s a bunch of messages (e.g. from a particular domain) you need to delete from the queue, the above method simply too much of a hassle (well, unless you want to delete *everything*, which would be #postsuper -d ALL). Postfix does not have a function for doing that. Luckily, a search on Google yielded this Perl script that does exactly what I want, removing message(s) from queue based on my keyword. Here is the content of that Perl script called “delete-from-mailq”:

#!/usr/bin/perl

$REGEXP = shift || die “no email-adress given (regexp-style, e.g. bl.*\@yahoo.com)!”;

@data = qx;
for (@data) {
if (/^(\w+)(\*|\!)?\s/) {
$queue_id = $1;
}
if($queue_id) {
if (/$REGEXP/i) {
$Q{$queue_id} = 1;
$queue_id = “”;
}
}
}

open(POSTSUPER,”|postsuper -d -”) || die “couldn’t open postsuper” ;

foreach (keys %Q) {
print POSTSUPER “$_\n”;
};
close(POSTSUPER);

Save the above script to a file say “delete-queue” in your home directory, and make it excutable:

# chmod 755 delete-queue

Usage

Delete all queued messages from or to the domain “iamspammer.com”

./delete-queue iamspammer.com
Delete all queued messages to specific address “bogususer@mydomain.com”

./delete-queue bogususer@mydomain.com
Delete all queued messages that begin with the word “bush” in the e-mail address:

./delete-queue bush*\@whateverdomain.com
Delete all queued messages that contain the word “biz” in the e-mail address:

./delete-queue biz

That's it.

Self-Signed IIS SSL Certificates using OpenSSL

Self-Signed IIS SSL Certificates using OpenSSL

This tutorial assumes that you have a Linux box with OpenSSL installed,and that you want to create a self-signed certificate for IIS5.0 / 6.0

Set up your CA (you only have to do this once)
ON THE LINUX BOX…

Create a private key

openssl genrsa -des3 -out CA.key 1024

(You’ll need to supply a passphrase. DON’T FORGET THIS!!)

Set this to read-only for root for security

chmod 400 CA.key

Create the CA certificate

openssl req -new -key CA.key -x509 -days 1095 -out CA.crt

(Provide appropriate responses to the prompts…for Common Name, you might want to use something like “OurCompany CA”)

Set the certificate to read-only for root for security

chmod 400 CA.crt

Obtain a CSR
ON THE IIS BOX…

Open the Internet Manager
Select the site for which you want to create a key
Right-click and choose Properties
Select the “Directory Security” tab
Click the “Server Certificate” button
Follow the prompts to create a CSR
Save
your CSR, then transfer it to the Linux box for further processing.
(For the following steps, we’ll refer to your CSR as “new.csr”)
Sign the CSR
ON THE LINUX BOX…

Sign the CSR (all of this on one line)

openssl x509 -req -days 365 -in new.csr -CA CA.crt
-CAkey CA.key -CAcreateserial -out new.crt

Transfer the new.crt file back to the IIS box
Install self-signed certificate
ON THE IIS BOX…

Open the Internet Manager
Select the site to install the key
Right-click and choose properties
Select the “Directory Security” tab
Click the “Server Certificate” button
Specify that you want to complete the pending request
Select the .crt file that you just transferred
That’s it!



PS: If you have problems with the certification path (”does not chain up to a
trusted root certificate” in System Log), the following seems to fix it:

1. Internet Information Services -> select the site -> right click -> Properties
2. Directory Security -tab -> Secure communications -frame -> Edit…
3. Select “Enable certificate trust list”, click New… -> Next
4. Add from file -> use CA.crt -> Next
5. Write something to the Name and Description, if you like. -> Next -> Finish

Tripwire generating too big report files

Tripwire was generating big report files in one of our boxes, almost 12MB, compared to 60KB for the others.
I found the problem is that there were many changes applied to this server, and files copied/moved,
so the tripwire DB holding the changes grew up a lot.
The only command to run and update the tripwire DB is:
tripwire --update -Z low

This command will compare your database against your current file system and then launch an editor so that you can choose to make changes to your database.

