Part I, Part II, Part III.

Install go (golang) on Rocky Linux 8

As the user developing in Go, remove if you have any old versions. On new installs, not needed.

sudo yum module -y remove go-toolset

Download the latest version and make it executable.

wget https://storage.googleapis.com/golang/getgo/installer_linux
chmod +x ./installer_linux

Run the installer.

./installer_linux 

You’ll get a message …One more thing! Run source …. Do as it says, run the source command.
Test with go version.

Add entries under Windows 11 Terminal

Go to %LOCALAPPDATA%\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState folder and open settings.json file. Under the “list” section, add a new entry. Here is an example with opacity and background image for SSH access with a key. Go to this site, generate a GUID and replace the value.

            {
                "backgroundImage": "C:\\Some-Folder\\wallpaper.jpg",
                "backgroundImageOpacity": 0.25,
                "commandline": "ssh -i \"C:\\Random-Folder\\keys\\MyKeyPair.pem\" username@hostname.com",
                "guid": "{dee15512-fc2f-416d-ac0f-961378b46f6e}",
                "hidden": false,
                "name": "Name-in-the-dropdown-list"
            },

Install Office 365 using Office Deployment Tool

1) Download Office Deployment Tool
2) Run and extract somewhere
3) Go to this link and configure your settings
4) In my case I used:

– 64-bit Business Apps
– No Visio and Project
– Current channel
– Latest

5) Choose the apps that you want installed
6) Check the other settings, pretty much default
7) Click Export to download an XML file and put this file in the same folder as the Office Deployment Tool
8) From an admin command prompt type setup.exe /download <filename.xml>
9) The previous command will download the whole Office suite. You’ll see an Office folder in the same directory where ODT tool is installed.
10) Finally type setup.exe /configure <filename.xml>

Non-functional requirements

Non-functional requirements (NFRs), also known as quality attributes or system qualities, are essential aspects of software development that describe how a system should perform rather than what it should do. These requirements help ensure that the application meets certain performance, security, scalability, and usability standards. Here are some common categories of non-functional requirements for an application:

Performance:

• Response Time: Define the maximum allowable response times for different operations or transactions.
• Throughput: Specify the number of transactions or operations the system should handle per unit of time.
• Scalability: Describe how the application should scale to accommodate increased load.

Reliability:

• Availability: Define the percentage of time the system should be available for use.
• Fault Tolerance: Specify how the system should handle and recover from failures.
• Recovery: Describe the time and methods required to recover from failures or disasters.

Security:

• Authentication and Authorization: Define how users are authenticated and what actions they are authorized to perform.
• Data Encryption: Specify the encryption standards for data in transit and at rest.
• Access Control: Describe how sensitive data and system resources are protected from unauthorized access.

Usability:

• User Interface: Define the user interface design principles, accessibility standards, and usability guidelines.
• User Experience: Specify user interaction and navigation expectations.

Scalability and Capacity:

• Load Handling: Describe how the system should handle increasing loads, such as more users or data.
• Resource Utilization: Specify the maximum acceptable resource utilization, such as CPU, memory, and storage.

Maintainability:

• Modifiability: Describe how easily the system can be modified or extended.
• Code Quality: Specify coding standards, code documentation, and code review processes.

Interoperability:

• Integration Standards: Define how the application should interact with other systems or platforms.
• Data Format Compatibility: Specify data exchange formats and protocols.

Compliance and Legal Requirements:

• Regulatory Compliance: Ensure that the application complies with relevant laws and regulations.
• Data Privacy: Specify how sensitive data is handled to comply with data protection regulations.

Performance Metrics and Monitoring:

• Logging and Monitoring: Describe the logging and monitoring requirements for tracking system performance and errors.
• Alerting: Define the conditions that trigger alerts or notifications for system administrators.

Localization and Internationalization:

• Localization: Specify requirements for adapting the application to different languages and regions.
• Internationalization: Define design principles that enable easy adaptation to different languages and regions.

Operational Requirements:

• Deployment: Describe how the application should be deployed, including hardware and software requirements.
• Business Continuity: Specify backup and recovery procedures.
• RACI model: Define who is responsible, accountable, consulted and informed for the application components.

Documentation:

• User Documentation: Describe user manuals, help guides, and other user-facing documentation.
• Technical Documentation: Specify technical documentation for developers, including APIs and system architecture.

These non-functional requirements are crucial for defining the overall quality and performance of an application, and they help guide the development, testing, and deployment processes to ensure that the system meets its intended goals and functions effectively in its operational environment. The specific NFRs for an application will vary based on its unique requirements and context.

Reference your own public IP in Terraform group

If you want to add your own home IP to a security group, e.g. you want to restrict access to an instance for your home computer only, this is the Terraform script.

data "http" "myip" {
  url = "http://ipv4.icanhazip.com"
}

module "instance_security_group" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "5.1.0"

  name    = "sgInstances"
  vpc_id  = module.vpc.vpc_id

  ingress_with_self = [{
    rule = "all-all"
  }]

  ingress_with_cidr_blocks = [
    {
      rule        = "ssh-tcp"
      cidr_blocks = "${chomp(data.http.myip.response_body)}/32"
    },
  ]
}

Update AWS EKS cluster in kubeconfig

aws eks update-kubeconfig --name <cluster_name>

AWS SSO token expiration

If you receive an e-mail that your IdP token expires (“We’re contacting you because you automatically provision users and groups from your corporate identity provider (IdP) to IAM Identity Center, a process which uses the SCIM protocol (System for Cross-domain Identity Management). The SCIM access token used to automatically provision users and groups from your IdP to IAM Identity Center expires in 82 days on Fri Jan 05 13:40:46 UTC 2024.”), do the following:

• Log to the Master Account for your Org
• Go to IAM Identity Center
• Click Settings on the left and Manage token on the right.
• Click Generate Token

Verify that the token works and then delete the old one.

Dynamic auto-provisioning of persistent volumes and claims on a bare-metal Kubernetes server

If you have a bare-metal or VM running Kubernetes and you need some dynamic provisioning of persistent volumes and persistent volume claims on an NFS server, read further.
Install NFS CSI driver for Kubernetes.

curl -skSL https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/v4.4.0/deploy/install-driver.sh | bash -s v4.4.0 --

Install the nfs-subdir-external-provisioner.

helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
helm install nfs-subdir-external-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
    --set nfs.server=x.x.x.x \
    --set nfs.path=/exported/path

It creates a storage class for you.

kubectl get sc
NAME         PROVISIONER                                     RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE
nfs-client   cluster.local/nfs-subdir-external-provisioner   Delete          Immediate           true                   2d3h

Check the docs.
You need the nfs-utils on nfs-tools installed on the underlying OS. Otherwise, you’ll get an error in the pods saying that mount nfs can not be found or something like that.
Anytime there is a need for storage, just specify the storageClass as nfs-client in the manifest. The volumes and claims will be provisioned for you automatically.
If you use NFSv4 use the root as exported path, e.g. –set nfs.path=/

NFSv4 on FreeBSD

Add these in /etc/rc.conf

rpcbind_enable="YES"
nfs_server_enable="YES"
mountd_enable="YES"
nfsv4_server_enable="YES"
nfsv4_server_only="YES"

This is the /etc/exports file

V4: /nfs -network 192.168.1.0/24 
/nfs -network 192.168.1.0/24

Mount from Linux.

sudo mount -t nfs -o vers=4.0 192.168.1.26:/ /mnt

Install Kube Prometheus stack on NFS and behind ngninx ingress on MetalLB load balancer

You need MetalLB and nginx ingress for this. Read here.

helm install -f kps-custom.yaml kps prometheus-community/kube-prometheus-stack -n monitoring

File kps-custom.yaml.

prometheus:
  prometheusSpec:    
    storageSpec: 
     volumeClaimTemplate:
       spec:
         storageClassName: nfs-client
         accessModes: ["ReadWriteOnce"]
         resources:
           requests:
             storage: 10Gi
alertmanager:
  alertmanagerSpec:
      storage: 
        volumeClaimTemplate:
          spec:
            storageClassName: nfs-client
            accessModes: ["ReadWriteOnce"]
            resources:
                requests:
                  storage: 10Gi