If you try this command but get an error message about a missing report file, the reason is most likely that the last check was not run immediately prior to the update. The report file in the /var/lib/tripwire/report directory is named by hostname, then date (yyyymmdd) then time. If you have recently run a check and want the update to proceed using your most recent report file, then use the -r option and provide the report filename that you want the update to use.
tripwire --update -Z low --twrfile host-yyyymmdd-tttttt.twr

If it asks for a password, you'll have to set it up first, unless you already know the password:

tripwire --local-passphrase mypassword

Then, run the sync again, now you know the password.

Converting Ext2 Filesystems to Ext3

This is one of those tips that are handy when you upgrade or have a partition already formatted and with data, and you realize that it is ext2!, there is no need to re-format it, or erase the data, just convert it !

When you see the partition type, 83 is used for a Linux partition, no matter if it is ext2 or ext3.

The Ext3 filesystem is an Ext2 filesystem with a journal file and some filesystem driver additions making the filesystem journalized.

Converting from Ext2 to Ext3
The conversion procedure is simple enough. Imagine /dev/sdb1 mounted as /data – the procedure would be as follows:

Log in as root
Make sure /etc/fstab has /dev/sdb1 mounted to /data as ext2, read write
umount /dev/sdb1
If you can't unmount it, then remount it read only (mount -o remount,ro /dev/sdb1)
tune2fs -j /dev/sdb1
Edit /etc/fstab, and for /dev/sdb1, change ext2 to ext3
mount /dev/sdb1 /data, or mount -a
Check if the partition was correctly mounted:
mount | grep /dev/sdb1
If it's not shown as ext3, reboot (shutdown -r now)
if still not, troubleshoot ...
Otherwise, you're done.
A few explanations are in order.
The tune2fs command creates the journal file, which is kept in a special inode on the device (by default). You then must change the /etc/fstab entry to reflect it's a journalling filesystem, and then mount it.

You can check a full article describing other procedures in:
http://www.troubleshooters.com/linux/ext2toext3.htm

Accurate Date and Time in Linux using ntp step by step instructions

First, a little bit of theory. Read it all, so you will understand how time works, and why setup needs some steps.

Why do We Need a Precise Clock?
If our computer never connects to other computers (or other devices that use a clock), the precision of the clock is not critical itself, it depends on the need of the user. However, programs that some way use the net are dependent on a precise date and time. Some examples, when you may need precise clock:

Softwares that deal with transactions

Commercial applications (e.g. eBay)

Mail and messaging-related client and servers

Websites that use cookies

Distributed web applications

Web services

Distributed component-based applications as J2EE, .NET, etc

Advanced modern and paralel filesystems, as AFS, DFS, GFS, GPFS, etc

And of course, to use the computer to adjust our wristwatch clock.




Computer Global Date and Time Concept
To determine the current time for some planet region, a computer needs exactly these two pieces of information:

Correct UTC (universal time as in Greenwich, but not GMT) time

Region's current Time Zone

For computers, there is also the hardware clock, which is used as a base by the OS to set its time.

OS date and time (we'll use only date or time from now on) is set on boot, by some script that reads the hardware clock, makes Time Zone calculations (there is no time zone data stored in BIOS) and sets the OS. After this synchronization, BIOS
and OS time are independent from each other. So after a while they may have some seconds of difference. Which one is correct?
If you don't make any special configuration, none of them.

We'll discuss here how to make them both globally 100% accurate.




Time Zones
Time Zones are a geographical world globe division of 15o each, starting at Greenwich, in England, created to help people know what time is it now in another part of the world.

Nowadays it is much more a political division than geographical, because sometimes people needs to have the same time as other people in not-so-far locations. And for energy savings reasons, we have today the Daylight Savings Time, that are also a Time
Zone variation.

Time Zones are usually defined by your country government or some astronomical institute, and is represented by 3 or 4 letters.

Use the timezoneconverter.com to know what time is it now at any part of the globe.



Daylight Savings Time
For energy savings reasons, governments created the Daylight Savings Time. Our clocks are forwarded one hour, and this makes our days look longer. In fact, what really happens is only a Time Zone change. The primitive time (UTC) is still, and will always be, the same.



Time Zone Mechanism on Linux
Linux systems uses the GLIBC dynamic Time Zones, based on /etc/localtime. This file is a link to (or a copy of) a zone information file, usually located under /usr/share/zoneinfo directory.
To make it effective, you only have to link (or copy) the zoneinfo file to /etc/localtime. In some distributions, there is a higher level (and preferred) way to set the Time Zone, described later.

After making /etc/localtime pointing to the correct zoneinfo file, you are already under that zone rules and DST changes are automatic -- you don't have to change time manually.


Accurate Global Time Synchronization
To have accurate time in all your systems is as important as having a solid network security strategy (achieved by much more than simple firewall boxes). It is one of the primary components of a system administration based on good practices, which leads to organization and security. Specially when administering distributed applications, web-services, or even a distributed security monitoring tool, accurate time is a must.


NTP: The Network Time Protocol
We won't discuss here the protocol, but how this wonderful invention, added to the pervasivenes of the Internet, can be useful for us. You can find more about it at www.ntp.org.

Once your system is properly setup, NTP will manage to keep its time accurate, making very small adjustments to not impact the running applications.

People can get exact time using hardware based on atom's electrons frequency. There is also a method based on GPS (Global Positioning System). The first is more accurate, but the second is pretty good also. Atomic clocks require very special and
expensive equipment, but their maintainers (usually universities and research labs) connect them to computers, that run a NTP daemon, and some of them are connected to the Internet, that finally let us access them for free. And this is how we'll
synchronize our systems.

Building a Simple Time Synchronization Architecture
You will need:

1) A direct or indirect (through a firewall) connection to the Internet, to syncrhonize our servers with a public accurate NTP server.

2) Choose some NTP servers. You can use the public server pool.ntp.org, or choose some from the stratum 2 public time servers on NTP website. If you don't have an Internet access, your WAN administrator (must be a clever guy) can provide you some internal addresses.

3) Have the NTP package installed in all systems you want to synchronize. You can find RPMs in your favorite Linux distribution CD, or make a search on rpmfind.net.

Local Relay Servers for NTP

If you have several machines to synchronize, do not make them all access the remote NTP servers you chose. Only 2 of your server farm's machines need access remote NTP servers, and the other machines will sync with these 2. We will call them the Relay Servers.

Your Relay Servers can be any machine already available in your network. NTP consumes low memory and CPU. You don't need a dedicated machine for it.



The Correct Settings for Your Linux Box
For any OS installation, you must know your Time Zone. This is expressed in terms of a city, a state or a country. You must also decide how to set BIOS time, and we may follow two strategies here:

Linux Only Machine
In this case you should set BIOS time to UTC time. DST changes will be dynamically managed by Time Zone configurations.

Dual Boot Linux and MS Windows Machine
Windows handles time in a more primitive way than Linux. For Windows, BIOS time is allways your local time, so DST changes are more aggressive because they directly change hardware clock. And since both Linux and Windows initially get and set time from the hardware, when they are together, Linux must handle it in the same way. So set BIOS time to your localtime.


Step 1, Setting the Zone Info file:

Your time zone is defined by /etc/localtime

If you are unsure of the file you have is the correct one, you can check if its the same as your time zone:
diff -b /usr/share/zoneinfo/America/Vancouver /etc/localtime
If it doesn't, you will have to remove it and create the link:
#rm /etc/localtime
#ln -s /usr/share/zoneinfo/America/Vancouver /etc/localtime
Alternatively, instead of creting the symbolic link, you can just copy the file:
#rm /etc/localtime
#cp /usr/share/zoneinfo/America/Vancouver /etc/localtime

Step 2, Setting the Time Zone:

On Red Hat Linux and derived systems, you can set the hardware clock strategy and Time Zone using the timeconfig command:
#timeconfig
that shows a user-friendly dialog to select your time zone, and apply the changes.

You can also use it non-interactively:
#timeconfig "America/Vancouver" # set HC to localtime, and TZ to America/Vancouver
or
#timeconfig --utc "America/Vancouver" # set HC to UTC, and TZ to America/Vancouver

In any case, this utility changes /etc/sysconfig/clock file that is read at boot time.
You can edit it by hand, and that is how it looks:

#cat /etc/sysconfig/clock
ZONE="America/Vancouver"
UTC=true
ARC=false

Step 3, Setting the Hardware Clock

I encourage you to set your hardware clock only after understanding how to get accurate time.