Create a MetalLB load balancer.

kubectl expose deployment kps-grafana --port 80 --target-port 3000 --name=grafana-lb --type=LoadBalancer -n monitoring

or with a manifest.

apiVersion: v1
kind: Service
metadata:
  name: example-service
  namespace: monitoring
spec:
  selector:
    app: kps-grafana
  ports:
    - port: 80
      targetPort: 3000
  type: LoadBalancer

Username and password: admin / prom-operator
If you want to use nginx ingress on already configured MetalLB load balancer, there is no need to do kubectl expose deployment kps-grafana…Just add these lines at the end of kps-custom.yaml and update the chart.

grafana:
  ingress:
    enabled: true
    ingressClassName: nginx
    annotations: {}
      # kubernetes.io/ingress.class: nginx
      # kubernetes.io/tls-acme: "true"
    labels: {}
    hosts:
      - grafana.iandreev.com

    ## Path for grafana ingress
    path: /

    ## TLS configuration for grafana Ingress
    ## Secret must be manually created in the namespace
    ##
    tls: []
    # - secretName: grafana-general-tls
    #   hosts:
    #   - grafana.example.com

Install KubeCost on NFS

Install KubeCost and MetalLB load balancer. You need MetalLB and nginx ingress for this. Read here.

helm install kubecost kubecost/cost-analyzer -n kubecost  --set kubecostToken="aGVsbUBrdWJlY29zdC5jb20=xm343yadf98" \
--set prometheus.server.persistentVolume.storageClass=nfs-client --set persistentVolume.storageClass=nfs-client
kubectl expose deployment kubecost-cost-analyzer --port 80 --target-port 9090 --name=kubecost-lb --type=LoadBalancer -n kubecost

The commands above are enough to create Kubecost deployment and a MetalLB load balancer. If you want nginx ingress read further.
If you already have nginx ingress, skip the last line and do the following. The username/password is optional, but if you are exposing kubecost publicly, then you want some type of authentication.

sudo dnf install httpd-tools
httpasswd -c auth admin

The commands above will download httpd-tools and then prompt you to create a password for the admin as user. The output is written in a file called auth.
Create a Kubernetes secret from that file. You can delete the file, it’s not needed anymore after the command below.

kubectl create secret generic kubecost-basic-auth --from-file=auth -n kubecost

Check if everything looks OK.

kubectl get secret kubecost-basic-auth -o yaml -n kubecost
apiVersion: v1
data:
  auth: YWW46Jsomethinghere!$#ASEDFdwasfasWESDCAVsdcewqEwyMAo=
kind: Secret
metadata:
  creationTimestamp: "2023-10-26T17:24:47Z"
  name: kubecost-basic-auth
  namespace: default
  resourceVersion: "3561042"
  uid: 8ad981c2-4a4d-4488-9a38-9873286f4efa
type: Opaque

Create this file. I named it kubecost-ingress-auth.yaml. Specify the secret name at line 8 and your FQDN at line 13.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kubecost
  namespace: kubecost
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: kubecost-basic-auth
    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - kubecost'
spec:
  ingressClassName: nginx
  rules:
  - host: kubecost.iandreev.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kubecost-cost-analyzer
            port:
              number: 9090
#  tls:
#  - hosts:
#      - kubecost.your.com
#    secretName: kubecost-tls
# Use any cert tool/cert-manager or create manually: kubectl create secret tls kubecost-tls --cert /etc/letsencrypt/live/kubecost.your.com/fullchain.pem --key /etc/letsencrypt/live/kubecost.your.com/privkey.pem

Then create the ingress.

kubectl apply -f kubecost-ingress-auth.yaml

Connect to a remote Kubernetes cluster/Merge config files

• Make a backup of the current .kube/config file
• Transfer the config file from the remote cluster to the local machine and save it as config_new
• Run this command:

  KUBECONFIG=~/.kube/config:~/.kube/config_new kubectl config view --flatten > ~/.kube/config

• Install kubectx tool and run it without any parameters
• Switch to the remote cluster using kubectx some_name

Ubuntu 22 – Change from DHCP to static IP, change hostname

As root or sudo create or edit /etc/netplan/01-netcfg.yaml file.
Add these lines to specify the network card (line 5), IP and subnet mask (line 7), DNS (line 9) and the gateway (line 12).

network:
    version: 2
    renderer: networkd
    ethernets:
        eth0:
            addresses:
                - 192.168.1.212/24
            nameservers:
                addresses: [8.8.8.8, 8.8.4.4]
            routes:
                - to: default
                  via: 192.168.1.1

Change the hostname using:

sudo hostnamectl set-hostname pihole.homelab.local

Edit /etc/hosts and change the 2nd localhost line to specify FQDN.

127.0.0.1 localhost
127.0.1.1 pihole.homelab.local

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback

VMWare Tools on CentOS/Rocky Linux/Red Hat

dnf install open-vm-tools

For desktop use open-vm-tools-desktop

Passwordless login

• Do ssh-keygen on the client machine
• From the client machine do ssh-copy-id user@ip-hostname-of-the-server or copy id_rsa.pub to .ssh/authorized_keys on the SSH server

Resize FreeBSD ZFS partition

Find the disk from the pool.

zpool status
  pool: zroot
 state: ONLINE
config:

        NAME        STATE     READ WRITE CKSUM
        zroot       ONLINE       0     0     0
          da0p3     ONLINE       0     0     0

errors: No known data errors

In my case the disk is da0. The partition is da0p3.
Check the size of the disk. You should see the extra space added (4G).

gpart show
=>      40  25165751  da0  GPT  (12G)
        40      1024    1  freebsd-boot  (512K)
      1064       984       - free -  (492K)
      2048   4194304    2  freebsd-swap  (2.0G)
   4196352  12578816    3  freebsd-zfs  (6.0G)
  16775168   8390623       - free -  (4.0G)

If you see that the GPT says corrupt, execute gpart recover da0.
Resize the 3rd partition freebsd-zfs.

gpart resize -i 3 -s 10200M da0

Check the pools.

zpool list

If the size didn’t change, resize the pool where zroot is the name of the pool and da0p3 is the name of the partition. Get them with zpool status.

zpool online -e zroot da0p3

If you do zpool list this time, you’ll see that the partition was resized.
If you want for the pool to auto expand next time, you have to change the setting.

zpool set autoexpand=on zroot

If you this, next time you resize the partition with gpart, you won’t have to do zpool online command.

Node.js update on Ubuntu

Check all Node.js editions.

nvm list-remote

Check current running.

node --version

Also…

nvm list

Update from the remote-list. It automatically switches to default.

nvm install v20.11.0

Use specific version.

nvm use v20.10.0

Increase disk size on Ubuntu 22

Expand the disk space in vCenter or AWS Console. Boot up and type cfdisk.
Select the partition which size you want to increase and select Resize.

Then select Write and confirm. Exit the tool.
Because we added the free space to /dev/sda3, we have to resize the physical volume.

pvresize /dev/sda3

Type vgdisplay. You should see that you have extra space under Free PE/Size.
Extend the logical volume with all (100%) available free space.

lvextend -l +100%FREE /dev/mapper/ubuntu--vg-ubuntu--lv

Now resize the filesystem.

resize2fs /dev/mapper/ubuntu--vg-ubuntu--lv

Verify with df -h.

df -h
Filesystem                         Size  Used Avail Use% Mounted on
tmpfs                              197M  1.1M  196M   1% /run
/dev/mapper/ubuntu--vg-ubuntu--lv   37G   15G   21G  43% /
tmpfs                              982M     0  982M   0% /dev/shm
tmpfs                              5.0M     0  5.0M   0% /run/lock
/dev/sda2                          1.7G  253M  1.4G  16% /boot
/dev/sda1                          571M  6.1M  565M   2% /boot/efi
tmpfs                              197M  4.0K  197M   1% /run/user/1000

RDP to an AzureAD (Entra ID) joined computer

If the RDP client computer is also joined to AzureAD (Entra ID) then, most likely you’ll just get prompted for username and password or PIN. You might also want to disable NLA.