The hwclock command reads and sets the hardware clock, based on several options you give to it, documented in its man page.
But you don't have to use it if you have a modern Linux distribution. After defining your hardware clock strategy and Time Zone, you can use the high level setclock command to correctly set your hardware clock.
You don't need to pass any parameters because setclock intelligently calls hwclock to set the BIOS based on your OS current date and time. So you should always use the setclock command.

#hwclock --systohc --utc # set HC with UTC time based on OS current time (I personally use this one)

You can also use any of these options:

#setclock # The easy way to set HC
#hwclock # reads HC
#hwclock --systohc # set HC with local time based on OS current time
#hwclock --set --date "21 Oct 2004 21:17" # set HC with time specified on stringSince the OS time is independent from the hardware clock, any BIOS change we make will take place in the next boot.


Another option to change HC is rebooting and accessing your computer BIOS screens, but as you see, there is no need to do it in Linux!

Step 4, Configure NTP protocol

Of course, as a prerequisite, you need to install the ntp package.

The only file to configure is /etc/ntp.conf, doesn't matter if you are configuring a client, or a server (like a local relay server to serve your local network), you will only need an additional keyword.

Change the following parameters in /etc/ntp.conf:

To make it a local relay server:

1) First we specify the servers you're interested in:

server otherntp.server.org # A stratum 1 server at server.org
server ntp.research.gov # A stratum 2 server at research.gov

2) Restrict the type of access you allow these servers. In this example the servers are not allowed to modify the run-time configuration or query your Linux NTP server.

restrict otherntp.server.org mask 255.255.255.255 nomodify notrap noquery
restrict ntp.research.gov mask 255.255.255.255 nomodify notrap noquery

The mask 255.255.255.255 statement is really a subnet mask limiting access to the single IP address of the remote NTP servers.

3) As this server is also going to provide time for other computers, such as PCs, other Linux servers and networking devices, then you'll have to define the networks from which this server will accept NTP synchronization requests. You do so with a
modified restrict statement removing the noquery keyword to allow the network to query your NTP server. The syntax is:

restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

In this case the mask statement has been expanded to include all 255 possible IP addresses on the local network.

4) We also want to make sure that localhost (the universal IP address used to refer to a Linux server itself) has full access without any restricting keywords:

restrict 127.0.0.1

5) Save the file and restart NTP for these settings to take effect.

6) To get NTP configured to start at boot, use the line:

# chkconfig ntpd on



You can now configure other Linux hosts on your network to synchronize with this new master NTP server in a similar fashion.
To make it a client accessing your brand new local relay server:

1) First we specify the servers you're interested in, you can use a host name or an ip address; it is recommended to use a host name, if later you have to change their ip address, you don't have to change anything in your client computers:

server ntp1.mynetwork.com # Your first local ntp server
server ntp2.mynetwork.com # Your second local ntp server

2) Restrict the type of access you allow these servers. In this example the servers are not allowed to modify the run-time configuration or query your Linux NTP server.

restrict ntp1.mynetwork.com mask 255.255.255.255 nomodify notrap noquery
restrict ntp2.mynetwork.com mask 255.255.255.255 nomodify notrap noquery

The mask 255.255.255.255 statement is really a subnet mask limiting access to the single IP address of the remote NTP servers.

3) As this server is NOT going to provide time for other computers, there is no need to allow others to query it, then include the noquery statement:

restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap noquery

In this case the mask statement has been expanded to include all 255 possible IP addresses on the local network.

4) We also want to make sure that localhost (the universal IP address used to refer to a Linux server itself) has full access without any restricting keywords:

restrict 127.0.0.1

5) Save the file and restart NTP for these settings to take effect.

6) To get NTP configured to start at boot, use the line:

# chkconfig ntpd on


Step 5: First sync:

It's a good practice to syncronize manually the first time, because if the time difference is too big, it will not be synchronized automatically.

For your local ntp server:

#service ntpd stop
#ntpdate otherntp.research.gov
#service ntpd start


For the rest of your servers/guests ntp clients:

#service ntpd stop
#ntpdate ntp1.mynetwork.com
#service ntpd start


To check the sync status, you can use:

#ntpq -p


Enjoy, and have A GOOD TIME !!!

Control Windows services of a remote computer using the command line

You can control Windows services of a remote computer just using the command line.
There are some options around there, but the one I use is psservice. This is a command line utility, part of PsTools, that allows you to control services. (See at the bottom a short description of PsTools).
The syntax is very simple:

psservice.exe \\HOST -u USERNAME -p PASSWORD COMMAND SERVICENAME


HOST - is the hostname or ip address of the host to control (local or remote)
USERNAME - a user with permissions to control services of the HOST
PASSWORD - the password of the user
COMMAND - the action to take with the service. The most commonly used are: query, stop, start, restart
SERVICENAME - the name of the service to control

For example, to restart IIS service of a remote server:

psservice.exe \\192.x.x.x -u user -p ******* restart W3SVC

If you receive an error like:


Unable to access Service Control Manager on \\192.x.x.x:
Access is denied.

or

Unable to connect to \\192.x.x.x

It's because pstools relies on $admin share access. A way to open it is:

net use \\HOST\admin$ PASSWORD /USER:USERNAME

HOST - is the hostname or ip address of the host
PASSWORD - the password of the user
USERNAME - a local or domain user with permissions to map a folder in the host
if USERNAME is a local user, type it as HOST\USERNAME,
if USERNAME is a domain user, type it as DOMAIN\USERNAME

For example:

net use \\192.x.x.x\admin$ ****** /USER:DOMAIN\USERNAME

You can remove the connection using:

net use \\192.x.x.x\admin$ /DELETE

Whith this base, you can create a batch file to restart services of a remote host with just a double-click

----------------------------------------------

PsTools description
===================

This tool is a set of command line utilities that allow you to manage local and remote systems
PsTools is a set of commandline utilities that allow you to manage local and remote systems.

All of the utilities in the PsTools suite work on Windows NT, Windows 2000 and Windows XP. The PsTools download package includes an HTML help file with complete usage information for all the tools.

The tools included in the PsTools suite are:

· PsExec - execute processes remotely
· PsFile - shows files opened remotely
· PsGetSid - display the SID of a computer or a user
· PsKill - kill processes by name or process ID
· PsInfo - list information about a system
· PsList - list detailed information about processes
· PsLoggedOn - see who's logged on locally and via resource sharing (full source is included)
· PsLogList - dump event log records
· PsService - view and control services
· PsShutdown - shuts down and optionally reboots a computer
· PsSuspend - suspends processes
· PsUptime - shows you how long a system has been running since its last reboot (PsUptime's functionality has been incorporated into PsInfo)

Centos 5.1 Chrooting SFTP using SCPonly

Centos 5.1 Chrooting SFTP using SCPonly

Installation

GCC is installed.

OpenSSH is installed.

Download scponly from: https://sourceforge.net/project/showfiles.php?group_id=155849 and extract it to /tmp

Configure Your Installation

Navigate into the directory in /tmp where you extracted scponly. Configure with the bellow command:

./configure --enable-chrooted-binary

Build & Install The Binaries

make

make install

This will install your manpage and scponly binary/binaries.

Edit /etc/shells using vi to look like this:



/bin/sh

/bin/bash

/sbin/nologin

/bin/tcsh

/bin/csh

/bin/ksh

/usr/local/sbin/scponlyc

If you want to not use scponly in a chrooted fashion then use the following instead of scponlyc:

/usr/local/bin/scponly

Set up the jail with the following command which invokes a helper script:

make jail

The output will look similar to below:

/usr/bin/install -c -d /usr/local/bin

/usr/bin/install -c -d /usr/local/man/man8

/usr/bin/install -c -d /usr/local/etc/scponly

/usr/bin/install -c -o 0 -g 0 scponly /usr/local/bin/scponly

/usr/bin/install -c -o 0 -g 0 -m 0644 scponly.8 /usr/local/man/man8/scponly.8

/usr/bin/install -c -o 0 -g 0 -m 0644 debuglevel /usr/local/etc/scponly/debuglevel

if test "xscponlyc" != "x"; then \

/usr/bin/install -c -d /usr/local/sbin; \

rm -f /usr/local/sbin/scponlyc; \

cp scponly scponlyc; \

/usr/bin/install -c -o 0 -g 0 -m 4755 scponlyc /usr/local/sbin/scponlyc; \

fi

chmod u+x ./setup_chroot.sh

./setup_chroot.sh

Next we need to set the home directory for this scponly user.

please note that the user's home directory MUST NOT be writeable

by the scponly user. this is important so that the scponly user

cannot subvert the .ssh configuration parameters.

for this reason, a writeable subdirectory will be created that

the scponly user can write into.