REM Disable the Network Level Authentication
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0

If the RDP client is joined to another AD, then you have to add these two lines in the RDP file. Just edit it as a text file.

enablerdsaadauth:i:0
enablecredsspsupport:i:0

If you want to save the password in the RDP file, encrypt your password first.

("SuperSecretPassword01!" | ConvertTo-SecureString -AsPlainText -Force) | ConvertFrom-SecureString;

Then add this line at the end of the RDP file.

password 51:<the output of the previous PowerShell command>

In this short article I’ll describe briefly how to stream/broadcast from your phone’s camera to the world. In order to do that, you’ll need the Larix Broadcaster app installed on your phone, you will need a server with a public IP and a Haivision Media Gateway installed and for the end users, they’ll need standard VLC Player install.
The Larix Broadcaster app and the VLC player are free, but Haivision Media Gateway is not. In addition, if you have your own server and want to install it as a VM, you’ll have to contact the vendor directly. I’ll use a much easier option and host it in AWS where it comes as a template from the AWS Marketplace.

Haivision Media Gateway in AWS

In AWS, launch a new instance from the AWS Marketplace and search for SRT. You’ll see several options(SRT Gateway vs. Media Gateway and BYOL as PAYG license). I’ll choose Pay-as-You-Go Media Gateway.

As you can see, the software is not that cheap and you pay as much as you used. So if you are not streaming, just shut down the instance. Another important thing is the size of the instance, how much horse power you need. Is it 2 CPUs, 4 CPUs, 8? Well, nobody knows your needs, but it also depends on what type of stream are you sending, is it going to be a low-res or 1080p, how many users will consume that stream, etc. I strongly suggest that you go over this document. It describes how to size your environment and it gives you practical guidance on how to configure the Media Gateway. It’ not a necessary read to continue with this post, but it’s strongly recommended once you have everything up and running.
OK, in my case I’ll go with a t3.medium instance which is 2 CPUs and 4GB RAM. Create the instance as you normally do, make sure you have a public IP and the ports that are recommended in the security group given are open (22, 80 and 443). Once the instance boots up log with the default username haiadmin and the password is your instance id which is i-0123something.

I won’t go into details what each option does and what each keyword means, I’ll just guide you through creating a route for you to be able to broadcast. So, from the screen that you see, click on the button to add a route.

These are my parameters. For the Route Name, enter a description and make sure the checkmark is checked for Start Route. Further down, enter a description for the Source Name, in my case it’s Larix Cam or whatever you want to put here. The Protocol is TS Over SRT and the port is 50000. The Mode is Listener and the rest are the defaults. As I said earlier, if you want a better throughput, read the SRT deployment guide doc that I’ve sent earlier. It will tell you how to tweak these parameters. So, this tells the Media Gateway to listen on port UDP 50000 for any incoming broadcast.
Now, click on the Destination button.

The Destination is where the broadcast will be distributed. So, you got the point now. A camera on your phone sends the video to our instance in AWS and this instance (Media Gateway) distributes the feed to numerous viewers. You can’t stream from your phone directly, because your phone’s bandwidth and horse power are minuscule, so you need a gateway.
Here is how the Destination looks like.

Name the destination however you like, make sure the Protocol is TS over SRT and the Port is 50001. The Media Gateway passes the signal from UDP 50000 (source) to UDP 50001 (destination). Can you use some other ports? Yes, you can as long as they are not the same and greater than 1024 and less than 65535. Change the Type to Listener and leave the rest of the parameters as-is. Again, read the SRT Deployment Guide. Click Add and once you go back, click Create to create the route.
SUPER IMPORTANT: Make sure you edit the security group for this instance and open the ports for the source and destination. In my case, you have to add UDP ports 50000 and 50001 to the rules of the security group.

Larix Broadcaster app

On your phone download this app from Google Play or App Store. Go to Settings (the gear icon), Connections and click on the (+) sign to add a connection.
Enter a name for your connection, and for the URL enter the public IP of your instance and the port of the listener, so it looks like srt://public_IP:port. Make sure you specify srt:// as prefix. The defaults are 640×480 with audio, but you can change that in the settings for the app. Now, that you have a connection, make sure it’s active by selecting it and after that just hit the Record button. If something is not right, you’ll see it right away on your camera. It will tell you that the app can’t connect to the server. And if everything is OK after about 8-10 seconds you’ll see a green dot next to your source in the Media Gateway.

VLC PLayer

There is really nothing much to say here. Go to this website, download and install VLC and from the menu click on Media | Open Network Stream. Enter the IP address of the AWS instance and specify the destination port like srt://public_IP:port. Make sure you specify the destination port, not the source port and the protocol should be srt.

Stream a video file (optional)

In case you want your source to be a video file instead of a camera stream, reconfigure the source or add another route with new source and destination of which the source is RTMP. Configure the source so it looks like this.

From another server send the video stream to the Media Gateway using this command (you need ffmpeg installed).

ffmpeg -re -i video-file.mp4 -c copy -f flv rtmp://media_gateway_ip/live/stream

In VLC, use the srt://media_gateway_ip:port to watch the stream.

Part I, Part II, Part IV.

If you have a WordPress blog, you probably know that there are tons of attempts from users/scripts to try to take over your blog and post spam. There are a lot of plugins there that can take care of different security aspects, but by far, this simple solution works best for me.
It prevents anyone except white listed IPs to access your login page. Instead they’ll get error 404, page not found. The only problem is that you can’t have your own user base. So, if someone wants to post a comment, it can’t be a user registered on your blog. I use the Social Login plugin that allows users to login and register with one click on this blog, using their own social network’s logins.

Anyway, you need mod_rewite installed on your web server. Look for this line and if it’s commented, remove the # and reload the config.

LoadModule rewrite_module libexec/apache24/mod_rewrite.so

In the root of your blog, edit the .htaccess file and make sure it looks like this.
In my example, I have only two IPs allowed that can access the wp-login page. The rest will get page not found when accessing wp-login.php or wp-admin.

ErrorDocument 401 /index.php?error=404
ErrorDocument 403 /index.php?error=404

 <IfModule mod_rewrite.c>
 RewriteEngine on
 RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
 RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
 RewriteCond %{REMOTE_ADDR} !^198.16.3.247$
 RewriteCond %{REMOTE_ADDR} !^24.184.123.233$
 RewriteRule ^(.*)$ - [R=403,L]
 </IfModule>
 # BEGIN protect xmlrpc.php
 <files xmlrpc.php>
 order allow,deny
 deny from all
 </files>
 # END protect xmlrpc.php

AWS: ssh to a server with private IP only

I was playing with some servers in AWS. One of them had a public IP, but the second one had a private IP only. In order to access the 2nd server with private IP only, open up the key that was given to you for the 2nd server by AWS in PEM format in your favorite text editor. Select the text and copy it to the clipboard. The key looks like this. This key should belong to the 2nd server.

Now, log to the first server with the public IP as ec2-user.
Create a new file with nano or vi and paste the content. Save it as some_file.pem.
Change the permissions.

chmod 600 some_file.pem

Then log to the 2nd server with the private IP.

ssh -i some_file.pem <internal_IP>

NTP sync in a domain environment

On the PDC domain controller.

w32tm /config /manualpeerlist:"0.us.pool.ntp.org 1.us.pool.ntp.org 2.us.pool.ntp.org 3.us.pool.ntp.org" /syncfromflags:manual /reliable:yes /update 

On all other DCs.

w32tm /config /syncfromflags:domhier /update 

Resync manually.

w32tm.exe /resync /rediscover

Check the status.

w32tm /query /status

Ubunty 18 – DNS

First, configure the YAML file /etc/netplan, do netplan apply and then…

sudo rm -f /etc/resolv.conf
sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf

Ubuntu 18 – Change hostname

hostnamectl set-hostname <new_hostname>

Edit /etc/cloud/cloud.cfg and replace preserve_hostname: false to true

Change Windows password from command line prompt

Open up PowerShell/CMD with admin privileges and type:

net user username new_password

FreeBSD vmtools in vCenter

If you want to install VMWare Tools in FreeBSD running in vCenter, install this package.

pkg -y install open-vm-tools-nox11

If you want the full tools that cover X11, install open-vm-tools without “-nox11” suffix in the above command.
Edit /etc/rc.conf and add these lines.

vmware_guest_vmblock_enable="YES"
vmware_guest_vmhgfs_enable="NO"
vmware_guest_vmmemctl_enable="YES"
vmware_guest_vmxnet_enable="YES"
vmware_guestd_enable="YES"

FreeBSD change from DHCP to static IP, default gateway and DNS

Edit /etc/rc.conf and you’ll see a ifconfig DHCP assignment somewhere. Change the DHCP keyword with your static IP and netmask and don’t forget the default gateway.

ifconfig_vmx0="inet 192.168.1.11 netmask 255.255.255.0"
defaultrouter="192.168.1.1"

The DNS settings are under /etc/resolv.conf.

Find Wireless (WiFi) password

netsh wlan show profile <SSID> key=clear

Install git 2 on CentOS 7 from source

yum -y groupinstall "Development Tools"
yum -y install gettext-devel openssl-devel perl-CPAN perl-devel zlib-devel wget
wget https://github.com/git/git/archive/v2.23.0.tar.gz -O /tmp/git.tgz
cd /tmp
tar xzvf git.tgz 
cd git*
make configure
./configure
make install
cd /tmp
rm -Rf git*

Use git with a private key and no password

Anytime you push, clone or pull a repo, you’ll get prompted for a password which is kind of annoying. Do this to use a private key access and never get prompted for a password again. On your Linux workstation, make changes in line 2 and 3 and do:

cd
git config --global user.name "Kliment Andreev"
git config --global user.email "klimenta@iandreev.com"
ssh-keygen -t rsa -b 4096
cat .ssh/id_rsa.pub

Go to GitHub, in the upper-right corner click on the avatar, choose Settings and then SSH and GPG keys. Click to add a key, name it and paste the output from the ssh-keygen command above.
You have to change the remote origin to use SSH instead of HTTPS.

git remote set-url origin git@github.com:<github_username>/<github_repo>

vi – use spaces instead of tabs

Add this to ~/.vimrc

set tabstop=2 shiftwidth=2 expandtab

Replace tabs with spaces in vi

:%s/\t/ /g

Replace tabs with spaces in files

sed -i 's/\t/ /g' *

S3 bucket policy for static web hosting

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicReadGetObject",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::example-bucket/*"
            ]
        }
    ]
}

Ansible execute playbook locally

ansible-playbook --connection=local --inventory 127.0.0.1, ansible.yml

Import AWS key from another region

Best practice is to have separate keys for all instances, but if you need “one key to rule them all” instances, you have to create a public key from your private key and import it in AWS keys.
Let’s say your private key is something.key.

ssh-keygen -y -f something.key > something.pem

Now, cat out the pem file and paste it under AWS key import.

vi tabs, spaces

Edit .virc or .vimrc and add this line

set tabstop=2 shiftwidth=2 expandtab

Convert tabs to spaces in existing file -> :retab

Log to AWS CLI using SSO

This tip requires an SSO configured, see this link.
Configure the SSO with aws sso configure once or multiple times for multiple profiles.
Then use aws sso login, a browser will pop up, log in and close the browser.
Export the profile you want to use, e.g. export AWS_PROFILE=dev, then aws sts get-caller-identity.
At this point use any CLI commands, e.g. aws s3 ls.

AWS IAM Identity Center (successor to AWS Single Sign-On) SCIM Access Token Approaching Expiration

If you received an e-mail from AWS that your token expires, open up the first two links at the bottom of the e-mail. The first one opens up your AWS console where the token is and the second one opens up a tutorial on how to create a new token. Create a new access token, but do not delete the old one. Copy the value (not the token ID), but the value that it will be presented to you only once.
Now, go to Azure, under Azure Active Directory, find the AWS SSO enterprise app and open it and from the left side on the screen, click on Provisioning. Expand the Admin Credentials and paste the token from AWS under Secret Token. Click Test Connection and if everything is OK, click Save and you are good and you can delete the old token in AWS.

In this post I’ll describe the current procedure of migrating a domain that’s registered and hosted at 1and1.com to godaddy.com. The reason for my migration is simple. I just want to move all my registered domains to godaddy.com and consolidate them. In addition, since I purchased some VPS, I’ve decided to migrate my stuff to a full-blown server instead of renting web hosting from 1and1.com

First log to your 1and1.com domain panel and click Manage domains.

Select the domain that you want to transfer (in my case iandreev.com), click Transfers and choose Lock/Unlock option.

Select Unlock.

ICANN regulations prohibit transferring domain names (except .au) that were registered or previously transferred in the last 60 days, so if you already transferred your domain in the past two months, you won’t be able to do so.

Back in the domain panel, select the domain again and click Info.

You should see something similar to this. The most important thing here is the last line “Auth code.com” and its value.

Log to your account at go daddy.com and go to this link.

http://www.godaddy.com/domains/domain-transfer.aspx

When you see this page:

Type the domain name that you want to transfer and click Go. At the top, you’ll see the domain name, just verify it and click Proceed to Checkout.

You’ll get some offers but they are not worth it, so just skip this step and click Continue.

Review the current order and pay the transfer fees.

Once your payment is approved, usually instantly click on Domain Name image.

Within a minute or two, you’ll receive this e-mail, so make sure you have access to the mailbox that was used when your domain was registered.

Kliment Andreev, approve your transfer request.

====================================================================
DOMAIN NAME TRANSFER - Initial Authorization for Registrar Transfer
====================================================================

Re: Transfer of IANDREEV.COM

Dear Kliment Andreev,

GoDaddy received a request on December 09, 2013 for us to become the new registrar of record.

You received this message because you're listed as the Registered Name Holder or Administrative contact for this domain name. If you're not the Account Holder, or you're transferring the domain to a new owner, please forward this email to the appropriate Account Holder to complete the transfer process.

///////////////////////////////////////////////////////////
IMPORTANT: If the steps below are not completed, the domain name(s) listed above will NOT be transferred to us.
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
When authorizing this transfer, you'll be prompted to provide the following Transfer IDs:

Transaction ID: 159067416
Security Code: OYVB28941

To proceed with the transfer, follow the instructions here:
http://support.godaddy.com/help/article/1592?prog_id=GoDaddy&isc=gdbbx2&ci=83387
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE: After a domain transfer is complete, you cannot transfer it to another registrar for 60 days, apart from transferring back to the original registrar in cases where both registrars so agree or where a decision in the dispute resolution process so directs.

If you DO NOT WANT the transfer to proceed, do not respond to this message.

If you have any questions about this process, contact us by email at support@godaddy.com, or by phone at (480) 505-8877.

Regards,
GoDaddy

Search for a new domain:
http://www.godaddy.com/domains/search.aspx?prog_id=GoDaddy&isc=gdbbx2&ci=83389

Go to My Account:
https://mya.godaddy.com/myrenewals/myrenewals.aspx?shopperid=2529155&prog_id=GoDaddy&myatabs=false&isc=gdbbx2&ci=83385

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Copyright (C) 1999-2013 GoDaddy.com, LLC. All rights reserved.

Next, click on Domains, then Transfers tab and click the green Launch image.

Click on Authorization code needed.

Then click Add now.

Enter the Transaction ID and Security Code from the e-mail that you just received.

Click Next.

When prompted for the Authorization Code, enter the code from 1and1.com (Info button).

You’ll see a short notice that the domain transfer is in process, but you’ll end up with a prompt to enter the Authorization Code again.