Username to install [scponly]scponly

home directory you wish to set for this user [/home/scponly]

name of the writeable subdirectory [incoming]files

useradd: warning: the home directory already exists.

Not copying any file from skel directory into it.

creating /home/scponly/files directory for uploading files

Your platform (Linux) does not have a platform specific setup script.

This install script will attempt a best guess.

If you perform customizations, please consider sending me your changes.

Look to the templates in build_extras/arch.

- joe at sublimation dot org

please set the password for scponly:

Changing password for user scponly.

New UNIX password:

Retype new UNIX password:

passwd: all authentication tokens updated successfully.

if you experience a warning with winscp regarding groups, please install

the provided hacked out fake groups program into your chroot, like so:

cp groups /home/scponly/bin/groups

Note: I ran the command mentioned at the end.

cp groups /home/scponly/bin/groups

Note that this is not the end all for setting up chrooted scponly!

During "make jail", for example I used /home/scponly/ as mychroot main path. The following are the final steps I took to get scponly working.

Edit /home/scponly/etc/ld.so.conf and replace its content with :



/lib

/usr/lib



Type ldconfig -r /home/scponly/

Copy /lib/ld-linux.so.* in /home/scponly/lib/

cp /lib/ld-linux.so.* /home/scponly/lib/

Copy /etc/group in /home/scponly/etc/

cp /etc/group /home/scponly/etc/

Create the folder /home/scponly/etc/selinux

mkdir /home/scponly/etc/selinux

Create a file named config there and insert the following content in this file :



vi /home/scponly/etc/selinux/config




SELINUX=disabled

SELINUXTYPE=targeted

SETLOCALDEFS=0

Create the folder:

mkdir /home/scponly/dev

Create the null device in chroot:

mknod /home/scponly/dev/null c 1 3

Change permissions on the null device:

chmod 666 /home/scponly/dev/null

Rescan dynamically the scsi bus (applicable to CX Clariion SAN infrastructure)

Rescan dynamically the scsi bus

I've been working for a while with a Dell - Clariion CX-300, and the best way to add new attached LUNs was always to reboot the server.
However, that procedure is not always the most acceptable if you're in a hurry or if just want to do some tests.
I found the procedure described above, in an outdated website, but worked very well in my case.

I also recommend to use rescan-scsi-bus.sh script with the options -lwc. Type rescan-scsi-bus.sh --help to see the description of each option.

The original link is: http://www.it-sudparis.eu/s2ia/user/procacci/Doc/AX100/AX100-en008.html


After initialization ends, the server doesn't see the new devices :-( I tried a script from http://www.linux1394.org/scripts/rescan-scsi-bus.sh that should dynamically rescan the bus, but with no sucess.

$ /root/rescan-scsi-bus.sh
Host adapter 1 (qla2xxx) found.
Host adapter 2 (qla2xxx) found.
Scanning for device 1 0 0 0 ...
OLD: Host: scsi1 Channel: 00 Id: 00 Lun: 00
Vendor: DGC Model: LUNZ Rev: 0208
Type: Direct-Access ANSI SCSI revision: 04
Scanning for device 2 0 0 0 ...
OLD: Host: scsi2 Channel: 00 Id: 00 Lun: 00
Vendor: DGC Model: LUNZ Rev: 0208
Type: Direct-Access ANSI SCSI revision: 04
0 new device(s) found.
0 device(s) removed.