Just hit F5 and you’ll see this.

After 2 hours I received an email from 1and1.com.

Dear Mr. Andreev,

Thank you for your transfer request for your domain iandreev.com
on 2013-12-10 04:01:39.We are happy to provide you with more
detailed information.

The current transfer status of your domain is: off.

Do you want to revoke the transfer of your domain? Simply change the
status to "Lock" in your 1&1 Control Panel. To do so, go to:

https://www.1and1.com/login

If you still want your domain to be transferred, please make sure the
status of your domain is set to "Unlock". The transfer of your domain
will then be completed automatically on 2013-12-15 04:01:39.

If your domain is locked, the transfer will be automatically canceled on
2013-12-14 04:01:39.

IMPORTANT: Please note that upon the domain transfer your domain as
well as all associated rights will be transferred to the new registrant -
thus to the new owner of the domain. This means that your domain, together
will all subdomains and e-mail accounts using this domain name, will be
removed from your contract.

Therefore, please make sure that you only agree to this domain transfer
if you have initiated it yourself or if you have already agreed on all
details with the new registrant.

Please find below a step-by-step instruction on how to lock or unlock
your domain for the transfer:

1. Log in to your 1&1 Control Panel with your customer data at
https://www.1and1.com/login.

2. Select the package containing the respective domain. Click on "Domains"
under "Domains & Web Space". You can lock or unlock your domain by selecting
the domain from the list and then clicking on "Transfers"/"Lock/Unlock".

If you cannot log in to your 1&1 Control Panel, please contact our
1&1 Customer Support via the following e-mail address:

support@1and1.com.

Please note our Terms and Conditions at https://www.1and1.com/Gtc. Please
refer to our FAQ section at http://faq.1and1.com/domains/domain_xfers/xfer_of_reg/index.html
for further information.

Yours sincerely,

1&1 Internet Inc.

The only important part in this e-mail is this “The transfer of your domain will then be completed automatically on 2013-12-15 04:01:39”. If everything goes well, after a week you’ll receive an email from godaddy.com that looks like this.

Click on Go to My Account and once you log in, click on Domains. Select the domain that you just transferred, click on the Nameservers icon and then click on Set Nameservers. 

Click on Standard to change the DNS servers to GoDaddy’s DNS servers.

Mind that when you are changing the DNS, all the sub domains that you had with 1 and 1 will be gone. You’ll have to recreate them under Go Daddy’s panel, so make sure that you have a migration plan for all of your sub domains and the data associated.

Recently, I had to connect a NetApp device with our HP blades in c7000 chassis, using a straight connection (meaning no switch in between). It took some significant time to make this thing work, because the connection between a NetApp storage device and HP Virtual Connect is supposed to be configured using a switch, not a straight and direct connection.

Cabling

There are two Virutal Connect modules in the HP c7000 chassis and two dual-head 10Gb NICs in each NetApp controller. Each Virtual Connect module is using ports x7 and x8. This is how the ports are connected.

• Port x7 on the first VC1 (Virtual Connect) module is connected to the NIC e3b on the first controller with a blue FC cable
• Port x8 on the first VC1 module is connected to the NIC e3b on the second controller with a yellow FC cable
• Port x7 on the second VC2 module is connected to the NIC e3a on the first controller with a green FC cable
• Port x8 on the second VC2 module is connected to the NIC e3a on the second controller with a gray FC cable

NOTE: When looking the NetApp controllers, NIC e3b is on left and NIC e3a is on the right side, as shown on the image above.

NetApp configuration

This is how the NICs are configured on the first controller. In case something goes wrong, these lines must be in /etc/rc on each controller. Otherwise, when the controllers are rebooted, these configuration changes will be lost.

ifconfig e3a down
ifconfig e3b down
ifgrp create single Trunk10 e3a e3b
vlan create Trunk10 10
ifconfig Trunk10-10 192.168.10.1 netmask 255.255.255.0 partner 192.168.11.1
ifgrp favor e3b
ifconfig Trunk10-10 up

This is how the NICs are configured on the second controller.

ifconfig e3a down
ifconfig e3b down
ifgrp create single Trunk11 e3a e3b
vlan create Trunk11 11
ifconfig Trunk11-11 192.168.11.1 netmask 255.255.255.0 partner 192.168.10.1
ifgrp favor e3a
ifconfig Trunk11-11 up

If you need to rebuild the configuration, first delete the vlan, and then destroy the group.

ifconfig Trunk10-10 down
vlan delete Trunk10 10
ifgrp destroy Trunk10

To see the config, execute ifconfig –a.

Virtual Connect configuration

The Virtual Connect module can be managed from http://<IP_of_the_Virtual_Connect>
There are two Shared External Uplink Sets defined.

• ENCSBP01_10G_NAS10
• ENCSBP01_10G_NAS11

If these sets need to be recreated, follow the screenshots below. This means that ports x7 from both VC1 (Bay 1) and VC2 (Bay 2) are defined as one external network card. The same applies for ports x8.

In addition to the Shared Uplink Sets, there are two networks defined.

• ENCSBP01_iSCSI_NAS10
• ENCSBP01_iSCSI_NAS11

The first network is associated with the first Shared Uplink Set and External VLAN ID 10, the second network is associated with the second Shared Uplink Set and External VLAN ID 11.

NOTE: It is important to match the VLAN IDs (10 and 11) on the NetApp controller and the networks defined in Virtual Connect.

Finally, when creating a profile for a server (ESXi or Windows), the following NICs should be assigned.

This means, that the first/second NIC are on VLAN21 from a different Shared Uplink Set. NIC from 3 to 6 are the ones used for iSCSI, and the last two NICs are used for the old iSCSI configuration and VLAN22 servers. Make sure that NICs 1 and 2 and 7 and 8 are set as CUSTOM port speed of 1Gb. That way, we’ll increase the iSCSI (NICs 3-6) to 4Gb.

MS Windows configuration

Depending on the subnet that MS Windows is going to use for a public IP, use NIC1 and NIC2 if the server is going to be on the 128.202.21.0/24 subnet and NIC7 and NIC8 if the server is going to be on the 128.202.22.0/24 subnet. These NIC pairs should be teamed using the provided HP Network Team Configuration utility. Your IP subnets may vary.

When dealing with MS Windows, it is unclear what NIC under Network Connections corresponds to the NICs under Virtual Connect (see previous screenshot).

In order to identify them we need to use ipconfig /all in Windows and then go to https://Chassis_IP, select the server name from the Device Bays on the left and click on the information tab.

Based on this information, you can map the NICs.

If we look at the screenshot from the Virtual Connect server profile, we need to team:

• 1A and 2A (LAC 7 and LAC 8 ) for a public NIC on 128.202.21.0/24 network or whatever your public IP for servers is.
• 1B and 2B (LAC and LAC 2) for iSCSI NIC team on the first NetApp controller
• 1C and 2C (LAC 3 and LAC 4) for iSCSI NIC team on the second NetApp controller
• 1D and 2D (LAC 5 and LAC 6) for another IP subnet that you might use

ESX/ESXi configuration

When building an ESXi host, follow the screenshots below. vmnic0 and vmnic1 should be used for the Management Network and VM NET 21 network (servers with IP range 128.202.21.0/24) or whatever your IP subnet for servers is.

The iSCIS NICs are vmnic2, vmnic3 for the first controller and vmnic4, vmnic5 for the second controller. They MUST be in active/standby mode, otherwise the connection won’t work.
In addition, the Network Failoved Detection MUST be set to Beacon probing for both vSwitch1 and vSwitch2, otherwise the failover won’t work.

Troubleshooting failover

The easiest way to validate the failover is to simulate a Virtual Connect crash. For that reason, we’ll ping constantly the first and the second controller’s IP for iSCSI (192.168.10.1 and 192.168.11.) and unplug both cables from VC2 module.

Part I, Part III, Part IV.

ssh-keygen -t rsa
ssh-copy-id test@localhost

PasswordAuthentication no

Get-ADForest andreev.local | ft DomainNamingMaster, SchemaMaster
Get-ADDomain andreev.local | ft InfrastructureMaster, PDCEmulator, RIDMaster
Import-Module ActiveDirectory
Move-ADDirectoryServerOperationMasterRole -Identity "dc02" –OperationMasterRole DomainNamingMaster,PDCEmulator,RIDMaster,SchemaMaster,InfrastructureMaster

$wc = new-object System.Net.WebClient
$wc.DownloadString("https://ip.andreev.it")

w32tm /config /manualpeerlist:0.north-america.pool.ntp.org /syncfromflags:manual /reliable:yes /update
net stop w32time
net start w32time

where 0.north-america.pool.ntp.org is the external time source (NTP server). You can check the list of these servers here.
On non-PDC domain controllers execute:

w32tm /config /syncfromflags:domhier /update 
net stop w32time
net start w32time

Prevent root login in SSH

To change this behavior, edit /etc/ssh/sshd_config and change from:

#PermitRootLogin yes

to ->

PermitRootLogin no

Now, restart the sshd daemon and log remotely using a regular user and then su – to switch to root.

Get BIOS serial number from command prompt

Works remotely.

wmic /node:[remote computer name] bios get serialnumber

Gnome on OpenBSD 4.2

Very simple…

export PKG_PATH=ftp://ftp.openbsd.org/pub/OpenBSD/4.2/packages/i386/
pkg_add gnome-desktop-2.18.2p0.tgz
pkg_add gnome-session-2.18.2p0.tgz
echo ‘exec gnome-session’ >> ~/.xinitrc
startx

Text/CSV file – Delete lines based on a value

I made a PowerShell script that scanned multiples subnets and generated about 130,000 lines of text. About 120,000 of these lines were not needed. Because the output was a CSV file, it was logical that I use Excel to delete these lines. But the macro that I used took forever and after one hour, it just stopped working. CSV is a text file, so I used Notepad++ to edit the file.
In order to delete the whole line that contained “NO RESPONSE” (in my case), I used Edit | Replace or Ctrl-H.

This replacement will delete all lines that contain the string “NO RESPONSE”. The syntax is ^.*YOUR_STRING.*$ and do not put nothing for “Replace with:” value. Make sure “Regular expression” is selected. The only problem is that these lines will be gone, but you’ll have empty lines now. In order to get rid of these lines, head to TextFX home page at SourceForge. Download this Notepad++ plugin, unzip the archive and put the DLL under C:\Program Files\Notepad++\plugins folder. Once you restart Notepad++, you’ll see a new menu called…TextFX. Select everything (Ctrl-A), then TextFX | TextFX Edit | Delete blank lines.

Upgrading VMware Tools fails on Windows Server 2008 with the message “Error 1316. A network error occured while attempting to read from the file C:\Windows\Installer\VMware Tools.msi”

I cloned one VM from an ESXi 4.0 host to an ESXi 5.0 U1. When I tried to upgrade the VM tools (interactively), I got an error saying “Error 1316. A network error occured while attempting to read from the file C:\Windows\Installer\VMware Tools.msi”.

At this point, just click OK, open a command prompt with Administrator’s privileges and type:

C:\users\username> D:
D:> setup /c

This command will delete some orphaned registry entries and after the command completes, which is less then a second, just do your standard VM tools upgrade by double-clicking the setup.exe icon.

Source: VMware KB 1012693

Fedora 18: Configure Wireless on Latitude E6400

I’ve installed the latest Fedora 18 64-bit on Dell Latitude E6400, but the wireless wasn’t working. After some research, I’ve found this website that explains how to install the drivers. In my case it was simple:

yum install kmod-wl
service NetworkManager restart

Of course, you need a wired connection to do that, othwerise you have to manually transfer the files manually. In addition, if downloading the dependency files is extremely slow, cancel the install and do:

yum install yum-plugin-fastestmirror

Find MAC address for the iLO NIC adapter

ssh to the iLO’s IP address and do:

show /map1/enetport1

This is how the output looks like.

status=0
status_tag=COMMAND COMPLETED


/map1/enetport1
  Targets
    lanendpt1
  Properties
    Autosense=yes
    PermanentAddress=00:1a:4b:e6:b0:ea
    LinkTechnology=Ethernet
    Speed=100 Mbits/s
    SystemName=your_host_name
    FullDuplex=yes
  Verbs
    cd version exit show set

Windows 2012R2 Upgrade fails with CRITICAL_STRUCTURE_CORRUPTION

I had to upgrade a Windows 2008R2 server to Windows 2012R2. The server was a VM running on a ESXi 5.0 Update 1 host. The upgrade failed with CRITICAL_STRUCTURE_CORRUPTION error.

The solution is to upgrade the ESXi host first to ESXi 5.0 Update 3 or use this workaround as described here.

1.Power down the virtual machine.
2.Right-click the virtual machine.
3.Click Edit Settings.
4.Click the Options tab.
5.Select CPUID Mask under Advanced.
6.Click Advanced.
7.Under the Register column, locate the edx register under Level 80000001.
8.Paste this into the Value field:

----:0---:----:----:----:----:----:----

9.Click OK.
10.Click OK to close the virtual machine properties.

Run PowerShell script as a scheduled task that uses Excel COM object

I made a small PowerShell script that reads an Excel file from SharePoint, converts it to CSV and does some calculations. The script was working fine, but when I tried to run the script as a scheduled task, the Excel->CSV conversion never happened. This is part of the code.

# Converts the Excel file. Excel must be installed. The output is MASTER-INVENTORY.csv
$xlCSV=6
$Excelfilename = $Path
$CSVfilename = "C:\Scripts\CheckIfBackupExists\MASTER-INVENTORY.csv"
$Excel = New-Object -comobject Excel.Application
$Excel.Visible = $False
$Excel.displayalerts=$False
$Workbook = $Excel.Workbooks.Open($ExcelFileName)
$Workbook.SaveAs($CSVfilename,$xlCSV)
$Excel.Quit()
If(ps excel){kill -name excel}

This code never executed properly when scheduled. I’ve found this solution to be the simplest.

For a 32 bit OS, create a folder called c:\Windows\System32\config\systemprofile\Desktop and for a 64-bit OS create both c:\Windows\System32\config\systemprofile\Desktop and c:\Windows\SysWOW64\config\systemprofile\Desktop.

Send SNMP trap to HP-SIM from command prompt

From time to time HP-SIM stops working and the only way to resolve this issue is to restart the HP-SIM service. In order to know when that’s going to happen, I am using this scheduled script to send a test trap to HP-SIM. If HP-SIM is properly configured, it will send an e-mail with “Generic Trap” in the subject. If something is wrong with HP-SIM, you won’t receive this email, which means it’s time to restart the HP-SIM service.

First, download trapgen from here. Then execute this command.

C:\> trapgen -d <servername> -c public -o 1.3.6.1.4.1.232 -g 6 -s 11003

If everything works fine, you can create a batch file and then do your scheduling tasks.

Power on/off HP servers remotely using plink

To be able to change the power state of the servers, we’ll use plink. plink allows you to SSH to the server and send a command, the one that you usually type in.

So, it’s really simple, just create a batch file and add one or more of these commands for multiple servers.

plink -pw ilo_pwd "ilo_username@ilo_ip_or_hostname" "power on"

or

plink -pw ilo_pwd "ilo_username@ilo_ip_or_hostname" "power off"

where ilo_pwd and ilo_username are the credentials that you use to log to iLO GUI and ilo_ip_or_hostname is the IP or the hostname of the iLO.

NOTE: The power off command will do hard power off, so the OS running won’t be aware of that. Make sure the OSes are properly shut down to avoid any corruption.

Powershell: Change SNMP settings on a remote server

Recently, I built a new HP-SIM server and I had to change the SNMP settings on 1000+ servers to send the traps to a new destination. Here is a script that I made. It should be self-explanatory.