So I stoped powerpath and unload qla modules in order to restart the whole thing.
$ /etc/init.d/PowerPath stop
Stopping PowerPath: done
$ lsmod | grep qla
qla6312 119233 0
qla2xxx 165733 1 qla6312
scsi_transport_fc 12225 1 qla2xxx
scsi_mod 116941 5 sg,qla2xxx,scsi_transport_fc,megaraid_mbox,sd_mod
[root@pasargades /opt/Navisphere/bin]
$ modprobe -r qla6312 qla2xxx
[root@pasargades /opt/Navisphere/bin]
$ lsmod | grep qla



then reload the whole thing:

$ modprobe qla2xxx qla6312
[root@pasargades /opt/Navisphere/bin]
$ /etc/init.d/PowerPath start
Starting PowerPath: done



then it works, the kernel does see the new devices

$ cat /proc/scsi/scsi
Attached devices:
Host: scsi0 Channel: 00 Id: 06 Lun: 00
Vendor: PE/PV Model: 1x2 SCSI BP Rev: 1.0
Type: Processor ANSI SCSI revision: 02
Host: scsi0 Channel: 01 Id: 00 Lun: 00
Vendor: MegaRAID Model: LD 0 RAID1 69G Rev: 521S
Type: Direct-Access ANSI SCSI revision: 02
Host: scsi3 Channel: 00 Id: 00 Lun: 00
Vendor: DGC Model: RAID 5 Rev: 0208
Type: Direct-Access ANSI SCSI revision: 04
Host: scsi3 Channel: 00 Id: 00 Lun: 01
Vendor: DGC Model: RAID 5 Rev: 0208
Type: Direct-Access ANSI SCSI revision: 04
Host: scsi4 Channel: 00 Id: 00 Lun: 00
Vendor: DGC Model: RAID 5 Rev: 0208
Type: Direct-Access ANSI SCSI revision: 04
Host: scsi4 Channel: 00 Id: 00 Lun: 01
Vendor: DGC Model: RAID 5 Rev: 0208
Type: Direct-Access ANSI SCSI revision: 04
[root@pasargades /opt/Navisphere/bin]
$ fdisk -l

Disk /dev/sda: 73.2 GB, 73274490880 bytes
255 heads, 63 sectors/track, 8908 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sda1 1 4 32098+ de Dell Utility
/dev/sda2 * 5 583 4650817+ 83 Linux
/dev/sda3 584 1220 5116702+ 83 Linux
/dev/sda4 1221 8908 61753860 5 Extended
/dev/sda5 1221 3770 20482843+ 83 Linux
/dev/sda6 3771 5682 15358108+ 83 Linux
/dev/sda7 5683 6192 4096543+ 82 Linux swap

Disk /dev/sdb: 676.4 GB, 676457349120 bytes
255 heads, 63 sectors/track, 82241 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/sdb doesn't contain a valid partition table

Disk /dev/sdc: 1395.8 GB, 1395864371200 bytes
255 heads, 63 sectors/track, 169704 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/sdc doesn't contain a valid partition table

Disk /dev/sdd: 676.4 GB, 676457349120 bytes
255 heads, 63 sectors/track, 82241 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/sdd doesn't contain a valid partition table

Disk /dev/sde: 1395.8 GB, 1395864371200 bytes
255 heads, 63 sectors/track, 169704 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/sde doesn't contain a valid partition table

Disk /dev/emcpowera: 676.4 GB, 676457349120 bytes
255 heads, 63 sectors/track, 82241 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/emcpowera doesn't contain a valid partition table

Disk /dev/emcpowerb: 1395.8 GB, 1395864371200 bytes
255 heads, 63 sectors/track, 169704 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/emcpowerb doesn't contain a valid partition table




REmarque: We can see that fdisk sees double path 'raw' devices ( /dev/sdb and /dev/sdd ) to a same device, which finnaly is presented by powerpath as /dev/emcpowera . All disk system command (fdisk etc ...) should now use that device in order to benefit the use of powerpath (load balancing and failover on our double attached FC ).//

The 'rescan' script shows that now:

$ /root/rescan-scsi-bus.sh
Host adapter 3 (qla2xxx) found.
Host adapter 4 (qla2xxx) found.
Scanning for device 3 0 0 0 ...
OLD: Host: scsi3 Channel: 00 Id: 00 Lun: 00
Vendor: DGC Model: RAID 5 Rev: 0208
Type: Direct-Access ANSI SCSI revision: 04
Scanning for device 4 0 0 0 ...
OLD: Host: scsi4 Channel: 00 Id: 00 Lun: 00
Vendor: DGC Model: RAID 5 Rev: 0208
Type: Direct-Access ANSI SCSI revision: 04
0 new device(s) found.
0 device(s) removed.