# Powershell to configure SNMP - K.Andreev 20141117
# Usage: ./SetSNMP.ps1 -server <server_name> -community <community_string> -target <target_hostname> -test $true/$false
# Adds target_hostname as a SNMP target, community_string as SNMP string on the server server_name
# If parameter -test is $true, nothing is added to the registry. If you ommit the parameter, nothing is added as well

param(
[string]$server = "",
[string]$community = "",
[string]$target = "",
[bool]$test = $true
)

if (($server -eq "") -or ($community -eq "") -or ($target -eq "")){
	Write-Host "-------------------------------"
	Write-Host "Kliment Andreev - November 2014"
	Write-Host "-------------------------------"
	Write-Host "Usage: ./SetSNMP.ps1 -server <server_name> -community <community_string> -target <target_hostname> -test true/false"
	Write-Host "Adds target_hostname as a SNMP target, community_string as SNMP string on the server server_name"
	Write-Host "If parameter -test is $true, nothing is added to the registry"
	Write-Host ""
	exit
}
try {
	$check = Get-WMIObject Win32_Service -ComputerName $server -ErrorAction Stop | Where-Object {$_.name -eq "SNMP"}
}
catch {
	$Exception = $_
    Write-Host "SNMP not installed on" $server ", exception: $($_.Exception.Message)" -ForegroundColor Red
}
if ($check.Status -eq "OK") {
	Write-Host "SNMP installed on" $server", proceeding with configuration..." -ForegroundColor Green
	$objReg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $server)
	
	# Tab Security, Accept SNMP packets from these hosts
	Write-Host "Accept packets from these hosts:" -ForegroundColor Yellow
	$Values_counter = 1
	$objRegKeyPM = $objReg.OpenSubKey("SYSTEM\\CurrentControlSet\\Services\\SNMP\\Parameters\\PermittedManagers",$true)
	$Duplicate = $false
	while ($true) {
		$value = $objRegKeyPM.GetValue($Values_counter.ToString())
		if ($value -eq $target) {
			$Duplicate = $true
			}
		if ($value -eq $null) {break}
		Write-Host `t $value -ForegroundColor White
		$Values_counter++
	}
	if (!$Duplicate) {
		Write-Host "===> Adding" $Values_counter $target "to HKLM\..\SNMP\Parameters\PermittedManagers"-ForegroundColor Green
		if (!$test) {$objRegKeyPM.SetValue($Values_counter.ToString(), $target)}
		} else {
		Write-Host $target "already exists." -ForegroundColor Red
		}
	$devnull = $objRegKeyPM.Close
	
	# Tab Security, Accepted Community Names
	Write-Host "Accepted Community Names:" -ForegroundColor Yellow
	$objRegKeyVC = $objReg.OpenSubKey("SYSTEM\\CurrentControlSet\\Services\\SNMP\\Parameters\\ValidCommunities",$true)
	$Duplicate = $false
	foreach($value in $objRegKeyVC.GetValueNames()){
		Write-Host `t $value, $objRegKeyVC.GetValue($value).ToString()
		if ($value -eq $community){
			$Duplicate = $true
		}
	}
	if (!$Duplicate) {
		Write-Host "===> Adding " $community "to HKLM\..\SNMP\Parameters\ValidCommunities" -ForegroundColor Green
		if (!$test) {$objRegKeyVC.SetValue($community, 8)}
		} else {
		Write-Host $community "already exists." -ForegroundColor Red
		}
	$devnull = $objRegKeyVC.Close
	
	# Tab Traps, Community Name
	$objRegKeyCN = $objReg.OpenSubKey("SYSTEM\\CurrentControlSet\\Services\\SNMP\\Parameters\\TrapConfiguration",$true)
	$devnull = $objRegKeyCN.CreateSubKey($community)
	$devnull = $objRegKeyCN.Close
	
	# Tab Traps, Trap Destinations
	Write-Host "Trap destinations:" -ForegroundColor Yellow
	$Values_counter = 1
	$strKey = "SYSTEM\\CurrentControlSet\\Services\\SNMP\\Parameters\\TrapConfiguration\\"
	$strKeyTD = $strKey + $community
	$objRegKeyTD = $objReg.OpenSubKey($strKeyTD,$true)
	$Duplicate = $false
	foreach($value in $objRegKeyTD.GetValueNames()){
		$value_name = $objRegKeyTD.GetValue($value).ToString()
		Write-Host `t $value, $value_name
		$Values_counter++
		if ($value_name -eq $target){
			$Duplicate = $true
		}
	}
	if (!$Duplicate) {
		Write-Host "===> Adding" $values_counter $target "to HKLM\..\SNMP\Parameters\TrapConfiguration\"$community -ForegroundColor Green
		if (!$test) {$objRegKeyTD.SetValue($Values_counter.ToString(), $target)}
		} else {
		Write-Host $target "already exists." -ForegroundColor Red
		}
	$devnull = $objRegKeyTD.Close
	$devnull = $objReg.Close
}

SSH public-key authentication for scp

I had to copy a file between two hosts using scp and it prompted me for a password. scp does not allow you to specify the password in a command line. So, here is a quick way to establish a trust between two hosts.
We’ll assume that user-A on host-A is copying a file to the home folder of user-B on host-B.

On host-A, logged as user-A create the private/public key pair.

ssh-keygen

You should see something like this. Do not enter a passphrase.

Generating public/private rsa key pair.
Enter file in which to save the key (/home/user-A/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user-A/.ssh/id_rsa.
Your public key has been saved in /home/user-A/.ssh/id_rsa.pub.
The key fingerprint is:
98:c4:fe:aa:ff:aa:bb:11:b4:3b:7a:94:1f:ac:c4:0f user-A@host-A
The key's randomart image is:
+--[ RSA 2048]----+
|                 |
|       .  .  . o |
|  AA  . . C . Y  |
|       + =   o o |
|      . X   . o  |
|         . & . . |
|        Y o B o  |
|         + o = . |
|          V . .  |
+-----------------+

You’ll have two files (/home/user-A/.ssh/id_rsa) which is your private key and (/home/user-A/.ssh/id_rsa.pub) which is your public key. Copy your public key to host-B.

cat ~/.ssh/id_rsa.pub | ssh user-A@host-B 'cat >> ~/.ssh/authorized_keys'

If you get access denied, just copy id_rsa.pub file to the home folder of user-B on host-B under the .ssh folder and append it to the authorized_keys file. If this file doesn’t exist, create it.

Once you are done, you can copy the files from host-A using:

scp somefiles.* user-B@host-B:

PowerShell, plink & HP c7000 chassis

Recently I was looking for a way to see how much memory I have installed on 16 blades that I have in a HP c7000 chassis. These blades are a mix of Windows and ESXi so a script that would cover both is not feasible. But, HP c7000 has a CLI that allows us to see how much memory each blade has.

We’ll use plink to sent this command to the chassis and run the whole thing from PowerShell so we can do string manipulation.

Open PowerShell, make sure that plink is in your PATH or specify the full path to plink and run:

$output = plink -pw "password_for_the_chassis" "username_for_the_chassis@chassis_hostname" "show server info all"

If everything is OK, you shouldn’t see any output. Do:

$output | select-string -pattern "Memory"

… and you should see this.

…or try this to see the IP addresses, CPUs, serial numbers etc…

$output | select-string -pattern "IP Address"
$output | select-string -pattern "CPU"
$output | select-string -pattern "Serial"
$output | select-string -pattern "FlexNIC"

mod_deflate on Apache 2.4

If you are using WordPress like I do, you’ll benefit if you have mod_deflate enabled. This module compresses the content that you specify and delivers it to the end user. Same technique as compressing text file using gzip. Apache 2.4 on FreeBSD already comes with mod_deflate precompiled, but it’s disabled by default.

First, edit /usr/local/etc/apache24/httpd.conf and uncomment the following line.

LoadModule deflate_module libexec/apache24/mod_deflate.so

Next, make sure that you have the following line in the same httpd.conf file.

Include etc/apache24/Includes/*.conf

This line enables httpd.conf to span in multiple files, so we can have our mod_deflate config parameters in a separate file. Go to /usr/local/etc/apache24/Includes and create a file called mod_deflate.conf. Add the following and save.

AddOutputFilterByType DEFLATE text/html text/plain
#Highest 9 - Lowest 1
DeflateCompressionLevel 9

#Optional
#Skip browsers with known problems
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4\.0[678] no-gzip
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

#Optional
#Logging
DeflateFilterNote ratio
LogFormat '"%r" %b (%{ratio}n) "%{User-agent}i"' deflate
CustomLog /var/log/deflate_log deflate

You can see what each line means, here. Make sure you don’t compress JPG, PNG, MP3 or PDF files. These files are already compressed and you’ll just make your web page load slower.
Restart apache with apachectl graceful and that’s it. If you want to see how much bandwidth you are saving, go to this page and enter your URL.

git – quick cheat sheet

Create a new repo at www.github.com called New-Project or Whatever. Install the git client on your local PC (e.g yum install git for CentOS/RedHat or pkg install git for FreeBSD). Download the client for Windows from https://git-scm.com/.

Once you have your project ready, type

git init
git add .
git commit -m "Final production code"
git remote add origin http://www.github.com/your_username/New-Project
git push origin master

If you get an error when you try to push, pull the changes from the master first.

git pull origin master

Part II, Part III, Part IV.

mysqldump -u <username>  -p <password> databasename > /somewhere/dbname.sql

mysql -u <username>  -p   <password> databasename <  /somewhere/dbname.sql

mysql -u adminusername -p
CREATE USER 'custom'@'localhost' IDENTIFIED BY 'obscure';
CREATE DATABASE databasename;
GRANT ALL PRIVILEGES ON databasename.* TO "custom"@"localhost" IDENTIFIED BY "obscure";
FLUSH PRIVILEGES;

freebsd-update fetch
freebsd-update install

portsnap fetch
portsnap update

portmaster -a

Get-Content -Path "<drive>:\Folder\FileName.extension" -Wait

tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&amp;0xf)<<2)) - ((tcp[12]&amp;0xf0)>>2)) != 0)'

tcpdump -A -s 0 'src example.com and tcp port 80 and (((ip[2:2] - ((ip[0]&amp;0xf)<<2)) - ((tcp[12]&amp;0xf0)>>2)) != 0)'

tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&amp;0xf)<<2)) - ((tcp[12]&amp;0xf0)>>2)) != 0)' -i lo

$comp=Get-ADComputer -identity <computer_name> -properties CanonicalName

$user=Get-ADUser -identity <user_name> -properties CanonicalName

<h1>Hello!</h1>

import smtplib

from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText

fromaddr = "no-reply@somedomain.com"
toaddr = "kliment.andreev@whatever.com"
EMAIL_HOST = 'email-smtp.us-east-1.amazonaws.com'
EMAIL_HOST_USER = 'AKIAJUEQQ7DIHJUCKAVA'
EMAIL_HOST_PASSWORD = 'AlRPmyef-qAkajSzCtn43YY447rFlJ8GXCBMWyaNide'
EMAIL_PORT = 587

msg = MIMEMultipart('alternative')
msg['Subject'] = "AWS TEST"
msg['From'] = fromaddr
msg['To'] = toaddr

html = open('index.html').read()

mime_text = MIMEText(html, 'html')
msg.attach(mime_text)

s = smtplib.SMTP(EMAIL_HOST, EMAIL_PORT)
s.set_debuglevel(10)
s.starttls()
s.login(EMAIL_HOST_USER, EMAIL_HOST_PASSWORD)
s.sendmail(fromaddr, toaddr, msg.as_string())
s.quit()

toaddr = "kliment.andreev@domain1.com,klimenta@domain2.com,kandreev@domain3.com"
s.sendmail(fromaddr, msg['To'].split(','), msg.as_string())

echo | openssl s_client -showcerts -servername blog.andreev.it -connect blog.andreev.it:443 2>/dev/null | openssl x509 -inform pem -noout -text

dnscmd /clearcache

aws ec2 describe-instances --query "Reservations[*].Instances[*].PublicIpAddress" --output=text

systemctl status firewalld

firewall-cmd --zone="trusted" –-add-source=192.168.1.0/24
firewall-cmd --zone="trusted" –-add-source=11.12.99.88

firewall-cmd --zone="trusted" –add-service=ssh

firewall-cmd --zone="trusted" –list-all

firewall-cmd –-zone=public –remove-service=ssh

firewall-cmd --zone="trusted" –-add-source=192.168.1.0/24 --permanent
firewall-cmd --zone="trusted" –-add-source=11.12.99.88 --permanent
firewall-cmd --zone="trusted" –add-service=ssh --permanent
firewall-cmd –-zone=public –remove-service=ssh --permanent

Go to the download page and find the archive that you want to download. Click to accept the agreement and then get the URL of the archive.

wget --header "Cookie: oraclelicense=accept-securebackup-cookie" <URL>

Convert MP3 files to Ogg-Vorbis using sox in all subfolders

find . -name '*.mp3' -exec bash -c ' sox -V3 "$1" "${1%.mp3}.ogg"' -- {} \;

Delete all mp3 files after.

find . -name "*.mp3" -exec rm {} \;

Extract a tar archive (tarball) without the head/container directory (folder)

You have a tarball aaa.tar.gz with the following structure.

—-file1.txt
—-file2.txt
You want to extract the files to a directory without the top aaa folder.

tar xzvf aaa.tar.gz --strip 1 -C destination_folder

Samba 4.x, list Windows share, mount Windows share

sudo mount.cifs -v -o username=my_username,domain=netbios_domain_name,vers=2.1 //host.domain.local/share /mnt

If you are unable to write to the mounted folder, specify the user as -o…vers=2.1,uid=4801105,gid=4800513 which is a user that has rights to that share.

smbclient //host.domain.local/share -U my_username@domain.local -m SMB3 -W netbios_domain_name

Speed up video files x30

ffmpeg -i input.mov -vf "setpts=(PTS-STARTPTS)/30" -crf 18 output.mov

Replace pattern in file names

E.g. You want to remove [BBB] from these files 123[BBB]aaa.txt and asd[BBB]123.txt.

Get-ChildItem *.txt | ForEach { Move-Item -LiteralPath $_.Name $_.Name.Replace("[BBB]", "") }

PowerShell – create TCP listener

$Listener = [System.Net.Sockets.TcpListener]9999;
$Listener.Start();
# Test the port with telnet
# once completed execute below
$Listener.Stop();

Get the model name of the computer from BIOS

wmic csproduct get name

uptime in Windows

Download the zipped EXE here. MD5: e37822139136b6296bc58617fceb010d. Source in C.

// uptime - shows the uptime on a Windows system
// K.Andreev - 20180803 - BSD Simplified License

#include "stdafx.h"
#include <Windows.h>

int main()
{
DWORD dMilliseconds = GetTickCount();
DWORD dDays = dMilliseconds / 86400000;
DWORD dHours = dMilliseconds / 3600000 - dDays * 24;
DWORD dMinutes = dMilliseconds / 60000 - dHours * 60 - dDays * 1440;
DWORD dTemp = dDays * 86400 - dHours * 3600 - dMinutes * 60;
DWORD dSeconds = dMilliseconds / 1000 - dDays * 86400 - dHours * 3600 - dMinutes * 60;

if (dDays != 0) {
printf("up %d days, %d hours, %d minutes, %d seconds", dDays, dHours, dMinutes, dSeconds);
return 0;
}
if (dHours != 0) {
printf("up %d hours, %d minutes, %d seconds", dHours, dMinutes, dSeconds);
return 0;
}
if (dMinutes != 0) {
printf("up %d minutes, %d seconds", dMinutes, dSeconds);
return 0;
}
printf("up %d seconds", dSeconds);

return 0;
}

Replace CRLF in a file, DOS 2 UNIX text format

sed -i 's/\r//g' /tmp/script.sh